You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jyri Korhonen <Jy...@planmeca.com> on 2006/11/13 12:57:39 UTC
AWL and Windows
I'm running SA 3.1.7 on Windows XP and it is working
pretty well. However I have a question about AWL.
Every now and then I can see a spam header
where AWL gives some negative score. The "debora"
stock spams seem to have this problem more often
than the others.
I'd like to check the contents of the AWL database,
but I'm not sure how "check_whitelist" works on a
Windows platform. Can you give me a hint?
Regards
Jyri Korhonen
---
Return-path: <de...@bulleys.com>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on virusscan
X-Spam-Level: ************
X-Spam-Status: Yes, score=12.5 required=5.0 tests=AWL,BAYES_99,
DATE_IN_FUTURE_03_06,RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL,
SARE_LWSHORTT,SARE_MLB_Stock1,SARE_MLB_Stock2,SARE_MLB_Stock5
autolearn=no version=3.1.7
X-Spam-Report:
* 2.0 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after
Received: date
* 1.7 SARE_MLB_Stock1 BODY: SARE_MLB_Stock1
* 1.7 SARE_MLB_Stock5 BODY: Mentions stock symbol, tickers, or
OTC.
* 1.7 SARE_MLB_Stock2 BODY: SARE_MLB_Stock2
* 0.8 SARE_LWSHORTT BODY: SARE_LWSHORTT
* 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic
IP address
* [219.160.210.228 listed in dnsbl.sorbs.net]
* 1.9 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local
SMTP
* [219.160.210.228 listed in combined.njabl.org]
* -2.7 AWL AWL: From: address is in the auto white-list
Received: from r2d2.sci.fi [195.74.0.50]
by mailcenter.plandent.com; Mon, 13 Nov 2006 12:31:59 +0200
Received: from ?p???R?? (p4228-ipad02otsu.shiga.ocn.ne.jp
[219.160.210.228])
by r2d2.sci.fi (Postfix) with ESMTP id 2A34DC9AF99E9;
Mon, 13 Nov 2006 12:32:00 +0200 (EET)
Received: from 83.170.64.230 (HELO uk2mxarray2.uk2.net)
by planmeca.com with esmtp (1Q4BQ0Y922V 9O6LFT)
id 51UIJZ-K21362-4J
for jyri.korhonen@planmeca.com; Mon, 13 Nov 2006 10:31:59 -0540
From: "Cliff Thorne" <de...@bulleys.com>
To: <jy...@planmeca.com>
Subject: *SPAM* Cliff
Date: Mon, 13 Nov 2006 10:31:59 -0540
Message-ID: <01...@deborahschmid>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Thread-Index: Aca6Q8VKHTK7EA422TZT6VA28LGM5V==
X-Spam-Prev-Subject: Cliff
Re: AWL and Windows
Posted by Matt Kettler <mk...@verizon.net>.
Jyri Korhonen wrote:
> I'm running SA 3.1.7 on Windows XP and it is working
> pretty well. However I have a question about AWL.
> Every now and then I can see a spam header
> where AWL gives some negative score.
That alone should not be worrisome. A negative score does not imply the
AWL thinks the message sender is nonspam. In fact, modest negative
scores from the AWL on spam are actually a good sign, as it means the
spammer's current messages are higher scoring than in the past. If the
AWL is always positive, that means the scores are constantly declining,
and eventually won't be tagged at all.
In your example below, the AWL had a historical score of about 9.8. The
message pre-awl scored about 15.2. The AWL split the difference and
deducted 2.7 to make the final score 12.5. The AWL still thought it was
a spam sender, just less spammy than current.
Perfectly normal.
See also
http://wiki.apache.org/spamassassin/AwlWrongWay
> The "debora"
> stock spams seem to have this problem more often
> than the others.
>
> I'd like to check the contents of the AWL database,
> but I'm not sure how "check_whitelist" works on a
> Windows platform. Can you give me a hint?
>
I'm not sure about windows specifics. You need to feed it the path to
the AWL db file, as it will not find this automatically on its own on
any platform.
> Regards
>
> Jyri Korhonen
>
>
> ---
> Return-path: <de...@bulleys.com>
> X-Spam-Flag: YES
> X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on virusscan
> X-Spam-Level: ************
> X-Spam-Status: Yes, score=12.5 required=5.0 tests=AWL,BAYES_99,
> DATE_IN_FUTURE_03_06,RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL,
> SARE_LWSHORTT,SARE_MLB_Stock1,SARE_MLB_Stock2,SARE_MLB_Stock5
> <snip>
> * -2.7 AWL AWL: From: address is in the auto white-list
>