Spam getting scored but not tagged -- redux

About a year ago, I started this thread:

[url]http://mail-archives.apache.org/mod_mbox/spamassassin-users/200708.mbox/%3cPine.LNX.4.64.0708160819330.18886@zaphod.nebrwesleyan.edu%3e[/url]

I kind of forgot about the issue, but it's cropping up again; we're
now on 3.2.4, and still having the problem. New logs:

Jun 12 08:04:02 vostok spamd[1299]: spamd: setuid to spamd succeeded
Jun 12 08:04:02 vostok spamd[1299]: spamd: processing message <48511EB8.00000392@va-123.onebigplatform.net> for spamd:402
Jun 12 08:04:04 vostok spamd[18567]: spamd: identified spam (16.0/5.0) for spamd:402 in 1.7 seconds, 1982 bytes.
Jun 12 08:04:06 vostok spamd[18567]: spamd: result: Y 16 - AWL,BAYES_99,EMPTY_MESSAGE,HTML_IMAGE_ONLY_12,HTML_IMAGE_RATIO_06,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,HTML_SHORT_LINK_IMG_2,MIME_HTML_ONLY,NWU_RCVD_INVALID_PTR2,RCVD_IN_NJABL_SPAM,RDNS_NONE,URIBL_RHS_DOB scantime=1.7,size=1982,user=spamd,uid=402,required_score=5.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=35145,mid=<48511EB8.00000392@va-123.onebigplatform.net>,bayes=1.000000,autolearn=no
Jun 12 08:04:06 vostok spamd[18567]: spamd: accidental fork: 18567 != 1299 at /usr/bin/spamd line 1645.
Jun 12 08:04:08 vostok spamd[1299]: spamd: identified spam (16.2/5.0) for spamd:402 in 5.3 seconds, 1982 bytes.
Jun 12 08:04:08 vostok spamd[1299]: spamd: result: Y 16 - AWL,BAYES_99,EMPTY_MESSAGE,HTML_IMAGE_ONLY_12,HTML_IMAGE_RATIO_06,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,HTML_SHORT_LINK_IMG_2,MIME_HTML_ONLY,NWU_RCVD_INVALID_PTR2,RCVD_IN_NJABL_SPAM,RDNS_NONE,URIBL_RHS_DOB scantime=5.3,size=1982,user=spamd,uid=402,required_score=5.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=35145,mid=<48511EB8.00000392@va-123.onebigplatform.net>,bayes=1.000000,autolearn=no
Jun 12 08:04:08 vostok spamd[1299]: spamd: connection from localhost.localdomain [127.0.0.1] at port 35155
Jun 12 08:04:08 vostok spamd[1299]: spamd: setuid to spamd succeeded
Jun 12 08:04:08 vostok spamd[1299]: spamd: processing message <741755515.1213275830117.JavaMail.app@c17-ave-nemoe2.cnet.com> for spamd:402

Any other ideas? Thanks!

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University

For what it's worth, this appears to be happening on _every_ message
that comes through. In other words, no spam at all is getting tagged,
and we're running on RBLs, etc., alone. So I'd appreciate any and all
suggestions. :)

Thanks.

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University

On Thu, 12 Jun 2008, Chris St. Pierre wrote:
[color=blue]
> About a year ago, I started this thread:
>
> [url]http://mail-archives.apache.org/mod_mbox/spamassassin-users/200708.mbox/%3cPine.LNX.4.64.0708160819330.18886@zaphod.nebrwesleyan.edu%3e[/url]
>
> I kind of forgot about the issue, but it's cropping up again; we're
> now on 3.2.4, and still having the problem. New logs:
>
> Jun 12 08:04:02 vostok spamd[1299]: spamd: setuid to spamd succeeded
> Jun 12 08:04:02 vostok spamd[1299]: spamd: processing message
> <48511EB8.00000392@va-123.onebigplatform.net> for spamd:402
> Jun 12 08:04:04 vostok spamd[18567]: spamd: identified spam (16.0/5.0) for
> spamd:402 in 1.7 seconds, 1982 bytes.
> Jun 12 08:04:06 vostok spamd[18567]: spamd: result: Y 16 -
> AWL,BAYES_99,EMPTY_MESSAGE,HTML_IMAGE_ONLY_12,HTML_IMAGE_RATIO_06,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,HTML_SHORT_LINK_IMG_2,MIME_HTML_ONLY,NWU_RCVD_INVALID_PTR2,RCVD_IN_NJABL_SPAM,RDNS_NONE,URIBL_RHS_DOB
> scantime=1.7,size=1982,user=spamd,uid=402,required_score=5.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=35145,mid=<48511EB8.00000392@va-123.onebigplatform.net>,bayes=1.000000,autolearn=no
> Jun 12 08:04:06 vostok spamd[18567]: spamd: accidental fork: 18567 != 1299 at
> /usr/bin/spamd line 1645.
> Jun 12 08:04:08 vostok spamd[1299]: spamd: identified spam (16.2/5.0) for
> spamd:402 in 5.3 seconds, 1982 bytes.
> Jun 12 08:04:08 vostok spamd[1299]: spamd: result: Y 16 -
> AWL,BAYES_99,EMPTY_MESSAGE,HTML_IMAGE_ONLY_12,HTML_IMAGE_RATIO_06,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,HTML_SHORT_LINK_IMG_2,MIME_HTML_ONLY,NWU_RCVD_INVALID_PTR2,RCVD_IN_NJABL_SPAM,RDNS_NONE,URIBL_RHS_DOB
> scantime=5.3,size=1982,user=spamd,uid=402,required_score=5.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=35145,mid=<48511EB8.00000392@va-123.onebigplatform.net>,bayes=1.000000,autolearn=no
> Jun 12 08:04:08 vostok spamd[1299]: spamd: connection from
> localhost.localdomain [127.0.0.1] at port 35155
> Jun 12 08:04:08 vostok spamd[1299]: spamd: setuid to spamd succeeded
> Jun 12 08:04:08 vostok spamd[1299]: spamd: processing message
> <741755515.1213275830117.JavaMail.app@c17-ave-nemoe2.cnet.com> for spamd:402
>
> Any other ideas? Thanks!
>
> Chris St. Pierre
> Unix Systems Administrator
> Nebraska Wesleyan University
>[/color]

On 12.06.08 16:22, Chris St. Pierre wrote:[color=blue]
> About a year ago, I started this thread:
>
> [url]http://mail-archives.apache.org/mod_mbox/spamassassin-users/200708.mbox/%3cPine.LNX.4.64.0708160819330.18886@zaphod.nebrwesleyan.edu%3e[/url]
>
> I kind of forgot about the issue, but it's cropping up again; we're
> now on 3.2.4, and still having the problem. New logs:[/color]

How do you use spamassassin, from procmail/maildrop? milter?

--
Matus UHLAR - fantomas, [email]uhlar@fantomas.sk[/email] ; [url]http://www.fantomas.sk/[/url]
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
42.7 percent of all statistics are made up on the spot.

On Fri, 13 Jun 2008, Matus UHLAR - fantomas wrote:
[color=blue]
> How do you use spamassassin, from procmail/maildrop? milter?[/color]

I call it from Postfix thusly:

------
main.cf:
------

smtpd_recipient_restrictions =
...
check_recipient_access hash:/etc/postfix/spamassassin

------
/etc/postfix/spamassassin:
------

# only filter email *to* our domain, not from it
nebrwesleyan.edu FILTER spamassassin:

------
master.cf
------

spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spamc -u spamd -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University

In v310.pre, we had this:

loadplugin Mail::SpamAssassin::Plugin::Pyzor

....amongst many other loadplugin lines. Through trial-and-error, I've
determined that commenting out the Pyzor line (along with the pyzor
config lines in local.cf) solves the problem.

Unfortunately, I really _liked_ Pyzor, and would like to be able to
run it. Thoughts?

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University

On Fri, 13 Jun 2008, Chris St. Pierre wrote:
[color=blue]
> On Fri, 13 Jun 2008, Matus UHLAR - fantomas wrote:
>[color=green]
>> How do you use spamassassin, from procmail/maildrop? milter?[/color]
>
> I call it from Postfix thusly:
>
> ------
> main.cf:
> ------
>
> smtpd_recipient_restrictions =
> ...
> check_recipient_access hash:/etc/postfix/spamassassin
>
> ------
> /etc/postfix/spamassassin:
> ------
>
> # only filter email *to* our domain, not from it
> nebrwesleyan.edu FILTER spamassassin:
>
> ------
> master.cf
> ------
>
> spamassassin unix - n n - - pipe
> user=spamd argv=/usr/bin/spamc -u spamd -e
> /usr/sbin/sendmail -oi -f ${sender} ${recipient}
>
> Chris St. Pierre
> Unix Systems Administrator
> Nebraska Wesleyan University
>
>[/color]

On 13.06.08 10:56, Chris St. Pierre wrote:[color=blue]
> In v310.pre, we had this:
>
> loadplugin Mail::SpamAssassin::Plugin::Pyzor
>
> ...amongst many other loadplugin lines. Through trial-and-error, I've
> determined that commenting out the Pyzor line (along with the pyzor
> config lines in local.cf) solves the problem.
>
> Unfortunately, I really _liked_ Pyzor, and would like to be able to
> run it. Thoughts?[/color]

I don't think that problem with not tagging your messages is anyhow related
to pyzor. I guess it's caused by postfix configuration, but I don't use
postfix so I can not comment that out.

--
Matus UHLAR - fantomas, [email]uhlar@fantomas.sk[/email] ; [url]http://www.fantomas.sk/[/url]
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Atheism is a non-prophet organization.

On Mon, June 16, 2008 09:43, Matus UHLAR - fantomas wrote:[color=blue]
> On 13.06.08 10:56, Chris St. Pierre wrote:[/color]
[color=blue]
> I don't think that problem with not tagging your messages is anyhow related
> to pyzor. I guess it's caused by postfix configuration, but I don't use
> postfix so I can not comment that out.[/color]

i had same problem when used sa-compile, shortcicuit plugin

problem seems to be when there is alot of rules in sa-compile it can happend
with no sigatures from spamassasssin

it was here, its definely not postfix fault


Benny Pedersen
Need more webspace ? [url]http://www.servage.net/?coupon=cust37098[/url]

On Mon, 16 Jun 2008, Matus UHLAR - fantomas wrote:
[color=blue]
> I don't think that problem with not tagging your messages is anyhow related
> to pyzor. I guess it's caused by postfix configuration, but I don't use
> postfix so I can not comment that out.[/color]

Baroo? Using pyzor -> suckage; not using pyzor -> no suckage. I'm
not sure it's directly caused by pyzor, either, but I think it's
pretty clearly related in some way. I'd be interested to hear how
a problem like this could be related to _any_ MTA; Postfix doesn't
know or care what pyzor does.

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University

> On Mon, 16 Jun 2008, Matus UHLAR - fantomas wrote:[color=blue]
>[color=green]
> >I don't think that problem with not tagging your messages is anyhow related
> >to pyzor. I guess it's caused by postfix configuration, but I don't use
> >postfix so I can not comment that out.[/color][/color]

On 16.06.08 10:57, Chris St. Pierre wrote:[color=blue]
> Baroo? Using pyzor -> suckage; not using pyzor -> no suckage. I'm
> not sure it's directly caused by pyzor, either, but I think it's
> pretty clearly related in some way. I'd be interested to hear how
> a problem like this could be related to _any_ MTA; Postfix doesn't
> know or care what pyzor does.[/color]

Simply - if spamassassin fails, it does neither score nor tag the message.
If spammassin scored the message, it did not fail. According to OP, the
spamassassin did score the message, so it did not fail. When headers are not
found in the resulting message, it's not problem of SA.

I guess that checking the message tooks too long time so postfix timed out
and continued with original message.

Maybe the long time and timeout was caused by pyzor. However as the OP said,
the spamassassion DOES score.
--
Matus UHLAR - fantomas, [email]uhlar@fantomas.sk[/email] ; [url]http://www.fantomas.sk/[/url]
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Support bacteria - they're the only culture some people have.

On Fri, June 13, 2008 17:56, Chris St. Pierre wrote:
[color=blue]
> Unfortunately, I really _liked_ Pyzor, and would like to be able to
> run it. Thoughts?[/color]

pyzor and pyzord is stable here

more stable then razor, but i maked pyzord install here since i was tired of
timeout on official pyzord servers, now waiting for pyzord digest exchanges

how can i help you ?

[url]http://bugs.gentoo.org/show_bug.cgi?id=216374[/url]

Benny Pedersen
Need more webspace ? [url]http://www.servage.net/?coupon=cust37098[/url]