On 8/15/2011 10:57 AM, Rodney Baker wrote:
> Hi all. I'm running spamassassin 3.3.1 on my openSuse 11.2 box at home. Mail
> is collected from multiple ISP mail accounts via fetchmail and delivered to
> local IMAP mail folders via procmail. My user account .procmailrc file begins
> thus:
>
> LOGFILE=$HOME/pm.log
>
> :0fw: spamassassin.lock
> | spamc
>
>
> :0
> * ^Subject.*SPAM\([0-9]{1,3}\.[0-9]\).*
> $HOME/Maildir/.Spam//
>
> I'm attempting to filter on the modified subject line (which for some reason
> isn't working - that rule never seems to match and spam never gets moved into
> the Spam folder, even though I've tested the regex manually). I thought of
> filtering on the X-Spam-Status header instead, but when I had a look at a
> message that was marked as Spam (according to the subject line) I found
> something rather strange...
>
> X-Virus-Flag: no
> X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
> <my.local.mailhost.name.removed>
> X-Spam-Level: *
> X-Spam-Status: No, score=1.5 required=6.5
> tests=BAYES_00,IMPOTENCE,NO_RELAYS
> autolearn=no version=3.3.1
> X-Spam-Virus: No
> Received: from localhost by <my.local.mailhost.name.removed>
> with SpamAssassin (version 3.3.1);
> Mon, 15 Aug 2011 18:58:01 +0930
> From: "Adele Key" <spam.address.removed>
> To: another.u...@iinet.net.au
> Subject: ****SPAM(10.1)**** <spam-subject-removed>
> Date: Mon, 15 Aug 2011 18:12:48 +0900
> Message-Id: <165971112.54106003786840@spamdomain.removed>
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
> boundary="----------=_4E48E6A1.127A41A2"
> X-Length: 7330
> X-UID: 83487
> X-KMail-Filtered: 61220
> Status: R
> X-Status: N
> X-KMail-EncryptionState:
> X-KMail-SignatureState:
> X-KMail-MDN-Sent:
>
> Spam detection software, running on the system
> <my.local.mailhost.name.removed>, has
> identified this incoming email as possible spam. The original message
> has been attached to this so you can view it (if it isn't spam) or label
> similar future email. If you have any questions, see
> postmaster for details.
>
>
> Content preview: [...]
>
>
> Content analysis details: (10.1 points, 6.5 required)
>
>
> pts rule name description
> ---- ---------------------- ----------------------------------------------
> 3.8 KB_DATE_CONTAINS_TAB KB_DATE_CONTAINS_TAB
> 3.0 IMPOTENCE BODY: Impotence cure
> -0.0 BAYES_20 BODY: Bayes spam probability is 5 to 20%
> [score: 0.1050]
> 2.0 KB_FAKED_THE_BAT KB_FAKED_THE_BAT
> 1.2 RDNS_NONE Delivered to internal network by a host with no
>
> rDNS
>
>
> I don't get it - the content analysis shows a score of 10.1, the modified
> subject line shows 10.1, but the X-Spam-Status header shows 1.5! What have I
> messed up in my configuration?
This message is going through SA twice.
The first time, it is marked as spam and the message is re-written per
your "report_safe" setting. This generates the analysis shown in the
body itself.
The second time, the re-written message is scanned by SA. This time,
all of the incriminating stuff has been hidden by the rewrite, so it is
not marked as spam. This is the analysis shown in the header.
You need to fix whatever is causing the message to be scanned twice.
--
Bowie
