Re: not scoring correctly

On Wed, 2007-07-18 at 10:12 -0500, Craig Carriere wrote:
  

I use 256K, but I have a small volume (about a thousand emails a day)
server load.  We are also experimenting with the SaneSecurity
definitions for clam which catch a lot of this rodent mail as well and
should lower the SA load.

Glad it helped.

    

I'm sure it did tremendously, thanks again. But WOW! Look at this one
where the logs indicate it was scored at 4.441 as I received the
message, but if I login as the vscan user, I get a score of 5.8...

Content analysis details:   (5.8 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.6 GMD_PDF_ENCRYPTED      BODY: Attached PDF is encrypted
 1.4 DCC_CHECK              Listed in DCC (
http://rhyolite.com/anti-spam/dcc/)
 1.3 MISSING_SUBJECT        Missing Subject: header
 1.5 EMPTY_MESSAGE          Message appears to have no textual parts and no
                            Subject: text
 1.0 TVD_PDF_FINGER01       Mail matches standard pdf spam fingerprint

$ exit
esmtp# grep Hpqf4RZBgPd0 /var/log/maillog
Jul 18 14:12:54 esmtp amavis[26504]: (26504-09) Passed CLEAN, [63.139.123.10] [166.149.97.103] 
<ntpd@usaor.net> -> 
<robert@webtent.com>, quarantine: clean-Hpqf4RZBgPd0.gz, Message-ID: 
<469E593B.8050405@usaor.net>, mail_id: Hpqf4RZBgPd0, Hits: 4.441, queued_as: 9663137B50F, 2405 ms

What other things can contribute to this type of scenario?

  

This archive was generated by hypermail 2.1.8 : Sun Oct 21 2007 - 17:28:32 EDT