Page 1 of 1
{Spam not delivered} and "lower scoring spam"
Posted: 02 Mar 2017 08:56
by strivoli
Hi, first of all thanks for the great job you're doing. eFa is simply AWESOME.
Defaults consider 4 and above as "Spam", 7 and above as "High Spam".
What I found difficult to find out is "lower scoring spam". Which value is it? Below 6?
When "lower scoring spam" is triggered the recipients receive a mail with subject starting with "{Spam not delivered}".
What's the value of "lower scoring spam" and how can I change it?
Thanks.
Re: {Spam not delivered} and "lower scoring spam"
Posted: 02 Mar 2017 12:32
by stusmith
strivoli wrote: 02 Mar 2017 08:56
Hi, first of all thanks for the great job you're doing. eFa is simply AWESOME.
Defaults consider 4 and above as "Spam", 7 and above as "High Spam".
What I found difficult to find out is "lower scoring spam". Which value is it? Below 6?
When "lower scoring spam" is triggered the recipients receive a mail with subject starting with "{Spam not delivered}".
What's the value of "lower scoring spam" and how can I change it?
Thanks.
I believe that what you're looking for is found in
/etc/MailScanner/MailScanner.conf
Code: Select all
2224 # This replaces the SpamAssassin configuration value 'required_hits'.
2225 # If a message achieves a SpamAssassin score higher than this value,
2226 # it is spam. See also the High SpamAssassin Score configuration option.
2227 # This can also be the filename of a ruleset, so the SpamAssassin
2228 # required_hits value can be set to different values for different messages.
2229 Required SpamAssassin Score = 4
2230
2231 # If a message achieves a SpamAssassin score higher than this value,
2232 # then the "High Scoring Spam Actions" are used. You may want to use
2233 # this to deliver moderate scores, while deleting very high scoring messsages.
2234 # This can also be the filename of a ruleset.
2235 High SpamAssassin Score = 7
2236
The default for
Required SpamAssasin Score is 5, I think, and it's the floor for SPAM detection. The
High SpamAssassin Score is the ceiling. Anything between those values is 'lower scoring SPAM', I believe.
Re: {Spam not delivered} and "lower scoring spam"
Posted: 02 Mar 2017 14:24
by strivoli
Thank you for your reply.
Yesterday I got 48 mail rated spam from 4 to 6.99 but I got only 39 notifications and the highest rating mail notified was rated 6.99. This tells me two things:
1. Any mail rated spam triggers the notification. Rated from 4 to 6.99.
2. Some notifications are not sent. Yesterday 8 notifications were non sent.
Question: how can I troubleshoot failed notifications?
Re: {Spam not delivered} and "lower scoring spam"
Posted: 02 Mar 2017 21:27
by stusmith
strivoli wrote: 02 Mar 2017 14:24
Thank you for your reply.
Yesterday I got 48 mail rated spam from 4 to 6.99 but I got only 39 notifications and the highest rating mail notified was rated 6.99. This tells me two things:
1. Any mail rated spam triggers the notification. Rated from 4 to 6.99.
2. Some notifications are not sent. Yesterday 8 notifications were non sent.
Question: how can I troubleshoot failed notifications?
I would start two places, which may not yield much other than confirming what you already know. I would
and
Code: Select all
sudo grep -i 'Message Quarantine Report' /var/log/maillog
sudo grep -i 'not delivered\}' /var/log/maillog
You can add
-A <#> and
-B <#> to display
<#> number of lines
-Before and
-After the line that matches.
After that I'd start looking into php error logs, but I haven't dug into that (yet) so I don't have a ready answer. I have a few users who have problems with quarantines and I've experienced some bugs with the phpsession cookies ( mainly because I'm constantly restarting services due to configuration or rule changes while I'm doing a soft-cutover ).
If I can find more information, I'll share it with you.
Re: {Spam not delivered} and "lower scoring spam"
Posted: 09 Mar 2017 06:28
by strivoli
I've set syslogd to redirect to a central syslogd SERVER where I can better search/filter/...
Will have a look in the next days in order to understand what happens with unsent notifications and will report back.