Rules in local.cf are not read?

[Simone Morandini]

Hi all,

I'm using MailScanner with SpamAssassin, and I'm using the "Cache SpamAssassin Results = yes" option.
Since I've enabled this option, I'm seeing that some spam messages pass through, although the subject or body match one or more own-written rules in my local.cf file.
If I look at the header of these messages, they have:

X-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, timed out)

If I save the message and try "spamassassin -D < mymessage" it is correctly detected as spam, also against the rules in local.cf file.
I know that SpamAssassin sometimes times out on network checks, but aren't the rules in the local.cf file read anyway?

Thanks in advance for your help.

Simone.

[Martin.Hepworth]

Simone

This is more a mailscanner issue - try asking there..

The spamassassin is timing out. What RBL's are you running in spamassassin?

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: [phone]

> -----Original Message-----
> From: Simone Morandini [mailto:simone.morandini@...]
> Sent: 20 June 2008 15:37
> To: users@...
> Subject: Rules in local.cf are not read?
>
>
> Hi all,
>
> I'm using MailScanner with SpamAssassin, and I'm using the
> "Cache SpamAssassin Results = yes" option.
> Since I've enabled this option, I'm seeing that some spam
> messages pass through, although the subject or body match one
> or more own-written rules in my local.cf file.
> If I look at the header of these messages, they have:
>
> X-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
> timed out)
>
> If I save the message and try "spamassassin -D < mymessage"
> it is correctly detected as spam, also against the rules in
> local.cf file.
> I know that SpamAssassin sometimes times out on network
> checks, but aren't the rules in the local.cf file read anyway?
>
> Thanks in advance for your help.
>
> Simone.
> --
> View this message in context:
> http://www.nabble.com/Rules-in-local.cf-are-not-read--tp180309
> 07p18030907.html
> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>
>

**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the
addressee only and may be confidential. If they come to you in error
you must take no action based on them, nor must you copy or show them
to anyone. Please advise the sender by replying to this e-mail
immediately and then delete the original from your computer.
Opinion : Any opinions expressed in this e-mail are entirely those of
the author and unless specifically stated to the contrary, are not
necessarily those of the author's employer.
Security Warning : Internet e-mail is not necessarily a secure
communications medium and can be subject to data corruption. We advise
that you consider this fact when e-mailing us.
Viruses : We have taken steps to ensure that this e-mail and any
attachments are free from known viruses but in keeping with good
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
United Kingdom
**********************************************************************

[McDonald, Dan]

On Fri, 2008-06-20 at 07:36 -0700, Simone Morandini wrote:

> X-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, timed out)
>
> If I save the message and try "spamassassin -D < mymessage" it is correctly
> detected as spam, also against the rules in local.cf file.
> I know that SpamAssassin sometimes times out on network checks, but aren't
> the rules in the local.cf file read anyway?

Don't forget to restart mailscanner each time you change rules or run
sa-update.


--
Daniel J McDonald, CCIE #2495, CISSP #78281, CNX
Austin Energy
http://www.austinenergy.com

[Simone Morandini]

Thanks for the replies...

My MailScanner is set to restart once a day, and the problem I see happens a few times, but every day...

My question was more related to the general behaviour of SpamAssassin checks: I understand it could timeout, but I'd expect that the rules written in the local.cf file are read anyway.
I have written some basic rules that match single words, and sometimes messages that contains one of these words pass anyway, because they are not detect as being spam.
I thought that reading the local.cf file could be made regardless timeouts...

Thanks anyway for the support.

Simone.

--
Daniel J McDonald, CCIE #2495, CISSP #78281, CNX
Austin Energy
http://www.austinenergy.com


 

[mouss-2]

Simone Morandini wrote:

> Thanks for the replies...
>
> My MailScanner is set to restart once a day, and the problem I see happens a
> few times, but every day...
>
> My question was more related to the general behaviour of SpamAssassin
> checks: I understand it could timeout, but I'd expect that the rules written
> in the local.cf file are read anyway.
> I have written some basic rules that match single words, and sometimes
> messages that contains one of these words pass anyway, because they are not
> detect as being spam.
> I thought that reading the local.cf file could be made regardless
> timeouts...
>  

then maybe you are using the wrong expression. show the rule and a
sample message that slips...

[Simone Morandini]

mouss-2 wrote:

then maybe you are using the wrong expression. show the rule and a
sample message that slips...

The following message has been delivered to my inbox:

Subject: Royal luxury of high-rank watches
Body: Rep1!c@ watches presented at our store are available at the most competitive prices on the net

The SpamCheck header says: "not spam, SpamAssassin (not cached, timed out)"

The rules (that I added to local.cf file) that should have worked are:

header SHOPPING_H               Subject =~ /\b(?:luxury|handbag|rolex|gucci|armani|prada|dsquared|burberry|hermes|fashion|discount|replica|watches|\bdior\b|bikkember)/i
describe SHOPPING_H             Non adoro sperperare

body SHOPPING_B         /\b(?:luxury|handbag|rolex|gucci|armani|prada|dsquared|burberry|hermes|fashion|discount|replica|watches|\bdior\b|bikkember)/i
describe SHOPPING_B             Non adoro sperperare

Thanks for any help,
Simone.

[Anthony Peacock]

Hi,

Simone Morandini wrote:

>
>
> mouss-2 wrote:
>> then maybe you are using the wrong expression. show the rule and a
>> sample message that slips...
>>
>
> The following message has been delivered to my inbox:
>
> Subject: Royal luxury of high-rank watches
> Body: Rep1!c@ watches presented at our store are available at the most
> competitive prices on the net
>
> The SpamCheck header says: "not spam, SpamAssassin (not cached, timed out)"

This looks like something that MailScanner puts into the headers.  It
means that the call to SA timed out and the message does not appear in
MailScanner's cache (if it is MailScanner, of course).

I would suggest that you save the full email, and run it manually
through SA using the command line tool, something like:

spamassassin --test-mode < file_that_contains_the_email_you_saved.eml

This will show you which rules spamassassin will score on.

>
> The rules (that I added to local.cf file) that should have worked are:
>
> header SHOPPING_H               Subject =~
> /\b(?:luxury|handbag|rolex|gucci|armani|prada|dsquared|burberry|hermes|fashion|discount|replica|watches|\bdior\b|bikkember)/i
> describe SHOPPING_H             Non adoro sperperare
>
> body SHOPPING_B        
> /\b(?:luxury|handbag|rolex|gucci|armani|prada|dsquared|burberry|hermes|fashion|discount|replica|watches|\bdior\b|bikkember)/i
> describe SHOPPING_B             Non adoro sperperare
>
> Thanks for any help,
> Simone.

--
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
Study Health Informatics - Modular Postgraduate Degree
http://www.chime.ucl.ac.uk/study-health-informatics/