On Wed, 2010-08-25 at 08:10 +0530, Suhag Desai wrote:
> Aug 25 08:07:12 spd spamd[3776]: spamd: clean message (4.0/5.0) for clamav:46
> in 10.7 seconds, 2792 bytes.
> Aug 25 08:07:12 spd spamd[3776]: spamd: result: . 4 -
> ALL_TRUSTED,HTML_MESSAGE,LOCAL_DEMONSTRATION_RULE,MIME_HTML_MOSTLY,TVD_SPACE_RATIO
>
> scantime=10.7,size=2792,user=clamav,uid=46,required_score=5.0,rhost=spd,raddr=127.0.0.1,rport=59296,mid=<00fb01cb43fe$5e706710$1b5135...@com>,autolearn=no
> It seems that it consider test.cf file (LOCAL_DEMONSTRATION_RULE) while
> processing the mail..but still not consider it as a mail...
SA uses a scoring system. The fact a single rule hit has a score equal
the required_score threshold is irrelevant. The *sum* of all hit rules'
scores is what determines a message to be spam or ham.
ALL_TRUSTED has a score of -1. The other rules account for 0.001 each
(network tests enabled, no Bayes because it hasn't been trained
sufficient.)
So the overall score for that test message is 4.0 (rounded), exactly as
the log shows. Below the required_score threshold.
There is nothing wrong with your SA, it works just as expected.
> > After upgrade the SpamAssassin Server version to 3.3.1, my mail
> > scanning stop working partially.
> > Let me explain in details. When I set the required score to 5.0, mail
> > scanning is not working properly. When I send the mail with “test123”
> > with required score 5, SA not consider it spam but when I set the
> > required score to 4, SA consider it spam the same mail. I have check
> > the same with many other test.
>
> What do the X-Spam headers read SA generates?
>
> You are using a test rule with a score of 5.0, which is the same as the
> required_score threshold. Odds are, there are other rules firing on the
> message a well.
>
> If the sum of these other rules is less than 0, but greater than -1,
> you'd get exactly what you just described.
q.e.d. :)
--
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
