From: Jeff <je...@lo...> - 2007-01-31 23:01:01
|
Mark Martinec wrote: > Jeff, > > >>>> Done, and this did produce more output. FuzzyOcr is being called by the >>>> vscan user, and produces exactly the same log output as other users, >>>> with no errors. >>>> Still no scores from it in the headers for the vscan user. >>>> Does that give a clue? >>>> > > >> 2.3b from ports. >> > > Well, I don't know. I've been using 2.3b in the past (now we are at 3.5.1) > and it's been behaving the same: either invoked from a command line as user > vscan, or from amavisd, adding its score contribution to the final SA score, > and adding its test names that were triggered to the %T macro > (if you have the following line (without an initial '#') > in $log_templ: [? %#T ||, Tests: \[[%T|,]\]]# ) > The list of tests is also in X-Spam-Status of a quarantined message. > > Btw, the beta versions of 3.5.0 had some issues with amavisd, > but that did not produce the effect you describe. > Perhaps you should carefully compare again both SA logs. > > Mark > > Everything is fine. This is an embarrassing case of RTFM. I'd installed Sare rules and FuzzyOcr around the same time. Not having seen many FuzzyOcr headers, I mistook the Sare Stock hits for Ocr. I do still have an issue here, which is that some Sare rules are not being used by the vscan user. I won't waste any else's time with it until I review the config and consult the docs more thoroughly. If I really can't fix it myself, I'll ask for help. You guys were very generous with your time. Thanks. |