Re: Headers not being updated

[Henk S <he...@standhardt.nl>]

I experience the same problem.
Lots of spam and normal e-mail have X_Spam_Status: "No, score=". And
X_spam_Flag: "NO"
But not all. Sometimes it is: Yes, score=7.7 and marked as spam, sometimes
"No, score=2.0" and ofcourse not marked as spam. Even "No, score=0.0".
What is causing this and how can it be solved?
(It started in august 2007, but since beginning of december it has increased
very much.)
Regards,
Henk




Matt Kettler-3 wrote:
> 
> MartyG wrote:
>> I have recently moved to a new VPS, everything has been setup for me and
>> is
>> working well except Spamassassin. (I've never had problems with it on my
>> previous host and I'm a newbie to working with it, so please excuse my
>> ignorance.).
>>
>> Hopefully this might help.
>>
>> Server: Apache/1.3.37 
>> Spamassassin Version 3.2.3  running on perl 5.8.8
>>
>> I have tested the install by using spamassassin -D <  sample-spam.txt 
>> and
>> it seems to work fine.
>>
>> Now the problem, all incoming emails on all accounts have following
>> headers
>> :-
>>
>> X-Spam-Status: No, score=
>> X-Spam-Score: 
>> X-Spam-Bar: 
>> X-Spam-Flag: NO
>>   
> At casual glance, it looks like you're trying to use spamc, but spamd
> isn't running.
> 
> 
> 

-- 
View this message in context: http://www.nabble.com/Headers-not-being-updated-tp13223298p14541691.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Headers not being updated

[Matt Kettler <mk...@verizon.net>]

Henk S wrote:
> I experience the same problem.
> Lots of spam and normal e-mail have X_Spam_Status: "No, score=". And
> X_spam_Flag: "NO"
> But not all. Sometimes it is: Yes, score=7.7 and marked as spam, sometimes
> "No, score=2.0" and ofcourse not marked as spam. Even "No, score=0.0".
> What is causing this and how can it be solved?
>   
Well, it really doesn't help that you've left out any useful details at all.

Scores alone tell me, or anyone else, very, very, little.

At the absolute minimum we'd need: a full X-Spam-Status (with the list
of hits), and what version of SA you're running, and a crude description
of the spam (enough that we'd have a good chance of finding a similar
one in our inboxes).

Even better would be to put one of the messages somewhere that we can
look at it. (ie: pastebin, or whatever works for you).

There's a few hundred different tactics spammers use to evade detection,
which one is affecting your current setup is a mystery to me.

However, I can tell you that the the ones with just "score=" and no
numbers following are likely a messages that were too large to be
scanned. If you're using spamc/spamd, by default messages larger than
500kb aren't scanned. You can change this with a command-line parameter
to spamc, but be aware that scanning really large messages can bog down
SA pretty badly.