Subject Rename, No Delete

[John Chase <jo...@sketchy.info>]

Hi,
  This is my fist time posting to the list so I hope that my message is
targeted to the appropriate audience. I'm running SA 3.0 with Qmail Scanner.
I hope to delete all detected spam. However, some Spam is slipping by. The
subject is renamed, but the message is not deleted.

In the below example a message was sent, scanned, and determined to be spam.
However, it was received in my inbox with the subject ':SPAM: New product!
Cialis soft tabs.' - not deleted like other spam messages.

Any suggestions would be appreciated.

Thanks.


>From /var/qmail/bin/qmail-scanner-queue.pl

my $spamc_subject=":SPAM:";
my $sa_delete='1.0';


>From /var/qmailscan/qmail-queue.log

Wed, 27 Oct 2004 08:26:04 EDT:27282: from='"Merlin Barnes"
<m....@mbox.dkm.cz>', subj='New product! Cialis soft tabs.', via SMTP
from 65.175.186.24
Wed, 27 Oct 2004 08:26:04 EDT:27282: This is a PLAIN text message, skip
virus scanners - but not SA
Wed, 27 Oct 2004 08:26:23 EDT:27282: SA: yup, this smells like SPAM
Wed, 27 Oct 2004 08:26:23 EDT:27282: SA: required_hits 5.0 / sa_quarantine
+0 / sa_delete +1.0
Wed, 27 Oct 2004 08:26:23 EDT:27282: SA: finished scan in 18.453429 secs -
hits=5.1
Wed, 27 Oct 2004 08:26:23 EDT:27282: p_s: finished scan in 0.004306 secs

Re: Subject Rename, No Delete

[Matt Kettler <mk...@evi-inc.com>]

At 04:26 PM 10/29/2004, John Chase wrote:
>   This is my fist time posting to the list so I hope that my message is
>targeted to the appropriate audience. I'm running SA 3.0 with Qmail Scanner.
>I hope to delete all detected spam. However, some Spam is slipping by. The
>subject is renamed, but the message is not deleted.

First a warning: what you want to do is a pretty bad idea. SA does have 
false positives sometimes. If you value your email, don't treat SA as a 
deletion criteria, except perhaps at very high scores.

Your question is really a qmail-scanner question, not a SA question.

sa_delete is set to 1.0. This means that qmail-scanner will delete mail 
when it hits a score of 6.0 (requried_hits + sa_delete).

To do what you want, you need it set to 0.

However, heed my warning, this is really not a very smart thing to do. I 
myself would never even consider setting it to less than 10.0 (delete above 
15.0 total score). You might be less conservative than I am, but it's still 
a reference point.