Strange HITS

["R.Smits" <R....@tudelft.nl>]

Hello,

We sometimes have in our loggin for spamassassin the following entry :

mail_id: 3pCjeOEN7rlE, Hits: -, size: 6408, queued_as: 6B9B150489, 185 ms

This seems normal, but there are some blacklisted url's in this message,
so it seems that spamassassin is "giving up" because it does not know
the type or something.

Are there reason's why SA gives the message : Hits: -

Ofcourse there is the possibility that no spam rules hit, but in this
case, this was not the issue....

Greetings.. Richard Smits

Re: Strange HITS

[Mark Martinec <Ma...@ijs.si>]

Richard,

> We sometimes have in our loggin for spamassassin the following entry :
>
> mail_id: 3pCjeOEN7rlE, Hits: -, size: 6408, queued_as: 6B9B150489, 185 ms
>
> This seems normal, but there are some blacklisted url's in this message,
> so it seems that spamassassin is "giving up" because it does not know
> the type or something.
>
> Are there reason's why SA gives the message : Hits: -
>
> Ofcourse there is the possibility that no spam rules hit, but in this
> case, this was not the issue....

What is your interface to SpamAssassin? If this is amavisd-new,
the 'Hits: -' is reported if SpamAssassin was not called, or
it didn't produce a result (e.g. on a timeout). Here are some
reasons why SpamAssassin would not be called:

- message larger than $sa_mail_body_size_limit (with version 2.6.2
  or older; with 2.6.3 a message passed to SA is just truncated);

- recipient matches @bypass_spam_checks_maps;

- sender is white- or blacklisted by amavisd;

- bounce killer in action (but not in your case)


Mark

Re: Strange HITS

[Matt Kettler <mk...@verizon.net>]

R.Smits wrote:
> Hello,
>
> We sometimes have in our loggin for spamassassin the following entry :
>
> mail_id: 3pCjeOEN7rlE, Hits: -, size: 6408, queued_as: 6B9B150489, 185 ms
>
> This seems normal, but there are some blacklisted url's in this message,
> so it seems that spamassassin is "giving up" because it does not know
> the type or something.
>
> Are there reason's why SA gives the message : Hits: -
>
> Ofcourse there is the possibility that no spam rules hit, but in this
> case, this was not the issue....
>
> Greetings.. Richard Smits
>   
No, no spam rules hitting would be hits of 0. Hits of - suggests that
spamc never passed the message to spamd (assuming you're using spamc).

Was the message larger than 500k (or whatever you're other threshold
passing with -m on the spamc command-line)? If so, that's why. Spamc has
a max-size threshold, after which it will just skip a message. This
prevents SA from bogging down scanning an absurdly large message.

Re: Strange HITS

["R.Smits" <R....@tudelft.nl>]

Hi,

This is my setting for the $sa_mail_body_size_limit

$sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is
larger

I think we have found the issue that was troubling us. It seems that
this message was coming from a trusted relay. It took a while for us to
find that in the logging.

Thank you all for the information.

Benny Pedersen wrote:
> On Wed, April 22, 2009 12:39, R.Smits wrote:
>> We sometimes have in our loggin for spamassassin the following entry :
>> mail_id: 3pCjeOEN7rlE, Hits: -, size: 6408, queued_as: 6B9B150489, 185 ms
>>
>> This seems normal, but there are some blacklisted url's in this message,
>> so it seems that spamassassin is "giving up" because it does not know
>> the type or something.
>>
>> Are there reason's why SA gives the message : Hits: -
> 
> no Hits is not in spamassassin source code :)
> 
> reason for Hits - is that either msg was big or the msg is detected as
> virus in your virus scanner
> 
>> Ofcourse there is the possibility that no spam rules hit, but in this
>> case, this was not the issue....
> 
> post your *.pre files or show spamassassin 2>&1 -D --lint output on pastebin
> 

Re: Strange HITS

[Benny Pedersen <me...@junc.org>]

On Wed, April 22, 2009 12:39, R.Smits wrote:
> We sometimes have in our loggin for spamassassin the following entry :
> mail_id: 3pCjeOEN7rlE, Hits: -, size: 6408, queued_as: 6B9B150489, 185 ms
>
> This seems normal, but there are some blacklisted url's in this message,
> so it seems that spamassassin is "giving up" because it does not know
> the type or something.
>
> Are there reason's why SA gives the message : Hits: -

no Hits is not in spamassassin source code :)

reason for Hits - is that either msg was big or the msg is detected as
virus in your virus scanner

> Ofcourse there is the possibility that no spam rules hit, but in this
> case, this was not the issue....

post your *.pre files or show spamassassin 2>&1 -D --lint output on pastebin

-- 
http://localhost/ 100% uptime and 100% mirrored :)