AWL score change

[Steve Ingraham <si...@okcca.net>]

I am running qmail with spamassassin 3.1.5.  I am having a problem with
spamassassin scoring.  I have been attempting to change the score for
AWL to -25.  Here is a header from an email I received a short time ago
with a score of 1.4 for AWL in the X-Spam-Report section:

 

Microsoft Mail Internet Headers Version 2.0

Received: from MXI.occa.state.ok.us ([172.16.255.12]) by
mxi2.occa.state.ok.us with Microsoft SMTPSVC(6.0.3790.1830);

             Wed, 1 Nov 2006 11:42:36 -0600

Received: from dellapp02.occa.state.ok.us ([204.87.111.225]) by
MXI.occa.state.ok.us with Microsoft SMTPSVC(5.0.2195.6713);

             Wed, 1 Nov 2006 11:42:36 -0600

Received: (qmail 14972 invoked by uid 507); 1 Nov 2006 17:37:38 -0000

Received: by simscan 1.2.0 ppid: 14916, pid: 14927, t: 6.1872s

         scanners: attach: 1.2.0 clamav: 0.88.4/m:40/d:2106 spam: 3.1.5

X-Spam-Flag: YES

X-Spam-Checker-Version: SpamAssassin 3.1.5 (2006-08-29) on 

            dellapp02.occa.state.ok.us

X-Spam-Level: *****

X-Spam-Status: Yes, score=5.4 required=5.0 tests=AWL,BAYES_50,

            JR_RCVD_TOO_FEW_HOPS autolearn=no version=3.1.5

X-Spam-Report: 

            *  1.0 JR_RCVD_TOO_FEW_HOPS Just one hop means direct
untrusted client

            *  3.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%

            *      [score: 0.5858]

            *  1.4 AWL AWL: From: address is in the auto white-list

Received: from unknown (HELO 101comm.hdsmail.com) (66.37.227.191)

  by dellapp02.occa.state.ok.us with SMTP; 1 Nov 2006 17:37:32 -0000

Received-SPF: pass (dellapp02.occa.state.ok.us: SPF record at
101comm.hdsmail.com designates 66.37.227.191 as permitted sender)

From: "Federal Computer Week" <FC...@hdsmail.com>

To: singraham@okcca.net

Subject: ***SPAM*** Effective Compliance Strategies webinar from FCW and
CA

Date: Wed, 01 Nov 2006 11:00:00 -0600

MIME-Version: 1.0

Content-Type: text/plain; charset="ISO-8859-1"

Content-Transfer-Encoding: 7bit

Reply-To: FCW@lists.101com.com

Message-Id:
<HDSMAIL-79219493-93448-2006.11.01-11.00.03--singraham#okcca.net@101comm
.hdsmail.com>

X-Spam-Prev-Subject: Effective Compliance Strategies webinar from FCW
and CA

Return-Path: bounce-93448-79219493@101comm.hdsmail.com

X-OriginalArrivalTime: 01 Nov 2006 17:42:36.0803 (UTC)
FILETIME=[1E815530:01C6FDDD]

 

I don't understand why AWL would not be showing a score of -25.  The
above header is just one example of user emails that have an AWL score
higher than the -25 that I set up.  I believe I have made the change for
this scoring correctly.  To make the change I inserted a line in
local.cf.

 

Here is the local.cf script:

 

# These values can be overridden by editing
~/.spamassassin/user_prefs.cf 

# (see spamassassin(1) for details)

 

# These should be safe assumptions and allow for simple visual sifting

# without risking lost emails.

 

# This file has been changed to support spamassassin-toaster-3.0.1-1.2.1

# Nick Hemmesch <ni...@ndhsoft.com>

# May 30, 2005 <http://www.qmailtoaster.com>

 

#ok_languages all

ok_locales all

skip_rbl_checks 0

 

required_hits 5

report_safe 0

# report_header 1

# use_terse_report 1

# rewrite_subject 0

rewrite_header Subject ***SPAM***

 

use_bayes 1

bayes_file_mode 0700

bayes_path /etc/mail/spamassassin/.spamassassin/bayes

bayes_auto_learn_threshold_spam 8.0

bayes_auto_expire 1

 

use_auto_whitelist 1

auto_whitelist_file_mode 0700

auto_whitelist_path /etc/mail/spamassassin/.spamassassin/auto-whitelist

 

#use_razor2 1

 

score BAYES_05 0.5

score BAYES_50 3.0

score BAYES_95 9.5

score BAYES_99 10.0

score AWL -25

 

whitelist_to *@decisions.okcca.net

whitelist_from *@abanet.org *.abanet.org *@aol.com

whitelist_from searchExchange@lists.techtarget.com *@mysql.com
*@eb.emediaUSA.com

whitelist_from *@newsletters.101com.com *@thomsonwest.com

whitelist_from rstrubhar@wisplinx.com

whitelist_from *@*.state.ok.us *@okhouse.gov *@ok.gov

 

After saving local.cf I then ran Jake Vickers command qmail-spam restart
but our users are still receiving emails with AWL scores that are not
showing as -25.  Does anyone have any ideas why my AWL scores are not
reflecting -25?  Where is the AWL rule located?  I would like to
understand better how spamassassin is using AWL and why my change to the
local.cf is not having an effect on this score.

 

Thanks in advance,

Steve Ingraham

Director of Information Services

Oklahoma Court of Criminal Appeals

singraham@okcca.net

405 522-5343

 

Re: AWL score change

[Jim Maul <jm...@elih.org>]

Steve Ingraham wrote:
> I am running qmail with spamassassin 3.1.5.  I am having a problem with 
> spamassassin scoring.  I have been attempting to change the score for 
> AWL to -25.  Here is a header from an email I received a short time ago 
> with a score of 1.4 for AWL in the X-Spam-Report section:
> 
> 

You can not change the score of this rule.  The AWL is not a whitelist. 
  It is a score averager. Its score changes depending on certain factors.

Why not just disable it and use real whitelisting?

-Jim