Re: Subject only rewritten sometimes?

[James Feger]

Hi Chris,



Nothing looks horribly wrong to me with your setup.   See if you can
reproduce the no-rewrite state with an email you have received which did 

not
get the subject rewritten.  Remove the spamassassin markup and re-send 

the
message through spamassassin (pipe a marked-up email through 

"spamassassin
-d").  Then, run it through spamc once, twice, three times.  Does it 

fail to
rewrite the header here each time?  If it doesn't fail, the problem may 

be

outside SA.  If it does fail to rewrite the header each time, then try
passing it through spamassassin (not spamc).  Does it fail?  Also, 

enable -D

when passing it to spamassassin and look for any problems in the debug
output.


I tired this, same results.  The eamil is flagged as spam, but the subject
is not re-written.  Something of interest though.  I did not have the:
"rewrite_header Subject *SPAM*" option in my local.cf.  I added
this option, and now all the subjects that are associated with spam are
getting flagged with *SPAM*.  However, some are now coming through
as "*SPAM* [SPAM] original-subject".  Alsmost seems as if SA or
some associated option in SA is parsing the mail twice?  Any idea what
defaults to [SPAM] in the subjects?  Razor, DCC, etc?

Nothing in the message header stands out.  This is an example of what I am
getting now:

Received: from localhost by stuttgart.feger.net
with SpamAssassin (version 3.1.0);
Thu, 01 Dec 2005 16:01:43 -0600
From: "Dennis H. NORAD" <[EMAIL PROTECTED]>
To: Jade <[EMAIL PROTECTED]>
Subject: *SPAM* [SPAM] Software
Date: Fri, 02 Dec 2005 05:03:39 -0600
Message-Id: <[EMAIL PROTECTED]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on 
stuttgart.feger.net

X-Spam-Level: 
X-Spam-Status: Yes, score=16.2 required=7.0 tests=DATE_IN_FUTURE_12_24,
RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,
SPF_HELO_PASS,UNPARSEABLE_RELAY,URIBL_AB_SURBL,URIBL_JP_SURBL,
URIBL_SBL,URIBL_SC_SURBL autolearn=spam version=3.1.0
MIME-Version: 1.0



I guess I just need  to track down what defaults as [SPAM]. :)  Maybe this 
is a Debian thing. :)


Thanks,
James

Subject only rewritten sometimes?

[James Feger]

Hello,
I recently installed Spamassassin 3.1.0 on a Debian Linux.  I used the
apt-get method of installing the binary and the needed support files.  I
am running spamassassin as spamd.  I am invoking spamd with the Debian
spamc client invoked via .procmailrc.  I am using Sendmail as my local
mailer, Pine as my client.

The problem I am running into is somewhat interesting, and yet I can seem
to find an exact match of similar topics via google or the FAQ's/List,
etc.

I have set my local.cf to look for a hit score of 7.0 or higher. I am
receiving email and spamd is processing it as spam, attaching a score, and
adding the default message at the top of the email (Email has been tagged
as possible spam by the system...or whatever).  However, the Subject
rewrite is not getting performed.  For some emails, the rewrite occurs,
but not all of them.


Example of the Subject being rewritten:

Received: from localhost by stuttgart.feger.net
with SpamAssassin (version 3.1.0);
Thu, 01 Dec 2005 05:36:20 -0600
From: "Ellis Donaldson" <[EMAIL PROTECTED]>
To: undisclosed-recipients:;
Subject: [SPAM] =?ISO-8859-1?B?R29vZCBkYXk=?=
Date: Thu, 01 Dec 2005 10:28:46 +
Message-Id: <[EMAIL PROTECTED]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on 
stuttgart.feger.net

X-Spam-Level: **
X-Spam-Status: Yes, score=22.5 required=7.0 tests=FUZZY_REFINANCE,
RATWARE_NAME_ID,SPF_FAIL,SPF_HELO_PASS,SUBJECT_EXCESS_BASE64,
UNDISC_RECIPS,URIBL_AB_SURBL,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SBL,
URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=no version=3.1.0
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--=_438EE034.02066030"
Parts/Attachments:
   1   Shown42 lines  Text
   2 OK  3 KB Message, "original message before SpamAssassin"
   2.1 Shown 6 lines  Text
   2.2 Shown28 lines  Text






Example of not being re-written:

Received: from localhost by stuttgart.feger.net
with SpamAssassin (version 3.1.0);
Thu, 01 Dec 2005 05:53:09 -0600
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: headline news
Date: Thu, 1 Dec 2005 19:49:52 +0900
Message-Id: <[EMAIL PROTECTED]>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on 
stuttgart.feger.net

X-Spam-Level: **
X-Spam-Status: Yes, score=10.1 required=7.0 tests=HTML_IMAGE_ONLY_08,
HTML_MESSAGE,MIME_HTML_ONLY,NO_REAL_NAME,RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_XBL,RCVD_NUMERIC_HELO,SPF_NEUTRAL autolearn=no version=3.1.0
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--=_438EE425.6E2DE4F1"
Parts/Attachments:
   1   Shown34 lines  Text
   2 OK 23 KB Message, "original message before SpamAssassin"
   2.1 Shown   ~19 lines  Text (charset: ISO-8859-1)
   2.2  16 KB Image



Something else to note, my DALnet email appears to get the subject rewrite 
very often, wheras the email falling through to default does not.  This is 
also happening on my wife's email account, which only has the SA config in 
her .procmailrc, not folder sorting options.


 Any ideas?

Here is my .procmailrc

SHELL=/bin/bash   #Use the Bourne shell (check your path!)
MAILDIR=${HOME}/mail#First check what your mail directory is!
LOGFILE=${HOME}/.procmail.log
LOG="--- Logging ${LOGFILE} for ${LOGNAME}, "

#Spamassassin start
:0fw: spamassassin.lock
| /usr/bin/spamc
#Spamassassin end

# DALnet email
:0
* [EMAIL PROTECTED]
dalnet
# 

# DALnet email
:0
* [EMAIL PROTECTED]
dalnet
# 

# *Default Rule
:0:
${DEFAULT}
# *


Thanks again,
James