On Tue, Sep 04, 2007 at 01:17:06PM +0100, [EMAIL PROTECTED] wrote:
> On Tue, Sep 04, 2007 at 12:48:40PM +0100, [EMAIL PROTECTED] wrote:
...
> > Forgive me if this has come up before, I did try searching the archives
> > but found it extremely tricky to get the correct search and have found
> > no useful information.
> >
> > I have a problem whereby a lot of spamassassin checks do not appear to
> > be happening when mail goes through amavis. One particular email scored
> > 3.632 when it first arrived, but when passed through spamassassin on a
> > different server with same local.cf it scored 10.0.
> >
> > Both serers are running FreeBSD 6.1. The failing server is running
> > amavisd-new-2.4.2 (20060627) installed from ports collection, with
> > SpamAssassin version 3.1.4, Perl version 5.8.8. I am running clamd and
> > amavisd chrooted, with Postfix mta. The other spamassassin install is
> > 3.2.1 on Perl 5.8.8.
> >
> > I have tried running "amavisd debug-sa" but I could see no errors that I
> > think would cause this, only some dns / whois timeouts and a problem
> > with razor2 not working, but I think this is unrelated because I get the
> > same high-score if I switch off razor2 in the standalone spamassassin.
...
You have too many variables there to sort things out readily; you
should expect different versions of SA to score individual tests quite
differently.
I'd start by taking out the chrooting in the failing system and see
if its scores shift dramatically.
> ...sorry, I think I may have just partly figured out what's wrong. The
> two status lines look like this:
>
> X-Spam-Status: No, score=3.632 required=4.5 tests=[BAYES_50=0.001,
> DATE_IN_FUTURE_06_12=1.668, EXTRA_MPART_TYPE=1.091, HTML_30_40=0.374,
> HTML_IMAGE_ONLY_16=0.497, HTML_MESSAGE=0.001]
>
> and
>
> X-Spam-Status: Yes, score=9.9 required=5.0 tests=AWL,DATE_IN_FUTURE_06_12,
> EXTRA_MPART_TYPE,HTML_IMAGE_ONLY_16,HTML_MESSAGE,MIME_QP_LONG_LINE,
>
> PART_CID_STOCK,RDNS_NONE,STOCK_IMG_CTYPE,STOCK_IMG_HDR_FROM,STOCK_IMG_HTML,
> T_TVD_FW_GRAPHIC_ID1,UNPARSEABLE_RELAY autolearn=no version=3.2.1
>
> So it looks like only some of the tests are missing (perhaps to do with
> the difference SA versions), but what I'm now noticing is the difference
> in the scores for the different tests. Eg, the DATE_IN_FUTURE_06_12 test
> is 1.668 for the amavisd scanner, but the standalone SA gives it a 3.1!!
It isn't clear if when you say "standalone" you mean you're running a
test with the spamassassin command line on the same server, but I'll
assume you are. (As I said, you should expect different versions of SA
to score individual tests quite differently.)
This might suggest that amavisd is picking up a different set of SA
config files than the SA scanner run standalone. Look at the list of
directories amavisd logs when it starts up, and see if you find some SA
files in a directory that's ahead of the ones you're looking at. Also
in general look for warnings during the startup. Again, the number one
thing to try is to toggle chroot on and off and observe how the scoring
is affected; it's far easier to troubleshoot without it, get it the way
you like and only then try to get chrooting working.
> Does anyone know how I can get them to be the same. I can see some small
> differences in the contents of /usr/local/share/spamassassin/*.cf but am
> unsure of how to interpret the differences, nor why they would be
> different in the first place. Is it safe to simply overwrite one set of
> *.cf files with a different one or is that not advisable? (sorry if
> that's slightly off-topic).
The .cf files need to match the version of SA or it will be less
accurate. Concentrate on making sure that the new system has a
consistent version of everything and that amavisd is seeing it. If you
really need to downgrade SA, you should downgrade both the installed SA
and its config files; I would not recommend just swapping old versions
of the config files in en masse.
-- Clifton
--
Clifton Royston -- [EMAIL PROTECTED] / [EMAIL PROTECTED]
President - I and I Computing * http://www.iandicomputing.com/
Custom programming, network design, systems and network consulting services
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
