Going from procmail based SA to spamass-milter produces more spam

[Mark Linford]

Ken Long
Mon, 30 Oct 2006 12:23:53 -0800

Three...
"erratic results" doesn't tell me much.

Erratic means some messages seemed to tag out the same and some
did not.

As I mentioned, I tried setting up a double check by passing the
mail
that makes it through sa-milter into procmail and here is an
example
e-mail.

spamass-milter provided these results:

Oct 30 13:33:57 mailbuoy spamd[22619]: clean message (3.3/5.0)
for
klong:0 in 4.4 seconds, 6936 bytes.
Oct 30 13:33:57 mailbuoy spamd[22619]: result: . 3 -
HTML_80_90,HTML_FONT_BIG,HTML_MESSAGE,HTML_NONELEMENT_00_10,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,URIBL_WS_S
URBL
scantime=4.4,size=6936,mid=<[EMAIL PROTECTED]>,autolearn=no

It then went on to my .procmailrc where it was run against spamc
and
came up with these results:

Oct 30 13:34:01 mailbuoy spamd[22920]: identified spam (5.2/5.0)
for
klong:0 in 3.2 seconds, 7101 bytes.
Oct 30 13:34:01 mailbuoy spamd[22920]: result: Y 5 -
HTML_80_90,HTML_FONT_BIG,HTML_MESSAGE,HTML_NONELEMENT_00_10,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_NJ
ABL_SPAM,SPF_HELO_PASS,SPF_PASS,URIBL_WS_SURBL
scantime=3.2,size=7101,mid=<[EMAIL PROTECTED]>,autolearn=no

Same message. Same SA configuration on same machine using same
bayes
and same preferences. Different results.

Saving the message and running it with spamassassin -t gives me
this:

Content analysis details: (5.2 points, 5.0 required)

pts rule name description
---- ----------------------
--------------------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 HTML_80_90 BODY: Message is 80% to 90% HTML
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 HTML_FONT_BIG BODY: HTML tag for a big font size
0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level
above
50%
[cf: 100]
0.0 HTML_NONELEMENT_00_10 BODY: 0% to 10% of HTML elements are
non-standard
1.5 RAZOR2_CHECK Listed in Razor2
(http://razor.sf.net/)
1.8 RCVD_IN_NJABL_SPAM RBL: NJABL: sender is confirmed spam
source
[65.175.106.73 listed in
combined.njabl.org]
1.5 URIBL_WS_SURBL Contains an URL listed in the WS
SURBL
blocklist
[URIs: supercenterpromotions.com]


That matches what spamc got through procmail. So, being called
through
the milter definitely changes the results - but why?

Try using -d for spamass-milter.

I'll give that a try and see if I can see anything.

Thanks

-Ken



Out of curiosity, did anyone ever discover a cure to this behavior? I'm
having a similar problem, though slightly different. It appears that the
spamass-milter is submitting the message to spamassasin twice for each
message. Sometimes, it comes back with the same result, sometimes it's
drastically different. For example, from my logs:


Aug 16 15:02:21 busservices sendmail[8819]: l7GM2HWF008819: Milter
change: header X-Spam-Status: from Yes, score=8.3 required=5.0
tests=BAYES_00,DCC_CHECK,\n
\tDIGEST_MULTIPLE,DK_POLICY_SIGNSOME,MIME_BASE64_TEXT,PYZOR_CHECK,\n
\tRAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100 autolearn=no
version=3.2.2 to No, score=2.5 required=5.0
tests=BAYES_00,DK_POLICY_SIGNSOME,\n
\tMIME_BASE64_TEXT,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100\n
\tautolearn=no version=3.2.2

Aug 16 15:02:21 busservices sendmail[8819]: l7GM2HWF008819: Milter
change: header X-Spam-Level: from ******** to **


As you can see, this a very inconsistent and frustrating behavior. Any
ideas why it's doing this? Thanks!

Mark