Spam scores

salware_ironport · ‎04-23-2007

Hello:

I've seen that in mail policies you can configure the threshold for spam positive and suspected spam between 1 and 100.

But in CASE and antispam logs the scores for the messages usually ranks below 30 and even could have some negative values.

So my question is, is there any relationship between the scores you can setup in the mail policies configuration and the scores logged for each message?

Thank you

jaigill · ‎04-24-2007

Ironport does not log spam scores to any log files. Spam scores are kept confidential and not logged to case/antispam logs.

Do you have a log snippet showing spam scores?

salware_ironport · ‎04-25-2007

Here you have:

Wed Apr 25 08:11:53 2007 Info: CASE - engine (70415) : [MID 181613946] case-daemon: result: Y 8 - SUCCESS scantime=0.2,size=17696,user=(unknown),uid=783,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=[tmpdir]case_srv.sock,mid=<000a01c78700>,autolearn=unavailable

It tells that is spam positive, with a score of 8 that is greater that the required score 5.

Mark [CSE]_ironport · ‎04-25-2007

Well those scores seen there is not the anti spam score. It's a part but only on of many parts.

However if the number is a lot higher than the threshold (in this case 5) this will give some direction where the final score will be.

Cheers,

Mark