SpamAssassin subject rewriting procedure

[sonicbum]

I've read the docs, FAQ, and searched through google and still don't quite understand how SA rewriting works with the Toaster.

I've removed the if() statement in /usr/local/etc/mail/mailfilter that deletes and reroutes spam.  My toaster-watcher.conf settings are:

install_spamassassin           = 1
install_spamassassin_flags     = -a -d -v -x -r /var/run/spamd.pid

And under scanner queue processing:

qmail_scanner_scanners         = clamscan,fast_spamassassin=SPAM-FB

I've verified SA works via checking the headers (that and Matt installed my server, so I know it's all good ).  And from my understanding the system pulls in new settings from the watcher every so often...

So since this didn't seem to change anything within 24 hours, I added these lines to the spamassassin local.cf just in case:

rewrite_subject 1
subject_tag ***SPAM***

Stll no change.  Any tips?  Thanks.

[donavan]

IIRC SA runs in Fast or Verbose mode. Verbose is needed to change the body etc. qmail-scanner-queue.pl is normally setup to run in Fast mode. Fast wont change anything in a message so theres a mode called something like "Fast + Subject" where you input the message to spamd and it gives back whether its spam, and if so it also outputs the new subject line.
You local.cf changes are for verbose mode where you can tag headers, body, etc.

Check your /var/qmail/bin/qmail-scanner-queue.pl for a line like "my $spamc_subject=' ';" and change that to something like "my $spamc_subject='***SPAM*** ';" . IIRC again, but that should enable your Subject tagging.

You might want to also check out your /usr/local/etc/mail/mailfilter as you can set more site options there.  I have the following bit in mine in the X-Spam-Status area:

       if ( $MATCH2 >= 20 )   # from Adam Senuik post to mail-toasters
       {
               log "   SPAM: score $MATCH2: nuking message for $EXT@$HOST!"
               log "=== END === $EXT@$HOST success (discarded)"
               EXITCODE=0
               exit
       }

[sonicbum]

Thanks for the tips.  I'll give the verbose_spamassassin a shot first, and see if the processor doesn't hit the wall.  I imagine not.  If that becomes to much CPU work then I'll try your sugestion on the fast_ mod.

Great idea on the mailfilter.  I removed all the SA stuff out initally since all my users are pop3-ssl, and I *wanted* to see all the spam initally to make sure everythings in order.  So maybe I'll move to the mailfilter mod eventually.

Thanks again.