Still not quite there. First, thanks to all (especially JQ and Sandy) for your suggestions. I've implemented several of them, but still do not get the X-Spam* headers. I sent a test SPAM message from one of my email addresses to another (actually forwarded some real SPAM). Below are the following: 1 - a snippet from my /var/log/mail file; 2 - the headers in the message I received. 3 - startup messages from amavis-new 4 - the spamassassin config lines in /etc/amavisd.conf Again I am running SLES9, Postfix, cyrus and amavisd-new with clamd and spamassassin configured. did one thing different than before - somewhere I read that if spamassassin was configured in amavis-new that I did not need to run spamd. I thought they might be conflicting so I stopped spamd and just started amavis-new. The amavis startup messages appear to indicate that it has started spamassassin OK, but I might be wrong. Many thanks in advance for your help - Richard **** /var/log/mail - BEGIN **** <SNIP> Apr 1 09:24:12 gofish amavis[19362]: (19362-01) Passed, <email1@qwest.net> -> <email1@gofish.acmesoftware.com>, Message-ID: <DKELJBPNDHJEECCAEPGOKEALLEAA.email1@qwest.net>, Hits: 3.584 Apr 1 09:24:12 gofish amavis[19362]: (19362-01) TIMING [total 1300 ms] - SMTP EHLO: 4 (0%), SMTP pre-MAIL: 0 (0%), mkdir tempdir: 0 (0%), create email.txt: 0 (0%), SMTP pre-DATA-flush: 3 (0%), SMTP DATA: 38 (3%), body hash: 1 (0%), mkdir parts: 1 (0%), mime_decode: 15 (1%), get-file-type: 14 (1%), get-file-type: 14 (1%), decompose_part: 2 (0%), decompose_part: 0 (0%), parts: 0 (0%), AV-scan-1: 4 (0%), SA msg read: 2 (0%), SA parse: 1 (0%), SA check: 1106 (85%), fwd-connect: 33 (3%), fwd-mail-from: 2 (0%), fwd-rcpt-to: 7 (1%), write-header: 2 (0%), fwd-data: 0 (0%), fwd-data-end: 46 (4%), fwd-rundown: 1 (0%), unlink-2-files: 3 (0%), rundown: 0 (0%) Apr 1 09:24:12 gofish postfix/smtp[19399]: CC8E1165A: to=<email1@gofish.acmesoftware.com>, orig_to=<email1@acme.com>, relay=localhost[127.0.0.1], delay=2, status=sent (250 2.6.0 Ok, id=19362-01, from MTA: 250 Ok: queued as 3F7AE175C) Apr 1 09:24:12 gofish postfix/qmgr[10679]: CC8E1165A: removed Apr 1 09:24:12 gofish postfix/lmtp[19405]: 3F7AE175C: to=<email1@gofish.acmesoftware.com>, relay=/var/lib/imap/socket/lmtp[/var/lib/imap/socket/lmtp], delay=0, status=sent (250 2.1.5 Ok) Apr 1 09:24:12 gofish postfix/qmgr[10679]: 3F7AE175C: removed <SNIP> **** /var/log/mail - END **** **** Received message headers - BEGIN **** Return-Path: <email1@qwest.net> Received: from gofish.acmesoftware.com ([unix socket]) by gofish (Cyrus v2.2.3) with LMTP; Fri, 01 Apr 2005 09:24:12 -0700 X-Sieve: CMU Sieve 2.2 Received: from localhost (localhost [127.0.0.1]) by gofish.acmesoftware.com (Postfix) with ESMTP id 3F7AE175C for <email1@gofish.acmesoftware.com>; Fri, 1 Apr 2005 09:24:12 -0700 (MST) Received: from gofish.acmesoftware.com ([127.0.0.1]) by localhost (gofish [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 19362-01 for <email1@gofish.acmesoftware.com>; Fri, 1 Apr 2005 09:24:11 -0700 (MST) Received: from mpls-qmqp-02.inet.qwest.net (mpls-qmqp-02.inet.qwest.net [63.231.195.113]) by gofish.acmesoftware.com (Postfix) with SMTP id CC8E1165A for <email1@acme.com>; Fri, 1 Apr 2005 09:24:10 -0700 (MST) Received: (qmail 19474 invoked by uid 0); 1 Apr 2005 16:24:10 -0000 Received: from mpls-pop-10.inet.qwest.net (63.231.195.10) by mpls-qmqp-02.inet.qwest.net with QMQP; 1 Apr 2005 16:24:10 -0000 Received: from vdsl-130-13-0-2.phnx.qwest.net (HELO redfish) (130.13.0.7) by mpls-pop-10.inet.qwest.net with SMTP; 1 Apr 2005 16:24:09 -0000 Date: Fri, 1 Apr 2005 09:23:54 -0700 Message-ID: <DKELJBPNDHJEECCAEPGOKEALLEAA.email1@qwest.net> From: "Richard Mixon (qwest)" <email1@qwest.net> To: email1@acme.com Subject: test s p a m MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_04AC_01C5369C.8624BD80" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.2527 Importance: Normal X-Virus-Scanned: by amavisd-new at acme.com **** Received message headers - END **** **** /var/log/messages - BEGIN **** <SNIP> Apr 1 09:22:16 gofish amavis[19360]: starting. amavisd at gofish amavisd-new-20030616-p9, Unicode aware, LC_CTYPE=en_US.UTF-8 Apr 1 09:22:16 gofish amavis[19360]: Perl version 5.008003 Apr 1 09:22:16 gofish amavis[19360]: Module Amavis::Conf 1.15 Apr 1 09:22:16 gofish amavis[19360]: Module Archive::Tar 1.08 Apr 1 09:22:16 gofish amavis[19360]: Module Archive::Zip 1.14 Apr 1 09:22:16 gofish amavis[19360]: Module Compress::Zlib 1.33 Apr 1 09:22:16 gofish amavis[19360]: Module Convert::TNEF 0.17 Apr 1 09:22:16 gofish amavis[19360]: Module Convert::UUlib 1.0 Apr 1 09:22:16 gofish amavis[19360]: Module DB_File 1.808 Apr 1 09:22:16 gofish amavis[19360]: Module MIME::Entity 5.404 Apr 1 09:22:16 gofish amavis[19360]: Module MIME::Parser 5.406 Apr 1 09:22:16 gofish amavis[19360]: Module MIME::Tools 5.411 Apr 1 09:22:16 gofish amavis[19360]: Module Mail::Header 1.60 Apr 1 09:22:16 gofish amavis[19360]: Module Mail::Internet 1.60 Apr 1 09:22:16 gofish amavis[19360]: Module Mail::SpamAssassin 2.64 Apr 1 09:22:16 gofish amavis[19360]: Module Net::Cmd 2.24 Apr 1 09:22:16 gofish amavis[19360]: Module Net::DNS 0.46 Apr 1 09:22:16 gofish amavis[19360]: Module Net::SMTP 2.26 Apr 1 09:22:16 gofish amavis[19360]: Module Net::Server 0.87 Apr 1 09:22:16 gofish amavis[19360]: Module Time::HiRes 1.52 Apr 1 09:22:16 gofish amavis[19360]: Module Unix::Syslog 0.100 Apr 1 09:22:16 gofish amavis[19360]: Found myself: /usr/sbin/amavisd -c /etc/amavisd.conf Apr 1 09:22:16 gofish amavis[19360]: Lookup::SQL code NOT loaded Apr 1 09:22:16 gofish amavis[19360]: Lookup::LDAP code NOT loaded Apr 1 09:22:16 gofish amavis[19360]: AMCL-in protocol code loaded Apr 1 09:22:16 gofish amavis[19360]: SMTP-in protocol code loaded Apr 1 09:22:16 gofish amavis[19360]: ANTI-VIRUS code loaded Apr 1 09:22:16 gofish amavis[19360]: ANTI-SPAM code loaded Apr 1 09:22:16 gofish amavis[19361]: Net::Server: Process Backgrounded Apr 1 09:22:16 gofish amavis[19361]: Net::Server: 2005/04/01-09:22:16 Amavis (type Net::Server::PreForkSimple) starting! pid(19361) Apr 1 09:22:16 gofish amavis[19361]: Net::Server: Binding to UNIX socket file /var/spool/amavis/amavisd.sock using SOCK_STREAM Apr 1 09:22:16 gofish amavis[19361]: Net::Server: Binding to TCP port 10024 on host 127.0.0.1 Apr 1 09:22:16 gofish amavis[19361]: Net::Server: Setting gid to "103 103" Apr 1 09:22:16 gofish amavis[19361]: Net::Server: Setting uid to "65" Apr 1 09:22:16 gofish amavis[19361]: Found $file at /usr/bin/file Apr 1 09:22:16 gofish amavis[19361]: Found $arc at /usr/bin/arc Apr 1 09:22:16 gofish amavis[19361]: Found $gzip at /usr/bin/gzip Apr 1 09:22:16 gofish amavis[19361]: Found $bzip2 at /usr/bin/bzip2 Apr 1 09:22:16 gofish amavis[19361]: No $lzop, not using it Apr 1 09:22:16 gofish amavis[19361]: Found $lha at /usr/bin/lha Apr 1 09:22:16 gofish amavis[19361]: Found $unarj at /usr/bin/unarj Apr 1 09:22:16 gofish amavis[19361]: Found $uncompress at /usr/bin/uncompress Apr 1 09:22:16 gofish amavis[19361]: No $unfreeze, not using it Apr 1 09:22:16 gofish amavis[19361]: Found $unrar at /usr/bin/unrar Apr 1 09:22:16 gofish amavis[19361]: Found $zoo at /usr/bin/zoo Apr 1 09:22:16 gofish amavis[19361]: Found $cpio at /usr/bin/cpio Apr 1 09:22:16 gofish amavis[19361]: Using internal av scanner code for (primary) Clam Antivirus-clamd Apr 1 09:22:16 gofish amavis[19361]: Found secondary av scanner Clam Antivirus - clamscan at /usr/bin/clamscan Apr 1 09:22:16 gofish amavis[19361]: SpamControl: initializing Mail::SpamAssassin Apr 1 09:22:17 gofish amavis[19361]: SpamControl: done <SNIP> **** /var/log/messages - END **** **** /etc/amavisd.conf - BEGIN **** <SNIP> # SpamAssassin settings # $sa_local_tests_only is passed to Mail::SpamAssassin::new as a value # of the option local_tests_only. See Mail::SpamAssassin man page. # If set to 1, SA tests are restricted to local tests only, i.e. no tests # that require internet access will be performed. # #$sa_local_tests_only = 1; # (default: false) #$sa_auto_whitelist = 1; # turn on AWL (default: false) $sa_timeout = 30; # timeout in seconds for a call to SpamAssassin # (default is 30 seconds, undef disables it) $sa_mail_body_size_limit = 256*1024; # don't waste time on SA if mail is larger # (less than 1% of spam is > 64k) # default: undef, no limitations # default values, can be overridden by more specific lookups, e.g. SQL $sa_tag_level_deflt = 3.0; # add spam info headers if at, or above that level $sa_tag2_level_deflt = 5.0; $sa_kill_level_deflt = $sa_tag2_level_deflt; # triggers spam evasive actions # at or above that level: bounce/reject/drop, # quarantine, and adding mail address extension $sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent, # effectively turning D_BOUNCE into D_DISCARD; # undef disables this feature and is a default; # # The $sa_tag_level_deflt, $sa_tag2_level_deflt and $sa_kill_level_deflt # may also be hashrefs to hash lookup tables, to make static per-recipient # settings possible without having to resort to SQL or LDAP lookups. # a quick reference: # tag_level controls adding the X-Spam-Status and X-Spam-Level headers, # tag2_level controls adding 'X-Spam-Flag: YES', and editing Subject, # kill_level controls 'evasive actions' (reject, quarantine, extensions); # it only makes sense to maintain the relationship: # tag_level <= tag2_level <= kill_level < $sa_dsn_cutoff_level # string to prepend to Subject header field when message exceeds tag2 level $sa_spam_subject_tag = '***SPAM*** '; # (defaults to undef, disabled) # (only seen when spam is not to be rejected # and recipient is in local_domains*) $sa_spam_modifies_subj = 1; # may be a ref to a lookup table, default is true # Example: modify Subject for all local recipients except user@example.com #$sa_spam_modifies_subj = [qw( !user@example.com . )]; <SNIP> **** /etc/amavisd.conf - END ****