multiple check für one mail normal?

[AlexL1981]

Hello!

First - sorry for my bad english. I'm from Germany.

I propably have a problem with my SpamAssassin Installation on my root-server. It checks mails more than one time. A Subject of a Spam-Marked Mail looks after scanning like this:

****SPAM(9.1)**** ****SPAM(3.8)**** Cheapest OEM Software Store

Body:
Pkte Regelname              Beschreibung
---- ---------------------- --------------------------------------------------
 0.0 UNPARSEABLE_RELAY      Informational: message has unparseable relay lines
 0.3 HTML_60_70             BODY: Nachricht besteht zu 60-70% aus HTML
 0.0 HTML_MESSAGE           BODY: Nachricht enthält HTML
 0.2 MIME_QP_LONG_LINE      RAW: "quoted-printable"-kodierte Zeile länger als
                            76 Zeichen
 3.1 MSGID_DOLLARS          Muster in Kopfzeile "Message-ID" typisch für Spam
 2.4 RATWARE_MS_HASH        Bulk email fingerprint (msgid ms hash) found
 3.1 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name) found



When I open the attachment from the Spam-Mail I got the Subject

****SPAM(3.8)**** Cheapest OEM Software Store

Body:
Pkte Regelname              Beschreibung
---- ---------------------- --------------------------------------------------
 3.4 HELO_DYNAMIC_IPADDR    HELO-Rechnername verdächtig (IP-Adresse 1)
 0.3 HTML_60_70             BODY: Nachricht besteht zu 60-70% aus HTML
 0.0 HTML_MESSAGE           BODY: Nachricht enthält HTML
 0.2 MIME_QP_LONG_LINE      RAW: "quoted-printable"-kodierte Zeile länger als
                            76 Zeichen


What is configured wrong? Or is it quiet normal that this happen? Maybe it is not a bug - its a feature ;)

Thanks a lot for your replys.

Alex

[Jari Fredriksson]

>
> What is configured wrong? Or is it quiet normal that this
> happen? Maybe it is not a bug - its a feature ;)

Something certainly is configured wrong, but it's impossible to say without seeing your configuration.

How do you use SpamAssassin? What calls it and how?

What other software do you have there in processing email?

[Jari Fredriksson]

>
> What is configured wrong? Or is it quiet normal that this
> happen? Maybe it is not a bug - its a feature ;)

Something certainly is configured wrong, but it's impossible to say without seeing your configuration.

How do you use SpamAssassin? What calls it and how?

What other software do you have there in processing email?

[AlexL1981]

Hello Jari!

First here are my Config-Files:

[init.pre]

loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
loadplugin Mail::SpamAssassin::Plugin::Hashcash
loadplugin Mail::SpamAssassin::Plugin::SPF


[local.cf]

ok_locales          de
ok_languages         de
required_score           3.0
report_safe             1
use_bayes               1
bayes_auto_learn              1
rewrite_header Subject ****SPAM(_SCORE_)****
skip_rbl_checks         0
use_razor2              1
use_dcc                 1
use_pyzor               1


[v310.pre]
loadplugin Mail::SpamAssassin::Plugin::DCC
loadplugin Mail::SpamAssassin::Plugin::Pyzor
loadplugin Mail::SpamAssassin::Plugin::Razor2
loadplugin Mail::SpamAssassin::Plugin::SpamCop
loadplugin Mail::SpamAssassin::Plugin::AWL
loadplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold
loadplugin Mail::SpamAssassin::Plugin::TextCat
loadplugin Mail::SpamAssassin::Plugin::WhiteListSubject
loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
loadplugin Mail::SpamAssassin::Plugin::ReplaceTags

[v312.pre]
loadplugin Mail::SpamAssassin::Plugin::DKIM


The system runs with qmail, clamav and spamassassin (xinet.d)


I just recognized that when I write in my config files "ok_languages de" and some content analysis written in the body of the mail produced by Spamassissin are not translated into German the mail would give a reason for another run for the Scanner? Could this be?

Greetings

[Jari Fredriksson]

> Hello Jari!
>
> First here are my Config-Files:
>
>
> The system runs with qmail, clamav and spamassassin
> (xinet.d)
>
>
> I just recognized that when I write in my config files
> "ok_languages de" and some content analysis written in
> the body of the mail produced by Spamassissin are not
> translated into German the mail would give a reason for
> another run for the Scanner? Could this be?
>
> Greetings

Your SA-config propably is not the cause. I don't know about qmail, and how it calls SpamAssassin, but could it be that SpamAssassin is called in two separate places?

First in some QMail configuration, and then later in procmail or whatever delivers the mail to the user mailbox.

Something like that might look possible to me. SpamAssassin itself does not call itself no matter how you configure.

The problem propably lies in qmail and other mail delivery configuration files.

[AlexL1981]

I don't think, that 2 calls are the source of my problem. Some mails pass only one time SA, others 2-3 times...

Jari Fredriksson wrote:

> Hello Jari!
>
> First here are my Config-Files:
>
>
> The system runs with qmail, clamav and spamassassin
> (xinet.d)
>
>
> I just recognized that when I write in my config files
> "ok_languages de" and some content analysis written in
> the body of the mail produced by Spamassissin are not
> translated into German the mail would give a reason for
> another run for the Scanner? Could this be?
>
> Greetings

Your SA-config propably is not the cause. I don't know about qmail, and how it calls SpamAssassin, but could it be that SpamAssassin is called in two separate places?

First in some QMail configuration, and then later in procmail or whatever delivers the mail to the user mailbox.

Something like that might look possible to me. SpamAssassin itself does not call itself no matter how you configure.

The problem propably lies in qmail and other mail delivery configuration files.

[Karsten Bräckelmann-2]

On Mon, 2007-09-17 at 11:47 -0700, AlexL1981 wrote:
> I don't think, that 2 calls are the source of my problem. Some mails pass
> only one time SA, others 2-3 times...

SpamAssassin ain't either.

Whatever calls SA is the cause of your problem. SA does not call itself.
SA does not process your mail on its own. SA is being called by other
apps, which usually are part of your mail processing chain.

Processing a mail multiple times is not a SA issue. It is a problem in
your mail chain, MTAs and MDAs. You should carefully review the path
your mails take, where and what calls SA.

And yes, according to your initial description, "2 calls" indeed are the
source of your problem. If the number or calls actually depends on some
yet unknown pattern, that doesn't change anything in this regard. The
source of your problem still is, that SA is being called {1,2,3,many}
times...


Note: You should not change sensitive defaults like required_score
(which you apparently set to 3.0), unless you are perfectly aware what
you are doing.

  guenther  who wonders, if replies-to-list would reach posters via
            nabble at all

--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

[Matus UHLAR - fantomas]

On 17.09.07 07:21, AlexL1981 wrote:
> First - sorry for my bad english. I'm from Germany.
>
> I propably have a problem with my SpamAssassin Installation on my
> root-server. It checks mails more than one time. A Subject of a Spam-Marked
> Mail looks after scanning like this:
>
> ****SPAM(9.1)**** ****SPAM(3.8)**** Cheapest OEM Software Store

Seemt that spamassassin is called from two places. Probably once from MTA
or its plugins (milter?) and once from your .procmailrc or .mailfilter

> When I open the attachment from the Spam-Mail I got the Subject
>
> ****SPAM(3.8)**** Cheapest OEM Software Store

what do the X-Spam-Checker-Version headers say?
--
Matus UHLAR - fantomas, uhlar@... ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Quantum mechanics: The dreams stuff is made of.