Re: Apache SpamAssassin 3.2.0 using older version of ImageInfo
r p wrote: I can not even get the 3.2 to run cleanly due to ImageInfo. When I leave the ImageInfo in the init.pre and in the plugin directory I get: That's the problem, ImageInfo is enabled in v320.pre in the new SA, review that old init.pre . What plugin directory? what do you mean by that? plugins are installed automagically (cpan, or rpm, or when you do make install) you don't have to put anything anywhere by yourself. [snip] If I take the ImageInfo out , I get: warn: plugin: failed to parse plugin /etc/mail/spamassassin/ImageInfo.pm: Can't locate /etc/mail/spamassassin/ImageInfo.pm in @INC (@INC contains: /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl) at /usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin/PluginHandler.pm line 97. Running sendmail 8.13 and spamassassin via procmail. That's a strange place for your SA installation, vendor_perl... usually it's under site_perl. Even worse is the first line, there is no such ImageInfo.pm under /etc/mail/spamassassin, it should be with all the rest of the SA installation. Looks to me like a scrambled installation. -- René Berber
Re: re2c and sare rules
On Sun, 06 May 2007 13:25:08 +0100 [EMAIL PROTECTED] (Justin Mason) wrote: > Loren Wilton writes: > > Its a new feature with 3.2. We have to rewrite most of the obfu > > rules to get around this, and none of us have had the time yet. > > more correctly, it's a perl bug, not a new feature in 3.2.0. Yeah - I saw the bug posting after googling for the right stuff. I had to disable sare obfu, bml and adult to get things to work. I had my maillogs fill up /var (4GB) in under an hour so I'm hoping the sare rules get updated soon. Thanks, Josh
Re: Apache SpamAssassin 3.2.0 using older version of ImageInfo
On Sun, May 06, 2007 at 02:59:13PM -0700, r p wrote: > I can not even get the 3.2 to run cleanly due to ImageInfo. > When I leave the ImageInfo in the init.pre and in the plugin directory I get: > warn: Subroutine new redefined at /etc/mail/spamassassin/ImageInfo.pm > line 68. You have the standard ImageInfo plugin, and a different one in /etc/mail/spamassassin. Choose one. > If I take the ImageInfo out , I get: > warn: plugin: failed to parse plugin /etc/mail/spamassassin/ImageInfo.pm: > Can't locate /etc/mail/spamassassin/ImageInfo.pm in @INC (@INC You're trying to load the plugin after you've removed it. -- Randomly Selected Tagline: "Outside of traffic, there is nothing that has held this country back as much as committees." - Will Rodgers pgpubb3TyDxE7.pgp Description: PGP signature
Re: Apache SpamAssassin 3.2.0 using older version of ImageInfo
On 2 May 2007 at 15:32, Rose, Bobby wrote: > The ImageInfo packaged with 3.2.0 isn't the latest version from SARE as > it's missing the image_name_regex method. > > -=B > > I can not even get the 3.2 to run cleanly due to ImageInfo. When I leave the ImageInfo in the init.pre and in the plugin directory I get: warn: Subroutine new redefined at /etc/mail/spamassassin/ImageInfo.pm line 68. [10997] warn: Subroutine _get_images redefined at /etc/mail/spamassassin/ImageInfo.pm line 193. [10997] warn: Subroutine image_named redefined at /etc/mail/spamassassin/ImageInfo.pm line 230. [10997] warn: Subroutine image_count redefined at /etc/mail/spamassassin/ImageInfo.pm line 246. [10997] warn: Subroutine pixel_coverage redefined at /etc/mail/spamassassin/ImageInfo.pm line 262. [10997] warn: Subroutine image_to_text_ratio redefined at /etc/mail/spamassassin/ImageInfo.pm line 278. [10997] warn: Subroutine image_size_exact redefined at /etc/mail/spamassassin/ImageInfo.pm line 300. [10997] warn: Subroutine image_size_range redefined at /etc/mail/spamassassin/ImageInfo.pm line 316. [10997] warn: Subroutine result_check redefined at /etc/mail/spamassassin/ImageInfo.pm line 344. If I take the ImageInfo out , I get: warn: plugin: failed to parse plugin /etc/mail/spamassassin/ImageInfo.pm: Can't locate /etc/mail/spamassassin/ImageInfo.pm in @INC (@INC contains: /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl) at /usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin/PluginHandler.pm line 97. Running sendmail 8.13 and spamassassin via procmail.
Re: False Positive
Marc Perkel wrote the following on 5/6/2007 9:17 AM -0800: > Been getting a few strange false positives lately. Here's something > unusual. > > X-Spam-Report: > * 0.0 HTML_MESSAGE BODY: HTML included in message > * -2.0 BAYES_05 BODY: Bayesian spam probability is 1 to 5% > * [score: 0.0206] > * 1.4 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars > * 25 AWL AWL: From: address is in the auto white-list > > Is there some change to the AWL scoring? I haven't paid a lot of > attention to this but a score of 25 is rather high. Perhaps this needs > some tweaking? AWL scoring is based on on the score difference (positive or negative) between the weight of the current message against the average weight of previous messages from that particular message sender. For more detail, see: http://wiki.apache.org/spamassassin/AutoWhitelist Bill
R: False Positive
> -Messaggio originale- > Da: Marc Perkel [mailto:[EMAIL PROTECTED] > > Been getting a few strange false positives lately. Here's something > unusual. > > X-Spam-Report: > * 0.0 HTML_MESSAGE BODY: HTML included in message > * -2.0 BAYES_05 BODY: Bayesian spam probability is 1 to 5% > * [score: 0.0206] > * 1.4 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 > chars > * 25 AWL AWL: From: address is in the auto white-list > > Is there some change to the AWL scoring? I haven't paid a lot of > attention to this but a score of 25 is rather high. Perhaps this needs > some tweaking? The AWL score is not fixed: it is computed based on the scores "gained" from previous messages from the very same source of the message you see (i.e.: same "from:" and MTA ip address). This means that the sender of the message you see did a lot of spam in the past, OR that somebody used him/her mail account in order to send spam. Giampaolo
False Positive
Been getting a few strange false positives lately. Here's something unusual. X-Spam-Report: * 0.0 HTML_MESSAGE BODY: HTML included in message * -2.0 BAYES_05 BODY: Bayesian spam probability is 1 to 5% * [score: 0.0206] * 1.4 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars * 25 AWL AWL: From: address is in the auto white-list Is there some change to the AWL scoring? I haven't paid a lot of attention to this but a score of 25 is rather high. Perhaps this needs some tweaking?
Evaluating how good is a rule
Dears, I'm something in need to write custom rules in order to penalize some kind of messages running through my SA. Now, of course I do apply a 0.001 score to my own test rules in order not to create FPs on received mails. Also, things are setup such that no SA header is added to messages yielding a score below 5. This basically means that, while I may not causing FPs while testing, I can't even detect any possible FP which my rules may cause "in production" (when they get assigned an higher score) since I don't always get the SA headers in processed messages. Is there any way to instruct SA to put a copy of the message in some folder when a specific rule gets triggered? That would help rule debugging on running systems a lot... Thanks, - Giampaolo Tomassoni - I.T. Consultant Piazza VIII Aprile 1948, 4 I-53043 Chiusi (SI) - Italy Tel/Ph: +39-0578-21100 MAI mandare un messaggio a: NEVER send an e-mail to: [EMAIL PROTECTED]
Problem installing SA 3.2.0 via CPAN on OPenSuSE 10.2 or SLES 10
Hi guys, I've tried to install SA 3.2.0 on both an unpatched and fully patched versions of OpenSuSE 10.2 and SLES 10 via CPAN but on all attempts I receive the following errors during one of the test phases. It would be great if someone could help me out. t/spamc_z...Not found: firstline = Return-Path: [EMAIL PROTECTED] # Failed test 2 in t/SATest.pm at line 633 Not found: subj = Subject: There yours for FREE! # Failed test 3 in t/SATest.pm at line 633 fail #2 Not found: endsinnums = TEST_ENDSNUMS # Failed test 4 in t/SATest.pm at line 633 fail #3 Not found: noreal = TEST_NOREALNAME # Failed test 5 in t/SATest.pm at line 633 fail #4 Not found: lastline = This must be the very last line # Failed test 6 in t/SATest.pm at line 633 fail #5 Not found: flag = X-Spam-Flag: YES # Failed test 7 in t/SATest.pm at line 633 fail #6 Not found: stars = X-Spam-Level: ** # Failed test 8 in t/SATest.pm at line 633 fail #7 Not found: status = X-Spam-Status: Yes, score= # Failed test 9 in t/SATest.pm at line 633 fail #8 Output can be examined in: log/d.spamc_z/out.1 t/spamc_z...FAILED tests 2-9 Failed 8/9 tests, 11.11% okay Thanks,
Re: sa-compile Problem
Klaus Heinz wrote:
> Wolfgang Breyha wrote:
>
>> But after restarting spamd I get lots of message complaining about missing
>> body_400.pm up to body_1000.pm and same for body_neg400.pm to
>> body_neg1000.pm.
> ^^^
> Are you sure about this one? I have not seen this yet.
Correct! The complete list in my logs is
body_1000.pm
body_500.pm
body_900.pm
body_neg1000.pm
body_neg400.pm
body_neg900.pm
body_neg950.pm
> The messages only appear if "allow_user_rules 1" is used in local.cf.
Confirmed. First I though it depends on activation of Shortcircuit plugin.
But it depends on allow_user_rules as you say.
I did some tests with spamd running in debugmode and the missing module
messages apear inbetween of...
[10778] info: spamd: connection from localhost.localdomain [127.0.0.1] at
port 50835
[10778] info: spamd: setuid to spamass succeeded
[10778] dbg: config: finishing parsing!
[10778] dbg: conf: finish parsing
[10778] dbg: replacetags: replacing tags
[10778] dbg: replacetags: done replacing tags
[10778] dbg: zoom: loading compiled ruleset from
/var/lib/spamassassin/compiled/3.002000
[10778] error: Can't locate
Mail/SpamAssassin/CompiledRegexps/body_neg950.pm
[10778] dbg: zoom: no compiled ruleset found for
Mail::SpamAssassin::CompiledRegexps::body_neg400
[10778] dbg: info: user has changed
[10778] dbg: bayes: tie-ing to DB file R/O
/var/spamass/.spamassassin/bayes_toks
[10778] dbg: bayes: tie-ing to DB file R/O
/var/spamass/.spamassassin/bayes_seen
[10778] dbg: bayes: found bayes db version 3
In SpamAssassin.pm the function finish_parsing() is called if
allow_user_rules is true. This way
Mail::SpamAssassin::Plugin::Rule2XSBody::finish_parsing_end() get's called
again.
Since Logger.pm does
$SIG{__DIE__} = sub {
log_message("error", $_[0]) if $_[0] !~ /\bin eval\b/;
};
the failing "eval" get's logged.
So I've filed
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5449
Regards, Wolfgang
--
Wolfgang Breyha <[EMAIL PROTECTED]> | http://www.blafasel.at/
Vienna University Computer Center | Austria
Re: SA-Compile Error
check the FAQ --[ UxBoD ]-- writes: > Hi, > > I have just run sa-compile against my rules which ran through okay. > Though when I perform a lint now I get the following error :- > > /usr/bin/perl: symbol lookup > error: > /var/lib/spamassassin/compiled/3.002000/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so: > undefined symbol: Mail_SpamAssassin_CompiledRegexps_body_0_scan1 > > Any ideas on how to resolve it ? > > -- > --[ UxBoD ]-- > // PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import" > // Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8 > // Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8 > // Phone: +44 845 869 2749 > // SIP Phone: [EMAIL PROTECTED] > > -- > This message has been scanned for viruses and dangerous content by > MailScanner, and is > believed to be clean.
Re: sa-compile Problem
Wolfgang Breyha writes: > Hi! > > I tried to use sa-compile. sa-compile itself succeeded and body_0 rules are > built. > > But after restarting spamd I get lots of message complaining about missing > body_400.pm up to body_1000.pm and same for body_neg400.pm to body_neg1000.pm. > > eg.: > Can't locate Mail/SpamAssassin/CompiledRegexps/body_neg1000.pm in @INC (@INC > ) > > I can't find any information about those. Only body_0.pm. But this one was > correctly built and is used by spamd. > > spamd[21349]: zoom: able to use 309/309 'body_0' compiled rules (100%) > > BTW, the sa-compile docu requires re2c 0.10.x. Is 0.10(.8) really a > requirement, or is 0.12.0 ok, too? Actually, it's emerged that 0.10.x and 0.11.x contain a bug -- 0.12.0 is the only useful version to use at the moment ;) --j.
SA-Compile Error
Hi, I have just run sa-compile against my rules which ran through okay. Though when I perform a lint now I get the following error :- /usr/bin/perl: symbol lookup error: /var/lib/spamassassin/compiled/3.002000/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so: undefined symbol: Mail_SpamAssassin_CompiledRegexps_body_0_scan1 Any ideas on how to resolve it ? -- --[ UxBoD ]-- // PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import" // Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8 // Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8 // Phone: +44 845 869 2749 // SIP Phone: [EMAIL PROTECTED] -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
Re: re2c and sare rules
Loren Wilton writes: > Its a new feature with 3.2. We have to rewrite most of the obfu rules to > get around this, and none of us have had the time yet. more correctly, it's a perl bug, not a new feature in 3.2.0. --j.
Re: sa-compile Problem
yep, sounds like a bug, unfortunately... --j. Loren Wilton writes: > This looks like something that should be posted to Bugzilla. Likely there > was very little testing with allow_user_rules = 1. > > Loren > > - Original Message - > From: "Klaus Heinz" <[EMAIL PROTECTED]> > To: > Sent: Sunday, May 06, 2007 1:57 AM > Subject: Re: sa-compile Problem > > > > Wolfgang Breyha wrote: > > > >> But after restarting spamd I get lots of message complaining about > >> missing > >> body_400.pm up to body_1000.pm and same for body_neg400.pm to > >> body_neg1000.pm. > > ^^^ > > Are you sure about this one? I have not seen this yet. > > > >> > >> eg.: > >> Can't locate Mail/SpamAssassin/CompiledRegexps/body_neg1000.pm in @INC > >> (@INC ) > > > > I see exactly the same messages. The missing modules are (in this order > > but not always all of them for a single mail message) > > > > body_neg950.pm > > body_neg900.pm > > body_neg1000.pm > > body_1000.pm > > body_500.pm > > body_neg400.pm > > > > The messages only appear if "allow_user_rules 1" is used in local.cf. > > > > All modules except for body_500.pm correspond to priority values set in > > 60_awl.cf and 60_shortcircuit.cf. Where body_500.pm comes from I don't > > know. > > > > Mostly the messages look like this > > > > May 6 09:25:59 silence spamd[704]: Can't locate > > Mail/SpamAssassin/CompiledRegex > > ps/body_neg900.pm in @INC (@INC contains: > > /var/spamassassin/compiled/3.002000 > > /var/spamassassin/compiled/3.002000/auto > > /var/spamassassin/compiled/3.002000 > > /var/spamassassin/compiled/3.002000/auto > > lib /usr/pkg/lib/perl5/vendor_perl/5.8.0/i386-netbsd-thread-multi > > /usr/pkg/lib/perl5/vendor_perl/5.8.0 > > /usr/pkg/lib/perl5/site_perl/5.8.0/i386-netbsd-thread-multi > > /usr/pkg/lib/perl5/site_perl/5.8.0 /usr/pkg/ > > lib/perl5/5.8.0/i386-netbsd-thread-multi /usr/pkg/lib/perl5/5.8.0) at > > (eval 738) line 1. > > > > Note the duplicated paths "/var/spamassassin/compiled/3.002000 > > /var/spamassassin/compiled/3.002000/auto". Sometimes, I don't know why or > > when, the INC array runs wild and the number of those duplicated paths > > starts to grow, I have seen up to 11 occurences of those two paths in an > > error message. > > > > The error messages appear in a brand new SA 3.2.0 installation on NetBSD > > 3.1 with spamc/spamd, no special configuration, user rules or anything > > except for the addition of "allow_user_rules 1" and the enabled plugin > > Rule2XSBody. spamassassin --lint does not show any issues. > > Rules were compiled with re2c 0.12.0. > > > > A last check shows that "spamassassin -D < testmessage" does not show > > the errors. > > > > ciao > > Klaus
RE: ANNOUNCE: Apache SpamAssassin 3.2.0 available
At 07:56 AM 5.5.2007 -0400, Michael Scheidell wrote: > >> -Original Message- >> From: Jack L. Stone [mailto:[EMAIL PROTECTED] >> Sent: Friday, May 04, 2007 9:20 AM >> To: Justin Mason; users@spamassassin.apache.org; >> [EMAIL PROTECTED]; [EMAIL PROTECTED] >> Cc: [EMAIL PROTECTED] >> Subject: Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available > >> >> Any projection when SA-3.2 will be in the FBSD ports? Sent >> email to [EMAIL PROTECTED], but bounced back. >> >> Thanks for any news on this > >There are a LOT of subtle changes... But for the brave, here is a >tarball. >cd /usr/ports/mail/p5-Mail-SpamAssassin >rm -rf > >Untar this there: http://www.secnap.com/downloads/sa320.tgz > >(and, yes, I am the official maintainer of the SA port, just want to >test it on a few more systems before submitting it, and sa-compile >doesn't work via ports due to the .11.0 version of rec2) > Many thanks for the reply and add'l info about the new version. I usually like to jump right on these updates, but methinks I'll hold off a little longer until it settles down a bit more. (^_^) Happy trails, Jack L. Stone System Admin Sage-american
Re: sa-compile Problem
This looks like something that should be posted to Bugzilla. Likely there was very little testing with allow_user_rules = 1. Loren - Original Message - From: "Klaus Heinz" <[EMAIL PROTECTED]> To: Sent: Sunday, May 06, 2007 1:57 AM Subject: Re: sa-compile Problem Wolfgang Breyha wrote: But after restarting spamd I get lots of message complaining about missing body_400.pm up to body_1000.pm and same for body_neg400.pm to body_neg1000.pm. ^^^ Are you sure about this one? I have not seen this yet. eg.: Can't locate Mail/SpamAssassin/CompiledRegexps/body_neg1000.pm in @INC (@INC ) I see exactly the same messages. The missing modules are (in this order but not always all of them for a single mail message) body_neg950.pm body_neg900.pm body_neg1000.pm body_1000.pm body_500.pm body_neg400.pm The messages only appear if "allow_user_rules 1" is used in local.cf. All modules except for body_500.pm correspond to priority values set in 60_awl.cf and 60_shortcircuit.cf. Where body_500.pm comes from I don't know. Mostly the messages look like this May 6 09:25:59 silence spamd[704]: Can't locate Mail/SpamAssassin/CompiledRegex ps/body_neg900.pm in @INC (@INC contains: /var/spamassassin/compiled/3.002000 /var/spamassassin/compiled/3.002000/auto /var/spamassassin/compiled/3.002000 /var/spamassassin/compiled/3.002000/auto lib /usr/pkg/lib/perl5/vendor_perl/5.8.0/i386-netbsd-thread-multi /usr/pkg/lib/perl5/vendor_perl/5.8.0 /usr/pkg/lib/perl5/site_perl/5.8.0/i386-netbsd-thread-multi /usr/pkg/lib/perl5/site_perl/5.8.0 /usr/pkg/ lib/perl5/5.8.0/i386-netbsd-thread-multi /usr/pkg/lib/perl5/5.8.0) at (eval 738) line 1. Note the duplicated paths "/var/spamassassin/compiled/3.002000 /var/spamassassin/compiled/3.002000/auto". Sometimes, I don't know why or when, the INC array runs wild and the number of those duplicated paths starts to grow, I have seen up to 11 occurences of those two paths in an error message. The error messages appear in a brand new SA 3.2.0 installation on NetBSD 3.1 with spamc/spamd, no special configuration, user rules or anything except for the addition of "allow_user_rules 1" and the enabled plugin Rule2XSBody. spamassassin --lint does not show any issues. Rules were compiled with re2c 0.12.0. A last check shows that "spamassassin -D < testmessage" does not show the errors. ciao Klaus
Re: sa-compile Problem
Wolfgang Breyha wrote: > But after restarting spamd I get lots of message complaining about missing > body_400.pm up to body_1000.pm and same for body_neg400.pm to body_neg1000.pm. ^^^ Are you sure about this one? I have not seen this yet. > > eg.: > Can't locate Mail/SpamAssassin/CompiledRegexps/body_neg1000.pm in @INC > (@INC ) I see exactly the same messages. The missing modules are (in this order but not always all of them for a single mail message) body_neg950.pm body_neg900.pm body_neg1000.pm body_1000.pm body_500.pm body_neg400.pm The messages only appear if "allow_user_rules 1" is used in local.cf. All modules except for body_500.pm correspond to priority values set in 60_awl.cf and 60_shortcircuit.cf. Where body_500.pm comes from I don't know. Mostly the messages look like this May 6 09:25:59 silence spamd[704]: Can't locate Mail/SpamAssassin/CompiledRegex ps/body_neg900.pm in @INC (@INC contains: /var/spamassassin/compiled/3.002000 /var/spamassassin/compiled/3.002000/auto /var/spamassassin/compiled/3.002000 /var/spamassassin/compiled/3.002000/auto lib /usr/pkg/lib/perl5/vendor_perl/5.8.0/i386-netbsd-thread-multi /usr/pkg/lib/perl5/vendor_perl/5.8.0 /usr/pkg/lib/perl5/site_perl/5.8.0/i386-netbsd-thread-multi /usr/pkg/lib/perl5/site_perl/5.8.0 /usr/pkg/ lib/perl5/5.8.0/i386-netbsd-thread-multi /usr/pkg/lib/perl5/5.8.0) at (eval 738) line 1. Note the duplicated paths "/var/spamassassin/compiled/3.002000 /var/spamassassin/compiled/3.002000/auto". Sometimes, I don't know why or when, the INC array runs wild and the number of those duplicated paths starts to grow, I have seen up to 11 occurences of those two paths in an error message. The error messages appear in a brand new SA 3.2.0 installation on NetBSD 3.1 with spamc/spamd, no special configuration, user rules or anything except for the addition of "allow_user_rules 1" and the enabled plugin Rule2XSBody. spamassassin --lint does not show any issues. Rules were compiled with re2c 0.12.0. A last check shows that "spamassassin -D < testmessage" does not show the errors. ciao Klaus
