PREFACE: I've found a bug. Perhaps more an inconsistency but a bug none
the less.
These are non-default. Are they generated and inserted by SA?
You are right. These headers are generated from calls to spamd.
However, I can recreate the issue though it did take me quite a while!
Rounding issues? This one added by SA itself, unlike the above?
IIRC, there is *no* rounding (up) by SA, which caused confusion on the
users list before. So, did something else round up the value for the
other headers above? Hmm, *and* decided about the spam status "yes"...?
If you manually add up the rules below, you get 6.5. So looking for
rounding issues was my the next step. In short, here's the bug:
spamc called with parameter -R is printing the report with
"The first line of the output is the message score and the threshold, in this
format: score/threshold"
However, the first line does NOT agree with the content analysis details. Here's
the output from /usr/local/bin/spamc -R -z -d localhost -u root< /tmp/3:
6.5/6.5
...(STUFF REMOVED)
Content analysis details: (6.4 points, 6.5 required)
1.1 URIBL_GREY Contains an URL listed in the URIBL greylist
[URIs: constantcontact.com]
1.0 EXTRA_MPART_TYPE Header has extraneous Content-type:...type= entry
-0.5 TEMP TEMP
2.4 ONLINE_PHARMACY BODY: Online Pharmacy
1.2 TVD_VISIT_PHARMA BODY: TVD_VISIT_PHARMA
0.0 HTML_MESSAGE BODY: HTML included in message
2.3 ADVANCE_FEE_2 Appears to be advance fee fraud (Nigerian 419)
0.0 T_LOTS_OF_MONEY Huge... sums of money
-1.0 KAM_RPTR_PASSED Passed Mail Relay Reverse DNS Test
-0.0 AWL AWL: From: address is in the auto white-list
I am using spamc -R and using the first line of output to determine if_ham&&
to test if Spam.
OK, so long and short, this is bug 2607 rearing it's head in spamd.
I've found the cause of the issue and the fix. Will open a bug in bugzilla and
address this issue further there.
Regards,
KAM
