Hi Hamish,

I have a spam IMAP folder foreach user which he can use to move spam messages to there, and it is used by sa-learn everynight in order build the spam database.

A sample of my logs with a spam detection are: spamd[2712]: connection from localhost [127.0.0.1] at port 56773 Dec 10 09:54:27 xxxxxxx spamd[25604]: info: setuid to jreis succeeded Dec 10 09:54:27 xxxxxxx spamd[25604]: processing message <116638626203.ZNM92475@axn-asia.com>crewmen.freemessage.com> for xxxx:500. Dec 10 09:54:27 xxxxxxx spamd[25604]: identified spam (5.1/5.0) for xxxx:500 in 0.3 seconds, 2428 bytes.

As you can see i do not have as much as information as you have and probably my spamassasin is not as good configure as yours, and i am afraid this is the problem, because i have already marked a lot of LOTERY spam messages in order to sa-learn to learn from it and i continue to receive this kind of messages. Can you point me some direction on how to check my scores and to change its limits?

Thanks

OK you should be able to add this to your conf file: rewrite_header { subject } ***SPAM*** This is OFF by default so that could be your problem. Have a look here for the full details: http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.ht... Also, to give you a bit more work, but save you some in future... Try out amavisd-new. It is really really cool - It allows you to tie in clamav,spamassasin,a huge number of other scanners and loads of other options in one config file. Here is a nice howto: http://infolinux.de/blog/?q=title/sieve Hope that helps, H

look into the /etc/amavisd.conf and goto line #1094 $sa_timeout = 30; # timeout in seconds for a call to SpamAssassin # (default is 30 seconds, undef disables it) $sa_mail_body_size_limit = 150*1024; # don't waste time on SA if mail is larger # (less than 1% of spam is > 64k) # default: undef, no limitations # default values, can be overridden by more specific lookups, e.g. SQL $sa_tag_level_deflt = 3.0; # add spam info headers if at, or above that level $sa_tag2_level_deflt = 5.0; $sa_kill_level_deflt = $sa_tag2_level_deflt; # triggers spam evasive actions # at or above that level: bounce/reject/drop, # quarantine, and adding mail address extension $sa_dsn_cutoff_level = 5; # spam level beyond which a DSN is not sent, # effectively turning D_BOUNCE into D_DISCARD; # undef disables this feature and is a default; the last line $sa_dsn_cutoff= 5 (the number that should be the max of what is let through.) When you run amavisd it runs all of your spam configurations, not the spamassassin local.cf have a good day! At 03:22 AM 12/10/2004, João Reis wrote:

On Friday 10 December 2004 10:35, Hamish wrote:

...

João Reis wrote:

...

Hi to all,

I have a postfix+spamassassin+clamAV configuration and all works well except spamassassin.

When a mail message arrives at my mail server i can see on my logs that it is filtered throught clamAV and spamassassin in order to scan it for viruses or spam. ClamAV works great and spamassassin also cheks the message to see if it is spam, but unfortunately SpamAssassin does not mark spam messages as spam and i continue to receive spam.

I know that Spamassassin work with message statistics and i thought that the first spam would pass the spam tests but as the time goes on spamassassin would learn from messages which one is spam. Unfortunately i have spamassassin running for the past 4 months and all spam passes through the spam filter and it is not marked as spam.

Do you have any idea what might be wrong here? Is there any configuration parameter which i should set on spamassasin?

Thanks to all in advance.

João

Are you running sa-learn --spam /path/to/spam ? This is what teaches spamassasin and builds up the database. Its best to have a dedicted directory for spam (We use a public IMAP folder where users can dump all spam, then every night sa-learn goes over it) and run sa-learn as a cron .

Could you post the logs for one spam message? If spam email is getting a 'score' (hits) below your limit, it will not be marked. Here is part of one of my logs for a 419 email - it came through as ****SPAM****Urgent Business Proposal: amavisd[10650]: (10650-03) SPAM-TAG, -> , No, hits=4.999 tagged_above=3 required=6.3 tests=FROM_ENDS_IN_NUMS, FROM_HAS_ULINE_NUMS, HTML_10_20, HTML_MESSAGE, MILLION_USD, NO_REAL_NAME, RISK_FREE, SUBJ_ALL_CAPS, UNDISC_RECIPS, UPPERCASE_75_100, URG_BIZ

Here is one notifying me that I had won the international lottery, it was above my kill level, so just got quarantined: amavisd[10651]: (10651-02) SPAM, -> , Yes, hits=6.481 tag=3 tag2=6.3 kill=6.3 tests=FROM_ENDS_IN_NUMS, MILLION_USD, NIGERIAN_BODY1, NO_REAL_NAME, PLING_PLING, SUBJ_ALL_CAPS, UNDISC_RECIPS, US_DOLLARS_3, quarantine spam-a0c1886dfd9852c11de4e343adde52bc-20041209-180411-10651-02 (spam-quarantine)

Hope that helps, H

Hi Hamish,

I have a spam IMAP folder foreach user which he can use to move spam messages to there, and it is used by sa-learn everynight in order build the spam database.

A sample of my logs with a spam detection are: spamd[2712]: connection from localhost [127.0.0.1] at port 56773 Dec 10 09:54:27 xxxxxxx spamd[25604]: info: setuid to jreis succeeded Dec 10 09:54:27 xxxxxxx spamd[25604]: processing message <116638626203.ZNM92475@axn-asia.com>crewmen.freemessage.com> for xxxx:500. Dec 10 09:54:27 xxxxxxx spamd[25604]: identified spam (5.1/5.0) for xxxx:500 in 0.3 seconds, 2428 bytes.

As you can see i do not have as much as information as you have and probably my spamassasin is not as good configure as yours, and i am afraid this is the problem, because i have already marked a lot of LOTERY spam messages in order to sa-learn to learn from it and i continue to receive this kind of messages. Can you point me some direction on how to check my scores and to change its limits?

Thanks

-- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com