RE: SA Ignoring Config In LOCAL_RULES_DIR
On 16/9/2015 12:05 AM, Bowie wrote: > It sounds like it might be an issue with your init script. Check the init > script for spamassassin and see if it is starting spamd with a > '--siteconfigpath' option or similar. > You may also need to check in /etc/sysconfig if your init script pulls > anything from there. Thanks Bowie for your response, that thought had crossed my mind at some point also, sorry I failed to mention how it was starting up. I couldn't see any differences between working and not-working systems here and so I've included the advised files on how it's set up and how the process is running. With that said, I've narrowed the issue to be symbolic links, which I had thought I tested before sending my original message, but I guess not. I've got a btsync folder in /home that I link my exim and SA configuration files to, it would seem of the 5 servers configured this way, 3 SA's are having issues following the symbolic links. All the file permissions seem fine/the same as working and non-working systems. Although with this development, I've scripted a copy command when the files in /home/btsync change to copy them to "/etc/mail/spamassassin" and restart the SA service. This stream lines future changes even further, so win win really. I would be great to work out why symbolic links are stuffing up in 60% of my SA installs, but I think my care level is running low now. Thank you again Bowie for your support is has been greatly appreciated. This still leaves one system in an interesting state, that seems to read local.cf and addresses.cf files but ignores the latestspam.cf. I've tried renaming it to a.cf created a new file called newspam.cf and pasted the data into it, but it continues to ignore the data within. Yet moving this to the local.cf file, no worries it blocks on this. I've confirmed that "spamassassin --lint -D" sees the file but it doesn't seem to read it. Sep 16 15:13:11.529 [10089] dbg: config: using "/etc/mail/spamassassin" for site rules dir Sep 16 15:13:11.529 [10089] dbg: config: read file /etc/mail/spamassassin/addresses.cf Sep 16 15:13:11.529 [10089] dbg: config: read file /etc/mail/spamassassin/blocknathan.cf Sep 16 15:13:11.539 [10089] dbg: config: read file /etc/mail/spamassassin/latestspam.cf Sep 16 15:13:11.539 [10089] dbg: config: read file /etc/mail/spamassassin/local.cf . This is even further confirmed by creating a new file called blocknathan.cf with only a single blacklist_from that is ignored also. Is there any further debugging where you can see what it's read, or why it's not? What is making addresses.cf special? and why can I move it to zzzaddresses.cf and it still works :( I'm thinking a rebuild is due for this machine, as I can't back it up live with VMware ESXi snapshot, as it was poorly imported, so unless anyone else has any ideas I might just step up the migration. Thanks again for reading, Nathan. [root@avatar spamassassin]# ll total 64 -rw-r--r--. 1 root root 1418 Sep 16 15:17 addresses.cf drwxr-xr-x. 2 root root 4096 Feb 17 2013 channel.d -rw-r--r--. 1 root root 1299 Nov 16 2012 init.pre -rw-r--r--. 1 root root 7637 Sep 16 14:13 latestspam.cf -rw-r--r--. 1 root root 10815 Sep 16 15:09 local.cf drwx--. 2 root root 4096 Sep 16 01:10 sa-update-keys -rw-r--r--. 1 root root62 Nov 16 2012 spamassassin-default.rc -rwxr-xr-x. 1 root root35 Nov 16 2012 spamassassin-helper.sh -rw-r--r--. 1 root root55 Nov 16 2012 spamassassin-spamc.rc -rw-r--r--. 1 root root 2524 Nov 16 2012 v310.pre -rw-r--r--. 1 root root 1194 Nov 16 2012 v312.pre -rw-r--r--. 1 root root 2416 Nov 16 2012 v320.pre -rw-r--r--. 1 root root 1237 Nov 16 2012 v330.pre [root@mail2 ~]# ps aux | grep spamd root 43121 0.0 4.5 244384 32116 ?Ss 05:05 0:06 /usr/bin/spamd -d -c -m5 -H -r /var/run/spamd.pid nobody 43128 2.4 8.1 255396 56804 ?R05:06 4:55 spamd child root 43130 0.0 7.3 249660 51432 ?S05:06 0:12 spamd child [root@mail2 ~]# cat /etc/sysconfig/spamassassin # Options to spamd SPAMDOPTIONS="-d -c -m5 -H" [root@mail2 ~]# cat /etc/rc.d/init.d/spamassassin #!/bin/sh # # spamassassin This script starts and stops the spamd daemon # # chkconfig: - 78 30 # processname: spamd # description: spamd is a daemon process which uses SpamAssassin to check \ # email messages for SPAM. It is normally called by spamc \ # from a MDA. # Source function library. . /etc/rc.d/init.d/functions prog="spamd" # Source networking configuration. . /etc/sysconfig/network # Check that networking is up. [ ${NETWORKING} = "no" ] && exit 0 # Set default spamd configuration. SPAMDOPTIONS="-d -c -m5 -H" SPAMD_PID=/var/run/spamd.pid # Source spamd configuration. if [ -f /etc/sysconfig/spamassassin ] ; then . /etc/sysconfig/spamassassin
SA Ignoring Config In LOCAL_RULES_DIR
Hello, and thank you in advanced for looking into the below, I've been pondering over this issue for the past number of days, and don't feel I'm getting anywhere now. I am a system administrator and have been using a Exim/ClamAV/SpamAssassin setup for around 8 years, over which time I had felt I had learnt all the in's and out of the system, but this one has struck me as straight out annoying. I have got seven systems of different age, and operating systems (either Fedora or CentOS). I'll base the below on one of these systems, but it's important to note I'm having this issue on four of the seven machines. So therefore I have compared the config files I would normally use between working and nonworking systems to try and find the fault, but everything appears to be the same. All systems are at different point of updates, and I've tried to "yum update" a faulty machine to fix any bugs but not updated a working machine to see if it breaks. What I am finding is any config saved in the "/etc/mail/spamassassin/" folder is loaded during a "spamassassin --lint -D" but ignored during operations. For example I have a "addresses.cf" file for whitelist_to & from as well as blacklisted_to & from and these are simply ignored, no 100 or -100 score is added to the email header report. I've also got a "latestspam.cf" that I've hand written to block the latest breed of spams that I find an "sa-update" doesn't correct, again these are ignored. I've managed to get my local rules going again by moving the contents of these files into " /var/lib/spamassassin/3.003001/updates_spamassassin_org/local.cf" so my users aren't screaming at me anymore, this is confirmed using a "blacklist_from" and a 100 score is added. This is a fine temporary fix, but I would love for this directory to start working correctly again and to separate these data sets, for synchronization and update proposes. Exim is talking to the spamassassin process by using 127.0.0.1:783, and I've confirmed this connection, as when I stop the SA process, Exim complains it is missing in action. I have checked all the files in "/etc/mail/spamassassin/" in case something isn't toggled correct but I'm wondering where SA looks initially for it configuration folders. I.E. how does it know about the "/var/lib/spamassassin/3.003001/updates_spamassassin_org/" folder? I feel as if I'm missing a master configuration file somewhere. Or is anyone aware what would be making SA ignore my local.cf file in the expected LOCAL_RULES_DIR as listed in the "lint". I feel I've had a good look online and through the http://spamassassin.apache.org/ wiki and etc. I'm sorry if it is a simple issue and I'm just doing something wrong. Thanks again. [root@mail2 ~]# ss -tlp State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 127.0.0.1:783 *:* users:(("spamd",18049,5),("spamd",20074,5),("spamd",35678,5)) [root@mail2 ~]# spamassassin -V SpamAssassin version 3.3.1 running on Perl version 5.10.1 [root@mail2 ~]# exim -bV Exim version 4.72 #1 built 10-Oct-2014 09:23:33 Copyright (c) University of Cambridge, 1995 - 2007 Berkeley DB: Berkeley DB 4.7.25: (September 9, 2013) Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc TCPwrappers OpenSSL Content_Scanning DKIM Old_Demime Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz dnsdb dsearch ldap ldapdn ldapm nis nis0 nisplus passwd sqlite Authenticators: cram_md5 cyrus_sasl dovecot plaintext spa Routers: accept dnslookup ipliteral manualroute queryprogram redirect Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp Fixed never_users: 0 Size of off_t: 8 OpenSSL compile-time version: OpenSSL 1.0.1e-fips 11 Feb 2013 OpenSSL runtime version: OpenSSL 1.0.1e-fips 11 Feb 2013 Configuration file is /etc/exim/exim.conf [root@mail2 ~]# service spamassassin stop Stopping spamd:[ OK ] ==> /var/log/exim/main.log <== 2015-09-15 15:00:43 1ZbkEL-0009T1-Ob DKIM: d=icontactmail6.com s=default c=relaxed/relaxed a=rsa-sha256 [verification succeeded] 2015-09-15 15:00:43 1ZbkEL-0009T1-Ob spam acl condition: warning - spamd connection to 127.0.0.1, port 783 failed: Connection refused 2015-09-15 15:00:43 1ZbkEL-0009T1-Ob spam acl condition: all spamd servers failed 2015-09-15 15:00:44 1ZbkEL-0009T1-Ob <= bounces+1507538.10770803.82...@icpbounce.com H=drone058.ral.icpbounce.com [64.132.109.50] P=esmtp S=13408 [root@mail2 ~]# service spamassassin start Starting spamd:[ OK ] ==> /var/log/exim/main.log <== 2015-09-15 14:46:26 1Zbk0W-000Bcg-Bv
Bogus Data within style tags poisoning SA results
This seems to be a newer tactic, and a lot of email with content poisoning seems to be slipping through our spam filters. The reason is all the legitimate content between style tags. Most email apps don't show the data between style tags and therefore goes ignored and unseen by the recipient, but SA seems to be looking at it and using it to poison the scoring system. Here's an example of what we're seeing within the message source. style creatures quickly produce approve crevice nuclear moping esoteric pernicious motion faith does embodies does purify testament maximum exceeding centralism intellect prey tidying welcomed traal impress tuneless athwart mansions endures flames echo motion rooms alcohol rituals etc.. etc.. etc.. /style That is followed usually by common image spam with a link Click for more or Go to details. Anyone have a solution for this? Can SA be trained to ignore whats in between style tags? What would that break? Thanks, - N
sa-update isn't changing date stamp.
Hi all, I have running sa-update out of my weekly cron since you guys told me how to, early last year!! I noticed things aren't as good as they were.. so ran the sa-update -D and noticed that there was a few things that said failed, and the date stamps didn't alter on updates_spamassassin_org.xxx did i miss somthing, or has somthing brokenm, or is there just no updates? since dec last year?? Did a -D for you to see.. goaway:/var/lib/spamassassin/3.001007# ls -al total 20 drwxr-xr-x 3 root root 4096 2008-12-03 18:01 . drwxr-xr-x 3 root root 4096 2008-09-22 09:21 .. drwxr-xr-x 2 root root 4096 2008-12-03 18:01 updates_spamassassin_org -rw-r--r-- 1 root root 2200 2008-12-03 18:01 updates_spamassassin_org.cf -rw-r--r-- 1 root root 43 2008-12-03 18:01 updates_spamassassin_org.pre goaway:/var/lib/spamassassin/3.001007# sa-update -D [9278] dbg: logger: adding facilities: all [9278] dbg: logger: logging level is DBG [9278] dbg: generic: SpamAssassin version 3.1.7-deb [9278] dbg: config: score set 0 chosen. [9278] dbg: message: MIME PARSER START [9278] dbg: message: main message type: text/plain [9278] dbg: message: parsing normal part [9278] dbg: message: added part, type: text/plain [9278] dbg: message: MIME PARSER END [9278] dbg: dns: is Net::DNS::Resolver available? yes [9278] dbg: dns: Net::DNS version: 0.59 [9278] dbg: generic: sa-update version svn454083 [9278] dbg: generic: using update directory: /var/lib/spamassassin/3.001007 [9278] dbg: diag: perl platform: 5.008008 linux [9278] dbg: diag: module installed: Digest::SHA1, version 2.11 [9278] dbg: diag: module installed: HTML::Parser, version 3.55 [9278] dbg: diag: module installed: MIME::Base64, version 3.07 [9278] dbg: diag: module installed: DB_File, version 1.814 [9278] dbg: diag: module installed: Net::DNS, version 0.59 [9278] dbg: diag: module installed: Net::SMTP, version 2.29 [9278] dbg: diag: module installed: Mail::SPF::Query, version 1.999001 [9278] dbg: diag: module not installed: IP::Country::Fast ('require' failed) [9278] dbg: diag: module not installed: Razor2::Client::Agent ('require' failed) [9278] dbg: diag: module not installed: Net::Ident ('require' failed) [9278] dbg: diag: module not installed: IO::Socket::INET6 ('require' failed) [9278] dbg: diag: module not installed: IO::Socket::SSL ('require' failed) [9278] dbg: diag: module installed: Time::HiRes, version 1.86 [9278] dbg: diag: module installed: DBI, version 1.53 [9278] dbg: diag: module installed: Getopt::Long, version 2.35 [9278] dbg: diag: module installed: LWP::UserAgent, version 2.033 [9278] dbg: diag: module installed: HTTP::Date, version 1.47 [9278] dbg: diag: module installed: Archive::Tar, version 1.30 [9278] dbg: diag: module installed: IO::Zlib, version 1.04 [9278] dbg: gpg: Searching for 'gpg' [9278] dbg: util: current PATH is: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr /bin:/sbin:/bin [9278] dbg: util: executable for gpg was found at /usr/bin/gpg [9278] dbg: gpg: found /usr/bin/gpg [9278] dbg: gpg: release trusted key id list: 5E541DC959CB8BAC7C78DFDC4056A61A52 44EC45 26C900A46DD40CD5AD24F6D7DEE01987265FA05B 0C2B1D7175B852C64B3CDC716C553978 24F434CE [9278] dbg: channel: attempting channel updates.spamassassin.org [9278] dbg: channel: update directory /var/lib/spamassassin/3.001007/updates_spa massassin_org [9278] dbg: channel: channel cf file /var/lib/spamassassin/3.001007/updates_spam assassin_org.cf [9278] dbg: channel: channel pre file /var/lib/spamassassin/3.001007/updates_spa massassin_org.pre [9278] dbg: channel: metadata version = 699146 [9278] dbg: dns: 7.1.3.updates.spamassassin.org = 699146, parsed as 699146 [9278] dbg: channel: current version is 699146, new version is 699146, skipping channel [9278] dbg: diag: updates complete, exiting with code 1 goaway:/var/lib/spamassassin/3.001007# ls -al total 20 drwxr-xr-x 3 root root 4096 2008-12-03 18:01 . drwxr-xr-x 3 root root 4096 2008-09-22 09:21 .. drwxr-xr-x 2 root root 4096 2008-12-03 18:01 updates_spamassassin_org -rw-r--r-- 1 root root 2200 2008-12-03 18:01 updates_spamassassin_org.cf -rw-r--r-- 1 root root 43 2008-12-03 18:01 updates_spamassassin_org.pre Any advice?? N
is sa-update doing its thing?
Hi guys.. I would have expected to find this one so quickly, I tell you, either my google skills are on hold this week, or its not a common question at all!! How do i tell is sa-update is working? I assume either i can check a file date somewhere, or a log file, but tried looking about, and no luck... any hints would be gratefully received! N
Re: is sa-update doing its thing?
Thanks all of you.. Found it!! It seems I am running it from a cron, and all is working.. I was just concerned as the amount of spam getting through seems to be increasing.. I guess I need to read more and tweak stuff!! So, you may have guessed I am not good at this!! What should a newbie look at first, tweak, learn to do with Spamassassin, to get better results?? where should I apply my limited research skills? or what should I look into that will make this a more effective system for my users? I guess I am looking for the lists thoughts on the most effective starting step?? N At 21:23 23/09/2008, you wrote: Hi guys.. I would have expected to find this one so quickly, I tell you, either my google skills are on hold this week, or its not a common question at all!! How do i tell is sa-update is working? I assume either i can check a file date somewhere, or a log file, but tried looking about, and no luck... any hints would be gratefully received! N
Foreign Languages
Does SPAM Assassin score what we boarheaded Americans consider to be foreign language email messages the same as it would English? Pardon my ignorance on the matter! Thanks!! Nate
3.0.2 rules
Hi I am running an old version on debian. server:/usr/doc/spamassassin# spamassassin -V SpamAssassin version 3.0.2 running on Perl version 5.6.1 server:/usr/doc/spamassassin# I havn't done an apt-get upgrade for ages, and as such, when i did, the spamasasin failed to upgrade for some conflict, etc.. I'm not strong enough in skill to figure it out, and have started a rebuild of a newer machine anyway. however untill I get this new machine set up, and move the compant over to the new one, I realy need to get the rules updated to the newest I can under the 3.0.2 version. I have looked over the wiki, and belive I can't use sa-update, and found a page about updateing the rules for 3.1.0 - but its a little to technical for me, and I am missing some things it seems to assume... So.. Can any one help me. I think the key parts I am missing are where do I get a set of rules that will work with 3.0.2 that are the most recent rules possible... and then, where do I put them!! Thanks in advance N
3.0.2 rules
Hi I am running an old version on debian. server:/usr/doc/spamassassin# spamassassin -V SpamAssassin version 3.0.2 running on Perl version 5.6.1 server:/usr/doc/spamassassin# I havn't done an apt-get upgrade for ages, and as such, when i did, the spamasasin failed to upgrade for some conflict, etc.. I'm not strong enough in skill to figure it out, and have started a rebuild of a newer machine anyway. however untill I get this new machine set up, and move the compant over to the new one, I realy need to get the rules updated to the newest I can under the 3.0.2 version. I have looked over the wiki, and belive I can't use sa-update, and found a page about updateing the rules for 3.1.0 - but its a little to technical for me, and I am missing some things it seems to assume... So.. Can any one help me. I think the key parts I am missing are where do I get a set of rules that will work with 3.0.2 that are the most recent rules possible... and then, where do I put them!! Thanks in advance N
Need to block spam - help!
I am getting pounded by increase your size, your sausage is small for your darling emails. The subject is always different and the body, but the common words. Is there a ruleset out there? I am running sa 3.1.7 with all the latest sa-updates, but these just come right on through.
lint check of update failed
Running SA 3.1.7. Never had a problem with sa-update until today. I'm getting channel: lint check of update failed, channel failed. Running spamassassin -D --lint does not return any errors, however. How do I fix this?
My Mail is being blocked
Hello, Running on Postfix 2.3.3, amavisd-new-2.4.2, SA 3.1.4. Some users on my server are starting to get a message stating Unsolicated email apparently from you has been stopped. We try to reduce backscatter. I have saawl whitelisting setup and it is being stored in mysql. I also have bayes set to autolearn and it is stored in mysql. I can't find any information on how to make sure valid users don't get blocked or how to unblock their email. Please help. It's becoming a problem with more and more users.
Re: My Mail is being blocked
Benny Pedersen wrote: That message is coming from amavisd-new. There are two ways his users would be seeing that message: 1) he is scanning outgoing email (why?) to autolearn ham and it is scoring that email as possible spam, or 2) it is coming from a remote mail system that customers are trying to send mail to. policy banks in amavisd solves this, postfix/amavisd can have diff banks for non authed users and smtp authed, do not blame me :-) set kill level highter for auth users then non authed Policy banks. I'll look into it. Thanks for all the responses I have enough hear to solve the problem now. Options to fix summary: 1. Have users use their ISP's smtp server. 2. Have a separate outgoing mail server from my incoming mail server 3. http://www200.pair.com/mecham/spam/bypassing.html 4. Policy Banks and higher kill level for auth users. I'll test option 4 first and comment on the final resolution for my case with this apparently from you blocked mail. By the way, none of the emails I am sending out or my clients are spam in any way, but for accounts that apparently send a lot of email it happens more often. Not sure how this factors in exactly, but that seems to be the trend so far.
RE: Spamassassin munging headers
Title: Scalix message content Hello SA Users, Our software uses SpamAssassin to scorevarious content, but the score below doesn't make much sense: "2.6 ALL_NATURAL BODY: Spam is 100% natural?!" Anyone familiar with this or have insight? Also, if there is any documentation on scoring, please send that alongtoo. Thanks! Nate From: Hardy, Anthony [mailto:[EMAIL PROTECTED] Sent: Monday, August 28, 2006 9:21 AMTo: usersSubject: Spamassassin munging headers A few particular email servers have been complaining about munged email headers and it seems that SpamAssassin is the culprit. I saw something about this somewhere on another list, but couldnt find a fix. It seems as if the problem still exists in the latest version. The workaround was to remove status headers: remove_header all Status I believe the problem was in a lack of a proper return at the end of the spamassassin version line? Only a /n or a /r and not both. Is anyone else aware of this problem? Anthony HardyDirector of Technology/ISJefferson Davis Community College[EMAIL PROTECTED]251.809.1531
What does ALL_NATURAL BODY mean?
Title: Scalix message content Hey Bill, Sorry about that- first timer in this group... anyone know why a message is scored with the following?: "2.6 ALL_NATURAL BODY: Spam is 100% natural?!" Thanks again, Nate From: Bill Landry [mailto:[EMAIL PROTECTED] Sent: Monday, August 28, 2006 9:37 AMTo: Nathan Brink; usersSubject: Re: Spamassassin munging headers Why would you hijack someone else's thread? If you are not going to at least response to the original question, then at least have the courtesy to start your own new message thread. Bill - Original Message - From: Nathan Brink To: users Sent: Monday, August 28, 2006 9:27 AM Subject: RE: Spamassassin munging headers Hello SA Users, Our software uses SpamAssassin to scorevarious content, but the score below doesn't make much sense: "2.6 ALL_NATURAL BODY: Spam is 100% natural?!" Anyone familiar with this or have insight? Also, if there is any documentation on scoring, please send that alongtoo. Thanks! Nate From: Hardy, Anthony [mailto:[EMAIL PROTECTED] Sent: Monday, August 28, 2006 9:21 AMTo: usersSubject: Spamassassin munging headers A few particular email servers have been complaining about munged email headers and it seems that SpamAssassin is the culprit. I saw something about this somewhere on another list, but couldnt find a fix. It seems as if the problem still exists in the latest version. The workaround was to remove status headers: remove_header all Status I believe the problem was in a lack of a proper return at the end of the spamassassin version line? Only a /n or a /r and not both. Is anyone else aware of this problem? Anthony HardyDirector of Technology/ISJefferson Davis Community College[EMAIL PROTECTED]251.809.1531
RE: conf file
That's just what I was looking for. Thank you. On Tue, 2006-05-23 at 10:11 -0400, Bowie Bailey wrote: Nathan Broderick wrote: Where does the local.cf file first get read in by SpamAssassin? Run 'spamassassin -D --lint' and you can see exactly when all the config files are read in.
RE: FetchmailRC and Bayes
Mouss replied make sure the user who runs sa-learn is the one you use when running spamassassing -D --lint above. if it's the case, try feeding some messages to sa-learn and see if it learns them. The reason I am using fetchmailrc is because I am using dbmail to store mail in mysql. So my mail is not in a standard mbox format that I can just point sa-learn to. If I could I wouldn't have any use for fetchmailrc at this point. So I'm not sure how to test sa-learn other than through fetchmail with my particular setup. I didn't see it in the manual, but how can you tell fetchmail to use a specific user? ~mhe~
FetchmailRC and Bayes
Im running SA v 3.0.2 on Debian Woody. Spamassassin D lint returns the following regarding Bayes: debug: bayes: found bayes db version 3 debug: bayes: Not available for scanning, only 1 spam(s) in Bayes DB 200 I have been running the following fetchmailrc against ham and spam folders. My ham folder has 283 messages and my spam folder has 1014 messages. I can see that the messages are being read, but for some reason Bayes is not activating now that I have the minimums required for spam and ham. Why isnt Bayes running or even registering that I have more than 1 spam message? In my /etc/spamassassin/local.cf file I have: use_bayes 1 bayes_auto_learn 1 # fetchmailrc file set daemon 3600 set syslog set no bouncemail defaults: antispam -1 batchlimit 100 limit 512000 poll localhost with proto imap user [EMAIL PROTECTED] mda /usr/bin/sa-learn spam single password secret; folder \#Public/Spam keep poll localhost with proto imap user [EMAIL PROTECTED] mda /usr/bin/sa-learn ham single password secret; folder \#Public/Ham keep # End fetchmailrc file
RE: I'm a newbie to spamassassin
Sorry if those questions are too obvious to all you, but I'm completely lost - I'm unable to digest all the info available on the web. If you can help me to find out if I need a milter or not, and if so, which milter do I need, I'll continue with more questions :-) Thanks VERY much in advance. Xavi. If you're new to SpamAssassin, you're best bet is to integrate it and Sendmail with a fully customizable integration package. Two such packages are MailScanner http://www.mailscanner.info - My favorite, well documented, and dead simple to install. Amavisd-new http://www.ijs.si/software/amavisd/