Hi Marius,
On Wed, 28 Aug 2013, Cyborg wrote:
>>> This works for entire day and night, since one or more years, BUT
>>> randomly, a spam slips throu with the remark, it wasn't scanned at all.
>>> Which is true, as Spamassassins log shows not even the try to check it.
>>
>> It could be that a rule higher up in the ACL accepted the message before it
>> got to spamd. For example, do you have a rule to allow all authenticated
>> email? Or all email to a particular domain, or from a particular host?
>> Without seeing the entire ACL before the spamd rule, it's difficult to know
>> what to suggest.
>
> The answere is no.
>
> The skipped message has this header "X-Spam-Note: SpamAssassin uebersprungen
> : domain=${domain:$h_to:} e=${domain:$recipients} " which is the "your not
> authenticated and spamd did not give a result either OR Antispam is disabled
> for that domain" rule.
>
> As antispam is enabled and the sender is not authenticated, the spamscore
> was not defined => not scanned.
>
> But it should have been... i added debug output to find out the cause of it.
OK. But the conditions on the spam rule and the warn rule are not the
same, if I understood your message correctly. So it's conceivable for a
message to not match the spam rule, but match the warn rule.
You might want to add another warn rule that duplicates the conditions of
the spam rule exactly, and see whether it's triggered if this happens
again.
Is there anything in the Exim mainlog about a failure to contact spamd (or
the database, or anything else) at the time that the message skipped the
spam rule?
Cheers, Chris.
--
_____ __ _
\ __/ / ,__(_)_ | Chris Wilson <chris+sig@???> Cambs UK |
/ (_/ ,\/ _/ /_ \ | Security/C/C++/Java/Ruby/Perl/SQL Developer |
\__/_/_/_//_/___/ | We are GNU : free your mind & your software |
