{Spam not delivered} and "lower scoring spam"

[strivoli]

Hi, first of all thanks for the great job you're doing. eFa is simply AWESOME.

Defaults consider 4 and above as "Spam", 7 and above as "High Spam".
What I found difficult to find out is "lower scoring spam". Which value is it? Below 6?

When "lower scoring spam" is triggered the recipients receive a mail with subject starting with "{Spam not delivered}".
What's the value of "lower scoring spam" and how can I change it?

Thanks.

[stusmith]

Hi, first of all thanks for the great job you're doing. eFa is simply AWESOME.

Defaults consider 4 and above as "Spam", 7 and above as "High Spam".
What I found difficult to find out is "lower scoring spam". Which value is it? Below 6?

When "lower scoring spam" is triggered the recipients receive a mail with subject starting with "{Spam not delivered}".
What's the value of "lower scoring spam" and how can I change it?

Thanks.

I believe that what you're looking for is found in /etc/MailScanner/MailScanner.conf

Code: Select all

2224 # This replaces the SpamAssassin configuration value 'required_hits'.
2225 # If a message achieves a SpamAssassin score higher than this value,
2226 # it is spam. See also the High SpamAssassin Score configuration option.
2227 # This can also be the filename of a ruleset, so the SpamAssassin
2228 # required_hits value can be set to different values for different messages.
2229 Required SpamAssassin Score = 4
2230
2231 # If a message achieves a SpamAssassin score higher than this value,
2232 # then the "High Scoring Spam Actions" are used. You may want to use
2233 # this to deliver moderate scores, while deleting very high scoring messsages.
2234 # This can also be the filename of a ruleset.
2235 High SpamAssassin Score = 7
2236

The default for Required SpamAssasin Score is 5, I think, and it's the floor for SPAM detection. The High SpamAssassin Score is the ceiling. Anything between those values is 'lower scoring SPAM', I believe.

[strivoli]

Thank you for your reply.
Yesterday I got 48 mail rated spam from 4 to 6.99 but I got only 39 notifications and the highest rating mail notified was rated 6.99. This tells me two things:
1. Any mail rated spam triggers the notification. Rated from 4 to 6.99.
2. Some notifications are not sent. Yesterday 8 notifications were non sent.

Question: how can I troubleshoot failed notifications?

[stusmith]

Thank you for your reply.
Yesterday I got 48 mail rated spam from 4 to 6.99 but I got only 39 notifications and the highest rating mail notified was rated 6.99. This tells me two things:
1. Any mail rated spam triggers the notification. Rated from 4 to 6.99.
2. Some notifications are not sent. Yesterday 8 notifications were non sent.

Question: how can I troubleshoot failed notifications?

I would start two places, which may not yield much other than confirming what you already know. I would

Code: Select all

sudo less /var/log/cron

and

Code: Select all

sudo grep -i 'Message Quarantine Report' /var/log/maillog
sudo grep -i 'not delivered\}' /var/log/maillog

You can add -A <#> and -B <#> to display <#> number of lines -Before and -After the line that matches.

After that I'd start looking into php error logs, but I haven't dug into that (yet) so I don't have a ready answer. I have a few users who have problems with quarantines and I've experienced some bugs with the phpsession cookies ( mainly because I'm constantly restarting services due to configuration or rule changes while I'm doing a soft-cutover ).

If I can find more information, I'll share it with you.

[strivoli]

I've set syslogd to redirect to a central syslogd SERVER where I can better search/filter/...
Will have a look in the next days in order to understand what happens with unsent notifications and will report back.