Issues with low spam delivery

classic Classic list List threaded Threaded
20 messages Options
Reply | Threaded
Open this post in threaded view
|

Issues with low spam delivery

ManicD
Emails that are clean deliver, emails that are highspam are quarantined, however emails that are lowspam are supposed to deliver but don't.

Further I have setup domain and user account, the user account spam scores dont seem to apply (have only tested low spam score) Only the domain score applys.

/var/log/maillog with Debug on for mailscanner, spamassassin and sql (i have removed some of the rules in the list but left references to domain.com)

=============================
Oct 17 09:54:35 mx3 MailScanner[26761]: MailScanner E-Mail Virus Scanner version 4.84.6 starting...
Oct 17 09:54:35 mx3 MailScanner[26761]: Reading configuration file /etc/MailScanner/MailScanner.conf
Oct 17 09:54:35 mx3 MailScanner[26761]: ConfigSQL configuration loaded with serial 245, next check in 900 seconds
Oct 17 09:54:35 mx3 MailScanner[26761]: Reading ruleset signmsgs for keyword signcleanmessages
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default  no) from database for keyword signcleanmessages

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset bannedlist for keyword spamblacklist
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (From:  *@xxxxx.xxx yes) from database for keyword spamblacklist

Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default no) from database for keyword spamblacklist

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset spamchecks for keyword spamchecks
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default yes) from database for keyword spamchecks

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset approvedlist for keyword spamwhitelist
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (From: xxxxx@xxxxx.xxx yes) from database for keyword spamwhitelist
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default no) from database for keyword spamwhitelist

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset deletedcontentmessage for keyword deletedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/deleted.content.message.txt) from database for keyword deletedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset deletedfilenamemessage for keyword deletedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/deleted.filename.message.txt) from database for keyword deletedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset deletedsizemessage for keyword deletedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/deleted.size.message.txt) from database for keyword deletedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset deletedvirusmessage for keyword deletedvirusmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/deleted.virus.message.txt) from database for keyword deletedvirusmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset disinfectedreport for keyword disinfectedreporttext
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/disinfected.report.txt) from database for keyword disinfectedreporttext
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset htmlsigs for keyword inlinehtmlsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default %%report-dir%%/inline.sig.html) from database for keyword inlinehtmlsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset inlinewarninghtml for keyword inlinehtmlwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/inline.warning.html) from database for keyword inlinehtmlwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset inlinespamwarning for keyword inlinespamwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/inline.spam.warning.txt) from database for keyword inlinespamwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset textsigs for keyword inlinetextsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default  %%report-dir%%/inline.sig.txt) from database for keyword inlinetextsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset inlinewarningtxt for keyword inlinetextwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/inline.warning.txt) from database for keyword inlinetextwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset languages for keyword languagestrings
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/languages.conf) from database for keyword languagestrings
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset recipientspamreport for keyword recipientspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/recipient.spam.report.txt) from database for keyword recipientspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset rejectionreport for keyword rejectionreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/rejection.report.txt) from database for keyword rejectionreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendercontentreport for keyword sendercontentreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/sender.content.report.txt) from database for keyword sendercontentreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendererrorreport for keyword sendererrorreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/sender.error.report.txt) from database for keyword sendererrorreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderfilenamereport for keyword senderfilenamereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/sender.filename.report.txt) from database for keyword senderfilenamereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderspamrblreport for keyword senderrblspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/sender.spam.rbl.report.txt) from database for keyword senderrblspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderspamsareport for keyword sendersaspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/sender.spam.sa.report.txt) from database for keyword sendersaspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendersizereport for keyword sendersizereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/sender.size.report.txt) from database for keyword sendersizereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderspamreport for keyword senderbothspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/sender.spam.report.txt) from database for keyword senderbothspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendervirusreport for keyword sendervirusreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/sender.virus.report.txt) from database for keyword sendervirusreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset storedcontentmessage for keyword storedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/stored.content.message.txt) from database for keyword storedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset storedfilenamemessage for keyword storedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/stored.filename.message.txt) from database for keyword storedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset storedsizemessage for keyword storedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/stored.size.message.txt) from database for keyword storedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset storedvirusmessage for keyword storedvirusmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default  %%report-dir%%/stored.virus.message.txt) from database for keyword storedvirusmessage

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset highspamscore for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: *@xxxxxx.co.uk   6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: relay@domain.com   6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: Jxxxxx@xxxxx.xxxx.xxxx   6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: ixxxxxx@xxxxxx.co.uk   6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: *@xxxxx.net   6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: *@domain.com   6) from database for keyword highspamassassinscore

Oct 17 09:54:36 mx3 MailScanner[26776]: BaruwaSQL: Alive with PID: 1152
Oct 17 09:54:41 mx3 MailScanner[26761]: Connected to Processing Attempts Database
Oct 17 09:54:41 mx3 MailScanner[26761]: Found 6 messages in the Processing Attempts Database
Oct 17 09:54:41 mx3 MailScanner[26761]: lock.pl sees Config  LockType =  posix
Oct 17 09:54:41 mx3 MailScanner[26761]: lock.pl sees have_module =  0
Oct 17 09:54:41 mx3 MailScanner[26761]: Using locktype = posix

Oct 17 09:55:29 mx3 MailScanner[26761]: New Batch: Scanning 1 messages, 2996 bytes
Oct 17 09:55:29 mx3 MailScanner[26761]: ConfigSQL configuration update check time not reached; next check in 846 seconds
Oct 17 09:55:29 mx3 MailScanner[26761]: Created attachment dirs for 1 messages
Oct 17 09:55:29 mx3 MailScanner[26761]: Completed checking by /usr/bin/file
Oct 17 09:55:29 mx3 MailScanner[26761]: Virus and Content Scanning: Starting
Oct 17 09:55:29 mx3 MailScanner[26761]: Commencing scanning by clamd...
Oct 17 09:55:29 mx3 MailScanner[26859]: Debug Mode Is On
Oct 17 09:55:29 mx3 MailScanner[26859]: Use Threads : NO
Oct 17 09:55:29 mx3 MailScanner[26859]: Socket    : /var/run/clamav/clamd.sock
Oct 17 09:55:29 mx3 MailScanner[26859]: IP        : Using Sockets
Oct 17 09:55:29 mx3 MailScanner[26859]: Lock File : NOT USED
Oct 17 09:55:29 mx3 MailScanner[26859]: Time Out  : 300
Oct 17 09:55:29 mx3 MailScanner[26859]: Scan Dir  : /var/spool/MailScanner/incoming/26761
Oct 17 09:55:29 mx3 MailScanner[26859]: Clamd : Sending PING
Oct 17 09:55:29 mx3 MailScanner[26859]: Clamd : GOT 'PONG'
Oct 17 09:55:29 mx3 MailScanner[26859]: ClamD is running
Oct 17 09:55:29 mx3 MailScanner[26859]: SENT : CONTSCAN /var/spool/MailScanner/incoming/26761
Oct 17 09:55:29 mx3 MailScanner[26761]: Completed scanning by clamd
Oct 17 09:55:29 mx3 MailScanner[26761]: Virus Scanning completed at 7601 bytes per second
Oct 17 09:55:29 mx3 MailScanner[26761]: Spam Checks: Starting
Oct 17 09:55:30 mx3 MailScanner[26761]: RBL Checks: returned 0
Oct 17 09:55:31 mx3 MailScanner[26761]: SpamAssassin returned 0
Oct 17 09:55:31 mx3 MailScanner[26761]: Message 1Xf3Jo-0006z5-KT from 84.92.46.238 (user@domain.com) to domain.com is spam, SpamAssassin (not cached, score=3.726, required 2, DOS_OUTLOOK_TO_MX 1.45, FSL_HELO_NON_FQDN_1 0.00, HTML_MESSAGE 0.00, KAM_LAZY_DOMAIN_SECURITY 1.00, MIME_HTML_MOSTLY 0.00, RDNS_NONE 1.27)
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Checks: Found 1 spam messages
Oct 17 09:55:31 mx3 MailScanner[26761]: Non-delivery of spam: message 1Xf3Jo-0006z5-KT from user@domain.com to user@domain.com with subject  test 0954
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Actions: message 1Xf3Jo-0006z5-KT actions are store
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Checks completed at 2268 bytes per second
Oct 17 09:55:31 mx3 MailScanner[26761]: Deleted 1 messages from processing-database
Oct 17 09:55:31 mx3 MailScanner[26761]: Batch completed at 1719 bytes per second (2996 / 1)
Oct 17 09:55:31 mx3 MailScanner[26761]: Batch (1 message) processed in 1.74 seconds
Oct 17 09:55:31 mx3 MailScanner[26761]: BaruwaSQL: 1Xf3Jo-0006z5-KT send to logger
Oct 17 09:55:31 mx3 MailScanner[26761]: "Always Looked Up Last" took 0.01 seconds
Oct 17 09:55:31 mx3 MailScanner[26761]: Config: calling custom end function BaruwaLog
Oct 17 09:55:31 mx3 MailScanner[26761]: BaruwaSQL: shutdown requested by child: 26761
Oct 17 09:55:31 mx3 MailScanner[26761]: MailScanner child dying of old age
=============================

Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

jeremymcs
Why is your spam score set for 2? That's really low imo. Everything will be flagged. 

--
Jeremy McSpadden
Flux Labs | http://www.fluxlabs.net | Endless Solutions
Office : <a href="tel:850-250-5590;501">850-250-5590x501 | Cell : <a href="tel:850-890-2543">850-890-2543 | Fax : <a href="tel:850-254-2955">850-254-2955

On Oct 17, 2014, at 4:16 AM, ManicD <[hidden email]> wrote:

Emails that are clean deliver, emails that are highspam are quarantined,
however emails that are lowspam are supposed to deliver but don't.

Further I have setup domain and user account, the user account spam scores
dont seem to apply (have only tested low spam score) Only the domain score
applys.

/var/log/maillog with Debug on for mailscanner, spamassassin and sql (i have
removed some of the rules in the list but left references to domain.com)

=============================
Oct 17 09:54:35 mx3 MailScanner[26761]: MailScanner E-Mail Virus Scanner
version 4.84.6 starting...
Oct 17 09:54:35 mx3 MailScanner[26761]: Reading configuration file
/etc/MailScanner/MailScanner.conf
Oct 17 09:54:35 mx3 MailScanner[26761]: ConfigSQL configuration loaded with
serial 245, next check in 900 seconds
Oct 17 09:54:35 mx3 MailScanner[26761]: Reading ruleset signmsgs for keyword
signcleanmessages
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default  no)
from database for keyword signcleanmessages

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset bannedlist for
keyword spamblacklist
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (From:  *@xxxxx.xxx yes)
from database for keyword spamblacklist

Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default no)
from database for keyword spamblacklist

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset spamchecks for
keyword spamchecks
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default yes)
from database for keyword spamchecks

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset approvedlist for
keyword spamwhitelist
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (From: [hidden email]
yes) from database for keyword spamwhitelist
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default no)
from database for keyword spamwhitelist

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset
deletedcontentmessage for keyword deletedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/deleted.content.message.txt) from database for keyword
deletedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset
deletedfilenamemessage for keyword deletedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/deleted.filename.message.txt) from database for keyword
deletedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset deletedsizemessage
for keyword deletedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/deleted.size.message.txt) from database for keyword
deletedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset deletedvirusmessage
for keyword deletedvirusmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/deleted.virus.message.txt) from database for keyword
deletedvirusmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset disinfectedreport
for keyword disinfectedreporttext
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/disinfected.report.txt) from database for keyword
disinfectedreporttext
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset htmlsigs for keyword
inlinehtmlsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default
%%report-dir%%/inline.sig.html) from database for keyword inlinehtmlsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset inlinewarninghtml
for keyword inlinehtmlwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/inline.warning.html) from database for keyword
inlinehtmlwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset inlinespamwarning
for keyword inlinespamwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/inline.spam.warning.txt) from database for keyword
inlinespamwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset textsigs for keyword
inlinetextsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default
%%report-dir%%/inline.sig.txt) from database for keyword inlinetextsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset inlinewarningtxt for
keyword inlinetextwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/inline.warning.txt) from database for keyword
inlinetextwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset languages for
keyword languagestrings
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/languages.conf) from database for keyword languagestrings
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset recipientspamreport
for keyword recipientspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/recipient.spam.report.txt) from database for keyword
recipientspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset rejectionreport for
keyword rejectionreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/rejection.report.txt) from database for keyword
rejectionreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendercontentreport
for keyword sendercontentreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.content.report.txt) from database for keyword
sendercontentreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendererrorreport
for keyword sendererrorreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.error.report.txt) from database for keyword
sendererrorreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderfilenamereport
for keyword senderfilenamereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.filename.report.txt) from database for keyword
senderfilenamereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderspamrblreport
for keyword senderrblspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.spam.rbl.report.txt) from database for keyword
senderrblspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderspamsareport
for keyword sendersaspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.spam.sa.report.txt) from database for keyword
sendersaspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendersizereport for
keyword sendersizereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.size.report.txt) from database for keyword
sendersizereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderspamreport for
keyword senderbothspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.spam.report.txt) from database for keyword
senderbothspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendervirusreport
for keyword sendervirusreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.virus.report.txt) from database for keyword
sendervirusreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset storedcontentmessage
for keyword storedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/stored.content.message.txt) from database for keyword
storedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset
storedfilenamemessage for keyword storedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/stored.filename.message.txt) from database for keyword
storedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset storedsizemessage
for keyword storedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/stored.size.message.txt) from database for keyword
storedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset storedvirusmessage
for keyword storedvirusmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/stored.virus.message.txt) from database for keyword
storedvirusmessage

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset highspamscore for
keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: *@xxxxxx.co.uk   6)
from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: [hidden email]  
6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To:
[hidden email]   6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: [hidden email]  
6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: *@xxxxx.net   6)
from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: *@domain.com   6)
from database for keyword highspamassassinscore

Oct 17 09:54:36 mx3 MailScanner[26776]: BaruwaSQL: Alive with PID: 1152
Oct 17 09:54:41 mx3 MailScanner[26761]: Connected to Processing Attempts
Database
Oct 17 09:54:41 mx3 MailScanner[26761]: Found 6 messages in the Processing
Attempts Database
Oct 17 09:54:41 mx3 MailScanner[26761]: lock.pl sees Config  LockType =
posix
Oct 17 09:54:41 mx3 MailScanner[26761]: lock.pl sees have_module =  0
Oct 17 09:54:41 mx3 MailScanner[26761]: Using locktype = posix

Oct 17 09:55:29 mx3 MailScanner[26761]: New Batch: Scanning 1 messages, 2996
bytes
Oct 17 09:55:29 mx3 MailScanner[26761]: ConfigSQL configuration update check
time not reached; next check in 846 seconds
Oct 17 09:55:29 mx3 MailScanner[26761]: Created attachment dirs for 1
messages
Oct 17 09:55:29 mx3 MailScanner[26761]: Completed checking by /usr/bin/file
Oct 17 09:55:29 mx3 MailScanner[26761]: Virus and Content Scanning: Starting
Oct 17 09:55:29 mx3 MailScanner[26761]: Commencing scanning by clamd...
Oct 17 09:55:29 mx3 MailScanner[26859]: Debug Mode Is On
Oct 17 09:55:29 mx3 MailScanner[26859]: Use Threads : NO
Oct 17 09:55:29 mx3 MailScanner[26859]: Socket    :
/var/run/clamav/clamd.sock
Oct 17 09:55:29 mx3 MailScanner[26859]: IP        : Using Sockets
Oct 17 09:55:29 mx3 MailScanner[26859]: Lock File : NOT USED
Oct 17 09:55:29 mx3 MailScanner[26859]: Time Out  : 300
Oct 17 09:55:29 mx3 MailScanner[26859]: Scan Dir  :
/var/spool/MailScanner/incoming/26761
Oct 17 09:55:29 mx3 MailScanner[26859]: Clamd : Sending PING
Oct 17 09:55:29 mx3 MailScanner[26859]: Clamd : GOT 'PONG'
Oct 17 09:55:29 mx3 MailScanner[26859]: ClamD is running
Oct 17 09:55:29 mx3 MailScanner[26859]: SENT : CONTSCAN
/var/spool/MailScanner/incoming/26761
Oct 17 09:55:29 mx3 MailScanner[26761]: Completed scanning by clamd
Oct 17 09:55:29 mx3 MailScanner[26761]: Virus Scanning completed at 7601
bytes per second
Oct 17 09:55:29 mx3 MailScanner[26761]: Spam Checks: Starting
Oct 17 09:55:30 mx3 MailScanner[26761]: RBL Checks: returned 0
Oct 17 09:55:31 mx3 MailScanner[26761]: SpamAssassin returned 0
Oct 17 09:55:31 mx3 MailScanner[26761]: Message 1Xf3Jo-0006z5-KT from
84.92.46.238 ([hidden email]) to domain.com is spam, SpamAssassin (not
cached, score=3.726, required 2, DOS_OUTLOOK_TO_MX 1.45, FSL_HELO_NON_FQDN_1
0.00, HTML_MESSAGE 0.00, KAM_LAZY_DOMAIN_SECURITY 1.00, MIME_HTML_MOSTLY
0.00, RDNS_NONE 1.27)
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Checks: Found 1 spam messages
Oct 17 09:55:31 mx3 MailScanner[26761]: Non-delivery of spam: message
1Xf3Jo-0006z5-KT from [hidden email] to [hidden email] with subject  test
0954
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Actions: message
1Xf3Jo-0006z5-KT actions are store
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Checks completed at 2268 bytes
per second
Oct 17 09:55:31 mx3 MailScanner[26761]: Deleted 1 messages from
processing-database
Oct 17 09:55:31 mx3 MailScanner[26761]: Batch completed at 1719 bytes per
second (2996 / 1)
Oct 17 09:55:31 mx3 MailScanner[26761]: Batch (1 message) processed in 1.74
seconds
Oct 17 09:55:31 mx3 MailScanner[26761]: BaruwaSQL: 1Xf3Jo-0006z5-KT send to
logger
Oct 17 09:55:31 mx3 MailScanner[26761]: "Always Looked Up Last" took 0.01
seconds
Oct 17 09:55:31 mx3 MailScanner[26761]: Config: calling custom end function
BaruwaLog
Oct 17 09:55:31 mx3 MailScanner[26761]: BaruwaSQL: shutdown requested by
child: 26761
Oct 17 09:55:31 mx3 MailScanner[26761]: MailScanner child dying of old age
=============================





--
View this message in context: http://baruwa-users-list.963389.n3.nabble.com/Issues-with-low-spam-delivery-tp4027481.html
Sent from the Baruwa users list mailing list archive at Nabble.com.

_______________________________________________
http://pledgie.com/campaigns/12056

_______________________________________________
http://pledgie.com/campaigns/12056
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
Just testing, trying to score low spam without going to high spam, just testing right now before turning this to production server.


- - - - -
Ashley
This message was sent via my iPad and may be brief. If you require additional information, please ask.

On 17 Oct 2014, at 13:00, "jeremymcs [via Baruwa users list]" <[hidden email]> wrote:

Why is your spam score set for 2? That's really low imo. Everything will be flagged. 

--
Jeremy McSpadden
Flux Labs | http://www.fluxlabs.net | Endless Solutions
Office : <a href="tel:850-250-5590;501">850-250-5590x501 | Cell : <a href="tel:850-890-2543">850-890-2543 | Fax : <a href="tel:850-254-2955">850-254-2955

On Oct 17, 2014, at 4:16 AM, ManicD <[hidden email]> wrote:

Emails that are clean deliver, emails that are highspam are quarantined,
however emails that are lowspam are supposed to deliver but don't.

Further I have setup domain and user account, the user account spam scores
dont seem to apply (have only tested low spam score) Only the domain score
applys.

/var/log/maillog with Debug on for mailscanner, spamassassin and sql (i have
removed some of the rules in the list but left references to domain.com)

=============================
Oct 17 09:54:35 mx3 MailScanner[26761]: MailScanner E-Mail Virus Scanner
version 4.84.6 starting...
Oct 17 09:54:35 mx3 MailScanner[26761]: Reading configuration file
/etc/MailScanner/MailScanner.conf
Oct 17 09:54:35 mx3 MailScanner[26761]: ConfigSQL configuration loaded with
serial 245, next check in 900 seconds
Oct 17 09:54:35 mx3 MailScanner[26761]: Reading ruleset signmsgs for keyword
signcleanmessages
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default  no)
from database for keyword signcleanmessages

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset bannedlist for
keyword spamblacklist
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (From:  *@xxxxx.xxx yes)
from database for keyword spamblacklist

Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default no)
from database for keyword spamblacklist

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset spamchecks for
keyword spamchecks
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default yes)
from database for keyword spamchecks

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset approvedlist for
keyword spamwhitelist
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (From: [hidden email]
yes) from database for keyword spamwhitelist
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default no)
from database for keyword spamwhitelist

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset
deletedcontentmessage for keyword deletedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/deleted.content.message.txt) from database for keyword
deletedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset
deletedfilenamemessage for keyword deletedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/deleted.filename.message.txt) from database for keyword
deletedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset deletedsizemessage
for keyword deletedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/deleted.size.message.txt) from database for keyword
deletedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset deletedvirusmessage
for keyword deletedvirusmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/deleted.virus.message.txt) from database for keyword
deletedvirusmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset disinfectedreport
for keyword disinfectedreporttext
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/disinfected.report.txt) from database for keyword
disinfectedreporttext
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset htmlsigs for keyword
inlinehtmlsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default
%%report-dir%%/inline.sig.html) from database for keyword inlinehtmlsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset inlinewarninghtml
for keyword inlinehtmlwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/inline.warning.html) from database for keyword
inlinehtmlwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset inlinespamwarning
for keyword inlinespamwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/inline.spam.warning.txt) from database for keyword
inlinespamwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset textsigs for keyword
inlinetextsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo: default
%%report-dir%%/inline.sig.txt) from database for keyword inlinetextsig
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset inlinewarningtxt for
keyword inlinetextwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/inline.warning.txt) from database for keyword
inlinetextwarning
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset languages for
keyword languagestrings
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/languages.conf) from database for keyword languagestrings
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset recipientspamreport
for keyword recipientspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/recipient.spam.report.txt) from database for keyword
recipientspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset rejectionreport for
keyword rejectionreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/rejection.report.txt) from database for keyword
rejectionreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendercontentreport
for keyword sendercontentreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.content.report.txt) from database for keyword
sendercontentreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendererrorreport
for keyword sendererrorreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.error.report.txt) from database for keyword
sendererrorreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderfilenamereport
for keyword senderfilenamereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.filename.report.txt) from database for keyword
senderfilenamereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderspamrblreport
for keyword senderrblspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.spam.rbl.report.txt) from database for keyword
senderrblspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderspamsareport
for keyword sendersaspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.spam.sa.report.txt) from database for keyword
sendersaspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendersizereport for
keyword sendersizereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.size.report.txt) from database for keyword
sendersizereport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset senderspamreport for
keyword senderbothspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.spam.report.txt) from database for keyword
senderbothspamreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset sendervirusreport
for keyword sendervirusreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/sender.virus.report.txt) from database for keyword
sendervirusreport
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset storedcontentmessage
for keyword storedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/stored.content.message.txt) from database for keyword
storedcontentmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset
storedfilenamemessage for keyword storedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/stored.filename.message.txt) from database for keyword
storedfilenamemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset storedsizemessage
for keyword storedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/stored.size.message.txt) from database for keyword
storedsizemessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset storedvirusmessage
for keyword storedvirusmessage
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (FromOrTo:  default
%%report-dir%%/stored.virus.message.txt) from database for keyword
storedvirusmessage

Oct 17 09:54:36 mx3 MailScanner[26761]: Reading ruleset highspamscore for
keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: *@xxxxxx.co.uk   6)
from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: [hidden email]  
6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To:
[hidden email]   6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: [hidden email]  
6) from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: *@xxxxx.net   6)
from database for keyword highspamassassinscore
Oct 17 09:54:36 mx3 MailScanner[26761]: Read rule  (To: *@domain.com   6)
from database for keyword highspamassassinscore

Oct 17 09:54:36 mx3 MailScanner[26776]: BaruwaSQL: Alive with PID: 1152
Oct 17 09:54:41 mx3 MailScanner[26761]: Connected to Processing Attempts
Database
Oct 17 09:54:41 mx3 MailScanner[26761]: Found 6 messages in the Processing
Attempts Database
Oct 17 09:54:41 mx3 MailScanner[26761]: lock.pl sees Config  LockType =
posix
Oct 17 09:54:41 mx3 MailScanner[26761]: lock.pl sees have_module =  0
Oct 17 09:54:41 mx3 MailScanner[26761]: Using locktype = posix

Oct 17 09:55:29 mx3 MailScanner[26761]: New Batch: Scanning 1 messages, 2996
bytes
Oct 17 09:55:29 mx3 MailScanner[26761]: ConfigSQL configuration update check
time not reached; next check in 846 seconds
Oct 17 09:55:29 mx3 MailScanner[26761]: Created attachment dirs for 1
messages
Oct 17 09:55:29 mx3 MailScanner[26761]: Completed checking by /usr/bin/file
Oct 17 09:55:29 mx3 MailScanner[26761]: Virus and Content Scanning: Starting
Oct 17 09:55:29 mx3 MailScanner[26761]: Commencing scanning by clamd...
Oct 17 09:55:29 mx3 MailScanner[26859]: Debug Mode Is On
Oct 17 09:55:29 mx3 MailScanner[26859]: Use Threads : NO
Oct 17 09:55:29 mx3 MailScanner[26859]: Socket    :
/var/run/clamav/clamd.sock
Oct 17 09:55:29 mx3 MailScanner[26859]: IP        : Using Sockets
Oct 17 09:55:29 mx3 MailScanner[26859]: Lock File : NOT USED
Oct 17 09:55:29 mx3 MailScanner[26859]: Time Out  : 300
Oct 17 09:55:29 mx3 MailScanner[26859]: Scan Dir  :
/var/spool/MailScanner/incoming/26761
Oct 17 09:55:29 mx3 MailScanner[26859]: Clamd : Sending PING
Oct 17 09:55:29 mx3 MailScanner[26859]: Clamd : GOT 'PONG'
Oct 17 09:55:29 mx3 MailScanner[26859]: ClamD is running
Oct 17 09:55:29 mx3 MailScanner[26859]: SENT : CONTSCAN
/var/spool/MailScanner/incoming/26761
Oct 17 09:55:29 mx3 MailScanner[26761]: Completed scanning by clamd
Oct 17 09:55:29 mx3 MailScanner[26761]: Virus Scanning completed at 7601
bytes per second
Oct 17 09:55:29 mx3 MailScanner[26761]: Spam Checks: Starting
Oct 17 09:55:30 mx3 MailScanner[26761]: RBL Checks: returned 0
Oct 17 09:55:31 mx3 MailScanner[26761]: SpamAssassin returned 0
Oct 17 09:55:31 mx3 MailScanner[26761]: Message 1Xf3Jo-0006z5-KT from
84.92.46.238 ([hidden email]) to domain.com is spam, SpamAssassin (not
cached, score=3.726, required 2, DOS_OUTLOOK_TO_MX 1.45, FSL_HELO_NON_FQDN_1
0.00, HTML_MESSAGE 0.00, KAM_LAZY_DOMAIN_SECURITY 1.00, MIME_HTML_MOSTLY
0.00, RDNS_NONE 1.27)
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Checks: Found 1 spam messages
Oct 17 09:55:31 mx3 MailScanner[26761]: Non-delivery of spam: message
1Xf3Jo-0006z5-KT from [hidden email] to [hidden email] with subject  test
0954
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Actions: message
1Xf3Jo-0006z5-KT actions are store
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Checks completed at 2268 bytes
per second
Oct 17 09:55:31 mx3 MailScanner[26761]: Deleted 1 messages from
processing-database
Oct 17 09:55:31 mx3 MailScanner[26761]: Batch completed at 1719 bytes per
second (2996 / 1)
Oct 17 09:55:31 mx3 MailScanner[26761]: Batch (1 message) processed in 1.74
seconds
Oct 17 09:55:31 mx3 MailScanner[26761]: BaruwaSQL: 1Xf3Jo-0006z5-KT send to
logger
Oct 17 09:55:31 mx3 MailScanner[26761]: "Always Looked Up Last" took 0.01
seconds
Oct 17 09:55:31 mx3 MailScanner[26761]: Config: calling custom end function
BaruwaLog
Oct 17 09:55:31 mx3 MailScanner[26761]: BaruwaSQL: shutdown requested by
child: 26761
Oct 17 09:55:31 mx3 MailScanner[26761]: MailScanner child dying of old age
=============================





--
View this message in context: http://baruwa-users-list.963389.n3.nabble.com/Issues-with-low-spam-delivery-tp4027481.html
Sent from the Baruwa users list mailing list archive at Nabble.com.

_______________________________________________
http://pledgie.com/campaigns/12056

_______________________________________________
http://pledgie.com/campaigns/12056



If you reply to this email, your message will be added to the discussion below:
http://baruwa-users-list.963389.n3.nabble.com/Issues-with-low-spam-delivery-tp4027481p4027482.html
To unsubscribe from Issues with low spam delivery, click here.
NAML
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

jeremymcs
Looks like your message was stored; not delivered. 

Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Actions: message
1Xf3Jo-0006z5-KT actions are store
--
Jeremy McSpadden
Flux Labs | http://www.fluxlabs.net | Endless Solutions
Office : <a href="tel:850-250-5590;501">850-250-5590x501 | Cell : <a href="tel:850-890-2543">850-890-2543 | Fax : <a href="tel:850-254-2955">850-254-2955

On Oct 17, 2014, at 7:02 AM, ManicD <[hidden email]> wrote:

84.92.46.238 ([hidden email]) to domain.com is spam, SpamAssassin (not
cached, score=3.726, required 2, DOS_OUTLOOK_TO_MX 1.45, FSL_HELO_NON_FQDN_1
0.00, HTML_MESSAGE 0.00, KAM_LAZY_DOMAIN_SECURITY 1.00, MIME_HTML_MOSTLY
0.00, RDNS_NONE 1.27)
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Checks: Found 1 spam messages
Oct 17 09:55:31 mx3 MailScanner[26761]: Non-delivery of spam: message
1Xf3Jo-0006z5-KT from [hidden email] to [hidden email] with subject  test
0954
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Actions: message
1Xf3Jo-0006z5-KT actions are store

_______________________________________________
http://pledgie.com/campaigns/12056
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
Yeah, but its set to deliver on the user and the domain. Not sure why its not getting the right settings.


- - - - -
Ashley
This message was sent via my iPad and may be brief. If you require additional information, please ask.

On 17 Oct 2014, at 13:08, "jeremymcs [via Baruwa users list]" <[hidden email]> wrote:

Looks like your message was stored; not delivered. 

Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Actions: message
1Xf3Jo-0006z5-KT actions are store
--
Jeremy McSpadden
Flux Labs | http://www.fluxlabs.net | Endless Solutions
Office : <a href="tel:850-250-5590;501">850-250-5590x501 | Cell : <a href="tel:850-890-2543">850-890-2543 | Fax : <a href="tel:850-254-2955">850-254-2955

On Oct 17, 2014, at 7:02 AM, ManicD <[hidden email]> wrote:

84.92.46.238 ([hidden email]) to domain.com is spam, SpamAssassin (not
cached, score=3.726, required 2, DOS_OUTLOOK_TO_MX 1.45, FSL_HELO_NON_FQDN_1
0.00, HTML_MESSAGE 0.00, KAM_LAZY_DOMAIN_SECURITY 1.00, MIME_HTML_MOSTLY
0.00, RDNS_NONE 1.27)
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Checks: Found 1 spam messages
Oct 17 09:55:31 mx3 MailScanner[26761]: Non-delivery of spam: message
1Xf3Jo-0006z5-KT from [hidden email] to [hidden email] with subject  test
0954
Oct 17 09:55:31 mx3 MailScanner[26761]: Spam Actions: message
1Xf3Jo-0006z5-KT actions are store

_______________________________________________
http://pledgie.com/campaigns/12056



If you reply to this email, your message will be added to the discussion below:
http://baruwa-users-list.963389.n3.nabble.com/Issues-with-low-spam-delivery-tp4027481p4027484.html
To unsubscribe from Issues with low spam delivery, click here.
NAML
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
Have compared the output of a working server to this broken server and in debug mode this appears on the working server but NOT in the broken server maillog



=====================================
Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset messagesize for keyword maxmessagesize
Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default 0) from database for keyword maxmessagesize
Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset spamscore for keyword reqspamassassinscore
Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (To: xxxxxxx@xxxxxxx.co.uk   4) from database for keyword reqspamassassinscore
Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (To: *@xxxxxxxxxxxxx.com   4) from database for keyword reqspamassassinscore
Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default 5) from database for keyword reqspamassassinscore
Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset sigimgs for keyword attachimageinternalname
Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default no) from database for keyword attachimageinternalname
Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset sigimgfiles for keyword attachimagename
Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default no) from database for keyword attachimagename
Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset spamactions for keyword spamactions
Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default store) from database for keyword spamactions
Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset highspamactions for keyword highscorespamactions
Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default store) from database for keyword highscorespamactions
Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset contentchecks for keyword dangerscan
Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset virusscan for keyword virusscan
Oct 22 10:50:22 mx2 MailScanner[27847]: Syntax error(s) in configuration file:
Oct 22 10:50:22 mx2 MailScanner[27847]: Unrecognised keyword "infoplease" at line 0
Oct 22 10:50:22 mx2 MailScanner[27847]: Warning: syntax errors in /etc/MailScanner/MailScanner.conf.
Oct 22 10:50:22 mx2 MailScanner[27847]: Read 875 hostnames from the phishing whitelist
Oct 22 10:50:22 mx2 MailScanner[27847]: Read 4260 hostnames from the phishing blacklists
Oct 22 10:50:22 mx2 MailScanner[27847]: Config: calling custom init function BaruwaLog
===========================================


Thus I can assume on the broken server a selection of the rules are not being loaded.

Any pointers where to look next?
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

admin-at-extremeshok-dot-com
Did u setup both servers with the same script ? Or by hand ?

The baruwa installer script doesn't have idempotency  ie. It can fail on something but still pass and it can destroy its install if it's re-run.

Might be quicker to just redo the faulty server, either a fresh install or clone the working install if it's a virtual machine

Sent from my iPhone

> On 22 Oct 2014, at 12:11 PM, ManicD <[hidden email]> wrote:
>
> Have compared the output of a working server to this broken server and in
> debug mode this appears on the working server but NOT in the broken server
> maillog
>
>
>
> =====================================
> Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset messagesize for
> keyword maxmessagesize
> Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default 0)
> from database for keyword maxmessagesize
> Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset spamscore for
> keyword reqspamassassinscore
> Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (To:
> [hidden email]   4) from database for keyword reqspamassassinscore
> Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (To: *@xxxxxxxxxxxxx.com  
> 4) from database for keyword reqspamassassinscore
> Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default 5)
> from database for keyword reqspamassassinscore
> Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset sigimgs for keyword
> attachimageinternalname
> Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default no)
> from database for keyword attachimageinternalname
> Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset sigimgfiles for
> keyword attachimagename
> Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default no)
> from database for keyword attachimagename
> Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset spamactions for
> keyword spamactions
> Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default store)
> from database for keyword spamactions
> Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset highspamactions for
> keyword highscorespamactions
> Oct 22 10:50:22 mx2 MailScanner[27847]: Read rule  (FromOrTo: default store)
> from database for keyword highscorespamactions
> Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset contentchecks for
> keyword dangerscan
> Oct 22 10:50:22 mx2 MailScanner[27847]: Reading ruleset virusscan for
> keyword virusscan
> Oct 22 10:50:22 mx2 MailScanner[27847]: Syntax error(s) in configuration
> file:
> Oct 22 10:50:22 mx2 MailScanner[27847]: Unrecognised keyword "infoplease" at
> line 0
> Oct 22 10:50:22 mx2 MailScanner[27847]: Warning: syntax errors in
> /etc/MailScanner/MailScanner.conf.
> Oct 22 10:50:22 mx2 MailScanner[27847]: Read 875 hostnames from the phishing
> whitelist
> Oct 22 10:50:22 mx2 MailScanner[27847]: Read 4260 hostnames from the
> phishing blacklists
> Oct 22 10:50:22 mx2 MailScanner[27847]: Config: calling custom init function
> BaruwaLog
> ===========================================
>
>
> Thus I can assume on the broken server a selection of the rules are not
> being loaded.
>
> Any pointers where to look next?
>
>
>
> --
> View this message in context: http://baruwa-users-list.963389.n3.nabble.com/Issues-with-low-spam-delivery-tp4027481p4027489.html
> Sent from the Baruwa users list mailing list archive at Nabble.com.
>
> _______________________________________________
> http://pledgie.com/campaigns/12056

_______________________________________________
http://pledgie.com/campaigns/12056
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
This post was updated on .
In reply to this post by ManicD
OK, Re-installed the server adn still seeing issues

from what i'm seeing the spamactions and the highspamactions rules are still not loading.

I have checked the postgresql through navicat and seen the views that are setup to list the rules in the database are not correctly outputting the list of rules, in fact only the default rules are listed.

I dont actually understand the SQL statement that creates the view.
Its this one
==========
baruwa/config/sql/integration.sql
==========
SELECT row_number, oldtable.*, character(50) 'spamactions' AS name FROM
(SELECT ARRAY_TO_STRING(ARRAY['To: ', name, ' ',
CASE WHEN spam_actions=1 THEN 'deliver'
WHEN spam_actions=3 THEN 'delete' END], ' ') ruleset from maildomains WHERE status='t' AND spam_actions != 2
UNION ALL
SELECT ARRAY_TO_STRING(ARRAY['FromOrTo:', 'default', 'store'], ' ')) AS oldtable
CROSS JOIN
(SELECT ARRAY(SELECT ARRAY_TO_STRING(ARRAY['To:', name, ' ',
CASE WHEN spam_actions=1 THEN 'deliver'
WHEN spam_actions=3 THEN 'delete' END], ' ') ruleset from maildomains WHERE status='t' AND spam_actions != 2
UNION ALL
SELECT ARRAY_TO_STRING(ARRAY['FromOrTo:', 'default', 'store'], ' ')) AS id) AS oldids
CROSS JOIN
generate_series(1, (SELECT COUNT(*) FROM
(SELECT id FROM maildomains WHERE status='t' AND spam_actions != 2 UNION ALL SELECT 1) AS td)) AS row_number
WHERE oldids.id[row_number] = oldtable.ruleset ORDER BY row_number;
=========

and the output is a single row with the default rule in it.

The same occurs with the high spam actions.

Anyone with any ideas?



Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

jeremymcs
Did you add he node and then adjust the rules ?

--
Jeremy McSpadden
Flux Labs | http://www.fluxlabs.net | Endless Solutions
Office : <a href="tel:850-250-5590;501">850-250-5590x501 | Cell : <a href="tel:850-890-2543">850-890-2543 | Fax : <a href="tel:850-254-2955">850-254-2955

On Nov 7, 2014, at 8:41 AM, ManicD <[hidden email]> wrote:

OK, from what i'm seeing the spamactions and the highspamactions rules are
still not loading.

I have checked the postgresql through navicat and seen the views that are
setup to list the rules in the database are not correctly outputting the
list of rules, in fact only the default rules are listed.

I dont actually understand the SQL statement that creates the view.
Its this one
==========
baruwa/config/sql/integration.sql
==========
SELECT row_number, oldtable.*, character(50) 'spamactions' AS name FROM
(SELECT ARRAY_TO_STRING(ARRAY['To: ', name, ' ',
CASE WHEN spam_actions=1 THEN 'deliver'
WHEN spam_actions=3 THEN 'delete' END], ' ') ruleset from maildomains WHERE
status='t' AND spam_actions != 2
UNION ALL
SELECT ARRAY_TO_STRING(ARRAY['FromOrTo:', 'default', 'store'], ' ')) AS
oldtable
CROSS JOIN
(SELECT ARRAY(SELECT ARRAY_TO_STRING(ARRAY['To:', name, ' ',
CASE WHEN spam_actions=1 THEN 'deliver'
WHEN spam_actions=3 THEN 'delete' END], ' ') ruleset from maildomains WHERE
status='t' AND spam_actions != 2
UNION ALL
SELECT ARRAY_TO_STRING(ARRAY['FromOrTo:', 'default', 'store'], ' ')) AS id)
AS oldids
CROSS JOIN
generate_series(1, (SELECT COUNT(*) FROM
(SELECT id FROM maildomains WHERE status='t' AND spam_actions != 2 UNION ALL
SELECT 1) AS td)) AS row_number
WHERE oldids.id[row_number] = oldtable.ruleset ORDER BY row_number;
=========

and the output is a single row with the default rule in it.

The same occurs with the high spam actions.

Anyone with any ideas?







--
View this message in context: http://baruwa-users-list.963389.n3.nabble.com/Issues-with-low-spam-delivery-tp4027481p4027522.html
Sent from the Baruwa users list mailing list archive at Nabble.com.

_______________________________________________
http://pledgie.com/campaigns/12056

_______________________________________________
http://pledgie.com/campaigns/12056
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
I believe so.
Certainly the node is added now and if i add new domains and check the database nothing new is in the view

regards
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
Further, the actual tables in the database seem to be fine and have all the right info, but the view fails to load the rules........very odd!
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

Andrew Colin Kissa
Administrator
In reply to this post by ManicD

Is the action for the domain in question different from the default action ?

On 07 Nov 2014, at 4:39 PM, ManicD <[hidden email]> wrote:

> Anyone with any ideas?


_______________________________________________
http://pledgie.com/campaigns/12056

signature.asc (858 bytes) Download Attachment
--
Baruwa - www.baruwa.org
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
Yes, the default is store, and the domain is set to deliver for lowspamaction
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

Andrew Colin Kissa
Administrator

Do you have data when you run

SELECT * FROM spamactions;

On 07 Nov 2014, at 5:21 PM, ManicD <[hidden email]> wrote:

> Yes, the default is store, and the domain is set to deliver for lowspamaction


_______________________________________________
http://pledgie.com/campaigns/12056

signature.asc (858 bytes) Download Attachment
--
Baruwa - www.baruwa.org
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
I have removed the 'where' statment (WHERE oldids.id[row_number] = oldtable.ruleset) at the end of the spamactions view, this produces a list where items are duplicated (I was about to test if it actually worked)

row_number - ruleset - name
1 - To: domain1 deliver - spamactions
1 - To: domain2 deliver - spamactions
1 - FromOrTo: default store - spamactions
2 - To: domain1 deliver - spamactions
2 - To: domain2 deliver - spamactions
2 - FromOrTo: default store - spamactions
3 - To: domain1 deliver - spamactions

however before i modded spamactions and i got

row_number - ruleset - name
3 - FromOrTo: default store - spamactions

and thats it,

However I have two domains listed in maildomains and both with spamaction set as 1


Its very odd!!!

Regards

Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
Further

I created two new Views to see if i could figure this out

===
View: oldids2
===
SELECT
        ARRAY (
                SELECT
                        array_to_string(
                                ARRAY [ 'To:' :: CHARACTER VARYING,
                                maildomains. NAME,
                                ' ' :: CHARACTER VARYING,
                                (
                                        CASE
                                        WHEN (maildomains.spam_actions = 1) THEN
                                                'deliver' :: TEXT
                                        WHEN (maildomains.spam_actions = 3) THEN
                                                'delete' :: TEXT
                                        ELSE
                                                NULL :: TEXT
                                        END
                                ) :: CHARACTER VARYING ], ' ' :: TEXT
                        ) AS ruleset
                FROM
                        maildomains
                WHERE
                        (
                                (maildomains.status = TRUE)
                                AND (
                                        maildomains.spam_actions <> 2
                                )
                        )
                UNION ALL
                        SELECT
                                array_to_string(
                                        ARRAY [ 'FromOrTo:' :: TEXT,
                                        'default' :: TEXT,
                                        'store' :: TEXT ], ' ' :: TEXT
                                ) AS array_to_string
        ) AS ID;
===
Which outputs

id
{"To: domain1   deliver","To: domain2   deliver","FromOrTo: default store"}


=================
AND
=================

===
View: oldtable2
===

SELECT
        array_to_string(
                ARRAY [ 'To: ' :: CHARACTER VARYING,
                maildomains. NAME,
                ' ' :: CHARACTER VARYING,
                (
                        CASE
                        WHEN (maildomains.spam_actions = 1) THEN
                                'deliver' :: TEXT
                        WHEN (maildomains.spam_actions = 3) THEN
                                'delete' :: TEXT
                        ELSE
                                NULL :: TEXT
                        END
                ) :: CHARACTER VARYING ], ' ' :: TEXT
        ) AS ruleset
FROM
        maildomains
WHERE
        (
                (maildomains.status = TRUE)
                AND (
                        maildomains.spam_actions <> 2
                )
        )
UNION ALL
        SELECT
                array_to_string(
                        ARRAY [ 'FromOrTo:' :: TEXT,
                        'default' :: TEXT,
                        'store' :: TEXT ], ' ' :: TEXT
                ) AS ruleset;
===
Which Outputs

ruleset
To:  domain1   deliver
To:  domain2   deliver
FromOrTo: default store




Not sure if this helps..... basically i was trying to break down the spamactions veiw to take a look at how it worked

From what i could see these two were CROSS JOIN together and then that output CROSS JOIN with a generate_series section.

no clue if that helps....

Thanks for your help


Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
Anyone have any ideas about this?

It seems very wrong to me! and seems like its a fairly key fault.

Andrew, would you be able to check the enterprise edition and paste the SQL statement that creates the views there. I assume they are working correctly.

many many many thanks
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

Andrew Colin Kissa
Administrator
Hi

The only difference that i know of is the enterprise edition queries a view
which is a combination of the domains and domain alias objects, but i did
not really analyse it.

Please find attached the whole integration file from Enterprise.




You can do a pull request into github if you fix it.

On 13 Nov 2014, at 11:16 AM, ManicD <[hidden email]> wrote:

> Andrew, would you be able to check the enterprise edition and paste the SQL
> statement that creates the views there. I assume they are working correctly.


_______________________________________________
http://pledgie.com/campaigns/12056

integration.sql (25K) Download Attachment
signature.asc (858 bytes) Download Attachment
--
Baruwa - www.baruwa.org
Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
Interestingly the view now works.

I edited alldomains, to maildomains but it works fine

Need to look at if the system accepts it with the new *@ added in each rule

This shows the highlighted differences

https://www.diffchecker.com/o73f56tm

thanks!!!

Reply | Threaded
Open this post in threaded view
|

Re: Issues with low spam delivery

ManicD
In case anyone is interested or requires this the resolution is:
https://github.com/akissa/baruwa2/commit/d58506a20fc16df86e158052fc248655e3546c83?diff=split