Atomicorp

Posted: **Thu Jun 20, 2013 6:49 am**

I would like to see the scores that Spamassassin is putting on emails with teh SA-VERBOSE command. We use qmail-scanner with SA via that.

Do I do this in qmail-scanner.ini?

Code: Select all

# qmail-scanner settings
QMAILSCANNERHOME="/usr/share/qmail-scanner"
SPOOLDIR="/var/spool/qscan"
SPAMDIR="/var/spool/qscan/quarantine/spam"

QS_USER="qscand"                        # default is qscand
QS_GROUP="qscand"                       # default is qscand
NOTIFY="none"                           # [none|sender|recips|precips|admin|nmladm|nmlvadm|all] (defaults to "psender,nmlvadm")
ARCHIVE="no"                            # [yes|no|regex]
FIX_MIME="2"                            # [yes|no|num], try "1" if blocks occurring due to this setting
IGNORE_EOL_CHECK="no"                   # [yes|no]
ADD_DESC_HEADERS="no"                   # [yes|no|all], old-fashion X-Qmail-Scanner, "all" adds rcpt to headers
DEBUG="no"                              # [yes|no]
MINIDEBUG="1"                           # [yes|no|1|2]
SETTINGS_PER_DOMAIN="yes"               # [yes|no]

# ClamAV settings
CLAMD_USER="qscand"                     # default is clamav

# Spamassassin settings
SA_SETTINGS="-d -c -m5 -H"              # Default settings for spamd
SA_SQL="no"                             # [yes|no], runs spamassassin with the 'rcpt to' as option. Only use if mysql is enabled in SA
SA_DELTA="1"                            # [num]
SA_SUBJECT="****SPAM****"               # <"some text">
SA_QUARANTINE="0"                       # [num], required_hits + sa_quarantine  will go to SPAMDIR, 0 disables
SA_DELETE="1"                           # [num], required_hits + sa_delete will be deleted, 0 disables
SA_REJECT="no"                          # [yes|no], changes deletes to rejects
SA_ALT="no"                             # [yes|no], runs in *fast_spamassassin* mode and doesn't pass the '-u' optio
SA_DEBUG="no"                           # [yes|no], requires sa-alt: yes
SA_REPORT="no"                          # [yes|no], requires sa-alt: yes, sa-debug: yes
SA_FORWARD=""                           # <username@domain>, User to redirect quarantined spam mails, unmodified for sa-learn (not used)
SA_VERBOSE="no"                         # [yes|no], requires SA-FORWARD (not used)

I want to make SA_VERBOSE "yes".

But what does the "requires SA-FORWARD (not used)" mean? We have autolearn working - not sure where the proof of this is, but emails are marked accordingly.

And after I put it on, do I simply restart spamassassin?

Many thanks, as ever, in advance.

Posted: **Fri Jun 21, 2013 7:26 am**

anyone?

Posted: **Fri Jun 21, 2013 7:53 am**

If you change qmail-scanner.ini you need to run "qmail-scanner-reconfigure".

Posted: **Fri Jun 21, 2013 11:49 am**

Thanks you prupert
If I turn VERBOSE ON, do I have to put something in SA-FORWARD as it says:
requires SA-FORWARD (not used) nad that says:

Code: Select all

SA_FORWARD=""                           # <username@domain>, User to redirect quarantined spam mails, unmodified for sa-learn (not used)

Is it saying we should create a specific email account for that purpose - say quarantine-spam@domain1.com, then add:

Code: Select all

SA_FORWARD="quarantine-spam@domain1.com"

or can we just leave that blank because we DO use sa-learn? I guess it would be quite useful to be able to look at the quarantined emails in an email account somewhere. Just a bit worried about privacy in case a genuine email got put there.

Posted: **Fri Jun 21, 2013 1:12 pm**

What exactly are you trying to accomplish?

If you want to know which SpamAssassin tests were triggered by a specific message you can already see that in the maillog.

I don't think that you want to use SA_VERBOSE, which by the way, is something else than running SpamAssassin in verbose mode, and does require you to also set SA_FORWARD. Do note that running SpamAssassin in verbose mode (which is something else, to be clear!) is not even compatible with qmail-scanner, as noted in their manual.

Not related to this, but just so you know: SpamAssassin auto learning is on by default.

Posted: **Fri Jun 21, 2013 3:28 pm**

To achieve what you want, you need to use the following settings:

Code: Select all

SA_ALT="yes" # [yes|no], runs in *fast_spamassassin* mode and doesn't pass the '-u' option
SA_DEBUG="yes" # [yes|no], requires sa-alt: yes
SA_REPORT="yes" # [yes|no], requires sa-alt: yes, sa-debug: yes

The key here is that you want SA_REPORT "on", and in order to do so you have to set debug and alt to yes as well..

But everybody says it will have a serious impact in performance. Also, if qmail-scanner isn't passing the -u option....I'm not sure how far the impact of that will go.

Note also from the docs:

Code: Select all

--sa-alt [yes|no]               (default: no)
                   Use the alternative subroutine for spamassassin, it runs in
                   *fast_spamassassin* mode and doesn't pass the '-u' option
                   to spamc. (1/0)

  --sa-debug [yes|no]             (default: no)
                   If sa-alt is enabled an you enable this option, you will
                   have a beautiful log with the tests and the scores of
                   spamassassin in the file qmail-queue.log (1/0)

  --sa-report [yes|no]            (default: no)
                   If sa-alt is enabled you can add the X-Spam-Report header
                   to the messages enabling this option.

So in fact everything you want will actually be going to qmail-queue.log and you won't necessarily need to look at the individual email headers - you should be able to identify the emails in question from the log in most cases as the from/to and subject is shown there.

Posted: **Sat Jun 22, 2013 12:36 pm**

Thank you prupert and faris
What I was trying to do is be able to see the scores allocated to the various rules that are triggered.

I know that they are listed on the SA website but when we change the score it would be good to see what scores the emails are getting. Especially when we detect a Spam that gets through the system.
I seem to have pretty well stopped it now though as there was one (Indian) IP range that was sending lots which got through Spamassassin and we simply blocked that range which has made a dramatic improvement.

Atomicorp

Enable Spamassassin verbose

Enable Spamassassin verbose

Re: Enable Spamassassin verbose

Re: Enable Spamassassin verbose

Re: Enable Spamassassin verbose

Re: Enable Spamassassin verbose

Re: Enable Spamassassin verbose

Re: Enable Spamassassin verbose