Menu
▾
▴
RE: [Assp-user] ARG! Variances in Spam Scoring
|
From: Theo A. <tau...@lo...> - 2005-01-27 22:53:50
|
Sorry, I must have misunderstood. Anyway, the first two lines from your log are likely to be a single email. My log shows the same thing for each individual email. The third line is a mystery to me unless there was another "...Passing if safe..." line to go with it. I do notice that the phrase "Passing if safe" appears twice in the code, and I wonder if there might be a way for both logs to occur on a single email. If you are brave, you could add a 1 and 2 to the "Passing if safe" strings in the perl sript to determine if both are occuring. As far as the three messages are concerned, you need to make sure they arrived to assp as three separate SMTP transactions. Can you check the headers for all three messages? Look at the "Received:" lines and look for a "Message-Id:" line. If these are truly different emails, they should show different received from times as they passed through assp. They should also show unique message id's. Does this happen to ALL spam or just SOME spam? Theo -----Original Message----- From: ass...@li... [mailto:ass...@li...] On Behalf Of Dan Felix Sent: Thursday, January 27, 2005 1:58 PM To: ass...@li... Subject: Re: [Assp-user] ARG! Variances in Spam Scoring Hi Theo, I don't mean to digress too much here, but I understood Chris's posts to mean that he had two separate issues ... (1) messages that 'analyze' as spam, but make it through without being marked, and (2) replies from people who have already been mailed to (i.e. automatically whitelisted) getting marked as SPAM, with him verifying that the those senders had, in fact, made it onto the white list. As to the 2nd problem, it could be something funky going on with SPF ... don't really have enough info. But the first kind of sounds a bit like what I'm seeing. Here's more details on an example scenario that I've got: From maillog.txt: Jan-27-05 10:54:05 200.140.99.13 <ale...@br...> to: bo...@fe... Passing if safe because testmode, otherwise Bayesian Spam Jan-27-05 10:54:05 200.140.99.13 <ale...@br...> to: bo...@fe... Spam determined to be safe, passing on to recipient Jan-27-05 10:54:11 200.140.99.13 <mol...@br...> to: bo...@fe... Spam determined to be safe, passing on to recipient In my internal mail system, all three messages appear to have been received at 10:54:47 on 1/27/2005 and only the first message is marked [SPAM] on the subject line. If I copy and paste the mime.822 info from any one of the 3 messages, they 'analyze' as spam-prob =3D 1.00000, but only the first of the group of 3 messages got marked as [SPAM]. I've got a bunch of examples like this, if anyone wants to take a closer look at the actual messages. Best Regards, Dan On Thu, 27 Jan 2005 08:22:35 -0800, Theo Aukerman <tau...@lo...> wrote: > It would help if you provided log entries for the messages in question. >=20 > Please realize that Chris later admitted that the sender was=20 > whitelisted... >=20 > Theo >=20 > -----Original Message----- > From: ass...@li... > [mailto:ass...@li...] On Behalf Of Dan Felix > Sent: Wednesday, January 26, 2005 8:21 PM > To: ass...@li... >=20 > Subject: Re: [Assp-user] ARG! Variances in Spam Scoring >=20 > I might have a related symptom. I'm a relatively new ASSP user=20 > running ver 1.1.1 beta 11 in test mode. I get messages coming through > in groups of two or three where the first message gets marked as SPAM, > but the next one or two messages don't get marked. If I 'analyze' the > mails that didn't get marked, they score as SPAM. My mail system=20 > shows the messages as received at the same time, down to the second. >=20 > Any thoughts? >=20 > Thanks, > Dan >=20 > On Tue, 25 Jan 2005 10:29:11 -0600, Chris Norman=20 > <ch...@in...> wrote: > > Ok, maybe I've messed up my config somehow, but this is driving me > nuts. > > > > I get an email not marked as spam. However, when I score it, it=20 > > scores as 100% spam. > > > > The sender isn't whitelisted. > > > > Also, valid replys are automatically getting tagged as spam. My=20 > > users can all contribute to the whitelist, and I've verified that=20 > > the false spam replying user is whitelisted. > > > > It's like it's working in reverse or something. > > > > Any suggestions on what I should check? > > > > Thanks in advance for any help > > > > ------------------------------------------------------- > > This SF.Net email is sponsored by: IntelliVIEW -- Interactive=20 > > Reporting Tool for open source databases. Create drag-&-drop reports. > > Save time by over 75%! Publish reports on the web. Export to DOC,=20 > > XLS, > RTF, etc. > > Download a FREE copy at http://www.intelliview.com/go/osdn_nl > > _______________________________________________ > > Assp-user mailing list > > Ass...@li... > > https://lists.sourceforge.net/lists/listinfo/assp-user > > >=20 >=20 > ------------------------------------------------------- > This SF.Net email is sponsored by: IntelliVIEW -- Interactive=20 > Reporting Tool for open source databases. Create drag-&-drop reports.=20 > Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. > Download a FREE copy at http://www.intelliview.com/go/osdn_nl > _______________________________________________ > Assp-user mailing list > Ass...@li... > https://lists.sourceforge.net/lists/listinfo/assp-user >=20 >=20 > ------------------------------------------------------- > This SF.Net email is sponsored by: IntelliVIEW -- Interactive=20 > Reporting Tool for open source databases. Create drag-&-drop reports.=20 > Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. > Download a FREE copy at http://www.intelliview.com/go/osdn_nl > _______________________________________________ > Assp-user mailing list > Ass...@li... > https://lists.sourceforge.net/lists/listinfo/assp-user > ------------------------------------------------------- This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool for open source databases. Create drag-&-drop reports. Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. Download a FREE copy at http://www.intelliview.com/go/osdn_nl _______________________________________________ Assp-user mailing list Ass...@li... https://lists.sourceforge.net/lists/listinfo/assp-user |