<div dir="ltr">I forgot to mention that I have the following in my /etc/amavisd/amavisd.conf:<div><br></div><div>$sa_debug = 1;</div><div>$sa_local_tests_only = 0;<br><div><br></div><div><br><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Feb 18, 2015 at 1:58 PM, Bruce Pennypacker <span dir="ltr"><<a href="mailto:bruce.pennypacker@gmail.com" target="_blank">bruce.pennypacker@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">I have amavisd-new-2.9.1 running on a Centos 6.6 server with spamassassin-3.3.1 and postfix-2.6.6.  I'm regularly seeing spam come in that only hits a subset of SA rules when it's processed by amavisd, but more checks are matched when I run the command locally.  For example, one spam I received just a few minutes ago had the following header:<div><br>X-Spam-Status: Yes, score=6.491 tagged_above=-9999 required=6<br>tests=[BAYES_99=3, BAYES_999=3.5, T_RP_MATCHES_RCVD=-0.01,<br>URIBL_BLOCKED=0.001] autolearn=no<br><br>Yet when I took the full contents of that spam and piped it to "spamassassin -t" it generated the following results:<br><br>Content analysis details:   (14.6 points, 6.0 required)<br><br> pts rule name              description<br>---- ---------------------- --------------------------------------------------<br> 1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in <a href="http://bl.spamcop.net" target="_blank">bl.spamcop.net</a><br>                [Blocked - see <<a href="http://www.spamcop.net/bl.shtml?46.166.189.2" target="_blank">http://www.spamcop.net/bl.shtml?46.166.189.2</a>>]<br> 0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.<br>                            See<br>                            <a href="http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block" target="_blank">http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block</a><br>                             for more information.<br>                            [URIs: <a href="http://pennypacker.org" target="_blank">pennypacker.org</a>]<br> 3.0 BAYES_99               BODY: Bayes spam probability is 99 to 100%<br>                            [score: 1.0000]<br> 3.3 RCVD_IN_SBL_CSS        RBL: Received via a relay in Spamhaus SBL-CSS<br>                            [46.166.189.2 listed in <a href="http://zen.spamhaus.org" target="_blank">zen.spamhaus.org</a>]<br>-0.0 T_RP_MATCHES_RCVD      Envelope sender domain matches handover relay<br>                            domain<br> 3.5 BAYES_999              BODY: Bayes spam probability is 99.9 to 100%<br>                            [score: 1.0000]<br> 1.1 DCC_CHECK              Detected as bulk mail by DCC (<a href="http://dcc-servers.net" target="_blank">dcc-servers.net</a>)<br> 2.0 PYZOR_CHECK            Listed in Pyzor (<a href="http://pyzor.sf.net/" target="_blank">http://pyzor.sf.net/</a>)<br> 0.3 DIGEST_MULTIPLE        Message hits more than one network digest check</div><div><br></div><div>In the above test I was logged in as the amavis user, which is the same user that amavisd-new is running as.  It seems that amavisd-new isn't running any of the remote checks. Why am I getting different results when the e-mails are processed through amavisd-new, and what can I do to get it to run them?</div><div><br></div><div>Thanks,</div><div><br></div><div>-Bruce</div><div><br></div></div>
</blockquote></div><br></div></div></div></div>