Re: Install spamassassin

[Richard Collyer]

Banyan He wrote:

Hi Guys,
 
Can anyone provide me a process how to integrate the spamassassin with 
postfix. I tried many times. But I cannot identify why I always get 
the following logs.
 
Mar 10 05:38:26 gateway postfix/qmgr[13424]: 01A8217FBD: 
to=<[EMAIL PROTECTED] >, relay=none, 
delay=25610, delays=25610/0.01/0/0, dsn=4.3.0, status=deferred (mail 
transport unavailable)
Mar 10 05:38:26 gateway postfix/qmgr[13424]: C82B117FB7: 
from=<[EMAIL PROTECTED] >, size=362, nrcpt=1 
(queue active)
Mar 10 05:38:26 gateway postfix/qmgr[13424]: C82B117FB7: 
to=<[EMAIL PROTECTED] >, relay=none, 
delay=25989, delays=25989/0.01/0/0, dsn=4.3.0, status=deferred (mail 
transport unavailable)
Mar 10 05:39:06 gateway postfix/qmgr[13424]: warning: connect to 
transport spamassassin: Connection refused

I cannot find the cause. Does anyone know this?
 
Many thanks,
 
Banyan

Have you made sure spamassassin is running?

Cheers
Richard

Re: pls unsubcribe me

[Richard Collyer]

usha chowdary wrote:
pls unsubcribe me from this group 

From the headers:

list-unsubscribe: 

Re: commerce Antispam Products

[Richard Collyer]

> We're looking for a commerce antispam product.It should be high 
> performance and has the strong ability to capture spams.
> Could you recommend me a good product about it?We are an ISP,have 
> millions of users.
> (Please don't say Symantec's brightmail,it's fairly good,but it's too 
> expensive for us.)

Is there any reason that you don't want to use spamassassin?

Regards,
Richard

Re:

[Richard Collyer]

Andreas Walter wrote:

unsubscribe
end



Send mail to: [EMAIL PROTECTED] to unsubscribe.

Re: unsubscribe

[Richard Collyer]

Jeremy wrote:
unsubscribe 



__ NOD32 1.1543 (20060517) Information __

This message was checked by NOD32 antivirus system.
http://www.eset.com





send e-mail to [EMAIL PROTECTED]

Re: Blank emails

[Richard Collyer]

Richard Collyer wrote:

Ryan Holowaychuk wrote:
I just sent an email and had some lengthy text and it gave it a score 
of 3.8


What score did the blank e-mail get the one that is getting past the 
spam filters.


Cheers
Richard

Re: Blank emails

[Richard Collyer]

Ryan Holowaychuk wrote:

I just sent an email and had some lengthy text and it gave it a score of 3.8

Re: Blank emails

[Richard Collyer]

Ryan Holowaychuk wrote:

I am have SA running on a windows machine.
 
Sa 3.1.1

Hmailer
Clam ANtivirus
 
I have it set up, but when an email goes through the server I am getting 
blank emails?  what am I missing here?


What level is the spam getting?

Its probably only tripping one rule for short message length.

Cheers
Richard

Re: SA 99,9% CPU and freeze

[Richard Collyer]

nicolas aulas wrote:

Any idea what's wrong ? Thanks in advance for your help.


Going on that try removing dns availible.

Also try and re-install / upgrade Net::DNS perl module.

Have you updated perl recentely?

Cheers
Richard



After upgrade Net::DNS to 0.57, I got exactly the same error log

[1353] warn: dns: sendto() failed:  at
/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/DnsResolver.pm line 340.
(...)

BUT SA up to "only" 55% cpu and after 1-2 seconds, mail is scanned correctly
... End of my freeze problem ?

I still don't know why this mail is problematic... Is there any suplementary
tests to do ? Somebody can test it ?

Thanks

Nicolas


I'd also try updating perl.

How long is it taknig to scan the mail? I'm guessing it could be a DNS 
issue.


Try running a local DNS server to see if that helps.

do spamassassin -D < test-message.msg

and see what that returns. Where does it hang etc...

Also look at: 
http://linuxfromscratch.org/pipermail/blfs-support/2005-October/057116.html


Cheers
Richard

Also: make sure you reply to the list ;)

Re: SA 99,9% CPU and freeze

[Richard Collyer]

Nicolas Aulas wrote:
 >> With some mail (don't know why), SA up to 99,9% cpu and freeze mail 
queu (mail

are labelled in postfix as " maybe be sent more than once)

With problematic mail, sudo -u amavis -s | spamassassin -t <
/root/amavis-20060515T124439-32765/email.txt give :

[1353] warn: dns: sendto() failed:  at
/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/DnsResolver.pm line 340.
[1353] warn: dns: sendto() failed:  at
/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/DnsResolver.pm line 340.
[1353] warn: dns: sendto() failed:  at
/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/DnsResolver.pm line 340.
[1353] warn: dns: sendto() failed:  at
/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/DnsResolver.pm line 340.
[1353] warn: dns: sendto() failed:  at
/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/DnsResolver.pm line 340.
[1353] warn: dns: sendto() failed:  at
/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/DnsResolver.pm line 340.
[1353] warn: dns: sendto() failed:  at
/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/DnsResolver.pm line 340.
[1353] warn: dns: sendto() failed:  at
/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/DnsResolver.pm line 340.
[1353] warn: dns: sendto() failed:  at
/usr/lib/perl5/site_perl/5.8.3/Mail/SpamAssassin/DnsResolver.pm line 340.

Any idea what's wrong ? Thanks in advance for your help.



Going on that try removing dns availible.

Also try and re-install / upgrade Net::DNS perl module.

Have you updated perl recentely?

Cheers
Richard

Re: Spamassassin spamming system?

[Richard Collyer]

David Baron wrote:
Not really, but lots of nice instances are really bogging down the system when 
a lot of emails are being processed. They are run nice 15. How might I reduce 
this problem?


Using a debian Sid, exim4, mail retrieved by fetchmail. Spamassassin and clamd 
run through procmail.




spamassassin -D < message.msg

Look at the debug and see if it hangs anywhere...i.e. pauses while the 
output is running.


Cheers
Richard

Re: New script

[Richard Collyer]

It depends on what the script does. You could either make it public 
knowledge that this script exists and host it yourself or 
dev@spamassassin.apache.org seems like a good place to start.


Cheers
Richard

Drew Burchett wrote:
If I have created a new script that can be used with SpamAssassin (not a 
plugin), and would like to submit it for public use, where would I do that?


 


Thanks,

 


Drew Burchett

United Systems & Software

http://www.united-systems.com

Phone:  (270)527-3293

Fax: (270)527-3132

 




__ NOD32 1.1515 (20060501) Information __

This message was checked by NOD32 antivirus system.
http://www.eset.com

--

CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, 
is for the sole use of the intended recipient(s) and may contain 
confidential and privileged information. Any unauthorized review, use, 
disclosure or distribution is prohibited. If you are not the intended 
recipient, please contact the sender by reply e-mail and destroy all 
copies of the original message.



--
This message has been scanned for viruses and
dangerous content by *MailScanner* , and is
believed to be clean.

Re: Reference manual

[Richard Collyer]

Steve Sargent wrote:
Is there a reference manual with SpamAssassin, and if so were do I get a 
copy of it?


http://spamassassin.apache.org/doc.html

Cheers
Richard

Re: Very Long Scan Times (3.1.1 on FreeBSD)

[Richard Collyer]

John Rudd wrote:


It might be good to try running some tests with -L and some tests 
without -L, to see if the same test is fast without the network check.  
That would help isolate the problem to "is SpamAssassin slow" or "is 
SpamAssassin spending a lot of time waiting for DNS results".  It 
probably IS the latter, but it's always good to isolate symptoms, IMO.


Also, are you doing any other network stuff?  razor, pyzor, etc.?



Hmm. I did the spamassassin test with -L and it flew through the test.

I have done some dig requests using the hosts in the debug file and they 
are getting returned ok. Strange thing is that sometimes 18 or 38 pass, 
sometimes 25 of 38 pass there seems to be no pattern to them failing.


There is a firewall running (nothing that would stop the DNS queries as 
I disabled it for a test and that made no effect).


I cant see any reason why some DNS requests are failing. I'm looking at 
running bind and using that for most of the rDNS queries to see if that 
speeds stuff up.


As a work around I have set rbl_timeout to 5 to speed up the failures.

Anyone else got any ideas I could try.

Cheers
Richard

Re: Very Long Scan Times (3.1.1 on FreeBSD)

[Richard Collyer]

Daryl C. W. O'Shea wrote:

Richard Collyer wrote:

I've changed it to a DNS server from my ISP, but so far its not making 
any difference.


 SA: finished scan in 13.719613 secs - hits=-1.0


BTW, if you watch the debug output of a message being scanned, you'll 
see exactly where it's slow.


spamassassin -D < non-local-test.msg





Hello,

Thanks for the reply.

I'm guessing that these are the problems. SpamAssassin is launching a 
lot of rDNS queries looking for A records and such like. Better stil 
these are coming back false. Someone I was talking too mentioned i need 
a -H flag somewhere to stop these DNS lookups?


Ideas?
[EMAIL PROTECTED]:/home/richard] $ spamassassin -D < test-external.msg



[42615] dbg: dns: success for 16 of 38 queries
[42615] dbg: dns: timeout for sorbs after 12 seconds
[42615] dbg: dns: timeout for njabl-lastexternal,njabl after 12 seconds
[42615] dbg: dns: timeout for njabl after 12 seconds
[42615] dbg: dns: timeout for sblxbl after 12 seconds
[42615] dbg: dns: timeout for njabl after 12 seconds
[42615] dbg: dns: timeout for sblxbl after 12 seconds
[42615] dbg: dns: timeout for habeas-firsttrusted after 12 seconds
[42615] dbg: dns: timeout for njabl after 12 seconds
[42615] dbg: dns: timeout for whois after 12 seconds
[42615] dbg: dns: timeout for sblxbl after 12 seconds
[42615] dbg: dns: timeout for njabl after 12 seconds
[42615] dbg: dns: timeout for whois after 12 seconds
[42615] dbg: dns: timeout for whois after 12 seconds
[42615] dbg: dns: timeout for spamcop after 12 seconds
[42615] dbg: dns: timeout for bsp-untrusted after 12 seconds
[42615] dbg: dns: timeout for spamcop after 12 seconds
[42615] dbg: dns: timeout for bsp-untrusted after 12 seconds
[42615] dbg: dns: timeout for bsp-untrusted after 12 seconds
[42615] dbg: dns: timeout for bsp-untrusted after 12 seconds
[42615] dbg: dns: timeout for spamcop after 12 seconds
[42615] dbg: dns: timeout for spamcop after 12 seconds
[42615] dbg: dns: timeout for dsbl-lastexternal after 12 seconds



Cheers
Richard





The Full Debug:

[EMAIL PROTECTED]:/home/richard] $ spamassassin -D < test-external.msg
[42684] dbg: logger: adding facilities: all
[42684] dbg: logger: logging level is DBG
[42684] dbg: generic: SpamAssassin version 3.1.1
[42684] dbg: config: score set 0 chosen.
[42684] dbg: util: running in taint mode? yes
[42684] dbg: util: taint mode: deleting unsafe environment variables, 
resetting PATH

[42684] dbg: util: PATH included '/sbin', keeping
[42684] dbg: util: PATH included '/bin', keeping
[42684] dbg: util: PATH included '/usr/sbin', keeping
[42684] dbg: util: PATH included '/usr/bin', keeping
[42684] dbg: util: PATH included '/usr/games', keeping
[42684] dbg: util: PATH included '/usr/local/sbin', keeping
[42684] dbg: util: PATH included '/usr/local/bin', keeping
[42684] dbg: util: PATH included '/usr/X11R6/bin', keeping
[42684] dbg: util: PATH included '/home/richard/bin', which doesn't 
exist, dropping
[42684] dbg: util: final PATH set to: 
/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin

[42684] dbg: dns: is Net::DNS::Resolver available? yes
[42684] dbg: dns: Net::DNS version: 0.56
[42684] dbg: config: using "/usr/local/etc/mail/spamassassin" for site 
rules pre files

[42684] dbg: config: read file /usr/local/etc/mail/spamassassin/init.pre
[42684] dbg: config: read file /usr/local/etc/mail/spamassassin/v310.pre
[42684] dbg: config: using "/usr/local/share/spamassassin" for sys rules 
pre files
[42684] dbg: config: using "/usr/local/share/spamassassin" for default 
rules dir

[42684] dbg: config: read file /usr/local/share/spamassassin/10_misc.cf
[42684] dbg: config: read file 
/usr/local/share/spamassassin/20_advance_fee.cf
[42684] dbg: config: read file 
/usr/local/share/spamassassin/20_anti_ratware.cf
[42684] dbg: config: read file 
/usr/local/share/spamassassin/20_body_tests.cf
[42684] dbg: config: read file 
/usr/local/share/spamassassin/20_compensate.cf
[42684] dbg: config: read file 
/usr/local/share/spamassassin/20_dnsbl_tests.cf

[42684] dbg: config: read file /usr/local/share/spamassassin/20_drugs.cf
[42684] dbg: config: read file 
/usr/local/share/spamassassin/20_fake_helo_tests.cf
[42684] dbg: config: read file 
/usr/local/share/spamassassin/20_head_tests.cf
[42684] dbg: config: read file 
/usr/local/share/spamassassin/20_html_tests.cf
[42684] dbg: config: read file 
/usr/local/share/spamassassin/20_meta_tests.cf

[42684] dbg: config: read file /usr/local/share/spamassassin/20_net_tests.cf
[42684] dbg: config: read file /usr/local/share/spamassassin/20_phrases.cf
[42684] dbg: config: read file /usr/local/share/spamassassin/20_porn.cf
[42684] dbg: config: read file /usr/local/share/spamassassin/20_ratware.cf
[42684] dbg: config: read file /usr/local/share/spamassassin/20_uri_tests.cf
[42684] d

Re: Very Long Scan Times (3.1.1 on FreeBSD)

[Richard Collyer]

Daryl C. W. O'Shea wrote:

...
[31974] dbg: dns: name server: 192.168.1.1, family: 2, ipv6: 0
[31974] dbg: dns: testing resolver nameservers: 192.168.1.1
[31974] dbg: dns: trying (3) google.com...
[31974] dbg: dns: looking up NS for 'google.com'
[31974] dbg: dns: NS lookup of google.com using 192.168.1.1 succeeded 
=> DNS available (set dns_available to override)

[31974] dbg: dns: is DNS available? 1


192.168.1.1... is that a cable/dsl router acting as your local DNS 
server?  If so that could explain slow DNS results resulting in longer 
scan times for non-local mail.




Yep. Can see why that would slow DNS queries.

I've changed it to a DNS server from my ISP, but so far its not making 
any difference.


 SA: finished scan in 13.719613 secs - hits=-1.0

Cheers
Richard

Very Long Scan Times (3.1.1 on FreeBSD)

[Richard Collyer]

Hello,

I am trying to track down why is is tracking so long for mails to be 
scanned via FreeBSD.


I am scanning then using qmail-scanner (1.25).

From what I can see the problem is coming from when e-mails are 
arriving from external sources. The top log entry shows and e-mail from 
the lan. The secnod shows and e-mail from the Internet.


Tue, 18 Apr 2006 19:33:51 BST:31808: +++ starting debugging for process 
** via SMTP from 192.168.1.10
Tue, 18 Apr 2006 19:33:51 BST:31808: clamdscan: finished scan in 
0.042715 secs
Tue, 18 Apr 2006 19:33:52 BST:31808: SA: finished scan in 0.930511 secs 
- hits=-4.2

Tue, 18 Apr 2006 19:33:52 BST:31808: p_s: finished scan in 0.057874 secs
Tue, 18 Apr 2006 19:33:52 BST:31808: -- Process 31808 finished.

E-Mail from the Internet.

Tue, 18 Apr 2006 19:34:01 BST:31820: +++ starting debugging for process 
** via SMTP from 64.246..29
Tue, 18 Apr 2006 19:34:01 BST:31820: clamdscan: finished scan in 
0.046108 secs
Tue, 18 Apr 2006 19:34:13 BST:31820: SA: finished scan in 12.200674 secs 
- hits=-2.9

Tue, 18 Apr 2006 19:34:13 BST:31820: p_s: finished scan in 0.060179 secs
Tue, 18 Apr 2006 19:34:13 BST:31820: -- Process 31820 finished.


Looking at SA I find that:

[EMAIL PROTECTED]:/home/richard] $ spamassassin -D --lint
...
[31974] dbg: dns: is Net::DNS::Resolver available? yes
[31974] dbg: dns: Net::DNS version: 0.56
...
[31974] dbg: dns: name server: 192.168.1.1, family: 2, ipv6: 0
[31974] dbg: dns: testing resolver nameservers: 192.168.1.1
[31974] dbg: dns: trying (3) google.com...
[31974] dbg: dns: looking up NS for 'google.com'
[31974] dbg: dns: NS lookup of google.com using 192.168.1.1 succeeded => 
DNS available (set dns_available to override)

[31974] dbg: dns: is DNS available? 1

The only thing that I have found in the archieves to help would be

"On another, a new enough Net::DNS was
installed, but because of platform issues, it couldn't find the DNS.pm
in the @INC path."

I have the DNS.pm file at 
"/usr/local/lib/perl5/site_perl/5.8.8/mach/Net/DNS.pm"


Can anyone explain where this would be (the INC bit).

Cheers
Richard