On Thu, 2008-05-15 at 14:19 +0000, Jeff Aitken wrote: > For example, a message that was just delivered to my inbox contained the > following report from SA: > > X-Spam-Report: > * 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% > * [score: 1.0000] > * 0.3 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: > date > * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) > * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with > * dynamic-looking rDNS > > If I save the original message and run SA manually (spamassassin -t < msg) > I get the following: > > X-Spam-Report: > * 0.9 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic > IP address > * [88.73.238.103 listed in dnsbl.sorbs.net] > * 1.0 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org > * [<http://dsbl.org/listing?88.73.238.103>] > * 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% > * [score: 1.0000] > * 0.3 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: > date > * 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence > level > * above 50% > * [cf: 100] > * 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) > * 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above > 50% > * [cf: 100] > * 2.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist > * [URIs: win-todayoo.com.cn] > * 0.1 RDNS_DYNAMIC Delivered to trusted network by host with > * dynamic-looking rDNS > * -2.9 AWL AWL: From: address is in the auto white-list
No DNSBLs in the original result... This *may* be due to the BLs catching up, and the second run being done later. This specifically seems to be the case for Razor (which hit in both run, just differently) and likely for URIBL_BLACK, too. Maybe DNS timeout issues. Do you see hits URIBL_BLACK hits in the incoming stream at all? > I'm going to assume that the score being wrong by 0.1 (should be 7.4, not > 7.3) is due to a rounding error or other similar issue. However, I can't > figure out why the results are so different. What's even more interesting > is that if I turn on debugging (spamassassin -D -t < msg) then I get a > *third* different result: [...] > * -1.4 AWL AWL: From: address is in the auto white-list > > The two commands were run on the same host, by the same user, within > seconds of one another, and yet the scores for the AWL test are 1.5 > different. AWL is a score averager. It *will* change by run, unless the difference between the current score and the previous average is about 0. Please see these: http://wiki.apache.org/spamassassin/AutoWhitelist http://wiki.apache.org/spamassassin/AwlWrongWay guenther -- char *t="[EMAIL PROTECTED]"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
