[Mimedefang] spamassassin scoring discrepancy with local test vs real time ??

[Troy R. LeBouef]

spamassassin scoring discrepancy ??

I am running the latest mimedefang & spamassassin on Fedora 3 Core. 

I am experiencing an issue with scoring discrepancy that is somewhat
perplexing. 

When I get the spam the log file in maillog shows : 

>> Apr  9 10:20:58 ns1 mimedefang.pl[21978]:
MDLOG,j39FKuX3022016,spam,31.961,67.167.191.61,<adejo1keashaye at hotmail.c
om>,<ritu at lebouef.com>,FDA Approved Drug lasts 8x longer than Vi-ag-ra

To me this shows a score of 31.961 but when I check the quarantined
message ran against spamassassin I get the report 

The score in the report is 46.9 does anyone have any ideas about this ??




>Sender: lawso1n98 at hotmail.com
>Subject: [SPAM] FDA Approved Drug lasts 8x longer than Vi-ag-ra
>Content-Type: text/html;
>X-Spam-Prev-Subject: FDA Approved Drug lasts 8x longer than Vi-ag-ra
>X-Spam-Flag: YES
>X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on
ns1.lebouef.com
>X-Spam-Level: **********************************************
>X-Spam-Status: Yes, score=46.9 required=7.0
tests=ALL_TRUSTED,DRUGS_ERECTILE,
>
DRUGS_ERECTILE_OBFU,HTML_50_60,HTML_MESSAGE,HTML_TEXT_AFTER_BODY,
>        HTML_TEXT_AFTER_HTML,INFO_TLD,LONGWORDS,MIME_HEADER_CTYPE_ONLY,
>
MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,SARE_MSGID_EXCITE,
>        SUBJECT_DRUG_GAP_VIA,URIBL_AB_SURBL,URIBL_OB_SURBL,URIBL_SBL,
>        URIBL_SC_SURBL,URIBL_WS_SURBL,WLS_URI_OPT_877
autolearn=disabled
>        version=3.0.2
>X-Spam-Report:
>       *  1.8 SUBJECT_DRUG_GAP_VIA Subject contains a gappy version of
'viagra'
>        * -2.8 ALL_TRUSTED Did not pass through any untrusted hosts
>        *  2.0 WLS_URI_OPT_877 URI: URI contains sites starting with p
>        *  0.5 INFO_TLD URI: Contains an URL in the INFO top-level
domain
>        *  0.2 HTML_TEXT_AFTER_BODY BODY: HTML contains text after BODY
close tag
>        *  0.1 HTML_50_60 BODY: Message is 50% to 60% HTML
>        *  0.2 HTML_TEXT_AFTER_HTML BODY: HTML contains text after HTML
close tag
>        *  0.0 HTML_MESSAGE BODY: HTML included in message
>        *  8.0 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence
level above 50%
>        *      [cf: 100]
>        *  1.2 MIME_HTML_ONLY BODY: Message only has text/html MIME
parts
>        *  5.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
>        *  0.6 URIBL_SBL Contains an URL listed in the SBL blocklist
>        *      [URIs: pharmacyforyou.info]
>        *  2.0 URIBL_AB_SURBL Contains an URL listed in the AB SURBL
blocklist
>        *      [URIs: pharmacyforyou.info]
>        *  0.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL
blocklist
>        *      [URIs: pharmacyforyou.info]
>        *  2.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL
blocklist
>        *      [URIs: pharmacyforyou.info]
>        *  3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL
blocklist
>        *      [URIs: pharmacyforyou.info]
>        *  8.0 DRUGS_ERECTILE_OBFU Obfuscated reference to an erectile
drug
>        *  8.0 DRUGS_ERECTILE Refers to an erectile drug
>        *  3.0 SARE_MSGID_EXCITE Message-ID is forged, (excite.com)
>        *  0.5 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without
required MIME headers
>        *  2.3 LONGWORDS Long string of long words