[AMaViS-user] Spamassassin Scores

Jeff Grossman

unread,

Apr 15, 2009, 9:40:43 AM4/15/09

to

I have just started using Amavis and have a question regarding an
discrepancy between the Spamassassin header in a spam message and the
Spamassassin report included in the spam notification.

Here is the report in the spam notification:

Content analysis details: (22.0 points, 5.0 required)

pts rule name description
---- ----------------------
--------------------------------------------------
7.0 BAYES_99 BODY: Bayesian spam probability is 99 to
100%
[score: 0.9997]
7.5 AV_SS AV_SS
2.1 SUBJ_ALL_CAPS Subject is all capitals
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME
parts
0.0 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
0.8 MSOE_MID_WRONG_CASE MSOE_MID_WRONG_CASE
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
3.1 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS
Outlook

And, here is the report in the header of the quarantined message:

X-Spam-Status: Yes, score=21.973 tag=-9999 tag2=8 kill=10
tests=[AV:Sanesecurity.Junk.8084.UNOFFICIAL=0, AV_SS=7.5,
BAYES_99=7,
FORGED_MUA_OUTLOOK=3.116, FORGED_OUTLOOK_HTML=0.001,
FORGED_OUTLOOK_TAGS=0.001, HTML_MESSAGE=0.001,
MIME_HTML_ONLY=1.457,
MSOE_MID_WRONG_CASE=0.82, SUBJ_ALL_CAPS=2.077] autolearn=spam

How come the required value is only 5 in the spam notification while
in the config files and the header it shows as 8?

I was going to ask how come the spam score is different, but I just
figured out that is because of rounding.

Thanks,
Jeff

------------------------------------------------------------------------------
This SF.net email is sponsored by:
High Quality Requirements in a Collaborative Environment.
Download a free trial of Rational Requirements Composer Now!
http://p.sf.net/sfu/www-ibm-com
_______________________________________________
AMaViS-user mailing list
AMaVi...@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/

Daniel Luttermann

unread,

Apr 15, 2009, 11:17:08 AM4/15/09

to

Jeff Grossman wrote on 15.04.2009:

> I have just started using Amavis and have a question regarding an
> discrepancy between the Spamassassin header in a spam message and the
> Spamassassin report included in the spam notification.

> Here is the report in the spam notification:

> Content analysis details: (22.0 points, 5.0 required)

Looks like the default spamassassin settings from local.cf.

> And, here is the report in the header of the quarantined message:

> X-Spam-Status: Yes, score=21.973 tag=-9999 tag2=8 kill=10
> tests=[AV:Sanesecurity.Junk.8084.UNOFFICIAL=0, AV_SS=7.5,
> BAYES_99=7,
> FORGED_MUA_OUTLOOK=3.116, FORGED_OUTLOOK_HTML=0.001,
> FORGED_OUTLOOK_TAGS=0.001, HTML_MESSAGE=0.001,
> MIME_HTML_ONLY=1.457,
> MSOE_MID_WRONG_CASE=0.82, SUBJ_ALL_CAPS=2.077] autolearn=spam

> How come the required value is only 5 in the spam notification while
> in the config files and the header it shows as 8?

Spamassassin uses a default score of 5.0 (local.cf). When you run
spamassassin as user root or another user then the settings from
local.cf are used because you run spamassassin directly.

amavis runs as user "amavis" (or another dedicated user) and uses the
settings from amavisd.conf when it calls spamassassin.

The spam score itself are nearly the same (22.0 points) so it's OK.

--
Daniel Luttermann

Jeff Grossman

unread,

Apr 15, 2009, 12:40:19 PM4/15/09

to

Daniel Luttermann wrote:
>
> Jeff Grossman wrote on 15.04.2009:
>
>> I have just started using Amavis and have a question regarding an
>> discrepancy between the Spamassassin header in a spam message and the
>> Spamassassin report included in the spam notification.
>
>> Here is the report in the spam notification:
>
>> Content analysis details: (22.0 points, 5.0 required)
>
> Looks like the default spamassassin settings from local.cf.
>
>> And, here is the report in the header of the quarantined message:
>
>> X-Spam-Status: Yes, score=21.973 tag=-9999 tag2=8 kill=10
>> tests=[AV:Sanesecurity.Junk.8084.UNOFFICIAL=0, AV_SS=7.5,
>> BAYES_99=7,
>> FORGED_MUA_OUTLOOK=3.116, FORGED_OUTLOOK_HTML=0.001,
>> FORGED_OUTLOOK_TAGS=0.001, HTML_MESSAGE=0.001,
>> MIME_HTML_ONLY=1.457,
>> MSOE_MID_WRONG_CASE=0.82, SUBJ_ALL_CAPS=2.077] autolearn=spam
>
>> How come the required value is only 5 in the spam notification while
>> in the config files and the header it shows as 8?
>
> Spamassassin uses a default score of 5.0 (local.cf). When you run
> spamassassin as user root or another user then the settings from
> local.cf are used because you run spamassassin directly.
>
> amavis runs as user "amavis" (or another dedicated user) and uses the
> settings from amavisd.conf when it calls spamassassin.

But, the line above which says "5.0 required" is coming from the Amavis
spam notification e-mail. I am not running Spamassassin as root.
Spamassassin is only being run from Amavis, and Amavis is displaying too
different required values based on where I look. In the header of the
e-mail it is showing correctly, but in the body of the Amavis spam
notification e-mail it is displaying incorrectly.

>
> The spam score itself are nearly the same (22.0 points) so it's OK.
>
> See also:
> http://www.ijs.si/software/amavisd/#faq-spam

Thanks for your help.

Jeff

Mark Martinec

unread,

Apr 16, 2009, 1:47:59 PM4/16/09

to

Jeff,

> I have just started using Amavis and have a question regarding an
> discrepancy between the Spamassassin header in a spam message and the
> Spamassassin report included in the spam notification.
>
> Here is the report in the spam notification:
> Content analysis details: (22.0 points, 5.0 required)

> And, here is the report in the header of the quarantined message:

>
> X-Spam-Status: Yes, score=21.973 tag=-9999 tag2=8 kill=10
> tests=[AV:Sanesecurity.Junk.8084.UNOFFICIAL=0, AV_SS=7.5, BAYES_99=7,
> FORGED_MUA_OUTLOOK=3.116, FORGED_OUTLOOK_HTML=0.001,
> FORGED_OUTLOOK_TAGS=0.001, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457,
> MSOE_MID_WRONG_CASE=0.82, SUBJ_ALL_CAPS=2.077] autolearn=spam

> How come the required value is only 5 in the spam notification while
> in the config files and the header it shows as 8?

As Daniel Luttermann explained, the '5.0 required' in the notification
comes from 'required_hits' in local.cf, the whole text section is
produced by SpamAssassin and not edited by amavisd - just inserted as-is.

The tag2 and kill levels are what really controls the amavisd behaviour,
the 'required_hits' in local.cf is never used, only spam score value
is taken from SA.

The discrepancy is purely a cosmetic issue. The '5.0 required' in text
should be ignored, it has no effect. If it bothers you, the best
approach is to set 'required_hits' to the same value as tag2_level.

Mark

------------------------------------------------------------------------------
Stay on top of everything new and different, both inside and
around Java (TM) technology - register by April 22, and save
$200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco.
300 plus technical and hands-on sessions. Register today.
Use priority code J9JMT32. http://p.sf.net/sfu/p

Jeff Grossman

unread,

Apr 16, 2009, 2:00:24 PM4/16/09

to

Okay, that makes sense. Thank you for the answer.

Jeff