1 Topic by lug

  • lug
  • Member
  • Offline
  • Registered: 2016-12-07
  • Posts: 147

Topic: SpamAssassin Bayes doesn't really work

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.5
- Linux/BSD distribution name and version: ubuntu 16.04
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): ldap
- Web server (Apache or Nginx): apache
- Manage mail accounts with iRedAdmin-Pro? yes
- Related log if you're reporting an issue:
====

I wanted to use sa-bayes so I followed this tutorial:

http://www.iredmail.org/docs/store.spam … n.sql.html

But the first strange thing is, I haven't even used the Spam button in Roundcube but the bayes database is growing fast, like >8000 counts in under 5 minutes.

Second: I've sent a testmail with the text from /usr/share/doc/spamassassin/examples/sample-spam.txt to test if it gets the header [SPAM] or [Junk]
but it doesn't even show up at all. Not in the mail log /var/log/mail.log or in iRedAdmin...
Is it getting deleted by amavis or so? But even then it should show up in the mail log as recieved, right?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by lug

  • lug
  • Member
  • Offline
  • Registered: 2016-12-07
  • Posts: 147

Re: SpamAssassin Bayes doesn't really work

Ok If i send

This is the GTUBE, the
        Generic
        Test for
        Unsolicited
        Bulk
        Email

If your spam filter supports it, the GTUBE provides a test by which you
can verify that the filter is installed correctly and is detecting incoming
spam. You can send yourself a test mail containing the following string of
characters (in upper case and with no white spaces and line breaks):

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

You should send this test mail from an account outside of your network.

The Mail doesn't pop up in the log or whatever, but when I send

This is the GTUBE, the
        Generic
        Test for
        Unsolicited
        Bulk
        Email

If your spam filter supports it, the GTUBE provides a test by which you
can verify that the filter is installed correctly and is detecting incoming
spam. You can send yourself a test mail containing the following string of
characters (in upper case and with no white spaces and line breaks):

You should send this test mail from an account outside of your network.

I recieve it and it shows up in the mail log

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: SpamAssassin Bayes doesn't really work

Please enable debug mode in Amavisd to debug SpamAssassin. FYI:
http://www.iredmail.org/docs/debug.amavisd.html

4 Reply by lug (edited by lug 2017-04-19 14:47:12)

  • lug
  • Member
  • Offline
  • Registered: 2016-12-07
  • Posts: 147

Re: SpamAssassin Bayes doesn't really work

Oh well, I found the issue.
Another Mailserver is relaying mails to the iredmail server, and that relay server is blocking it before..

my bad, sorry

5 Reply by lug (edited by lug 2017-04-19 19:20:47)

  • lug
  • Member
  • Offline
  • Registered: 2016-12-07
  • Posts: 147

Re: SpamAssassin Bayes doesn't really work

So, now i've send the same Spam mail to the iredmail server 20 times and declared mail after mail as spam, the log shows me that it did the sa-learn --spam thing and the database is growing.

Is there any way to see why this mail is still not marked as spam?
I used guerrillamail.com to send the spam mails to have the same enviroment everytime.

Spamassassin score is everytime the same (DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,RCVD_IN_DNSWL_NONE=-0.0001,SPF_FAIL=0.919)

6 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: SpamAssassin Bayes doesn't really work

If i remember correctly, SpamAssassin needs at least 200 DIFFERENT emails before applying the bayes result.

7 Reply by lug

  • lug
  • Member
  • Offline
  • Registered: 2016-12-07
  • Posts: 147

Re: SpamAssassin Bayes doesn't really work

Well I don't know how it counts, but the bayes counter in the mysql database ist over 13.000

8 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: SpamAssassin Bayes doesn't really work

I suggest waiting for some more days until SpamAssassin was trained with enough different emails.

9 Reply by aarango (edited by aarango 2017-04-20 14:01:56)

  • aarango
  • Member
  • Offline
  • Registered: 2016-12-02
  • Posts: 52

Re: SpamAssassin Bayes doesn't really work

ZhangHuangbin wrote:

I suggest waiting for some more days until SpamAssassin was trained with enough different emails.

Hi, I use bayes on mysql, I see too a lot of counts on DB, its has a lot of registry, but in logs I see this (for example):

<enolic@kienfore.com> -> <domain@domain.com>, Queue-ID: 34FCB2EA1B5D, Message-ID: <Qa5B_2GUZKWEViJF9pbQRRfxjueanX
oibSX051wb90w.WOYFLjdt1rNJXxZKVsPq0YhtKC7K0bOTasw-NEy7dsg@kienfore.com>, mail_id: 236V8GpTjc1m, Hits: 0.951, size: 46468, queued_as: 8001A2EA1B62, Subject: "Boost Sexual Health and Performance", From: "VigorThrive"_<enolic@kienfore.com>,
 helo=kienfore.com, Tests: [ALL_TRUSTED=-1,HTML_FONT_LOW_CONTRAST=0.001,HTML_MESSAGE=0.001,URIBL_ABUSE_SURBL=1.948,URIBL_BLOCKED=0.001], autolearn=no autolearn_force=no, autolearnscore=1.95, 651 ms
Apr 20 05:53:23 mail postfix/smtp[25802]: 34FCB2EA1B5D: to=<domain@domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.6, delays=1.9/0/0/0.74, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as
 8001A2EA1B62)

Here more info:

$ sa-learn --dump magic 
0.000          0          3          0  non-token data: bayes db version
0.000          0          0          0  non-token data: nspam
0.000          0        554          0  non-token data: nham
0.000          0      53882          0  non-token data: ntokens
0.000          0 1491912844          0  non-token data: oldest atime
0.000          0 1492665084          0  non-token data: newest atime
0.000          0          0          0  non-token data: last journal sync atime
0.000          0 1492644242          0  non-token data: last expiry atime
0.000          0          0          0  non-token data: last expire atime delta
0.000          0          0          0  non-token data: last expire reduction count
mysql> SELECT COUNT(*) FROM bayes_token;
+----------+
| COUNT(*) |
+----------+
|    53947 |
+----------+


Clearly its spam but this email isn't marked as SPAM. I enabled bayes on DB 3 days ago and I talked with my partners to mark email as SPAM. Should I wait a bit more? I am worried by that "autolearn=no".

Should I enable anything more?

Thanks.

10 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,164

Re: SpamAssassin Bayes doesn't really work

Please enable debug mode in Amavisd to debug SpamAssassin. FYI:
http://www.iredmail.org/docs/debug.amavisd.html

11 Reply by aarango (edited by aarango 2017-04-21 14:11:10)

  • aarango
  • Member
  • Offline
  • Registered: 2016-12-02
  • Posts: 52

Re: SpamAssassin Bayes doesn't really work

ZhangHuangbin wrote:

Please enable debug mode in Amavisd to debug SpamAssassin. FYI:
http://www.iredmail.org/docs/debug.amavisd.html

Hi,

I enabled it, here a log:

Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running body tests; score so far=1.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running uri tests; score so far=1.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running rawbody tests; score so far=1.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running full tests; score so far=1.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running meta tests; score so far=1.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: check: running tests for priority: -950
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running one_line_body tests; score so far=1.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running head tests; score so far=1.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running head_eval tests; score so far=1.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule ALL_TRUSTED ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running body tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running uri tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running rawbody tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running full tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running meta tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: check: running tests for priority: -900
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running one_line_body tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running head tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running head_eval tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running body tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running uri tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running rawbody tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running full tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running meta tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: check: running tests for priority: -400
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running one_line_body tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running head tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running body tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running uri tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running body_eval tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running rawbody tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running full tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running meta tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: check: running tests for priority: 0
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running one_line_body tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: zoom: run_body_fast_scan for body_0 start
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: zoom: run_body_fast_scan for body_0 done
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running head tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __TB_MIME_BDRY_NO_Z ======> got hit: "boundary="------------9354837634511393"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __CTYPE_MULTIPART_ANY ======> got hit: "multipart/alternative"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __CTYPE_MULTIPART_ALT ======> got hit: "multipart/alternative"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __CTYPE_HAS_BOUNDARY ======> got hit: "boundary"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __CTYPE_HAS_BOUNDARY ======> got hit: "boundary"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __CT ======> got hit: "<YES>"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __HAS_DATE ======> got hit: "<YES>"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __DOS_RCVD_FRI ======> got hit: " Fri, "
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __HAS_RCVD ======> got hit: "<YES>"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __MISSING_REPLY ======> got hit: "UNSET"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __HAS_MSGID ======> got hit: "<"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __SANE_MSGID ======> got hit: "<LVy8qQNAs76NBEgjkrPLtz9NzLR3pimov8SOG8_Th_g.Dxe-jwVJf7dQzlvx7tKuqF_Ilqw5EmxSKP1VmhitmWI@beheathy.com>
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: [...] "
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __HAS_SUBJECT ======> got hit: "<YES>"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __NUMBERS_IN_SUBJ ======> got hit: "616"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __MISSING_REF ======> got hit: "UNSET"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __HAS_TO ======> got hit: "<YES>"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __HAS_FROM ======> got hit: "<YES>"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __TOCC_EXISTS ======> got hit: "<YES>"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __MSGID_OK_HOST ======> got hit: "@beheathy.com>"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __HAS_MESSAGE_ID ======> got hit: "<YES>"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran header rule __MIME_VERSION ======> got hit: "<YES>"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running head_eval tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dkim: signatures provided by the caller, 0 signatures
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dkim: signature verification result: none
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dkim: adsp: performing lookup on _adsp._domainkey.beheathy.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dkim: adsp result: U/unknown (dns: unknown), author domain 'beheathy.com'
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: spf: checking to see if the message has a Received-SPF header that we can use
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: spf: no suitable relay for spf use found, skipping SPF check
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: spf: already checked for Received-SPF headers, proceeding with DNS based checks
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: spf: no suitable relay for spf use found, skipping SPF-helo check
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: spf: def_spf_whitelist_from: already checked spf and didn't get pass, skipping whitelist check
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: RULE (FREEMAIL_FROM) check_freemail_from
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: all from-addresses: cecil@beheathy.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: RULE (__freemail_replyto) check_freemail_replyto
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: From address: cecil@beheathy.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: Reply-To is not freemail, skipping check
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: RULE (__smf_freemail_hdr_replyto) check_freemail_header
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: header Reply-To:addr not found from mail
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: RULE (FREEMAIL_ENVFROM_END_DIGIT) check_freemail_header regex:\\d@
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: address from header EnvelopeFrom: cecil@beheathy.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dkim: author cecil@beheathy.com, not in any dkim whitelist
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: RULE (__freemail_reply) check_freemail_replyto
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: From address: cecil@beheathy.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: No Reply-To and From is not freemail, skipping check
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: spf: whitelist_from_spf: already checked spf and didn't get pass, skipping whitelist check
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: RULE (FREEMAIL_REPLYTO_END_DIGIT) check_freemail_header regex:\\d@
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: header Reply-To not found from mail
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: RULE (__freemail_hdr_replyto) check_freemail_header
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: FreeMail: header Reply-To not found from mail
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: eval: From 2nd level domain: beheathy.com, EnvelopeFrom 2nd level domain: beheathy.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __ENV_AND_HDR_FROM_MATCH ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running body tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran body rule __BODY_TEXT_LINE ======> got hit: "Y"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran body rule __BODY_TEXT_LINE ======> got hit: "A"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran body rule __BODY_TEXT_LINE ======> got hit: "W"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "Y"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running uri tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran uri rule __LOCAL_PP_NONPPURL ======> got hit: "http://bars.beheathy.com"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran uri rule __DOS_HAS_ANY_URI ======> got hit: "h"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running body_eval tests; score so far=0.949
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: eval: body_length - 7363 - check for min of 512
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule HTML_MESSAGE ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __HTML_LINK_IMAGE ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: eval: body_length - 7363 - check for min of 1024
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __ANY_TEXT_ATTACH_DOC ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __TAG_EXISTS_HTML ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __ANY_TEXT_ATTACH ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __TVD_MIME_ATT_TP ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: eval: body_length - 7363 - check for min of 128
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: eval: text words: 64, html words: 68
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: eval: madiff: left: 12, orig: 68, max-difference: 17.65%
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __TAG_EXISTS_META ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __MIME_HTML ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __TAG_EXISTS_HEAD ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: eval: body_length - 7363 - check for min of 256
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __TAG_EXISTS_BODY ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running rawbody tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran rawbody rule __BUGGED_IMG ======> got hit: "<img src="http://bars.beheathy.com/dohokoku/xhuec17512drbz/.com/11f6e2EE38"
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running rawbody_eval tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running full tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules-all: running full rule NULL_IN_BODY
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules-all: running full rule __BASE64_MDAW
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running full_eval tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: ran eval rule __DKIM_DEPENDABLE ======> got hit (1)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: pyzor: pyzor is not available: no pyzor executable found
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: pyzor: no pyzor found, disabling Pyzor
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running meta tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: check: running tests for priority: 500
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dns: harvest_dnsbl_queries
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dns: dns reply to 27083/IN/A/23.222.67.194.sbl.spamhaus.org: NXDOMAIN
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: calling callback on key DNSBL:23.222.67.194:sbl.spamhaus.org, rule URIBL_SBL_A
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: uridnsbl: complete_dnsbl_lookup URIBL_SBL_A DNSBL:23.222.67.194:sbl.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dns: dns reply to 55811/IN/A/23.222.67.194.zen.spamhaus.org: NXDOMAIN
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: calling callback on key DNSBL:23.222.67.194:zen.spamhaus.org, rule URIBL_SBL
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: uridnsbl: complete_dnsbl_lookup URIBL_SBL DNSBL:23.222.67.194:zen.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dns: dns reply to 1981/IN/A/86.59.245.173.zen.spamhaus.org: NXDOMAIN
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: calling callback on key DNSBL:86.59.245.173:zen.spamhaus.org, rule URIBL_SBL
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: uridnsbl: complete_dnsbl_lookup URIBL_SBL DNSBL:86.59.245.173:zen.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dns: dns reply to 10288/IN/A/86.59.245.173.sbl.spamhaus.org: NXDOMAIN
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: calling callback on key DNSBL:86.59.245.173:sbl.spamhaus.org, rule URIBL_SBL_A
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: uridnsbl: complete_dnsbl_lookup URIBL_SBL_A DNSBL:86.59.245.173:sbl.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dns: dns reply to 42191/IN/A/221.58.245.173.zen.spamhaus.org: NXDOMAIN
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: calling callback on key DNSBL:221.58.245.173:zen.spamhaus.org, rule URIBL_SBL
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: uridnsbl: complete_dnsbl_lookup URIBL_SBL DNSBL:221.58.245.173:zen.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: dns: dns reply to 45027/IN/A/221.58.245.173.sbl.spamhaus.org: NXDOMAIN
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: calling callback on key DNSBL:221.58.245.173:sbl.spamhaus.org, rule URIBL_SBL_A
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: uridnsbl: complete_dnsbl_lookup URIBL_SBL_A DNSBL:221.58.245.173:sbl.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: select found no responses ready (t.o.=0.0)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: completed in 0.057 s: URIBL_SBL, URI-DNSBL, DNSBL:86.59.245.173:zen.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: completed in 0.057 s: URIBL_SBL, URI-DNSBL, DNSBL:221.58.245.173:zen.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: completed in 0.059 s: URIBL_SBL, URI-DNSBL, DNSBL:23.222.67.194:zen.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.003 . A:chuck.ns.cloudflare.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.003 . A:sharon.ns.cloudflare.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.005 . NS:beheathy.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.006 . A:bars.beheathy.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.006 . dns:MX:beheathy.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.006 . dns:A:beheathy.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.007 . DNSBL:beheathy.com:dob.sibl.support-intelligence.net
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.007 . DNSBL:beheathy.com:multi.uribl.com
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.013 . DNSBL:beheathy.com:dbl.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.014 . DNSBL:beheathy.com:multi.surbl.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.057 . DNSBL:221.58.245.173:zen.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.057 . DNSBL:221.58.245.173:sbl.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.057 . DNSBL:86.59.245.173:zen.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.058 . DNSBL:86.59.245.173:sbl.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.059 . DNSBL:23.222.67.194:zen.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: async: timing: 0.059 . DNSBL:23.222.67.194:sbl.spamhaus.org
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: check: tagrun - tag RBL is now ready, value: <dns:beheathy.com> [194.67.222.160]
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running one_line_body tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running head tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running body tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running uri tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running body_eval tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running rawbody tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running full tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: rules: running meta tests; score so far=0.95
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: learn: auto-learn: currently using scoreset 1
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: learn: auto-learn: adding body_only points 1.948
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: learn: auto-learn: adding body_only points 0.001
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: learn: auto-learn: adding head_only points 0.01
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: learn: auto-learn: message score: 0.96, computed score for autolearn: 1.959
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: learn: auto-learn? ham=0.1, spam=12, body-points=1.949, head-points=0.01, learned-points=0
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: learn: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: check: is spam? score=0.96 required=5
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: check: tests=ALL_TRUSTED,HTML_MESSAGE,T_REMOTE_IMAGE,URIBL_ABUSE_SURBL,URIBL_BLOCKED
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: check: subtests=__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BUGGED_IMG,__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__CTYPE_MULTIP
ART_ANY,__DKIM_DEPENDABLE,__DOS_HAS_ANY_URI,__DOS_RCVD_FRI,__ENV_AND_HDR_FROM_MATCH,__HAS_ANY_URI,__HAS_DATE,__HAS_FROM,__HAS_MESSAGE_ID,__HAS_MSGID,__HAS_RCVD,__HAS_SUBJECT,__HAS_TO,__HAS_URI,__HTML_LINK_IMAGE,__KHOP_NO_FULL_NAME,__LCL_
_ENV_AND_HDR_FROM_MATCH,__LOCAL_PP_NONPPURL,__MIME_HTML,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY,__MSGID_OK_HOST,__NONEMPTY_BODY,__NOT_SPOOFED,__NUMBERS_IN_SUBJ,__REMOTE_IMAGE,__SANE_MSGID,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EX
ISTS_HTML,__TAG_EXISTS_META,__TB_MIME_BDRY_NO_Z,__TOCC_EXISTS,__TVD_MIME_ATT_TP
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: timing: total 84 ms - parse: 1.04 (1.2%), b_tie_ro: 1.14 (1.4%), extract_message_metadata: 11 (12.9%), get_uri_detail_list: 0.93 (1.1%), tests_pri_-1000: 12 (14.5%), tests_pri_-950: 
1.27 (1.5%), tests_pri_-900: 0.95 (1.1%), tests_pri_-400: 0.84 (1.0%), tests_pri_0: 47 (56.7%), check_dkim_adsp: 1.66 (2.0%), check_spf: 0.34 (0.4%), check_pyzor: 0.17 (0.2%), tests_pri_500: 4.4 (5.3%)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) SA dbg: check: tagrun - tag DKIMDOMAIN is still blocking action 0
Apr 21 05:51:39 mail postfix/smtpd[3826]: connect from mail.domain.com[127.0.0.1]
Apr 21 05:51:39 mail postfix/smtpd[3826]: 305ED2EA1B9C: client=mail.domain.com[127.0.0.1]
Apr 21 05:51:39 mail postfix/cleanup[3822]: 305ED2EA1B9C: message-id=<LVy8qQNAs76NBEgjkrPLtz9NzLR3pimov8SOG8_Th_g.Dxe-jwVJf7dQzlvx7tKuqF_Ilqw5EmxSKP1VmhitmWI@beheathy.com>
Apr 21 05:51:39 mail postfix/smtpd[3826]: disconnect from mail.domain.com[127.0.0.1]
Apr 21 05:51:39 mail postfix/qmgr[26234]: 305ED2EA1B9C: from=<cecil@beheathy.com>, size=8842, nrcpt=1 (queue active)
Apr 21 05:51:39 mail amavis[19083]: (19083-06) FWD from <cecil@beheathy.com> -> <myaccount@domain.com>,RET=HDRS BODY=7BIT 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 305ED2EA1B9C
Apr 21 05:51:39 mail amavis[19083]: (19083-06) Passed CLEAN {RelayedInternal}, MYNETS LOCAL [192.168.1.1]:41651 [192.168.1.1] <cecil@beheathy.com> -> <myaccount@domain.com>, Queue-ID: A5D8D2EA1B09, Message-ID: <LVy8qQNAs76NBEgjkrPLtz9NzLR3p
imov8SOG8_Th_g.Dxe-jwVJf7dQzlvx7tKuqF_Ilqw5EmxSKP1VmhitmWI@beheathy.com>, mail_id: S0RzTfc6HwrJ, Hits: 0.96, size: 8119, queued_as: 305ED2EA1B9C,Subject: "You have (amazon-prime) hot product of the day 61637621", From: "_Karla"_<cecil@beheathy.com>, helo=beheathy.com, Tests: [ALL_TRUSTED=-1,HTML_MESSAGE=0.001,T_REMOTE_IMAGE=0.01,URIBL_ABUSE_SURBL=1.948,URIBL_BLOCKED=0.001], autolearn=no autolearn_force=no, autolearnscore=1.959, 324 ms
Apr 21 05:51:39 mail postfix/smtp[3823]: A5D8D2EA1B09: to=<myaccount@domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.67, delays=0.26/0/0/0.4, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as
 305ED2EA1B9C)
Apr 21 05:51:39 mail postfix/qmgr[26234]: A5D8D2EA1B09: removed
Apr 21 05:51:39 mail postfix/pipe[3827]: 305ED2EA1B9C: to=<myaccount@domain.com>, relay=dovecot, delay=0.31, delays=0.06/0/0/0.24, dsn=2.0.0, status=sent (delivered via dovecot service)
Apr 21 05:51:39 mail postfix/qmgr[26234]: 305ED2EA1B9C: removed

This is clearly a SPAM but it wasn't marked. Maybe I need more items on DB or I have something wrong.
I have another post talking same, maybe you can close it to avoid duplicate post:
http://www.iredmail.org/forum/topic1260 … assin.html

Thanks.