Different scores

[maillist <ma...@emailacs.com>]

Hi guys,

slackware 11.0
spamassassin version 3.2.5
  running on Perl version 5.8.8
mimedefang version 2.64
sendmail 8.14

    I am getting a lot of spam.  I did some investigating, and it looks 
like I have something set up incorrectly.  If I get a spam message, and 
run it through "spamassassin -t", then it shows that it should be spam, 
but during the process when the mail actually comes in, it is scoring 
much lower.  I have been using spamassassin for 3 years now, and can't 
seem to figure this out.

    I ran spamassassin -D --lint, and see nothing usefull.

When I start spamassassin, I start it like this:
/usr/bin/spamd -r /var/run/spamd.pid \
-d --username=defang --max-spare=8 --min-children=5 --max-children=25

I have been testing this as root, but tried as the user "defang" and get 
the same results.

I don't see anything in my logs that would reflect an error, I'm kind of 
stuck.  Can anyone give any advice?

TIA
-Aubrey

Re: Different scores

[Karsten Bräckelmann <gu...@rudersport.de>]

>     I am getting a lot of spam.  I did some investigating, and it looks 
> like I have something set up incorrectly.  If I get a spam message, and 
> run it through "spamassassin -t", then it shows that it should be spam, 
> but during the process when the mail actually comes in, it is scoring 
> much lower.  I have been using spamassassin for 3 years now, and can't 
> seem to figure this out.

You failed to provide any real data point. For starters, the most needed
information are the SA headers, clearly showing *which* rules fired. For
both, the original run, as well as the later, manual test. Without that,
there is not much we can say.

Well, other than the usual suspects. On a second run, AWL will score,
which it likely did not for the original check. Bayes might be
different. Since time past, *all* network tests got a chance to update,
and detect the spam at the later point. All of these will result in
different scores, and often in different rules firing.

  guenther


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: Different scores

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

On 28.07.08 14:44, maillist wrote:
>    I am getting a lot of spam.  I did some investigating, and it looks 
> like I have something set up incorrectly.  If I get a spam message, and 
> run it through "spamassassin -t", then it shows that it should be spam, 
> but during the process when the mail actually comes in, it is scoring 
> much lower.  I have been using spamassassin for 3 years now, and can't 
> seem to figure this out.

it's mostly because network checks catch spam some time after it began
spreading, so early recipients won't get it catched.

see the differencies in RAZOR, PYZIOR, DCC, URIBL scores
(and SOUGHT if you use them)
-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
The only substitute for good manners is fast reflexes.