At 21:31 17-07-2007, Debbie D wrote:
>But I am still getting way to many spams.. more than I did before
>the update -- cialis, viagra, all kinds of meds, all scoring between
>0.6 and 3.5


Post a link to some of these emails including full headers. That
should show the rules they hit.

>How can these mails score that low?


It depends on the tests performed and the rules hit.

>I used to be able to see the rules it hit on, but can no longer see
>this.. Also I see


You should also see he rules hit in your mail log.

>that since the upgrade local delivered mails are not being scanned
>at all.. not that those really matter IMHO.. they come from my
>forums or forms.. The SA version header is also gone from the headers..


SpamAssassin only assigns a score based on tests performed. It's
Exim that add these headers and accepts or rejects the message. From
your statistics it seems like emails are being scanned but if you
don't see the SA header, then something may be wrong.

>Other settings
>
>Reject mail at SMTP time if the spam score from spamassassin is
>greater than 10.0. [Ticked ON]
>Reject messages with potentially dangerous attachments. [Ticked ON]
>Rewrite messages SpamAssassin marks as spam with ***SPAM*** at the
>beginning of the subject line. [Ticked ON]
>
>OH WAIT.. Turn on SpamAssassin for all accounts (Global ON). is NOT
>checked... and neither is use old transport system.. am I just being
>dumb blond here??
>But if the global is not ON.. how is SA running? OK so I am really
>confused now


Are you sure SA is being called by Exim?

>I did turn SA ON globally and am tailing the mail logs right now..
>what I saw when SA restarted:
>Jul 17 22:30:18 server spamd[7755]: rules: meta test FM_DDDD_TIMES_2
>has dependency 'FH_HOST_EQ_D_D_D_D' with a zero score
>Jul 17 22:30:18 server spamd[7755]: rules: meta test FM_SEX_HOSTDDDD
>has dependency 'FH_HOST_EQ_D_D_D_D' with a zero score
>Jul 17 22:30:18 server spamd[7755]: rules: meta test HS_PHARMA_1 has
>dependency 'HS_SUBJ_ONLINE_PHARMACEUTICAL' with a zero score


You can ignore these three warnings.

Regards,
-sm