[Exim] Exiscan-ACL 4.31-16, wrong SpamAssassin report

Top Page
Delete this message
Reply to this message
Author: Andreas M. Kirchwitz
Date:  
To: exim-users
Subject: [Exim] Exiscan-ACL 4.31-16, wrong SpamAssassin report
    Hi Exiscan-ACL users!

I'm using Exim 4.31 + Exiscan-ACL 4.31-16 and SpamAssassin 2.63
on a Red Hat Linux 9 system. I'm just wondering why Exiscan puts
SpamAssassins long report into the message headers instead of
the terse report as configured in SpamAssassin's "local.conf":

    report_safe 0
    report_header 1
    use_terse_report 1
    defang_mime 0
    rewrite_subject 0


If I use "spamc" (with "spamd" running, of course ;-), headers like
the following ones are added to the message headers:

    X-Spam-Level: ********
    X-Spam-Status: Yes, hits=8.9 required=5.0 tests=BIZ_TLD,DATE_MISSING,
            FORGED_RCVD_NET_HELO,HTML_20_30,HTML_IMAGE_ONLY_06,HTML_MESSAGE,
        HTML_TAG_BALANCE_HTML,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,
        RCVD_NUMERIC_HELO autolearn=no version=2.63
    X-Spam-Report:
        *  1.0 DATE_MISSING Missing Date: header
        *  0.3 RCVD_NUMERIC_HELO Received: contains a numeric HELO
        [... etc ...]


Okay, that's what I want (terse report). And now the same with Exiscan.
Exiscan is configured in ~exim/configure to use "spamd" like this:

    spamd_address = 127.0.0.1 783


I've defined a DATA ACL like this to add a nice spam report
to the message headers:

    warn  message = X-Exiscan-SA-Score: $spam_bar ($spam_score)
          spam = nobody:true
    warn  message = X-Exiscan-SA-Report: $spam_report
          spam = nobody:true


Well, basically, it works. That's good. And the "X-Exiscan-SA-Score"
header looks like expected (similar to "spamc" output):

    X-Exiscan-SA-Score: ++++++++ (8.9)


But the report is the long one (and not the terse one):

    X-Exiscan-SA-Report: Spam detection software, running on the system "nautilus.zi
    kzak.de", has
    identified this incoming email as possible spam.  The original message
    has been attached to this so you can view it (if it isn't spam) or block
    similar future email.  If you have any questions, see
    the administrator of that system for details.
    Content preview:  </head>
    [... content preview follows ...]
    Content analysis details:   (8.9 points, 5.0 required)
    pts rule name              description
    ---- ---------------------- --------------------------------------------------
    1.0 DATE_MISSING           Missing Date: header
    0.3 RCVD_NUMERIC_HELO      Received: contains a numeric HELO
    [... etc ...]



Yes, I already searched the exim-users mailing list and found out
about SA options like "clear_report_template". I shouldn't get the
regular (long) report at all, but the terse (compact) spam report.
"spamc" does it as configured, but Exiscan does not.

How comes the difference between Exiscan and "spamc"? If SpamAssassin
is configured to give terse reports by default (because "local.conf"
is system-wide; and no user configs exist), how is it possible for
Exiscan to get the regular (long) report?

However, except for this issue, I'm very happy that it was really
easy to get Exiscan-ACL working with SpamAssassin and ClamAV (still
with "demime"; does it work with MIME ACL already?). Good documentation,
and a lot of useful examples on the exim-users list.

    Still wondering about the unexpected spam report ... Andreas