Subj : procmail problem
To   : All
From : Francois Thunus
Date : Sat Jun 18 2005 11:09 pm

Hello All.

Recently I have been bombed with spam to a point that SpamAssassin obviously no 
longer copes, even though I keep training it.
I have therefore resorted to other spam detectors, namely bogofilter and qsf.
Bogofilter is good, and catches some 80% of what SA lets thru. Qsf is even 
better, to the point that it has to be trained more with ham than with spam.

My solution was therefore easy: anything not already marked by SA and marked 
both by bogofilter and QSF goes to /dev/null, and anything marked by one of the 
three only goes to SPAM.

I then sort SPAM manually and mail goes to SPAM2 or HAM and is re-fed to the 
three spamfilters for training.

This solution has already reduced my spam level A LOT :-).

But I am now getting a lot of false positive, ie mail sent to SPAM for sorting, 
when NONE of the spam filter has marked it as spam. I have checked those 
legitimate messages: NOTHING in the header indicates spam whatsoever.

This means that for some reason procmail must be confused.

Hence my question: can anybody spot anything wrong with the following 
..procmailrc file:

>----- Begin -----

# contents of the file ".procmailrc"
#----------------------------------------------------------
# Checking for spam with Spamassassin

## Efface silencieusement tous les mails en langue asiatique
UNREADABLE='[^?"]*big5|iso-2022-jp|ISO-2022-KR|euc-kr|gb2312|ks_c_5601-1987'

        :0:
        * 1^0 $ ^Subject:.*=\?($UNREADABLE)
        * 1^0 $ ^Content-Type:.*charset="?($UNREADABLE)
        /export/home/ctserve/mail/SPAM2

        :0:
        * ^Content-Type:.*multipart
        * B ?? $ ^Content-Type:.*^?.*charset="?($UNREADABLE)
        /export/home/ctserve/mail/SPAM2

:0
{
        :0 fhw
        | /usr/local/bin/spamc
        :0 fw
        | /export/home/ctserve/share/qsf11/bin/qsf -r -A -s -v
        :0 fw
        |/export/home/ctserve/share/bogo/bin/bogofilter -p -e
}
# qsf
#  -s           add "[SPAM]" to Subject: of spam
#  -r           add an X-Spam-Rating header (0-100, 90+ = spam)
#  -A           add an X-Spam-Level header (0-20 *s)
#  -v           add informational headers to email
# bogo:
# -p passthru -e exit zero if non ham -u register accordingly
#  -p, --passthrough  - passthrough.
#  -e, --ham-true     - in -p mode, exit with code 0 when the mail is not
# spam.
#  -u, --update-as-scored    - score message as spam or non-spam and register 
#accordingly.

# Done Checking for spam

# If both filters agree it's spam, kill it.
   :0
   *  X-Bogosity: Spam, tests=bogofilter,
   * ^X-Spam: YES
   /dev/null

# Filtering Spam identified by Spamassassin
  :0
  * ^X-Spam-Status: Yes
   /export/home/ctserve/mail/SPAM

  :0
  * ^X-Spam-Flag: YES
  /export/home/ctserve/mail/SPAM

  :0
  * ^Subject:.*SPAM*            # spamassassin or bogo
  /export/home/ctserve/mail/SPAM

  :0
  * ^Subject:.[SPAM]            # qsf
  /export/home/ctserve/mail/SPAM

# recognized by qsf rules  ***************
 :0
 * ^X-Spam: YES
 * ^X-Spam-Rating: 100
 /export/home/ctserve/mail/SPAM

:0
* ^X-Spam-Level: ******************
# 18/20
/export/home/ctserve/mail/SPAM

# Bogo filter doesn't know...
 :0
 * ^Subject:.*?[Bogo:UNSURE]?*
 /export/home/ctserve/mail/SPAM


# Done Filtering Spam
#----------------------------------------------------------

>-----  End  -----

Thanks in advance...

Francois

--- FMailX 1.48b
 * Origin:  Xara Sto Pragma ! Cessange - Luxembourg -> (FidoNet 2:270/25.2)

.