SS 2.8.8 Marking Good as Spam

I have an issue whereby SpamSieve 2.8.8 with Apple Mail Lion using an iCloud mail account is occasionally marking trained good or Address Book related messages as spam. Looking at the log, it appears that SpamSieve is occasionally having trouble reading the From and Subject info of incoming messages. SpamSieve does not seem to have any trouble reading the Subject and From when I subsequently “Apply Rules” manually to these messages as SS then marks them as good. I’ve included the log info below for two mis-marked messages in a row this morning as well as the subsequent Apply Rules entry for the message where the sender is in my address book (I obscured the prefix of the sender’s address).

Is this to be expected, a problem with the SS Apple Mail plugin passing mail to SS or is there some other issue I should be chasing? The message headers don’t seem to be corrupted and as noted SS has no problem reading and interpreting them when the SS Rule is applied manually. Note also that this generally occurs when I first wake my laptop and Mail first downloads from iCloud all the mail received overnight. I don’t recall having seen it happen during the day when messages might be pushed to my laptop singly.

Rick

=====================================================================
Predicted: Spam (100)
Subject: <SpamSieve-Unknown-Subject>
From: <SpamSieve-Unknown-From>
Identifier: mGchMm62dFNB53dkuohH0Q==
Reason: looked up message in corpus
Date: 2011-12-21 14:28:22 +0000

Predicted: Spam (100)
Subject: <SpamSieve-Unknown-Subject>
From: <SpamSieve-Unknown-From>
Identifier: 8Zqiltj9SkOAS53TJQyvng==
Reason: looked up message in corpus
Date: 2011-12-21 14:28:33 +0000

=====================================================================
Predicted: Good (0)
Subject: Fwd: Whole Foods…Are all organic?..Read the labels.
From: (xxxxx)@mac.com
Identifier: MfESI9lc4rTWhfTL8/Xzsw==
Reason: sender <(xxxxx)@mac.com> in address book
Date: 2011-12-21 14:42:42 +0000

Not only that, but the message headers that it’s seeing exactly match those of messages that you’d previously trained as spam. That’s what the “Reason: looked up message in corpus” refers to. SpamSieve bypassed the address book and all the other filters because it thought it had direct knowledge, from you, about these particular messages.

I’ve never seen this problem before. Are you sure that the “Predicted: Spam (100)” log entries are from the messages that you think? I suggest that you click here to turn on logging. SpamSieve will then save each message it sees as a file in the folder:

/Users/<username>/Library/Application Support/SpamSieve/MessageLog

and then you can see what the messages look like. Perhaps Mail isn’t sending it the full data. You can click here to turn off logging.

Secondly, I would suggest looking in the All Messages section of the Console log to see whether Mail (or SpamSieve’s plug-in) is reporting any errors.

Michael,

I’m virtually certain about the first one (time stamped 14:28:22) based upon where it appeared in the log compared to the order my email was downloaded/received from iCloud. This one is from my wife, who most certainly is in my Address Book! The second instance may in fact be a trained Spam message. I went to All Messages in Console and pulled these 3 entries from a filter for SpamSieve:

12/21/11 7:28:22.723 AM Mail: SpamSieve Mail Plug-In: Message source fallback worked.
12/21/11 7:28:22.724 AM SpamSieve: Empty message
12/21/11 7:28:33.414 AM Mail: SpamSieve Mail Plug-In: Message source fallback worked.

I’m in mountain time (-0700GMT) so they seem to correlate precisely with timing in the SpamSieve log posted originally. The first two entries in particular might be of interest, including the Empty Message error, since as I said I’m comfortable that these two are related to the instance where the sender was in my address book. I received your PM, will install that, turn on logging and revert back to you the next time it occurs. I can send you the actual message of concern via PM if that would help. It was a forwarded message, but the text wasn’t anything I had received before.

Rick

That’s interesting. It seems that Mail is failing to get the message data for the SpamSieve plug-in. I’ve posted a new pre-release version at the URL that I e-mailed you. With the new version, if Mail gets the message data but it turns out to be empty, the plug-in will classify the message as good rather than passing it along to SpamSieve. It will also log some more detailed information to the Console about which messages are the problem ones.

Also, if the problem recurs I would suggest temporarily uninstalling your other Mail plug-ins to see whether that has any effect.

Rick sent me an e-mail saying that the problem went away after he installed a SpamSieve beta (which added some logging but didn’t fundamentally change anything) and relaunched all his applications.