Re: [Mimedefang] MD or SA? Not always getting bayes_ scores

2004-11-23 Thread Adam Beatham
It's a site-wide implementation, that I've had for atleast the last 18 
or so months, without any noticeable problems.  I have a feeling it 
occured when I upgraded to 3.0.1, but I can't pinpoint it.  I'm just at 
a loss as to whats going on..
I did search for any other bayes_* files, just to make sure I wasn't 
somehow using a different set of tokens than the ones I expected.. and 
there are no other ones present on my system.

-adam
-
"laughter is like music"

on 11/23/2004 9:43 PM Nate Carlson said the following:
On Tue, 23 Nov 2004, Adam Beatham wrote:
Unfortunately, there is nothing that is just jumping out at me.  
permissions are fine, nothing noticeable in the logs.  and the strangest
piece is that it stamps some, but not others..

I tested with a couple pieces of mail that had no BAYES_* test/score in
the headers, and ran it through spamassassin -D, and then they both WERE
stamped with BAYES_* scores..

Are you doing some form of per-user bayes, or global?
Is the receipient for all the messages the same? Do certain senders get 
bayes tagging, and not others?

--
Nate Carlson <[EMAIL PROTECTED]>   | Phone : (952)943-8700
http://www.real-time.com| Fax   : (952)943-8500
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] MD or SA? Not always getting bayes_ scores

2004-11-23 Thread Nate Carlson
On Tue, 23 Nov 2004, Adam Beatham wrote:
> Unfortunately, there is nothing that is just jumping out at me.  
> permissions are fine, nothing noticeable in the logs.  and the strangest
> piece is that it stamps some, but not others..
> 
> I tested with a couple pieces of mail that had no BAYES_* test/score in
> the headers, and ran it through spamassassin -D, and then they both WERE
> stamped with BAYES_* scores..

Are you doing some form of per-user bayes, or global?

Is the receipient for all the messages the same? Do certain senders get 
bayes tagging, and not others?

--
Nate Carlson <[EMAIL PROTECTED]>   | Phone : (952)943-8700
http://www.real-time.com| Fax   : (952)943-8500

___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


[Mimedefang] Re-init Bayes

2004-11-23 Thread Ben Kamen
I asked a while back and didn't see an answer... how often do people like to 
reinit their bayes databases??

 -Ben
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] MD or SA? Not always getting bayes_ scores

2004-11-23 Thread Adam Beatham
Unfortunately, there is nothing that is just jumping out at me. 
permissions are fine, nothing noticeable in the logs.  and the strangest 
piece is that it stamps some, but not others..

I tested with a couple pieces of mail that had no BAYES_* test/score in 
the headers, and ran it through spamassassin -D, and then they both WERE 
stamped with BAYES_* scores..

-adam
-
"laughter is like music"

on 11/23/2004 3:50 PM Nate Carlson said the following:
On Fri, 19 Nov 2004, Adam Beatham wrote:
This may or may not be a MD problem, but I'm stumped.  I don't know when
it exactly it happened, but recently I've noticed more and more spam
trickling into my inbox.  After looking, it appears that not every
message gets scored with a bayes_* tag.. some do, some don't.  I'm
running SA 3.0.1, and MD 2.48.  I've gone through all my configs..but
nothing is glaring to me, and i haven't changed any configuration
settings for a quite a while.. Anyone else seen this or something
similar?

Have you checked the perms on your bayes databases?
Anything in your logs?
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] MD or SA? Not always getting bayes_ scores

2004-11-23 Thread Nate Carlson
On Fri, 19 Nov 2004, Adam Beatham wrote:
> This may or may not be a MD problem, but I'm stumped.  I don't know when
> it exactly it happened, but recently I've noticed more and more spam
> trickling into my inbox.  After looking, it appears that not every
> message gets scored with a bayes_* tag.. some do, some don't.  I'm
> running SA 3.0.1, and MD 2.48.  I've gone through all my configs..but
> nothing is glaring to me, and i haven't changed any configuration
> settings for a quite a while.. Anyone else seen this or something
> similar?

Have you checked the perms on your bayes databases?

Anything in your logs?

-- 
Nate Carlson <[EMAIL PROTECTED]>   | Phone : (952)943-8700
http://www.real-time.com| Fax   : (952)943-8500

___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] MD or SA? Not always getting bayes_ scores

2004-11-23 Thread Adam Beatham
Sorry, my apologies for the multiple postings.
-adam
-
"laughter is like music"

on 11/23/2004 9:30 AM Adam Beatham said the following:
Howdy,
This may or may not be a MD problem, but I'm stumped.  I don't know when
it exactly it happened, but recently I've noticed more and more spam
trickling into my inbox.  After looking, it appears that not every
message gets scored with a bayes_* tag.. some do, some don't.   I'm
running SA 3.0.1, and MD 2.48.  I've gone through all my configs..but
nothing is glaring to me, and i haven't changed any configuration
settings for a quite a while.. Anyone else seen this or something similar?

___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


[Mimedefang] MD or SA? Not always getting bayes_ scores

2004-11-23 Thread Adam Beatham
Howdy,
This may or may not be a MD problem, but I'm stumped.  I don't know when 
it exactly it happened, but recently I've noticed more and more spam 
trickling into my inbox.  After looking, it appears that not every 
message gets scored with a bayes_* tag.. some do, some don't.   I'm 
running SA 3.0.1, and MD 2.48.  I've gone through all my configs..but 
nothing is glaring to me, and i haven't changed any configuration 
settings for a quite a while.. Anyone else seen this or something similar?

--
-adam
-
"laughter is like music"
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


[Mimedefang] MD or SA? Not always getting bayes_ scores

2004-11-23 Thread Adam Beatham
Howdy,
This may or may not be a MD problem, but I'm stumped.  I don't know when
it exactly it happened, but recently I've noticed more and more spam
trickling into my inbox.  After looking, it appears that not every
message gets scored with a bayes_* tag.. some do, some don't.   I'm
running SA 3.0.1, and MD 2.48.  I've gone through all my configs..but
nothing is glaring to me, and i haven't changed any configuration
settings for a quite a while.. Anyone else seen this or something similar?
--
-adam
-
"laughter is like music"

___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] Strange line in log

2004-11-23 Thread David F. Skoll
On Tue, 23 Nov 2004, Yanick Quirion wrote:

> mimedefang-multiplexor[1843]: Starting slave 9 (pid 26747) (10 running):
> About to execute command 'relayok 66.192.85.201
> 66-192-85-201.gen.twtelecom.net '

That's perfectly normal; check the mimedefang-multiplexor source code.

Regards,

David.
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] Strange line in log

2004-11-23 Thread Dave Ellenberger
I had the effect you mentioned when my mimedefang-filter was temporarely 
broken due to a missing bracket. (Re)assure yours isn't:

   mimedefang.pl -test

Dave
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] Mimedefang + Sendmail X (libpmilter)

2004-11-23 Thread Jason Gurtz
On 11/17/2004 11:14, Raphael Pennisi wrote:
> 
> Hello,
> I would like to know if someone have never tried to use mimedefang with
> the new sendmail project (SMX), or if the libpmilter (policy milter) provided 
> is somehow similar to the libmilter.

I don't think the policy milter is the same thing.  I asked a while back
on the SMX list and got the reply that a full milter interface won't be
along for a while.  To paraphrase, rejecting is possible, but
munging/changing isn't.

___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


[Mimedefang] Strange line in log

2004-11-23 Thread Yanick Quirion
Hi all,

I was looking at my sendmail log file and I found a lot of lines saying
"About to execute command...". I'm a little worried about, is somebody
try to use mimedefang to run a process on my system?

Here is one of the lines I got:
mimedefang-multiplexor[1843]: Starting slave 9 (pid 26747) (10 running):
About to execute command 'relayok 66.192.85.201
66-192-85-201.gen.twtelecom.net '

Regards,

Yanick Quirion


___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] using action_add_part on msgs to be quarantined

2004-11-23 Thread Aleksandar Milivojevic
Rolf wrote:
hello
Try as I might I cannot add the spamassassin report to the mail msg 
prior to it being quarantined.
[snip]
# If you find the SA report useful, add it, I guess...
action_add_part($entity, "text/plain", "-suggest",
"$report\n",
"SpamAssassinReport.txt", "inline",0);
action_quarantine_entire_message();
action_discard();
This one-liner should do the trick:
   # Quarantine mail and save report
   action_quarantine_entire_message($report);
   # Second line of one-liner ;-)
   return action_bounce("Smile, be happy, don't send spam");
You will find the report in file MSG.0 (unless you had some other 
action_quarantine_* with message included, each goes in its own MSG.n file).

Side-effect: When/if you send quarantine notifications later on, they 
will contain the report.

--
Aleksandar Milivojevic <[EMAIL PROTECTED]>Pollard Banknote Limited
Systems Administrator   1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB  R3T 1L7
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] timeout before data read / smfi_chgheader returned MI_FAILURE

2004-11-23 Thread Aleksandar Milivojevic
Jurgen Botz wrote:
Sorry, I should have mentioned that I saw that discussion, but my
problem seems to be different.  I didn't see the same symptoms of
the defang process being restarted quickly, for example, and there
definitely seems to be a connection to this error:
  Nov 22 09:33:54 kahuna mimedefang[5656]: iAMHXhdD005903: 
smfi_addheader returned MI_FAILURE
You will get that error if sendmail gave up on MIMEDefang (milter 
timeout for example), and MIMEDefang attempted to add the header.

Also, do note that MIMEDefang process doesn't need to restart quickly. 
How quickly it will restart dependes on the MTA configuration of 
connecting (remote) end.  It has nothing to do with you.  If remote MTA 
has retry interval set to something low (1, 5 or 10 minutes), your 
MIMEDefang will restart quickly.  If remote MTA has retry interval set 
to one hour or even longer, than your old MIMEDefang process will 
probably finish long before the other side tries to retransmit, and you 
will not see MIMEDefang processes accumulating (as was discussed in 
previous thread).  However the couse of the problem is probably still 
the same: timeouts set too low so MIMEDefang can't finish processing 
large emails.  Either set longer timeouts (in both MIMEDefang and 
Sendmail), or lower the maximum size of email you accept, or both.

Also, make sure that you are not feeding emails larger than ~100kB to 
SpamAssassin.  SpamAssassin takes forever to process them, and it is 
very unlikely that spam will be that big.

--
Aleksandar Milivojevic <[EMAIL PROTECTED]>Pollard Banknote Limited
Systems Administrator   1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB  R3T 1L7
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


[Mimedefang] MD or SA? Not always getting bayes_ scores

2004-11-23 Thread Adam Beatham
Howdy,
This may or may not be a MD problem, but I'm stumped.  I don't know when
it exactly it happened, but recently I've noticed more and more spam
trickling into my inbox.  After looking, it appears that not every
message gets scored with a bayes_* tag.. some do, some don't.   I'm
running SA 3.0.1, and MD 2.48.  I've gone through all my configs..but
nothing is glaring to me, and i haven't changed any configuration
settings for a quite a while.. Anyone else seen this or something similar?
--
-adam
-
"laughter is like music"

___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] Is this mimedefang or spamassassin? re-send

2004-11-23 Thread Renaud PASCAL
Le Jeudi 23 Septembre 2004 11:44, Bill Maidment a écrit :
> Paul Murphy wrote:
> > Bill,
> >
> > See
> > http://lists.roaringpenguin.com/pipermail/mimedefang/2004-September/024
> >386.html - I looked into this a while back, and it seems to be due to a
> > bug in the code.
> >
> > The solution is to use SA 3.0 and switch to the SQL backend for the
> > Bayes and AWL databases, since the DBM code has always been a bit flaky
> > in multi-user environments, which multi-slave MD is of course.
>
> Thanks for that. It does confirm some of my suspicions.
> However, I have got round the problem, rather than solve it, by adding
> "lock_method flock" to /etc/mail/spamassassin.local.cf as suggested in
> the UPGRADE notes. i.e. I avoid NFS where the error seems to come from.

Am I too late for the "goin round the problem" contest ?-D)

I entered this in the crontab :

12,24,35,46,57 * * * * (su - defang -c 
'head /var/spool/MIMEDefang/bayes_journal &>/dev/null') ||  chown 
defang.defang /var/spool/MIMEDefang/bayes_journal

-- 
.
.
no sigfile no cry
.
.
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] using action_add_part on msgs to be quarantined

2004-11-23 Thread David F. Skoll
On Tue, 23 Nov 2004, Rolf wrote:

[calls action_add_part]

> yet there is no part added to any of the files in the relevant
> qdir-d-a-t-e-ti.me.-001/

> Presumably by design, but how can I include the SA report there?

my $qdir = get_quarantine_dir();
if (open(SAREPORT, ">$qdir/SA-REPORT.TXT")) {
print SAREPORT "$report\n";
close(SAREPORT);
}
action_quarantine_entire_message();

--
David.
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


[Mimedefang] Slave 0 stderr: invalid rule: MAILER_ACC

2004-11-23 Thread Dave Ellenberger
Hi!

I occasionally (5% chance maybe?) see the following in my maillog:

Nov 23 13:11:29 hostname mimedefang-multiplexor[22828]: Slave 0 stderr: 
invalid rule: MAILER_ACC

It doesn't seem to hinder MIMEDefang to do its work properly, but I wonder 
if I could get rid of it somehow. I'm currently running mimedefang_2.48-
1_i386.deb on debian/unstable with a strongly modified, but well-working, 
mimedefang-filter. However, I had the same behaviour in all previous 
versions (actually, since ever this year...) of mimedefang too.

Any ideas?

Dave

___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang