You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by da...@protonmail.com on 2018/07/15 11:41:34 UTC
Score from command line is different from the one in the webmail
Dear list,
I am running spamassassin through amavis as a content filter for postfix.
I have opened a particular mail in the webmail and in the headers I can see that its score is 2.6
X-Virus-Scanned: Debian amavisd-new at messagerie.mydomain.tld
X-Spam-Flag: NO
X-Spam-Score: 2.621
X-Spam-Level: **
X-Spam-Status: No, score=2.621 tagged_above=-999 required=5
tests=[HTML_IMAGE_ONLY_08=1.781, HTML_IMAGE_RATIO_08=0.001,
HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.139,
MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, URIBL_BLACK=1.7]
autolearn=no autolearn_force=no
At the end of X-Spam-Status, you can see URIBL_BLACK=1.7
But when I scan the mail from the command line I have a different score of only 0.9 and no URIBL_BLACK match :
root@messagerie[10.10.10.19] /var/vmail/algerian-radio.dz/a.chaouche/cur # spamassassin -dt < ./1531341268.M70015P1288.messagerie-prep\,S=12464\,W=12661\:2\,S
[...]
Spam detection software, running on the system "messagerie-prep",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: It's incredibly confusing and drives me on simultaneously.
Watch until I removed it from the access. Unsubscribe It's incredibly confusing
and drives me on simultaneously. Watch until I removed it from the access.
[...]
Content analysis details: (0.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image area
1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list
manager
Why do I have different scores and how do I get same score on both configurations ?
Cheers.
Re: Score from command line is different from the one in the webmail
Posted by da...@protonmail.com.
Thanks Mathus, I think this was the case. After running spamassassin -D as suggested in #spamassassin, DNS responses were mainly NXDOMAIN. I have put DNS related output in this gist :
https://gist.githubusercontent.com/ychaouche/b412a7e5cb4c9501365c010734045eb9/raw/c3a69d7bf7dfdfe1d987489a15196488245d3b16/gistfile1.txt
Sent with ProtonMail Secure Email.
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On July 15, 2018 4:12 PM, Matus UHLAR - fantomas <uh...@fantomas.sk> wrote:
> On 15.07.18 07:41, daniel_1983@protonmail.com wrote:
>
> > X-Spam-Status: No, score=2.621 tagged_above=-999 required=5
> >
> > tests=[HTML_IMAGE_ONLY_08=1.781, HTML_IMAGE_RATIO_08=0.001,
> >
> > HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.139,
> >
> > MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, URIBL_BLACK=1.7]
> >
> > autolearn=no autolearn_force=no
>
> > At the end of X-Spam-Status, you can see URIBL_BLACK=1.7
>
> > But when I scan the mail from the command line I have a different score of only 0.9 and no URIBL_BLACK match :
>
> it's quite common that some blacklist appear/disappear when checking the
>
> same mail after some time.
>
> > Why do I have different scores and how do I get same score on both configurations ?
>
> you can't get the same score when the URI is not in blacklist anymore.
>
>
> --------------------------------------------------------------------------
>
> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
>
> Warning: I wish NOT to receive e-mail advertising to this address.
>
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
>
> Nothing is fool-proof to a talented fool.
Re: Score from command line is different from the one in the webmail
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 15.07.18 07:41, daniel_1983@protonmail.com wrote:
>X-Spam-Status: No, score=2.621 tagged_above=-999 required=5
> tests=[HTML_IMAGE_ONLY_08=1.781, HTML_IMAGE_RATIO_08=0.001,
> HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.139,
> MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, URIBL_BLACK=1.7]
> autolearn=no autolearn_force=no
>At the end of X-Spam-Status, you can see URIBL_BLACK=1.7
>But when I scan the mail from the command line I have a different score of only 0.9 and no URIBL_BLACK match :
it's quite common that some blacklist appear/disappear when checking the
same mail after some time.
>Why do I have different scores and how do I get same score on both configurations ?
you can't get the same score when the URI is not in blacklist anymore.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Nothing is fool-proof to a talented fool.
Re: Score from command line is different from the one in the webmail
Posted by Benny Pedersen <me...@junc.eu>.
daniel_1983@protonmail.com skrev den 2018-07-15 15:59:
> Postfix is run under postfix
+1
> Amavis is run under user amavis
+1
> I don't really know how spamassassin is run ?
only root can drop priveledges
> maybe it's loaded as a
> library from amavis itself ?
yes amavis loads perl modules of spamassaasin so spamassassin runs as
amavis system user
Re: Score from command line is different from the one in the webmail
Posted by da...@protonmail.com.
On July 15, 2018 12:57 PM, Antony Stone <An...@spamassassin.open.source.it> wrote:
> On Sunday 15 July 2018 at 13:41:34, daniel_1983@protonmail.com wrote:
> > I am running spamassassin through amavis as a content filter for postfix.
>
> Which user/s do those processes run as?
>
Postfix is run under postfix
Amavis is run under user amavis
I don't really know how spamassassin is run ? maybe it's loaded as a library from amavis itself ?
root@messagerie[10.10.10.19] /etc/postfix # lsof -u amavis | grep spam
/usr/sbin 1428 amavis mem REG 8,6 750728 671620 /var/lib/spamassassin/compiled/5.020/3.004000/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so
/usr/sbin 25702 amavis mem REG 8,6 750728 671620 /var/lib/spamassassin/compiled/5.020/3.004000/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so
/usr/sbin 28419 amavis mem REG 8,6 750728 671620 /var/lib/spamassassin/compiled/5.020/3.004000/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so
root@messagerie[10.10.10.19] /etc/postfix #
Here's the score as user amavis (I had to create a copy of the file in /tmp/ and make it world readable, because the owner is vmail, the user under which dovecot runs) :
root@messagerie[10.10.10.19] /var/vmail/mydomain/a.chaouche/.Junk/cur # su amavis -c 'spamassassin -dt < /tmp/mailfrancoise'
[...]
Spam detection software, running on the system "messagerie-prep",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: It's incredibly confusing and drives me on simultaneously.
Watch until I removed it from the access. Unsubscribe It's incredibly confusing
and drives me on simultaneously. Watch until I removed it from the access.
[...]
Content analysis details: (0.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 HTML_IMAGE_RATIO_08 BODY: HTML has a low ratio of text to image area
0.0 HTML_MESSAGE BODY: HTML included in message
1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words
0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image
-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list
manager
Re: Score from command line is different from the one in the webmail
Posted by Antony Stone <An...@spamassassin.open.source.it>.
On Sunday 15 July 2018 at 13:41:34, daniel_1983@protonmail.com wrote:
> Dear list,
>
> I am running spamassassin through amavis as a content filter for postfix.
Which user/s do those processes run as?
> But when I scan the mail from the command line I have a different score of
> only 0.9 and no URIBL_BLACK match :
>
> root@messagerie....
So, you test the message as root (which I seriously hope is not the user your
MTA and SA are being run as during normal mail processing).
> Why do I have different scores and how do I get same score on both
> configurations ?
Try running the SA check as the correct user; if the scores and tests are
still different, feel free to report back here.
Regards,
Antony.
--
What do you call a dinosaur with only one eye? A Doyouthinkesaurus.
Please reply to the list;
please *don't* CC me.