Re: crazy question qmail-scanner x SA scores
Rejaine Monteiro <[email protected]> Tue, 14 Mar 2017 19:23:18 -0300
| Newsgroups | gmane.mail.qmail.scanner |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============7708485900122288136==
Content-Type: multipart/alternative;
boundary="------------BD5693010B3B84BF2FBD9E1B"
This is a multi-part message in MIME format.
--------------BD5693010B3B84BF2FBD9E1B
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
The problem was the sa_quarantine_over parameter .. I think I was
interpreting it incorrectly .. as in my case I want for everything that
spam classifies above 5 in quarantine, then the value should be 0.1 and
not 5, as was before.
because this line:
if ($sa_quarantine_over > 0 && ($sa_score - $sa_required_hits) >=
$sa_quarantine_over) {
&debug("SA: seriously spammy - quarantine and don't deliver");
thanks!!
Em 14-03-2017 18:32, Rejaine Monteiro escreveu:
>
>
> qmail-scanner seems crazy here...
>
>
> Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner:
> Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914
> [email protected] [email protected]
> Instantly_erect,_instant_respect
> <qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG
> ....
>
>
> Why "Clear" if SA score is 7.7 ?? Why not going to quaratine ( my
> $sa_quarantine_over='5'; )
>
>
> qmail-queue.log is:
>
>
> Tue, 14 Mar 2017 17:40:00 BRT:3511: SA: yup, this smells like SPAM
> (score=7.7 required=5.0)
> Tue, 14 Mar 2017 17:40:00 BRT:3511: spamassassin: finished scan of dir
> "/var/spool/qscan/tmp/server14895239985893511" in 1.698798 secs
> Tue, 14 Mar 2017 17:40:00 BRT:3511: scanloop: finished scan of
> "/var/spool/qscan/tmp/server14895239985893511"...
> Tue, 14 Mar 2017 17:40:00 BRT:3511: ini_sc: scanning message took
> 1.735613 seconds
> Tue, 14 Mar 2017 17:40:00 BRT:3511: q_r: fork off child into
> /var/qmail/bin/qmail-queue...
> Tue, 14 Mar 2017 17:40:00 BRT:3525: q_r: xstatus=0
> Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner:
> Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914
> [email protected] [email protected]
> Instantly_erect,_instant_respect
> <qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG
> 1489523999.3513-0.server:3508 1489523999.3513-1.server:5515
> Tue, 14 Mar 2017 17:40:00 BRT:3511: cleanup: /usr/bin/rm -rf
> /var/spool/qscan/tmp/server14895239985893511/
> /var/spool/qscan/working/new/server14895239985893511
> Tue, 14 Mar 2017 17:40:00 BRT:3511: all finished. Total of 1.783561 secs
>
> I have several cases of messages with score by SA above 5 that should
> be quarantined, but that are being delivered normally ..
>
> I'm going crazy here. Any idea?
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
>
> _______________________________________________
> Qmail-scanner-general mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
--
Rejaine da Silveira Monteiro
Suporte-TI
Tel: (31) 2102-8854
Jamef Encomendas Urgentes - Matriz - Belo Horizonte/MG
www.jamef.com.br
--------------BD5693010B3B84BF2FBD9E1B
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
The problem was the sa_quarantine_over parameter .. I think I was
interpreting it incorrectly .. as in my case I want for everything
that spam classifies above 5 in quarantine, then the value should be
0.1 and not 5, as was before.
<br>
because this line:
<br>
<br>
if ($sa_quarantine_over > 0 && ($sa_score -
$sa_required_hits) >= $sa_quarantine_over) {
<br>
&debug("SA: seriously spammy - quarantine and don't
deliver");
<br>
<br>
thanks!!<br>
<br>
<div class="moz-cite-prefix">Em 14-03-2017 18:32, Rejaine Monteiro
escreveu:<br>
</div>
<blockquote
cite="mid:[email protected]"
type="cite">
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<br>
<br>
qmail-scanner seems crazy here... <br>
<br>
<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner:
Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914 <a
moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:[email protected]">[email protected]</a>
<a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:[email protected]">[email protected]</a>
Instantly_erect,_instant_respect
<qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG
.... <br>
<br>
<br>
Why "Clear" if SA score is 7.7 ?? Why not going to quaratine ( my
$sa_quarantine_over='5'; )<br>
<br>
<br>
qmail-queue.log is: <br>
<br>
<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: SA: yup, this smells like SPAM
(score=7.7 required=5.0)<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: spamassassin: finished scan of
dir "/var/spool/qscan/tmp/server14895239985893511" in 1.698798
secs<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: scanloop: finished scan of
"/var/spool/qscan/tmp/server14895239985893511"...<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: ini_sc: scanning message took
1.735613 seconds<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: q_r: fork off child into
/var/qmail/bin/qmail-queue...<br>
Tue, 14 Mar 2017 17:40:00 BRT:3525: q_r: xstatus=0<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner:
Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914 <a
moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:[email protected]">[email protected]</a>
<a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:[email protected]">[email protected]</a>
Instantly_erect,_instant_respect
<qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG
1489523999.3513-0.server:3508 1489523999.3513-1.server:5515<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: cleanup: /usr/bin/rm -rf
/var/spool/qscan/tmp/server14895239985893511/
/var/spool/qscan/working/new/server14895239985893511<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: all finished. Total of
1.783561 secs<br>
<br>
I have several cases of messages with score by SA above 5 that
should be quarantined, but that are being delivered normally .. <br>
<br>
I'm going crazy here. Any idea?<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! <a class="moz-txt-link-freetext" href="http://sdm.link/slashdot">http://sdm.link/slashdot</a></pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Qmail-scanner-general mailing list
<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general">https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Rejaine da Silveira Monteiro
Suporte-TI
Tel: (31) 2102-8854
Jamef Encomendas Urgentes - Matriz - Belo Horizonte/MG
<a class="moz-txt-link-abbreviated" href="http://www.jamef.com.br">www.jamef.com.br</a></pre>
</body>
</html>
--------------BD5693010B3B84BF2FBD9E1B--
--===============7708485900122288136==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============7708485900122288136==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Qmail-scanner-general mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
--===============7708485900122288136==--