Re: lug-bg: qmail+qmail-scanner problem

[Nick Kirchev <nick@xxxxxxxxxxx>]

това е част от моя лог :

============  

Wed, 15 Sep 2004 07:42:30 EEST:23506: +++ starting debugging for process 23506 
by uid=64011
Wed, 15 Sep 2004 07:42:30 EEST:23506: w_c: elapsed time from start 0.074439 
secs
Wed, 15 Sep 2004 07:42:30 EEST:23506: 
return-path='buqc108939xfqh@xxxxxxxxxxxxxxx', recips='user@xxxxxxxxxx'
Wed, 15 Sep 2004 07:42:30 EEST:23506: from='YourL.ife_Savers 
<YourLife_Savers@xxxxxxxxxxxxxxxx>', subj='S0NY member promo', via SMTP 
from66.54.93.243
Wed, 15 Sep 2004 07:42:30 EEST:23506: This is a PLAIN text message, skip virus 
scanners - but not SA
Wed, 15 Sep 2004 07:42:34 EEST:23499: SA: REPORT hits = -4.8/3.0
 -4.9 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
                             [score: 0.0000]
  0.1 AWL                    AWL: Auto-whitelist adjustment
Wed, 15 Sep 2004 07:42:34 EEST:23499: SA: required_hits 3.0 / sa_quarantine 
+1 / sa_delete +1
Wed, 15 Sep 2004 07:42:34 EEST:23499: SA: finished scan in 4.330661 secs - 
hits=-4.8
Wed, 15 Sep 2004 07:42:34 EEST:23499: p_s: finished scan in 0.016863 secs
Wed, 15 Sep 2004 07:42:34 EEST:23499: ini_sc: finished scan of 
"/var/spool/qmailscan/tmp/yanko109522335066023499"...
Wed, 15 Sep 2004 07:42:35 EEST:23499: ------ Process 23499 finished. Total of 
4.964673 secs
Wed, 15 Sep 2004 07:42:35 EEST:23506: SA: REPORT hits = 19.1/3.0
  2.7 X_PMFLAGS_PRESENT      Message has X-PMFLAGS header
  0.4 REMOVE_SUBJ            BODY: List removal information
  0.0 REMOVE_IN_QUOTES       BODY: List removal information
  5.4 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                             [score: 1.0000]
  5.0 RCVD_IN_BLCSMA         RBL: Received via a blocked site in bl.csma.biz
                             [66.54.93.243 listed in bl.csma.biz]
  1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
                 [Blocked - see 
<http://www.spamcop.net/bl.shtml?66.54.93.243>]
  1.1 RCVD_IN_SBL            RBL: Received via a relay in Spamhaus Block List
                       
[<http://www.spamhaus.org/SBL/sbl.lasso?query=SBL14642>]
                       
[<http://www.spamhaus.org/SBL/sbl.lasso?query=SBL14853>]
  3.0 RCVD_IN_SBLCSMA        RBL: Received via a blocked site in sbl.csma.biz
                             [66.54.93.243 listed in sbl.csma.biz]
Wed, 15 Sep 2004 07:42:35 EEST:23506: SA: yup, this smells like SPAM - 
hits=19.1 - rejecting message...
Wed, 15 Sep 2004 07:42:35 EEST:23506: SA: finished scan in 5.206498 secs - 
hits=19.1
Wed, 15 Sep 2004 07:42:35 EEST:23506: r_e: X-Qmail-Scanner-1.23st: We have 
reasons to believe this mail is SPAM
Wed, 15 Sep 2004 07:42:35 EEST:23506: ------ Process 23506 finished. Total of 
5.314908 secs

===============


On Friday 17 September 2004 18:14, Viktor Vasilev wrote:
> On Fri, Sep 17, 2004 at 05:32:53PM +0300, Danail Petrow wrote:
> > Nick Kirchev wrote:
> > >отвори си qmail-scanner-queue.pl
> > >
> > >и там може да видиш тези неща, и да си ги
> > >донастроиш , без да се налага да го
> > >генерираш всеки път.
> > >
> > >
> > ># st: Spam messages with a score higher than
> > ># (required_hits + sa_delete) should be deleted (or rejected).
> > ># Only relevant if SpamAssassin is used. Score of 0
> > ># means deliver all messages. Defaults to 0.
> > ># If sa-quarantine is set, sa-delete must be greater.
> > >my $sa_delete='1';
> > >
> > >
> > >
> > ># st: If you enable sa-reject and sa-delete is properly set,
> > ># messages with a score higher than (required_hits + sa_delete)
> > ># will be rejected before the smtp session is closed.
> > ># Otherwise they are just dropped silently. (1/0)
> > >my $sa_reject='1';
> >
> > и двете опций са така... НО НЕ трие
> > съобщението ...
> > пристига си нормално , с X-spam-Flag: Yes
> > X-sPam-level: *******
> > X-Spam-Status: Yes score=9.3 , required 3.0 ........
> >
> > drugi idei ?
>
> Какво пише за това съобщение във /var/spool/qmailscan/qmail-queue.log?
> При мен като изтрие някое, изглежда така:
>
>   Fri, 17 Sep 2004 17:03:19 CEST:40352: SA: yup, this smells like SPAM -
> deleting message... Fri, 17 Sep 2004 17:03:19 CEST:40352: SA: required_hits
> 5.0 / sa_quarantine +0 / sa_delete +2 Fri, 17 Sep 2004 17:03:19 CEST:40352:
> SA: finished scan in 5.174013 secs - hits=16.7
>
> При теб като проработи би трябвало да изглежда така:
>
>   SA: yup, this smells like SPAM - hits=9.3 - rejecting message...
>
> Сметките във qmail-scanner-queue.pl са доста прости...
>   if ( $sa_delete && (($sa_delete+$required_hits)<$sa_score)) {
>      if ( $sa_reject) {
>         &debug("SA: yup, this smells like SPAM - hits=$sa_score - rejecting
> message..."); ...
>      }
>      ...
>   }
>
>
> Поздрави,
> Виктор

-- 
 .''`.   Debian
: :'  :  GNU/Linux
`. `'`
  `-  
============================================================================
A mail-list of Linux Users Group - Bulgaria (bulgarian linuxers).
http://www.linux-bulgaria.org - Hosted by Internet Group Ltd. - Stara Zagora
To unsubscribe: http://www.linux-bulgaria.org/public/mail_list.html
============================================================================