Different spam reports between Amavis and SpamAssassin

[Oren Solomianik]

Hello,

I am trying to debug why my amavis+postfix+spamassassin setup is recently
letting a lot of spam through.

It seems that when I run spamassassin manually, I receive different reports
than what amavis produces.

Here is a sample:

Amavis report:
X-Spam-Status: No, score=2.784 tagged_above=-999 required=2.9
        tests=[FUZZY_DR_OZ=1.499, HTML_FONT_LOW_CONTRAST=0.001,
        HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RDNS_NONE=1.274,
        SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01]
        autolearn=no




Spamassassin manual run report:
 pts rule name              description
---- ----------------------
--------------------------------------------------
 3.6 RCVD_IN_SBL_CSS        RBL: Received via a relay in Spamhaus SBL-CSS
                            [38.113.188.92 listed in zen.spamhaus.org]
-0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 0.0 HTML_IMAGE_ONLY_32     BODY: HTML: images with 2800-3200 bytes of words
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
                            background
 1.3 RDNS_NONE              Delivered to internal network by a host with no
rDNS
 2.4 FUZZY_DR_OZ            Obfuscated Doctor Oz
 0.0 T_REMOTE_IMAGE         Message contains an external image



The difference here seems to be that Amavis fails to find the relay in
SBL_CSS, and also that the "FUZZY_DR_OZ" rule produces lower score in
amavis.

The manual run was performed with the same amavis user, and nearly
instantly after the message was received by amavis (to counter the
assumption that some time passed and the SBL updated meanwhile).

Any ideas why amavis produces a lower score report, and what should be my
next move?
Thanks,
Oren
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.amavis.org/pipermail/amavis-users/attachments/20150216/510ede35/attachment.html>