On Tue, Jul 29, 2008 at 05:00:53PM -0500, Len Conrad wrote:
> >On Tue, Jul 29, 2008 at 02:36:36PM -0500, Len Conrad wrote:
> > > >We're trying to replace a Windows anti-spam on the mailbox servers
> > > >with amavisd/sa/clam on the front-end mx.
> > > >
> > > >We are running in tandem both now in the amavis/sa/clam testing phase.
> > > >
> > > >The backend mail content-scanner is still catching too many true
> > > >spams that get past amavis.
> > > >
> > > >We uploaded the spams caught by backend to the mx and ran them
> > > >through spamc, with these results:
> >...
> > >
> > > here's an example of a true positive msg caught by the backed after
> > > amavis passed is as clean:
> > >
> > > "spamc -c" says against the DATA body checks out as:
> > >
> > > 70537530.eml 10.3/5.0
> > >
> > >
> > > but in the 70537530.eml file:
> > >
> > > X-Spam-Score: -2.27
> > > X-Spam-Level:
> > > X-Spam-Status: No, score=-2.27 tagged_above=-20 required=5
> > tests=[AWL=-1.556,
> > > BAYES_50=0.001, HABEAS_ACCREDITED_SOI=-4.3,
> > HTML_IMAGE_RATIO_04=0.172,
> > > HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, URIBL_BLACK=1.955]
> > >
> > > so amavis correctly decided "Passed CLEAN" for -2.27, but the 12+
> > > discrepancy between spamc and amavis scores"
> >
> > Are you running spamc as the same user amavisd runs as?
>
> good point, was su'd to root
>
> > If not - and
> >I suspect you're not - different per-user SA settings may be the source
> >of these differences. What score do you get when you run spamc on that
> >same file as the amavis user?
>
> I changed the file to vscan:vscan, su'd to vscan and command line
> spamassassin returned:
>
> Content analysis details: (6.8 points, 5.0 required)
>
> spamc -c running as vscan returns:
>
> $ spamc -c < /home/harry/declude/20080729/70537530.eml
> 10.2/5.0
Very strange. So you're getting 3 different sets of values here -
even spamc vs. command-line are disagreeing.
Hopefully someone else will have an idea, as I'm fresh out at the
moment.
> > The other problem I see there, very likely related, is that it
> >appears you've let amavisd run with Bayes and auto-whitelisting but
> >without any feedback of spam/nonspam, and so it's autowhitelisting
> >things it shouldn't and probably also has a polluted Bayes DB - note
> >that "AWL=-1.556" indicating that spam had been whitelisted.
>
> we have local.cf with bayes_auto_learn 1, but I can' see we have
> auto-whitelisting configged anywhere.
And yet I see that AWL=-1.556 in the report...
-- Clifton
--
Clifton Royston -- [EMAIL PROTECTED] / [EMAIL PROTECTED]
President - I and I Computing * http://www.iandicomputing.com/
Custom programming, network design, systems and network consulting services
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
