need help interpreting message_log

The first thing I see is that pmx is 82.5% sure (positive) the messages is spam. p=0.825

The other thing is all of the h=Some_Value are the reasons why it's at 82%. The h stands for hit, as in it matched a SPAM rule and each time it matched, the internal counter for pmx tallied this up to a number past the threshold in your policy. The policy then quarantined the message. Check out page 212 of the admin reference to see what each entry in the log file means.

From the appendix:

``spam score
 The spam score is the score assigned to a message by the anti-spam engine that indicates the relative likelihood that the
 message is spam.
 Anti-spam rules consist of a test definition and a "weight". If the test matches the message, the corresponding weight is
 added to the message's total spam score. Generally, multiple rules must be triggered by a message in order to result in a
 spam score high enough for an action to be taken. SophosLabs constantly analyzes emerging spam techniques and updates
 the ES4000 and PureMessage anti-spam rule sets accordingly.''

You may also want to review the troubleshooting steps starting on page 217.

Hello PierreE,

Since the message is quarantined, you can run a command line utility on the quarantined message to find out more information.

Locate the physical message in your quarantine:

It will reside on the server that quarantined it, in /opt/pmx/var/qdir/cur/[0-9]

You can find the ID for it either in the Manager interface or creative grep'ing.

Once you have located the file, as the pmx user:

$ pmx-spam scan -v <FILENAME>

This will give you the most detailed verbose output about which rules cause the message to be quarantined.

You can send this output in to support, or put it up here and I can discuss what the rules mean and what may have caused it.

Off the top, I see you hit RDNS_SUSP_MSGID

If I go into the Manager, Policy -> Anti-Spam Rules -> Search for RDNS_SUSP_MSGID:

Message contains a ratware message-id pattern and arrived via a host with suspicious rDNS.

So message heuristics have determined the message-id looks spamish, and the sending MTA was most likely from an IP range that is dynamic, and should not be sending mail.

This is a very quick look, and the steps above will show in more depth why this message was quarantined.

Hope this helps!

Thanks a lot, guys. Your posts were very helpful.

I have a problem with the pmx commands though. When I enter in the command "pmx-spam scan -v 17505749" I get:

-bash: pmx-spam: command not found

I get this with other pmx commands too. I'm logged in as root, then did a 'su pmx'.

Hi,

Look in your pmx home dir. There is a file called .pmx_sh_vars that you need to source after you su to the pmx user:

pmx@somehostname ~ $ . .pmx_sh_vars (if you use the csh there is one for calle .pmx_csh_vars)

Look closely because there is a period followed by the .pmx_sh_vars file. This is not a typo and it's how the shell reads that file.

To make this happen automagically on log in, you could add the . .pmx_sh_vars line to your .bashrc and the call your .bashrc from .bash_profile

Erric

Instead of :

# su  pmx

Do:

# su - pmx

Using the dash will make sure you get the pmx user's environment. 

If that doesn't work:

$ /opt/pmx/bin/pmx-spam scan ...