Spam Assassin auto delete spam message

[tnttech]

One more for the Forum.
I have Spam Assassin set up to auto delete any messages that have a score of 7 or higher. That seems ok.
Here is a message that went through to one of our users. Spam score is 13.3 and it was not auto deleted? Any thoughts or suggestions on why that happened?

Here is the email:

From: Best meds for male vigor <XXXXXXXX>
Date: September 4, 2010 8:46:17 AM CDT
To: XXXXXXXX
Subject: For XXXXXXX, Only 20% of a price to pay. prominent no Phytogeographically
Return-Path: <XXXXXXXX>
Envelope-To: XXXXXXx
Delivery-Date: Sat, 04 Sep 2010 09:46:20 -0400
Received: from [218.209.29.111] by geonosis.nocdirect.com with esmtp (Exim 4.69) (envelope-from <XxXXXXXXXX>) id 1Ort4V-0000BQ-Mh for XxXXXXXX; Sat, 04 Sep 2010 09:46:20 -0400
Mime-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Spam-Subject: ***SPAM*** For XXXXXXX, Only 20% of a price to pay. prominent no Phytogeographically
X-Spam-Status: Yes, score=13.3
X-Spam-Score: 133
X-Spam-Bar: +++++++++++++
X-Spam-Report: Spam detection software, running on the system "geonosis.nocdirect.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: age which China Minneapolis school international Click here to view as a web page. September 4, 2010 Unsubscribe | Change e-mail address | Privacy Policy | About Us Copyright 2009 They temperature nearby Inc. All rights reserved. [...] Content analysis details: (13.3 points, 7.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.8 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist [URIs: qlkt39a.com] 1.9 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist [URIs: qlkt39a.com] 3.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: qlkt39a.com] 4.0 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist [URIs: qlkt39a.com] 2.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist [URIs: east.com] 0.0 MISSING_MID Missing Message-Id: header 0.0 HTML_MESSAGE BODY: HTML included in message 1.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts -0.7 BAYES_20 BODY: Bayesian spam probability is 5 to 20% [score: 0.1202]
X-Spam-Flag: YES

[Vin DSL]

Any thoughts or suggestions on why that happened?

Nope!

That message should have been toast!

[JPC-Jawad]

tnttech, please open a support ticket so that this can be checked.

[Ron]

Is there any way to change the threshhold on auto-delete? I thought I had mine set for 10 at some point, but it seems to be immutably set to 20 now.

[Ron]

Anybody know?

[Frank Broughton]

Sorry Ron, I use ASSP on my VPS - I like it WAY better than Spam Assassin.

[JPC-Jawad]

Is there any way to change the threshhold on auto-delete? I thought I had mine set for 10 at some point, but it seems to be immutably set to 20 now.

Are you using any custom theme and have you tried changing scores after reverting the theme back to default X3. I am unaware of any change though. I see auto-delete score set to 5 in my account and its not immutable. Please open a ticket with support ticket so that we can check this for you.

[Ron]

In my account 5 is the required score to be considered spam, auto delete is set much higher at 20.

On the SA screen, it says

spam auto delete is enabled, spam with a score of 20 or higher will be deleted.

You can automatically delete messages marked as spam. First set the number of hits required before mail is considered spam.

(note: 5 is the default setting. The higher the number, the more conservative the setting. )

Score: {drop down box with scores of 1-10}

So under x3, the required hits and auto delete are always set to the same number? That's ridiculous if that's the case. I have rules to move spam in my client that look for the SA flagging (between 5 and the auto delete number) so that I may inspect them to ensure there's no ham in there.

I know that my user_prefs file specifies
required_score 5

Is there a parameter I can specify for auto delete?

Currently, emails are marked as spam with 5 hits and auto deleted at 20. I want emails marked as spam when they get 5 hits and auto deleted at 10 hits. This can't be configured through CPanel anymore?

I'm running x3, never a custom skin of my own, although I was on the jaguarpc skin for years before x3.
I just tried to go to another skin but a WHM error is preventing that, I've opened a ticket about that. (# 13211142)

[Ron]

Sorry Ron, I use ASSP on my VPS - I like it WAY better than Spam Assassin.

LOL thanks, Frank! I use Mobil gas in my Chevy. :-D

[Ron]

So I changed over to the jaguarpc skin and no difference. Somehow my account is set to mark spam at 5 and auto delete at 20. These options are not currently available for cpanel.

If I change cpanel to 10 and it auto deletes everything 10 and up, and I have "required_score 5" in my user_prefs file, will I get what I want? marked as spam at 5 and auto deleted over 10.

[Frank Broughton]

Hi Ron, I use Sunoco in my Dodge & Mobil in my Chevy.... but I was hinting at using ASSP, so I really was trying to help. ASSP with some scripts that integrate it into cPanel/whm is so much easier to administer than the SA!

[Vin DSL]

I use (mostly) Valero in my CiViC, mixed with acetone - 1 oz per 10 gallons. Here's my online fuel log.

I'm pretty much given up an SA, at a (shared) server level.

SA used to work great, but JagPC clients didn't know how to configure it correctly. I tried to walk ppl through it, in the threads.

At some point, control (seemingly) was taken out of 'our' hands. Something changed at a core level, and since then, no matter what I do makes a difference.

Maybe we should put 'our' collective heads together, and figure out a workaround...

Having thought about this for a while, since I run Linux on my desktops, I *think* the answer is to install SA on my local machines, and run it as a plugin inside my mail clients.

Many ppl are still crippled with Winders. So, I don't know if running SA locally is an option for the unwashed masses.

[Ron]

Frank, I'm on a shared reseller machine, not a vps.

I think there may be some precedence issues with the was either CPanel or jag has this set up. User_prefs works (which might be why my required_score works to mark things as spam at that level even though CPanel thinks it is at 20) but can't perform certain tasks such as subject rewrites while it can insert user_prefs reports even though CPanel says it can't.

I'm getting hundreds of spams again which hasn't happened since I turned off the catchall account. Now they're all hitting my main and beloved 12 year old email addy, and it'll be quite a task and a sad day to go to a new addy. However I have a feeling turning off this addy will take a large load off of the server dealing with all the spams I see and those I don't that are being processed just to be deleted.

[Frank Broughton]

I see, I thought you had a vps. Yes, you do not have much control of SA then, let alone the ability to add ASSP.

[Ron]

OK someone did something on my server either Saturday or Sunday.
Yet again, the ordering of webmail clients has changed. For YEARS Squirrel Mail was in the center position (out of three).
Last week it changed to the left-hand position, starting yesterday it is in the right-hand position.

In addition, I have received only 20 spams so far today, compared with normally 10-15 per hour.

Interestingly, on one account where I don't have a user_prefs, looking into the headers of one of the spams I got scored 0.1 but there was a full blown spam report. That's unusual behavior.

I think a tech (or two) are playing with (or have fixed) SA on this server? C'mon, fess up!