[sniffer] Re: Mdaemon plugin 'sleeping'

[Sven De Troch]

hello,   Nobody has any idea? SA and SNF seems to be configured correctly since most of the spams are being tagged. Still have the problem that some spam with "X-SortMonster-MessageSniffer-Result: 1-->63" in the header is not being scored (+5), see below.   thanks, Sven From: Sven De Troch Sent: vrijdag 22 september 2006 10:20 To: 'Message Sniffer Community' Subject: RE: [sniffer] Re: Mdaemon plugin 'sleeping' ok, I think that your are completely right, it seems that SA is not always detecting it. In my rules, Bayes = -4,1.   But I have seen lots of email wheren the SNF header was inserted (X-SortMonster-MessageSniffer-Result: 52), and where the +5 score for SNF detection has not been taken into account for the final scoring by SA.   In your situation I should see something like:     html +1 bayes -4 snf +5 ---- total +2   but in the logfiles of the messages, I see sometimes (not always and that's the problem)   html +1 bayes -4 ---- total -3 --> even if the SNF header is inserted (i.e. X-SortMonster-MessageSniffer-Result: 52)   So we narrowed the problem to SA (and not SNF)?   kind regards, Sven From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Jorge Asch Sent: vrijdag 22 september 2006 6:06 To: Message Sniffer Community Subject: [sniffer] Re: Mdaemon plugin 'sleeping' It seems indeed that SNF is always working now (thanks), that is always inserting a header into the mail, but apparently not always passing the message the message to Mdaemon's SA, since the +5 score is not added to the header: Well, the funny part here, SNF and SA have no communication at all. SNF just writes an extra header to the message. After that, SA parses the message, and should auto-detect it. So it's not that SNF is not allways passing the score, it's that SA is not allways detecting it. ++++++++++++++++++++++++ X-Spam-Status: No, score=0.3 required=6.1 tests=BAYES_00,HTML_MESSAGE, MESSAGE_SNIFFER autolearn=no version=3.1.3 X-SortMonster-MessageSniffer-Result: 52 It seems that indeed SA is detecting the SNF score. If you check the X-Spam-Status, "MESSAGE_SNIFFER" is part of the scoring.  From my default SA rules, BAYES_00 is -4 so this rule alone is substracting 4 points to your score. It could be higher on your system if you have bayesian learning enable. Let asume it's 5 o 6, so you basically end up with a negative number, and you add whatever score HTML_MESSAGE has. Check your logs for a more detailed scoring on each message. -- Jorge Asch Revilla CONEXION DCR www.conexion.co.cr 800-CONEXION