lots of negative spam scores

Jos_Louis · 06-30-2009, 12:00 PM

Upgraded to 6.2 and noticing a lot of spam getting through with a negative spam score.

I understand some of them as i've added the domain to the safelist but others dont make sense. I've turned on smtp tarpitting to try and slow down the messages to give the spam blocker time to learn, but its not helping.

couple of examples

Subject: We Have Great Discounts On Software.
Sender: damperssz61@schneider-beleuchtung.de
Spam score: -2.6

Subject: Learn the secrets of picking up women
Sender: vtpcplavhcc@bminc.com
Spam Score: -0.59

If they were not negative numbers i wouldnt be so concerned. but they are so i am

dmorris · 06-30-2009, 12:36 PM

do you have emails being relayed by another IP or backup MX that might mess up the AWL?

turn tarpitting off. that has nothing to do with spamassassin or learning.

Jos_Louis · 06-30-2009, 12:50 PM

there is a "main server" that is forwarding messages for select few people but what could be messing with the awl?

ok, tarpitting is off now

Jos_Louis · 07-02-2009, 08:24 AM

dmorris · 07-02-2009, 08:32 AM

Quote:

Originally Posted by Jos_Louis

there is a "main server" that is forwarding messages for select few people but what could be messing with the awl?

ok, tarpitting is off now

This makes spam filtering extremely hard and its gonna mess up.
I would put untangle in front of that server.

Jos_Louis · 07-02-2009, 12:27 PM

not physically possible. its a remote qmail server that i have forwarded about 10 admin staff emails to an internal server here (sbs2003 exchange).

dmorris · 07-02-2009, 12:36 PM

in that case I would just comment out the AWL line in the /etc/spamassassin/v310.pre file
like:
#loadplugin Mail::SpamAssassin::Plugin::AWL

and then
/etc/init.d/spamassassin restart

then hope for the best

smartswitch · 07-04-2009, 06:52 PM

About two weeks ago my wife started complaining about spam. When looking at the logs, I too am seeing negative numbers:

2009-07-04 8:00:02 pm pass message 10.10.10.10:45995 Spam Test 2 jrqqq.zzz.net jrqqq.zzz.org -4 xxx.xxx.xxx.xxx:110

2009-07-04 7:52:03 pm pass message 10.10.10.10:45885 SPAM jrqqq.zzz.net jrqqq.zzz.org -3.7 xxx.xxx.xxx.xxx:110

I also turned off AWL between messages which resuled in a -.3 difference
(-3.7 to -4) as you can see. I tried restarting assassin and saw this in the syslog:

Jul 4 20:14:23 untangle spamd[4720]: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC (@INC contains: /var/lib/spamass
assin/compiled/5.010/3.002005 /var/lib/spamassassin/compiled/5.010/3.002005/auto lib /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.1
0.0 /usr/local/share/perl/5.10.0 /usr/lib/perl5 /usr/lib/perl/5.10 /usr/share/perl/5.10 /usr/local/lib/site_perl) at (eval 1055) line 1

Could this be the problem?

juank · 10-09-2009, 06:55 PM

Check this : http://forums.untangle.com/spam-bloc...html#post76335

06-30-2009, 12:00 PM	#1 (permalink)
Jos_Louis Untangler Join Date: Feb 2008 Posts: 45	lots of negative spam scores Upgraded to 6.2 and noticing a lot of spam getting through with a negative spam score. I understand some of them as i've added the domain to the safelist but others dont make sense. I've turned on smtp tarpitting to try and slow down the messages to give the spam blocker time to learn, but its not helping. couple of examples Subject: We Have Great Discounts On Software. Sender: damperssz61@schneider-beleuchtung.de Spam score: -2.6 Subject: Learn the secrets of picking up women Sender: vtpcplavhcc@bminc.com Spam Score: -0.59 If they were not negative numbers i wouldnt be so concerned. but they are so i am

07-02-2009, 08:24 AM	#4 (permalink)
Jos_Louis Untangler Join Date: Feb 2008 Posts: 45	bump

10-09-2009, 06:55 PM	#9 (permalink)
juank Join Date: Aug 2007 Location: Athens URLs submitted: 40 Posts: 1,438	Check this : http://forums.untangle.com/spam-bloc...html#post76335 __________________ -------------------------------- Juan Machado -------------------------------- PLEASE Help me voting on this Feature Request : Quota based web usage for users http://bugzilla.untangle.com/show_bug.cgi?id=3475 Last edited by juank; 10-10-2009 at 04:40 PM..

06-30-2009, 12:36 PM	#2 (permalink)
dmorris Untangle Junkie Join Date: Nov 2006 Location: San Mateo, CA URLs submitted: 10 Posts: 6,694	do you have emails being relayed by another IP or backup MX that might mess up the AWL? turn tarpitting off. that has nothing to do with spamassassin or learning.

06-30-2009, 12:50 PM	#3 (permalink)
Jos_Louis Untangler Join Date: Feb 2008 Posts: 45	there is a "main server" that is forwarding messages for select few people but what could be messing with the awl? ok, tarpitting is off now

07-02-2009, 12:27 PM	#6 (permalink)
Jos_Louis Untangler Join Date: Feb 2008 Posts: 45	not physically possible. its a remote qmail server that i have forwarded about 10 admin staff emails to an internal server here (sbs2003 exchange).

07-02-2009, 12:36 PM	#7 (permalink)
dmorris Untangle Junkie Join Date: Nov 2006 Location: San Mateo, CA URLs submitted: 10 Posts: 6,694	in that case I would just comment out the AWL line in the /etc/spamassassin/v310.pre file like: #loadplugin Mail::SpamAssassin::Plugin::AWL and then /etc/init.d/spamassassin restart then hope for the best

07-04-2009, 06:52 PM	#8 (permalink)
smartswitch Newbie Join Date: Jul 2009 Posts: 1	About two weeks ago my wife started complaining about spam. When looking at the logs, I too am seeing negative numbers: 2009-07-04 8:00:02 pm pass message 10.10.10.10:45995 Spam Test 2 jrqqq.zzz.net jrqqq.zzz.org -4 xxx.xxx.xxx.xxx:110 2009-07-04 7:52:03 pm pass message 10.10.10.10:45885 SPAM jrqqq.zzz.net jrqqq.zzz.org -3.7 xxx.xxx.xxx.xxx:110 I also turned off AWL between messages which resuled in a -.3 difference (-3.7 to -4) as you can see. I tried restarting assassin and saw this in the syslog: Jul 4 20:14:23 untangle spamd[4720]: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC (@INC contains: /var/lib/spamass assin/compiled/5.010/3.002005 /var/lib/spamassassin/compiled/5.010/3.002005/auto lib /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.1 0.0 /usr/local/share/perl/5.10.0 /usr/lib/perl5 /usr/lib/perl/5.10 /usr/share/perl/5.10 /usr/local/lib/site_perl) at (eval 1055) line 1 Could this be the problem?