I just downloaded the newest sa-exim, exim, and spamassassin, which at
the time of this message is:
sa-exim: 3.0
exim: 4.14
SA: 2.53
I find that messages below the threshhold are being moved to my spam
basin. I have used the filtering configuration from dman's site to
set the rules up:
http://dman.ddts.net/~dman/config_docs/exim4_spamassassin.html
Here is my filter:
# Exim filter
| if
| $h_X-Spam-Status: contains "Yes" or
| "${if def:h_X-Spam-Flag: {def}{undef}}" is "def"
| then
| logfile /var/log/exim/spam
| logwrite "\n$tod_log -- ID: $message_id\n\
| \tFrom: $sender_address ($h_From:)\n\
| \tTo: $h_To:\n\
| \tSubject: $h_Subject:\n\
| \tX-Spam-Status: $h_X-Spam-Status:\n\n"
| save /home/virtualmail/marinar.com/spam-hole/${local_part}/
| finish
| endif
This filter has worked fine before upgrading (from SA:2.43, Exim:4.12,
no SA-Exim). Here is what doing a filter test shows:
| Exim version 4.12 uid=0 gid=0 pid=7012 D=fddcaefd
| Berkeley DB: Sleepycat Software: Berkeley DB 2.7.7: (08/20/99)
| Support for:
| Authenticators: cram_md5 plaintext
| Routers: accept dnslookup ipliteral manualroute queryprogram redirect
| Transports: appendfile/maildir/mbx autoreply pipe smtp
[...]
| >>Headers received:
| Received: from volatile.marinar.com
| ([209.176.254.114] helo=volatile ident=nobody)
| by intrepid.marinar.com with esmtp (Exim 4.12)
| id 19CR0m-0008FB-00
| for hank@???; Sun, 04 May 2003 17:27:08 -0400
| Received: from root by volatile with local (Exim 4.14)
| id 19CITD-0003J9-0K
| for hank@???; Sun, 04 May 2003 07:19:55 -0500
| Received: from 66-23-203-113.clients.speedfactory.net
| ([66.23.203.113] helo=dsl.net ident=xSCORPIONy)
| by intrepid.marinar.com with smtp (Exim 4.12)
| id 19COWa-0001hf-00
| for domreg@???; Sun, 04 May 2003 14:47:48 -0400
| Message-ID: <KMFOEKIMPKAKIMKKGFFPEKFPHGAA.cevans@???>
| From: "Charles Evans" <cevans@???>
| To: domreg@???
| Date: Mon, 05 May 2003 09:49:18 +0000
| MIME-Version: 1.0
| X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
| X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
| X-SA-Exim-Mail-From: root@volatile
| Subject: you must be worried 893g0s25qxtp
| Content-Type: text/html;
| charset="iso-8859-1"
| Content-Transfer-Encoding: 8bit
| X-Spam-Status: No, hits=3.9 required=5.0
| tests=BAYES_90,DATE_IN_FUTURE_12_24,FORGED_YAHOO_RCVD,HTML_70_80,
| HTML_IMAGE_ONLY_02,MIME_HTML_ONLY,MSGID_GOOD_EXCHANGE,
| NORMAL_HTTP_TO_IP,REMOVE_PAGE
| version=2.53
| X-Spam-Level: ***
| X-Spam-Checker-Version: SpamAssassin 2.53 (1.174.2.15-2003-03-30-exp)
| X-SA-Exim-Version: 3.0 (built Sun May 4 04:39:33 EST 2003)
| X-SA-Exim-Scanned: Yes
|
| rewrite_one_header: type=F:
| From: "Charles Evans" <cevans@???>
| rewrite_one_header: type=T:
| To: domreg@???
| search_tidyup called
| >>Headers after local additions:
| P Received: from root by intrepid.marinar.com with local (Exim 4.12)
| id 19CRMN-0001p6-00; Sun, 04 May 2003 17:49:27 -0400
| P Received: from volatile.marinar.com
| ([209.176.254.114] helo=volatile ident=nobody)
| by intrepid.marinar.com with esmtp (Exim 4.12)
| id 19CR0m-0008FB-00
| for hank@???; Sun, 04 May 2003 17:27:08 -0400
| P Received: from root by volatile with local (Exim 4.14)
| id 19CITD-0003J9-0K
| for hank@???; Sun, 04 May 2003 07:19:55 -0500
| P Received: from 66-23-203-113.clients.speedfactory.net
| ([66.23.203.113] helo=dsl.net ident=xSCORPIONy)
| by intrepid.marinar.com with smtp (Exim 4.12)
| id 19COWa-0001hf-00
| for domreg@???; Sun, 04 May 2003 14:47:48 -0400
| I Message-ID: <KMFOEKIMPKAKIMKKGFFPEKFPHGAA.cevans@???>
| F From: "Charles Evans" <cevans@???>
| T To: domreg@???
| Date: Mon, 05 May 2003 09:49:18 +0000
| MIME-Version: 1.0
| X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
| X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
| X-SA-Exim-Mail-From: root@volatile
| Subject: you must be worried 893g0s25qxtp
| Content-Type: text/html;
| charset="iso-8859-1"
| Content-Transfer-Encoding: 8bit
| X-Spam-Status: No, hits=3.9 required=5.0
| tests=BAYES_90,DATE_IN_FUTURE_12_24,FORGED_YAHOO_RCVD,HTML_70_80,
| HTML_IMAGE_ONLY_02,MIME_HTML_ONLY,MSGID_GOOD_EXCHANGE,
| NORMAL_HTTP_TO_IP,REMOVE_PAGE
| version=2.53
Clearly, X-Spam-Status is "No". There is no occurance of "Yes" for
the rest of this header.
| X-Spam-Level: ***
| X-Spam-Checker-Version: SpamAssassin 2.53 (1.174.2.15-2003-03-30-exp)
| X-SA-Exim-Version: 3.0 (built Sun May 4 04:39:33 EST 2003)
| X-SA-Exim-Scanned: Yes
|
| Filter: start of processing
| Sub-condition is true: $h_X-Spam-Status: contains Yes
Yet the condition is met; I do not understand how it comes to this
conclusion.
| Condition is true: $h_X-Spam-Status: contains Yes or ${if def:h_X-Spam-Flag: {def}{undef}} is def
| Filter: end of processing
| search_tidyup called
| >>>>>>>>>>>>>>>> Exim pid=7012 terminating with rc=0 >>>>>>>>>>>>>>>>
| Sender taken from "From" line
| Sender = root@volatile
| Recipient = root@???
| Testing Exim filter file /etc/exim/forward/marinar.com
|
| Logfile /var/log/exim/spam
| Logwrite "\n2003-05-04 17:49:27 -- ID: 19CRMN-0001p6-00\n From: root@volatile ("Charles Evans" <cevans@???>)\n To: domreg@???\n Subject: you must be worried 893g0s25qxtp\n X-Spam-Status: No, hits=3.9 required=5.0\n tests=BAYES_90,DATE_IN_FUTURE_12_24,FORGED_YAHOO_RCVD,HTML_70_80,\n HTML_IMAGE_ONLY_02,MIME_HTML_ONLY,MSGID_GOOD_EXCHANGE,\n NORMAL_HTTP_TO_IP,REMOVE_PAGE\n version=2.53\n\n"
| Save message to: /home/virtualmail/marinar.com/spam-hole/root/
| Finish
| Filtering set up at least one significant delivery or other action.
| No other deliveries will occur.
thanks for any suggestions,
hank
