>I mean the obvious stuff like "viagra" and such. Usually the spam is caught >but sporadically it does get through.
>What is happening. Simply, there are no X-Spam headers on these (and none or some of the "ham" as well). In other words, messages are being delivered before sa is running! Originally, I was starting everything by their standard packaged /etc/init.d scripts. All is fine except sa would start before the internet connection was working, sa_update would fail, leaving ALL spam getting through! (To me, this behavior is a bug--no sa_update today? Leave yesterday's rules intact.) So I included in my 99z_end-all-catch-all script (needed because of other things) which tries until ntpdate has worked implying a working internet connection and then ran sa_update and started spamassassin from there. The problem is now a catch 22: Fetchmail and exim are running beforehand and a few messages can get delivered before sa comes up. I could move all of this to my script but there must be a better, more correct and standard way to accomplish this. Any ideas?