Re: spamd keeps running at 99% CPU until i kill the process
Hello, Why is that? Surely updates are released for current, stable versions of spamassassin? Most of the world can't run SVN version! lol Any ideas why this might be? Thanks again, Richard. [EMAIL PROTECTED] wrote: >>> However, if there are no updates > > Which I bet you will be surprised to find will always be the case > these days, unless you use yet unreleased SVN versions of spamassassin. > > _ > This e-mail has been scanned for viruses by Verizon Business Internet Managed > Scanning Services - powered by MessageLabs. For further information visit > http://www.verizonbusiness.com/uk > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: spamd keeps running at 99% CPU until i kill the process
Hello, Sorry for so many emails, but it's sorted - removing "rewrite_subject 1" from the config does not stop the subject line from being rewritten, so i'm done! However, with regards to the cronjob, i'd like some intelligent reporting if possible, so i've constructed this: == echo "Updating rules..." && /usr/bin/sa-update && echo "Done, now checking config syntax..." && spamassassin --lint && echo "Done, now restarting spamd..." && /etc/init.d/spamassassin restart && echo "Done" == However, if there are no updates (and sa-update exits with an exit code of 1) i would like to print "No updates, exiting" and then exit. So i modified it to become this: == echo "Updating rules..." && /usr/bin/sa-update && echo "Done, now checking config syntax..." || echo "No updates, exiting"; exit && spamassassin --lint && echo "Done, now restarting spamd..." && /etc/init.d/spamassassin restart && echo "Done" ========== However, whether there are updates or not, the script still exits - do you know which syntax i need to use here (i'm using bash, btw). Thanks again, Richard. Richard Hobbs wrote: > Hello, > > Don't worry - i know what lint does now, but when i run it, i get this: > > mail:/etc/cron.weekly# spamassassin --lint > [25465] warn: config: failed to parse line, skipping: rewrite_subject 1 > [25465] warn: lint: 1 issues detected, please rerun with debug enabled > for more information > mail:/etc/cron.weekly# > > But, if i remove the "rewrite_subject 1" line, it stops rewriting the > subject line (i think)! > > Any suggestions? > > Thanks again, > Richard. > > > John D. Hardin wrote: >> On Wed, 29 Aug 2007, Richard Hobbs wrote: >> >>> Would you guys also recommend putting the command "/usr/bin/sa-update" >>> in the crontab as well? >>> >>> If so, should i be using any particular parameters? And how often should >>> it be run to be worthwhile? >> I run it weekly... >> >> /etc/cron.weekly/spamassassin-update: >> /usr/bin/sa-update && spamassassin --lint && service spamassassin restart >> >> -- >> John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ >> [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] >> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 >> --- >> The difference is that Unix has had thirty years of technical >> types demanding basic functionality of it. And the Macintosh has >> had fifteen years of interface fascist users shaping its progress. >> Windows has the hairpin turns of the Microsoft marketing machine >> and that's all.-- Red Drag Diva >> --- >> 21 days until Talk Like a Pirate day >> >> >> _ >> This e-mail has been scanned for viruses by Verizon Business Internet >> Managed Scanning Services - powered by MessageLabs. For further information >> visit http://www.verizonbusiness.com/uk >> >> > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: spamd keeps running at 99% CPU until i kill the process
Hello, Don't worry - i know what lint does now, but when i run it, i get this: mail:/etc/cron.weekly# spamassassin --lint [25465] warn: config: failed to parse line, skipping: rewrite_subject 1 [25465] warn: lint: 1 issues detected, please rerun with debug enabled for more information mail:/etc/cron.weekly# But, if i remove the "rewrite_subject 1" line, it stops rewriting the subject line (i think)! Any suggestions? Thanks again, Richard. John D. Hardin wrote: > On Wed, 29 Aug 2007, Richard Hobbs wrote: > >> Would you guys also recommend putting the command "/usr/bin/sa-update" >> in the crontab as well? >> >> If so, should i be using any particular parameters? And how often should >> it be run to be worthwhile? > > I run it weekly... > > /etc/cron.weekly/spamassassin-update: > /usr/bin/sa-update && spamassassin --lint && service spamassassin restart > > -- > John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ > [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > --- > The difference is that Unix has had thirty years of technical > types demanding basic functionality of it. And the Macintosh has > had fifteen years of interface fascist users shaping its progress. > Windows has the hairpin turns of the Microsoft marketing machine > and that's all.-- Red Drag Diva > --- > 21 days until Talk Like a Pirate day > > > _ > This e-mail has been scanned for viruses by Verizon Business Internet Managed > Scanning Services - powered by MessageLabs. For further information visit > http://www.verizonbusiness.com/uk > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: spamd keeps running at 99% CPU until i kill the process
Hello, What does "spamassassin --lint" do? I can't find the lint option in the man page... Thanks again, Richard. John D. Hardin wrote: > On Wed, 29 Aug 2007, Richard Hobbs wrote: > >> Would you guys also recommend putting the command "/usr/bin/sa-update" >> in the crontab as well? >> >> If so, should i be using any particular parameters? And how often should >> it be run to be worthwhile? > > I run it weekly... > > /etc/cron.weekly/spamassassin-update: > /usr/bin/sa-update && spamassassin --lint && service spamassassin restart > > -- > John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ > [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > --- > The difference is that Unix has had thirty years of technical > types demanding basic functionality of it. And the Macintosh has > had fifteen years of interface fascist users shaping its progress. > Windows has the hairpin turns of the Microsoft marketing machine > and that's all.-- Red Drag Diva > --- > 21 days until Talk Like a Pirate day > > > _ > This e-mail has been scanned for viruses by Verizon Business Internet Managed > Scanning Services - powered by MessageLabs. For further information visit > http://www.verizonbusiness.com/uk > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: spamd keeps running at 99% CPU until i kill the process
Hello, Would you guys also recommend putting the command "/usr/bin/sa-update" in the crontab as well? If so, should i be using any particular parameters? And how often should it be run to be worthwhile? Thanks again, Richard. Richard Hobbs wrote: > Hello, > > Thank you - this is now done! :-) > > I shall see how it goes... > > Richard. > > > Anthony Peacock wrote: >> Hi, >> >> Richard Hobbs wrote: >>> Hello, >> >> >>>>> Is this all correct? >>>> Yes. Set up expiration in a cron job, once per day is usually fine. >>> OK, will do - i assume "sa-learn --force-expire" is the command to run >>> via cron, right? >> Yup! This is my crontab line: >> >> 00 22 * * * /usr/local/bin/sa-learn --force-expire >> >>> Also, how do i disable automatic expiration? >> Set: >> >> bayes_auto_expire 0 >> >> In your local.cf file. >> >>> Thanks again, >>> Richard. >>> >>> >>>>> Would a suitable alternative be to delete "bayes_seen" and >>>>> "bayes_toks", >>>>> then restart spamd? I know i would be deleting everything that had been >>>>> learned over the last period of time, but starting afresh may not be a >>>>> bad thing, seeing as the rules in the database are probably 6 months to >>>>> a year old now (we've not been using spamd for a year or so, because i >>>>> broke it and had no time to fix it!). >>>>> >>>>> Please let me know your thoughts, and also let me know whether deleting >>>>> both of those files is a good way to go. >>>> No. >>>> >>>> >> > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: spamd keeps running at 99% CPU until i kill the process
Hello, Thank you - this is now done! :-) I shall see how it goes... Richard. Anthony Peacock wrote: > Hi, > > Richard Hobbs wrote: >> Hello, > > >>>> >>>> Is this all correct? >>> Yes. Set up expiration in a cron job, once per day is usually fine. >> >> OK, will do - i assume "sa-learn --force-expire" is the command to run >> via cron, right? > > Yup! This is my crontab line: > > 00 22 * * * /usr/local/bin/sa-learn --force-expire > >> >> Also, how do i disable automatic expiration? > > Set: > > bayes_auto_expire 0 > > In your local.cf file. > >> >> Thanks again, >> Richard. >> >> >>>> Would a suitable alternative be to delete "bayes_seen" and >>>> "bayes_toks", >>>> then restart spamd? I know i would be deleting everything that had been >>>> learned over the last period of time, but starting afresh may not be a >>>> bad thing, seeing as the rules in the database are probably 6 months to >>>> a year old now (we've not been using spamd for a year or so, because i >>>> broke it and had no time to fix it!). >>>> >>>> Please let me know your thoughts, and also let me know whether deleting >>>> both of those files is a good way to go. >>> No. >>> >>> >> > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: spamd keeps running at 99% CPU until i kill the process
Hello, Anthony Peacock wrote: > Hi, > > Richard Hobbs wrote: >> Hello, >> >> John D. Hardin wrote: >>> On Tue, 28 Aug 2007, Richard Hobbs wrote: >>> >>>> Could the size of "bayes_seen" and "bayes_toks" be causing this >>>> timeout? >>> Yes. >>> >>>> If so, what can i do about this? >>> Disable automatic Bayes expiry and do a manual expiration run, and >>> allow it to complete. >> >> So what you (and Michael Parker) are saying is that it's not the >> checking of spam against the tokens that is causing the timeout, it's >> the automatic expiration of old tokens that "conveniently" gets tagged >> onto the same operation, right? >> >> If so, let me get this straight - an email comes in and goes off to >> spamd. spamd then checks the message against the tokens to determine >> whether it's spam or not, then runs an expiry of old tokens (or perhaps >> it happens the other way around), and only then returns the mail to >> exim. The expiration of old tokens takes a lot longer than the spam >> checking and as a result it's timing out. >> >> So, if i disable automatic expiration, spamd will only attempt one >> operation at a time, (checking of spam against the tokens) and should >> therefore not timeout, correct? >> >> But, if i do disable automatic expiration, i will have to remember to do >> it manually, or via cron. >> >> Is this all correct? > > Yes. Set up expiration in a cron job, once per day is usually fine. OK, will do - i assume "sa-learn --force-expire" is the command to run via cron, right? Also, how do i disable automatic expiration? Thanks again, Richard. >> Would a suitable alternative be to delete "bayes_seen" and "bayes_toks", >> then restart spamd? I know i would be deleting everything that had been >> learned over the last period of time, but starting afresh may not be a >> bad thing, seeing as the rules in the database are probably 6 months to >> a year old now (we've not been using spamd for a year or so, because i >> broke it and had no time to fix it!). >> >> Please let me know your thoughts, and also let me know whether deleting >> both of those files is a good way to go. > > No. > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: spamd keeps running at 99% CPU until i kill the process
Hello, John D. Hardin wrote: > On Tue, 28 Aug 2007, Richard Hobbs wrote: > >> Could the size of "bayes_seen" and "bayes_toks" be causing this timeout? > > Yes. > >> If so, what can i do about this? > > Disable automatic Bayes expiry and do a manual expiration run, and > allow it to complete. So what you (and Michael Parker) are saying is that it's not the checking of spam against the tokens that is causing the timeout, it's the automatic expiration of old tokens that "conveniently" gets tagged onto the same operation, right? If so, let me get this straight - an email comes in and goes off to spamd. spamd then checks the message against the tokens to determine whether it's spam or not, then runs an expiry of old tokens (or perhaps it happens the other way around), and only then returns the mail to exim. The expiration of old tokens takes a lot longer than the spam checking and as a result it's timing out. So, if i disable automatic expiration, spamd will only attempt one operation at a time, (checking of spam against the tokens) and should therefore not timeout, correct? But, if i do disable automatic expiration, i will have to remember to do it manually, or via cron. Is this all correct? Would a suitable alternative be to delete "bayes_seen" and "bayes_toks", then restart spamd? I know i would be deleting everything that had been learned over the last period of time, but starting afresh may not be a bad thing, seeing as the rules in the database are probably 6 months to a year old now (we've not been using spamd for a year or so, because i broke it and had no time to fix it!). Please let me know your thoughts, and also let me know whether deleting both of those files is a good way to go. Thanks again, Richard. > Once that's done you *can* turn automatic expiry back on to maintain > it, but you might just get back into the same situation. You may want > to leave automatic expiry off, and use cron to schedule a manual > expiry at a low-traffic time of day. > > -- > John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ > [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > --- > Taking my gun away because I *might* shoot someone is like cutting > my tongue out because I *might* yell "Fire!" in a crowded theater. > -- Peter Venetoklis > --- > Today: Exercise Your Rights day > > > _ > This e-mail has been scanned for viruses by Verizon Business Internet Managed > Scanning Services - powered by MessageLabs. For further information visit > http://www.verizonbusiness.com/uk > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: spamd keeps running at 99% CPU until i kill the process
Hello, Michael Parker wrote: > Richard Hobbs wrote: >> Hello, >> >> Could the size of "bayes_seen" and "bayes_toks" be causing this timeout? >> > > No, those aren't really that big, but it does look like you have an > expiration problem. I've heard that this file should be around 10MB on a "standard" system, so surely 80MB is huge? Also, our mail server deals with around 1000-1500 emails per day, and is a single-CPU Pentium(R) 4 CPU 2.26GHz with 512MB RAM - should this be able to cope? > To solve your immediate problem you could just turn off bayes, that will > get mail flowing again and then you can address your real problem. How effective would spam checking be with bayes disabled, though? I know it's better than a broken solution, but just out of interest... > I'd guess that the spike in CPU you are seeing is due to bayes > expiration running and then getting killed off. Expiration can be very > IO intensive and it locks the database while running which can cause a > backup depending on you setup. To make matters worse it looks like > you've got something timing out and killing off the expiration so its > not allowed to complete. That sounds about right - i have no idea what "spamd" is doing during that time other than running a lot of "pread" system calls, but that would make sense. I think exim gives 5 minutes to the spam checker, and then kills it off and rejects the mail with the error in my previous mail. > Long term, I'd suggest turning off auto expiration and then running > sa-learn --force-expire via a cronjob. I believe there is good > information on setting this up on the wiki. Well, i've just run "sa-learn --force-expire" manually, and despite saying it had removed a whole load of entries from the database, the bayes_toks and bayes_seen files are still the same size (80MB and 10MB, respectively). > You can remove any *.expire* files that are older than 5 minutes, they > are left over from previously timed out expiration attempts. Done. > Like I said, check out the wiki, you should find more information there > on the problem and possible solutions. Hmm... will do, but you think it's all working perfectly, just slower than we'd like, right? Please correct me if that statement is incorrect. Thanks again, Richard. > Michael >> == >> mail:/home/spamcheck/.spamassassin# ls -l >> total 101060 >> -rw--- 1 spamcheck spamcheck 2637824 2007-08-28 12:42 auto-whitelist >> -rw--- 1 spamcheck spamcheck6 2007-02-27 16:35 >> auto-whitelist.mutex >> -rw--- 1 spamcheck spamcheck 56 2007-08-28 12:52 bayes.lock >> -rw--- 1 spamcheck spamcheck6 2007-02-27 16:33 bayes.mutex >> -rw--- 1 spamcheck spamcheck 10530816 2007-08-28 11:11 bayes_seen >> -rw--- 1 spamcheck spamcheck 83738624 2007-08-28 12:52 bayes_toks >> -rw--- 1 spamcheck spamcheck 1298432 2007-02-27 18:14 >> bayes_toks.expire1698 >> -rw--- 1 spamcheck spamcheck 1327104 2007-02-28 02:17 >> bayes_toks.expire17474 >> -rw--- 1 spamcheck spamcheck 2473984 2007-02-28 02:31 >> bayes_toks.expire17865 >> -rw--- 1 spamcheck spamcheck 1302528 2007-02-28 02:48 >> bayes_toks.expire17866 >> -rw--- 1 spamcheck spamcheck 1335296 2007-02-28 03:17 >> bayes_toks.expire18715 >> -rw--- 1 spamcheck spamcheck 2572288 2007-02-28 03:37 >> bayes_toks.expire19618 >> -rw--- 1 spamcheck spamcheck 655360 2007-02-28 09:19 >> bayes_toks.expire28928 >> -rw--- 1 spamcheck spamcheck 1302528 2007-08-28 10:14 >> bayes_toks.expire3058 >> -rw--- 1 spamcheck spamcheck 1302528 2007-08-28 10:34 >> bayes_toks.expire3059 >> -rw--- 1 spamcheck spamcheck 1298432 2007-02-27 17:33 >> bayes_toks.expire31684 >> -rw--- 1 spamcheck spamcheck 1302528 2007-02-27 18:42 >> bayes_toks.expire31685 >> -rw--- 1 spamcheck spamcheck 5017600 2007-08-28 11:08 >> bayes_toks.expire4625 >> -rw--- 1 spamcheck spamcheck 5013504 2007-08-28 12:35 >> bayes_toks.expire7150 >> -rw--- 1 spamcheck spamcheck 5013504 2007-08-28 12:52 >> bayes_toks.expire7925 >> -rw-r--r-- 1 spamcheck spamcheck 1175 2005-07-20 14:23 user_prefs >> mail:/home/spamcheck/.spamassassin# >> == >> >> If so, what can i do about this? >> >> Thanks again, >> Richard. >> >> >> Richard Hobbs wrote: >>> Hello, >>> >>> Mark Martinec wrote: >>>
Re: spamd keeps running at 99% CPU until i kill the process
Hello, Could the size of "bayes_seen" and "bayes_toks" be causing this timeout? == mail:/home/spamcheck/.spamassassin# ls -l total 101060 -rw--- 1 spamcheck spamcheck 2637824 2007-08-28 12:42 auto-whitelist -rw--- 1 spamcheck spamcheck6 2007-02-27 16:35 auto-whitelist.mutex -rw--- 1 spamcheck spamcheck 56 2007-08-28 12:52 bayes.lock -rw--- 1 spamcheck spamcheck6 2007-02-27 16:33 bayes.mutex -rw--- 1 spamcheck spamcheck 10530816 2007-08-28 11:11 bayes_seen -rw--- 1 spamcheck spamcheck 83738624 2007-08-28 12:52 bayes_toks -rw--- 1 spamcheck spamcheck 1298432 2007-02-27 18:14 bayes_toks.expire1698 -rw--- 1 spamcheck spamcheck 1327104 2007-02-28 02:17 bayes_toks.expire17474 -rw--- 1 spamcheck spamcheck 2473984 2007-02-28 02:31 bayes_toks.expire17865 -rw--- 1 spamcheck spamcheck 1302528 2007-02-28 02:48 bayes_toks.expire17866 -rw--- 1 spamcheck spamcheck 1335296 2007-02-28 03:17 bayes_toks.expire18715 -rw--- 1 spamcheck spamcheck 2572288 2007-02-28 03:37 bayes_toks.expire19618 -rw--- 1 spamcheck spamcheck 655360 2007-02-28 09:19 bayes_toks.expire28928 -rw--- 1 spamcheck spamcheck 1302528 2007-08-28 10:14 bayes_toks.expire3058 -rw--- 1 spamcheck spamcheck 1302528 2007-08-28 10:34 bayes_toks.expire3059 -rw--- 1 spamcheck spamcheck 1298432 2007-02-27 17:33 bayes_toks.expire31684 -rw--- 1 spamcheck spamcheck 1302528 2007-02-27 18:42 bayes_toks.expire31685 -rw--- 1 spamcheck spamcheck 5017600 2007-08-28 11:08 bayes_toks.expire4625 -rw--- 1 spamcheck spamcheck 5013504 2007-08-28 12:35 bayes_toks.expire7150 -rw--- 1 spamcheck spamcheck 5013504 2007-08-28 12:52 bayes_toks.expire7925 -rw-r--r-- 1 spamcheck spamcheck 1175 2005-07-20 14:23 user_prefs mail:/home/spamcheck/.spamassassin# == If so, what can i do about this? Thanks again, Richard. Richard Hobbs wrote: > Hello, > > Mark Martinec wrote: >> Richard, >> >>> To add information to this problem, it appears that spamd does >>> eventually give up after 5 minutes >> Capture a message causing touble from a MTA queue, >> and feed it to a command line spamassassin with -t -D options. > > I would love to do this, but it's not the same messages all the time - > in a batch of identical messages, some get through and others cause the > hanging. It seems to be completely random. > > Do you have any other ideas? > > Thanks again, > Richard. > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: spamd keeps running at 99% CPU until i kill the process
Hello, Mark Martinec wrote: > Richard, > >> To add information to this problem, it appears that spamd does >> eventually give up after 5 minutes > > Capture a message causing touble from a MTA queue, > and feed it to a command line spamassassin with -t -D options. I would love to do this, but it's not the same messages all the time - in a batch of identical messages, some get through and others cause the hanging. It seems to be completely random. Do you have any other ideas? Thanks again, Richard. -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: spamd keeps running at 99% CPU until i kill the process
Hello,
To add information to this problem, it appears that spamd does
eventually give up after 5 minutes - which then bounces the message back
to the sender stating:
421 SMTP incoming data timeout - message abandoned
Obviously, this cannot keep happening, but i don't know how to stop it...
Any advice greatly appreciated.
Thanks again,
Richard.
Richard Hobbs wrote:
> Hello,
>
> We are running SpamAssassin version 3.1.7-deb running on Perl version
> 5.8.4 on a Debian Sarge box with exim4.
>
> I am using the following router:
>
> ==
> sa_router:
>no_verify
>check_local_user
># When to scan a message :
># - it isn't already flagged as spam from Spamassassin
># - it isn't already scanned
># - it isn't local
># - it isn't from one internal domain user to another
>condition = "${if and { \
> {!eq {$received_protocol}{spam-scanned}} \
> {!eq {$received_protocol}{local}} \
> {!eq {$sender_address_domain}{$domain}} \
> } \
> {1}{0}}"
>driver= accept
>transport = sa_spamcheck
>local_parts = /etc/spamassassinUsers
> ==
>
> and the following transport:
>
> ==
> sa_spamcheck:
>driver = pipe
>command = /usr/sbin/exim4 -oMr spam-scanned -bS
>use_bsmtp = true
>transport_filter = /usr/bin/spamc
>home_directory = "/tmp"
>current_directory = "/tmp"
>user = spamcheck
>group = spamcheck
>log_output = true
>return_fail_output = true
>return_path_add = false
>message_prefix =
>message_suffix =
> ==
>
> This always used to work perfectly until i upgraded spamassassin using
> apt-get to the version above (which was done in order to give us access
> to the "sa-update" command).
>
> Now, on some emails spamd eats up 99% CPU and doesn't return until i
> kill it, at which point the email is delivered as non-spam, whether it
> is spam or not.
>
> Does anyone know why this is happening? It's destroying the use of our
> mail server, lol!
>
> Also, FYI, here is a copy of /etc/spamassassin/local.cf:
>
> ==
> # This is the right place to customize your installation of SpamAssassin.
> #
> # See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
> # tweaked.
> #
> # Only a small subset of options are listed below
> #
> ###
>
> rewrite_subject 1
>
> # Add *SPAM* to the Subject header of spam e-mails
> #
> rewrite_header Subject SPAM (_HITS_/_REQD_):
>
>
> # Save spam messages as a message/rfc822 MIME attachment instead of
> # modifying the original message (0: off, 2: use text/plain instead)
> #
> report_safe 1
>
>
> # Set which networks or hosts are considered 'trusted' by your mail
> # server (i.e. not spammers)
> #
> # trusted_networks 212.17.35.
> trusted_networks192.168.3.
> trusted_networks193.128.142.
>
>
> # Set file-locking method (flock is not safe over NFS, but is faster)
> #
> # lock_method flock
>
>
> # Set the threshold at which a message is considered spam (default: 5.0)
> #
> required_score 2.5
>
>
> # Use Bayesian classifier (default: 1)
> #
> # use_bayes 1
>
>
> # Bayesian classifier auto-learning (default: 1)
> #
> # bayes_auto_learn 1
>
>
> # Set headers which may provide inappropriate cues to the Bayesian
> # classifier
> #
> # bayes_ignore_header X-Bogosity
> # bayes_ignore_header X-Spam-Flag
> # bayes_ignore_header X-Spam-Status
>
> # WHITELIST
> whitelist_from [EMAIL PROTECTED]
> whitelist_from [EMAIL PROTECTED]
> whitelist_from [EMAIL PROTECTED]
> whitelist_from [EMAIL PROTECTED]
> whitelist_from [EMAIL PROTECTED]
> whitelist_from [EMAIL PROTECTED]
> whitelist_from [EMAIL PROTECTED]
> ==
>
> Thanks in advance for any assistance! It's greatly appreciated!
>
> Richard.
>
--
Richard Hobbs (Systems Administrator)
Toshiba Research Europe Ltd. - Speech Technology Group
Email: [EMAIL PROTECTED]
Web: http://www.toshiba-europe.com/research/
Tel: +44 1223 376964Mobile: +44 7811 803377
spamd keeps running at 99% CPU until i kill the process
Hello,
We are running SpamAssassin version 3.1.7-deb running on Perl version
5.8.4 on a Debian Sarge box with exim4.
I am using the following router:
==
sa_router:
no_verify
check_local_user
# When to scan a message :
# - it isn't already flagged as spam from Spamassassin
# - it isn't already scanned
# - it isn't local
# - it isn't from one internal domain user to another
condition = "${if and { \
{!eq {$received_protocol}{spam-scanned}} \
{!eq {$received_protocol}{local}} \
{!eq {$sender_address_domain}{$domain}} \
} \
{1}{0}}"
driver= accept
transport = sa_spamcheck
local_parts = /etc/spamassassinUsers
==
and the following transport:
==
sa_spamcheck:
driver = pipe
command = /usr/sbin/exim4 -oMr spam-scanned -bS
use_bsmtp = true
transport_filter = /usr/bin/spamc
home_directory = "/tmp"
current_directory = "/tmp"
user = spamcheck
group = spamcheck
log_output = true
return_fail_output = true
return_path_add = false
message_prefix =
message_suffix =
==
This always used to work perfectly until i upgraded spamassassin using
apt-get to the version above (which was done in order to give us access
to the "sa-update" command).
Now, on some emails spamd eats up 99% CPU and doesn't return until i
kill it, at which point the email is delivered as non-spam, whether it
is spam or not.
Does anyone know why this is happening? It's destroying the use of our
mail server, lol!
Also, FYI, here is a copy of /etc/spamassassin/local.cf:
==
# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
# Only a small subset of options are listed below
#
###
rewrite_subject 1
# Add *SPAM* to the Subject header of spam e-mails
#
rewrite_header Subject SPAM (_HITS_/_REQD_):
# Save spam messages as a message/rfc822 MIME attachment instead of
# modifying the original message (0: off, 2: use text/plain instead)
#
report_safe 1
# Set which networks or hosts are considered 'trusted' by your mail
# server (i.e. not spammers)
#
# trusted_networks 212.17.35.
trusted_networks192.168.3.
trusted_networks193.128.142.
# Set file-locking method (flock is not safe over NFS, but is faster)
#
# lock_method flock
# Set the threshold at which a message is considered spam (default: 5.0)
#
required_score 2.5
# Use Bayesian classifier (default: 1)
#
# use_bayes 1
# Bayesian classifier auto-learning (default: 1)
#
# bayes_auto_learn 1
# Set headers which may provide inappropriate cues to the Bayesian
# classifier
#
# bayes_ignore_header X-Bogosity
# bayes_ignore_header X-Spam-Flag
# bayes_ignore_header X-Spam-Status
# WHITELIST
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
whitelist_from [EMAIL PROTECTED]
======
Thanks in advance for any assistance! It's greatly appreciated!
Richard.
--
Richard Hobbs (Systems Administrator)
Toshiba Research Europe Ltd. - Speech Technology Group
Email: [EMAIL PROTECTED]
Web: http://www.toshiba-europe.com/research/
Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello, Quick question... This is a snippet from the exim mailing list: > The routers and transports seem fine. However, a quick check > through a FreeBSD Spamassassin change log does reveal that a > bug was introduced that gave problems with Exim, Spamassassin > and BSMTP: > > http://pkgsrc.se/mail/spamassassin > (bug 4966 in their numbering scheme) > > I'd check with the Debian package maintainers that this bug > has been fixed in the release they've put out. So... do you think i'm suffering this bug? The URL above indicates that it was fixed in 3.1.4, but am i suffering what looks like that bug, do you think? I'm still waiting to hear about the possible timeout setting in the exim config. Trouble is, with testing, if it goes wrong again, email is returned to the sender, and for people like my manager etc... this is unacceptable. Unfortunately, we do not have a test environment at the moment, so if i do make a change, i need to be as certain as i can be that it will fix the problem :-( Thanks again people... Richard. Adam Wilbraham wrote: >> You said in your other email that "since the --local option disables >> net tests, SA may pass a lot more spam". Does this mean it will think >> a lot of legit email is spam, whereas before it knew it was legit? > > Nope, he means the opposite - that a lot more spam will get through as > clean, as the network tests which help identify spam won't be used. > > > Adam. > > _ > This e-mail has been scanned for viruses by Verizon Business Internet Managed > Scanning Services - powered by MessageLabs. For further information visit > http://www.mci.com > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello, Replies inline... Gary V wrote: >> Hello, >> >> > If some work and some don't I suspect this could possibly >> > be a timeout issue. >> >> It is a timeout... see my message at 09:30 GMT this morning... >> >> >> 421 SMTP incoming data timeout - message abandoned >> > > While it's not clear to me what process produced this message, I would > assume it's EXIM's reply to the sender. That is correct. That is the response the sender received from exim. >> As for crashing out due to a possible time limit, how could i check >> this? surely such a feature would be built into spamassassin, right? >> > > I'm guessing here (because I have never used EXIM) but does EXIM set a > default time limit on sa_router: or sa_spamcheck: ? Not sure... i'll find out from the exim mailing list. >> AFAIK, this is a standard debian sarge box, with exim installed and >> configured, and not much else done to it. I could be wrong, but this is >> most likely the case. >> >> Also, with regards to --local, what does this do, and how can i actually >> run it this way? >> >> Thanks again, >> Richard. >> >> > > It disables network tests. I believe you can edit > /etc/default/spamassassin and add it to the list of OPTIONS, e.g.: > > OPTIONS="--local --create-prefs --max-children 5 --helper-home-dir" > > then restart spamd > /etc/init.d/spamassassin restart You said in your other email that "since the --local option disables net tests, SA may pass a lot more spam". Does this mean it will think a lot of legit email is spam, whereas before it knew it was legit? Thanks again, Richard. > Why do you say sa-update is not working? SA-update will not pull new > files if the files that exist are up to date. You can see if the new > rules are being used or not if you run a quick spamassassin debug (note > that --lint turns off net tests so this is not a full debug session): > > spamassassin --lint -D > > you should see stuff like: > > [27662] dbg: plugin: fixed relative path: > /var/lib/spamassassin/3.001007/updates_spamassassin_org/20_body_tests.cf > [27662] dbg: config: using > "/var/lib/spamassassin/3.001007/updates_spamassassin_org/20_body_tests.cf" > for included file > [27662] dbg: config: read file > /var/lib/spamassassin/3.001007/updates_spamassassin_org/20_body_tests.cf > > Gary V > > _ > Mortgage rates as low as 4.625% - Refinance $150,000 loan for $579 a > month. Intro*Terms > https://www2.nextag.com/goto.jsp?product=10035&url=%2fst.jsp&tm=y&search=mortgage_text_links_88_h27f6&disc=y&vers=743&s=4056&p=5117 > > > > _ > This e-mail has been scanned for viruses by Verizon Business Internet > Managed Scanning Services - powered by MessageLabs. For further > information visit http://www.mci.com > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello, > If some work and some don't I suspect this could possibly > be a timeout issue. It is a timeout... see my message at 09:30 GMT this morning... 421 SMTP incoming data timeout - message abandoned As for crashing out due to a possible time limit, how could i check this? surely such a feature would be built into spamassassin, right? AFAIK, this is a standard debian sarge box, with exim installed and configured, and not much else done to it. I could be wrong, but this is most likely the case. Also, with regards to --local, what does this do, and how can i actually run it this way? Thanks again, Richard. Gary V wrote: >> On Wed, 28 Feb 2007 11:26:52 + >> Richard Hobbs <[EMAIL PROTECTED]> wrote: >> >> > IO::Socket::INET6 >> > IO::Socket::SSL >> > DBI >> > Mail::SPF::Query >> > IP::Country::Fast >> > Razor2::Client::Agent >> > Net::Ident >> >> After a quick apt-cache search I'd suggest these should be what you >> need: >> >> libsocket6-perl >> libio-socket-ssl-perl >> libima-dbi-perl >> libmail-spf-query-perl >> razor >> libnet-ident-perl >> libgeo-ipfree-perl >> liblocale-subcountry-perl >> >> >> Adam. > > I'm not convinced that missing modules are your problem. AFAIK (please > correct me if I'm wrong) "require failed" in the debug output means a > given module is not required for SA to function. If installed however it > may turn on some currently unused feature. Remember that when installing > SA via apt that required modules are installed as dependencies. In my > experience each new version of SA is a little more resource intensive > than the last. This generally means that scan times increase. If some > work and some don't I suspect this could possibly be a timeout issue. Is > there some sort of time limit involved where once that amount of time > has passed the process errors out? If this is the problem then > installing additional software like razor may further increase scan > times and the problem should get worse and not better. As a test you > might start spamd using only local tests ( --local ). This will greatly > reduce scan times. If this works then I would consider the possibility > of a timeout issue somewhere. > > Gary V > > _ > The average US Credit Score is 675. The cost to see yours: $0 by > Experian. > http://www.freecreditreport.com/pm/default.aspx?sc=660600&bcd=EMAILFOOTERAVERAGE > > > > _ > This e-mail has been scanned for viruses by Verizon Business Internet > Managed Scanning Services - powered by MessageLabs. For further > information visit http://www.mci.com > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello, Which startup scripts? There are a lot of them, some of which might call others... am i going to have to trawl through rc3.d or is there an easier way? Thanks again, Richard. Adam Wilbraham wrote: > On Wed, 28 Feb 2007 11:20:28 + > Richard Hobbs <[EMAIL PROTECTED]> wrote: > >> As for memory softlimits - i have no idea. How can i check? > > In your startup scripts for exim you may have some commands softlimit / > ulimit commands... > > _ > This e-mail has been scanned for viruses by Verizon Business Internet Managed > Scanning Services - powered by MessageLabs. For further information visit > http://www.mci.com > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello, I have two problems currently: 1) sa-update may or may not be working - this is not urgent. 2) spamassassin itself is not working at all - this is very urgent! lol Does anyone have any idea why sa has stopped working for me? Let's ignore sa-update for the time being, unless it's relevant in terms of getting sa working generally! Thanks again people... i'm going to tackle sa-update again as soon as sa actually works :-) So... any ideas? Thanks again, Richard. Gary V wrote: >> On Wed, 28 Feb 2007 11:26:52 + >> Richard Hobbs <[EMAIL PROTECTED]> wrote: >> >> > IO::Socket::INET6 >> > IO::Socket::SSL >> > DBI >> > Mail::SPF::Query >> > IP::Country::Fast >> > Razor2::Client::Agent >> > Net::Ident >> >> After a quick apt-cache search I'd suggest these should be what you >> need: >> >> libsocket6-perl >> libio-socket-ssl-perl >> libima-dbi-perl >> libmail-spf-query-perl >> razor >> libnet-ident-perl >> libgeo-ipfree-perl >> liblocale-subcountry-perl >> >> >> Adam. > > I'm not convinced that missing modules are your problem. AFAIK (please > correct me if I'm wrong) "require failed" in the debug output means a > given module is not required for SA to function. If installed however it > may turn on some currently unused feature. Remember that when installing > SA via apt that required modules are installed as dependencies. In my > experience each new version of SA is a little more resource intensive > than the last. This generally means that scan times increase. If some > work and some don't I suspect this could possibly be a timeout issue. Is > there some sort of time limit involved where once that amount of time > has passed the process errors out? If this is the problem then > installing additional software like razor may further increase scan > times and the problem should get worse and not better. As a test you > might start spamd using only local tests ( --local ). This will greatly > reduce scan times. If this works then I would consider the possibility > of a timeout issue somewhere. > > Gary V > > _ > The average US Credit Score is 675. The cost to see yours: $0 by > Experian. > http://www.freecreditreport.com/pm/default.aspx?sc=660600&bcd=EMAILFOOTERAVERAGE > > > > _ > This e-mail has been scanned for viruses by Verizon Business Internet > Managed Scanning Services - powered by MessageLabs. For further > information visit http://www.mci.com > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello, Thank you - Before i go installing, do the following package names look correct to you: > IO::Socket::INET6 - libio-socket-inet6-perl > IO::Socket::SSL - libio-socket-ssl-perl > DBI - libdbi-perl > Mail::SPF::Query - libmail-spf-query-perl > IP::Country::Fast - Unknown > Razor2::Client::Agent - Unknown > Net::Ident - libnet-ident-perl For the "Unknown" package names, do you have any suggestions? Thanks again, Richard. Bram Mertens wrote: > Richard Hobbs <[EMAIL PROTECTED]> wrote on 02/28/2007 > 12:26:52 PM: >> I seem to have the following missing Perl libraries: >> >> IO::Socket::INET6 >> IO::Socket::SSL >> DBI >> Mail::SPF::Query >> IP::Country::Fast >> Razor2::Client::Agent >> Net::Ident >> >> You said that you installed the missing modules from the regular sarge >> distro, but i can't seem to find exact matches for any of them using >> "apt-cache search". Any suggestions? Or, failing that, could you >> possibly tell me the exact package names for the above modules so i can >> install them easily? :-) > > Perl libraries follow a specific naming convention; you can use apt-cache > search to look for them: > apt-cache search libio perl socket inet6 > libio-socket-inets-perl - object interface for AF_INET6 domain sockets > > apt-cache search libmail perl spf > libmail-spf-query-perl - query SPF (Sender Policy Framework) to validate > mail senders > > HTH > > Bram > > > > > _____ > This e-mail has been scanned for viruses by Verizon Business Internet Managed > Scanning Services - powered by MessageLabs. For further information visit > http://www.mci.com -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello,
I have now run "sa-update -D" and it has produced this:
mail:~# sa-update -D
[2304] dbg: logger: adding facilities: all
[2304] dbg: logger: logging level is DBG
[2304] dbg: generic: SpamAssassin version 3.1.7
[2304] dbg: config: score set 0 chosen.
[2304] dbg: message: MIME PARSER START
[2304] dbg: message: main message type: text/plain
[2304] dbg: message: parsing normal part
[2304] dbg: message: added part, type: text/plain
[2304] dbg: message: MIME PARSER END
[2304] dbg: dns: is Net::DNS::Resolver available? yes
[2304] dbg: dns: Net::DNS version: 0.59
[2304] dbg: generic: sa-update version svn454083
[2304] dbg: generic: using update directory: /var/lib/spamassassin/3.001007
[2304] dbg: diag: perl platform: 5.008004 linux
[2304] dbg: diag: module installed: Digest::SHA1, version 2.10
[2304] dbg: diag: module not installed: IO::Socket::INET6 ('require' failed)
[2304] dbg: diag: module not installed: IO::Socket::SSL ('require' failed)
[2304] dbg: diag: module installed: Time::HiRes, version 1.59
[2304] dbg: diag: module not installed: DBI ('require' failed)
[2304] dbg: diag: module installed: Getopt::Long, version 2.34
[2304] dbg: diag: module installed: LWP::UserAgent, version 2.033
[2304] dbg: diag: module installed: HTTP::Date, version 1.46
[2304] dbg: diag: module installed: Archive::Tar, version 1.23
[2304] dbg: diag: module installed: IO::Zlib, version 1.04
[2304] dbg: diag: module installed: DB_File, version 1.808
[2304] dbg: diag: module installed: HTML::Parser, version 3.45
[2304] dbg: diag: module installed: MIME::Base64, version 3.04
[2304] dbg: diag: module installed: Net::DNS, version 0.59
[2304] dbg: diag: module installed: Net::SMTP, version 2.30
[2304] dbg: diag: module not installed: Mail::SPF::Query ('require' failed)
[2304] dbg: diag: module not installed: IP::Country::Fast ('require' failed)
[2304] dbg: diag: module not installed: Razor2::Client::Agent ('require'
failed)
[2304] dbg: diag: module not installed: Net::Ident ('require' failed)
[2304] dbg: gpg: Searching for 'gpg'
[2304] dbg: util: current PATH is:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11
[2304] dbg: util: executable for gpg was found at /usr/bin/gpg
[2304] dbg: gpg: found /usr/bin/gpg
[2304] dbg: gpg: release trusted key id list:
5E541DC959CB8BAC7C78DFDC4056A61A5244EC45
26C900A46DD40CD5AD24F6D7DEE01987265FA05B
0C2B1D7175B852C64B3CDC716C55397824F434CE
[2304] dbg: channel: attempting channel updates.spamassassin.org
[2304] dbg: channel: update directory
/var/lib/spamassassin/3.001007/updates_spamassassin_org
[2304] dbg: channel: channel cf file
/var/lib/spamassassin/3.001007/updates_spamassassin_org.cf
[2304] dbg: channel: channel pre file
/var/lib/spamassassin/3.001007/updates_spamassassin_org.pre
[2304] dbg: channel: metadata version = 507739
[2304] dbg: dns: 7.1.3.updates.spamassassin.org => 507739, parsed as 507739
[2304] dbg: channel: current version is 507739, new version is 507739,
skipping channel
[2304] dbg: diag: updates complete, exiting with code 1
mail:~#
I seem to have the following missing Perl libraries:
IO::Socket::INET6
IO::Socket::SSL
DBI
Mail::SPF::Query
IP::Country::Fast
Razor2::Client::Agent
Net::Ident
You said that you installed the missing modules from the regular sarge
distro, but i can't seem to find exact matches for any of them using
"apt-cache search". Any suggestions? Or, failing that, could you
possibly tell me the exact package names for the above modules so i can
install them easily? :-)
Thanks again,
Richard.
John Fleming wrote:
>
> - Original Message -
>> There shouldn't be, from what I recall its as simple as that. The only
>> other thing you'll want to do is run sa-update and then restart spamd!
>
> Consider:
>
> 1) Run sa-update -D so you can see what it does or tries to do and what
> modules you might be missing and want. I had some missing modules that
> I installed from the regular sarge distro that I assume helped my
> functionality.
>
> 2) Add a channel for the SARE rulesets you want. This has been
> discussed a lot the last couple of days.
>
> _
> This e-mail has been scanned for viruses by Verizon Business Internet
> Managed Scanning Services - powered by MessageLabs. For further
> information visit http://www.mci.com
>
>
--
Richard Hobbs (Systems Administrator)
Toshiba Research Europe Ltd. - Speech Technology Group
Email: [EMAIL PROTECTED]
Web: http://www.toshiba-europe.com/research/
Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello, I would hope upgrading exim is not necessary, because that could easily become several weeks worth of approvals, testing, downtime etc...! As for memory softlimits - i have no idea. How can i check? Thanks again, Richard. Adam Wilbraham wrote: > My only other thoughts are - maybe you may need to upgrade exim to a > more recent version to keep the ability to talk to spamassassin working > (probably not though...). Also have you got any memory softlimits set > for exim / spamassassin or anything else ? In the past I've had issues > with memory limits being hit which has meant only some messages have > been getting through... Again I apologise as I'm probably not the best > person to help solve your issue seeing as I've no experience in the > exim side of things. > > > On Wed, 28 Feb 2007 09:59:39 + > Richard Hobbs <[EMAIL PROTECTED]> wrote: > >> Hello, >> >> Thank you for the link, but it's not for spamassassin... it does look >> very similar to the config i have in exim for spamassassin though. >> >> Does anyone know if i do need to adjust the config in exim when >> upgrading spamassassin from "3.0.3-2sarge1" to "3.1.7-1~bpo.1" as per >> the backports repository? >> >> My current exim config is as follows: > > _ > This e-mail has been scanned for viruses by Verizon Business Internet Managed > Scanning Services - powered by MessageLabs. For further information visit > http://www.mci.com > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello,
Thank you for the link, but it's not for spamassassin... it does look
very similar to the config i have in exim for spamassassin though.
Does anyone know if i do need to adjust the config in exim when
upgrading spamassassin from "3.0.3-2sarge1" to "3.1.7-1~bpo.1" as per
the backports repository?
My current exim config is as follows:
Router:
sa_router:
no_verify
check_local_user
# When to scan a message :
# - it isn't already flagged as spam from Spamassassin
# - it isn't already scanned
# - it isn't local
# - it isn't from one internal domain user to another
condition = "${if and { \
{!eq {$received_protocol}{spam-scanned}} \
{!eq {$received_protocol}{local}} \
{!eq {$sender_address_domain}{$domain}} \
} \
{1}{0}}"
driver= accept
transport = sa_spamcheck
local_parts = /etc/spamassassinUsers
Transport:
sa_spamcheck:
driver = pipe
command = /usr/sbin/exim4 -oMr spam-scanned -bS
use_bsmtp = true
transport_filter = /usr/bin/spamc
home_directory = "/tmp"
current_directory = "/tmp"
user = spamcheck
group = spamcheck
log_output = true
return_fail_output = true
return_path_add = false
message_prefix =
message_suffix =
As mentioned before, only *some* of the emails are failing. around 50%
were getting through fine.
Thanks again,
Richard.
Adam Wilbraham wrote:
> Looks like an exim problem to me, how is exim calling spamc?
> Unfortunately I have no exim experience whatsoever (I use qmail /
> qmailscanner) but maybe you need to revisit your exim config after the
> upgrade... This link may be of use but I'm not sure...
>
> http://sys-admin.org/en/node/21
>
> On Wed, 28 Feb 2007 09:30:19 +
> Richard Hobbs <[EMAIL PROTECTED]> wrote:
>
>> Hello,
>>
>> OK, since sending my last email (after upgrading to , but before
>> running "sa-update") we have been having problems:
>>
>>
>> mail:/var/log/exim4# grep BSMTP /var/log/exim4/mainlog.1
>> 2007-02-27 17:10:34 1HM5le-0008Sj-5j <[EMAIL PROTECTED]>:
>> sa_spamcheck transport output: An error was detected while processing
>> a file of BSMTP input.
>> 2007-02-27 17:23:09 1HM5xn-9Z-Cn <[EMAIL PROTECTED]>:
>> sa_spamcheck transport output: An error was detected while processing
>> a file of BSMTP input.
>> 2007-02-27 17:33:14 1HM67a-GO-BB <[EMAIL PROTECTED]>:
>> sa_spamcheck transport output: An error was detected while processing
>> a file of BSMTP input.
>> 2007-02-27 17:51:29 1HM6PC-UI-Kl <[EMAIL PROTECTED]>:
>> sa_spamcheck transport output: An error was detected while processing
>> a file of BSMTP input.
>> 2007-02-27 18:02:01 1HM6ZN-aK-JK <[EMAIL PROTECTED]>:
>> sa_spamcheck transport output: An error was detected while processing
>> a file of BSMTP input.
>> 2007-02-27 18:14:39 1HM6lf-hq-4x <[EMAIL PROTECTED]>:
>> sa_spamcheck transport output: An error was detected while processing
>> a file of BSMTP input.
>> 2007-02-27 18:31:31 1HM71z-rC-Qm <[EMAIL PROTECTED]>:
>> sa_spamcheck transport output: An error was detected while processing
>> a file of BSMTP input.
>> 2007-02-27 18:42:12 1HM7CJ-xC-Ss <[EMAIL PROTECTED]>:
>> sa_spamcheck transport output: An error was detected while processing
>> a file of BSMTP input.
>> 2007-02-27 18:42:14 1HM7CM-xN-HD <[EMAIL PROTECTED]>:
>> sa_spamcheck transport output: An error was detected while processing
>> a file of BSMTP input.
>> 2007-02-27 18:42:19 1HM7CR-xX-4h <[EMAIL PROTECTED]>:
>> sa_spamcheck transport output: An error was detected while processing
>> a file of BSMTP input.
>>
>>
>> It looks like 1 in 2 messages, at least to myself, was failing to get
>> through, and we have had to completely disable spamassassin
>> unfortunately :-(
>>
>> According to our other IT guy who did the troubleshooting last night
>> after i had gone home, this is what happened...
>>
>> He tried to email several of us, but for those of us who are
>> "subscribed" to spamassassin the message failed to get through,
>> stating:
>>
>> ==
Re: sa-update doesn't exist on my system
Hello, OK, since sending my last email (after upgrading to , but before running "sa-update") we have been having problems: mail:/var/log/exim4# grep BSMTP /var/log/exim4/mainlog.1 2007-02-27 17:10:34 1HM5le-0008Sj-5j <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. 2007-02-27 17:23:09 1HM5xn-9Z-Cn <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. 2007-02-27 17:33:14 1HM67a-GO-BB <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. 2007-02-27 17:51:29 1HM6PC-UI-Kl <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. 2007-02-27 18:02:01 1HM6ZN-aK-JK <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. 2007-02-27 18:14:39 1HM6lf-hq-4x <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. 2007-02-27 18:31:31 1HM71z-rC-Qm <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. 2007-02-27 18:42:12 1HM7CJ-xC-Ss <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. 2007-02-27 18:42:14 1HM7CM-xN-HD <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. 2007-02-27 18:42:19 1HM7CR-xX-4h <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. It looks like 1 in 2 messages, at least to myself, was failing to get through, and we have had to completely disable spamassassin unfortunately :-( According to our other IT guy who did the troubleshooting last night after i had gone home, this is what happened... He tried to email several of us, but for those of us who are "subscribed" to spamassassin the message failed to get through, stating: 421 SMTP incoming data timeout - message abandoned "tail -100 /var/log/exim4/mainlog | grep user1" then gave: 2007-02-28 01:34:27 1HMDi7-0004Gt-Qt <= [EMAIL PROTECTED] H=mail19.messagelabs.com [193.109.254.3] P=smtp S=2421 [EMAIL PROTECTED] T="RE: Firewall" from <[EMAIL PROTECTED]> for [EMAIL PROTECTED] [EMAIL PROTECTED] 2007-02-28 01:44:27 1HMDi7-0004Gt-Qt <[EMAIL PROTECTED]>: sa_spamcheck transport output: An error was detected while processing a file of BSMTP input. 2007-02-28 01:44:28 1HMDi7-0004Gt-Qt ** [EMAIL PROTECTED] <[EMAIL PROTECTED]> F=<[EMAIL PROTECTED]> P=<[EMAIL PROTECTED]> R=sa_router T=sa_spamcheck: Child process of sa_spamcheck transport returned 2 from command: /usr/sbin/exim4 Does anyone know what's going on here? Thanks again, Richard. John Fleming wrote: > > - Original Message - >> There shouldn't be, from what I recall its as simple as that. The only >> other thing you'll want to do is run sa-update and then restart spamd! > > Consider: > > 1) Run sa-update -D so you can see what it does or tries to do and what > modules you might be missing and want. I had some missing modules that > I installed from the regular sarge distro that I assume helped my > functionality. > > 2) Add a channel for the SARE rulesets you want. This has been > discussed a lot the last couple of days. > > _____ > This e-mail has been scanned for viruses by Verizon Business Internet > Managed Scanning Services - powered by MessageLabs. For further > information visit http://www.mci.com > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello, Thank you :-) Once i've run the command below, is there anything i need to do, other that restart the spamassassin daemon? Thanks again, Hobbs. Adam Wilbraham wrote: > Yupp - try giving apt-get the "-t sarge-backports" switch to force it > to download from that repository, eg: > > apt-get install -t sarge-backports spamassassin spamc > > Adam. > > > On Tue, 27 Feb 2007 09:32:39 + > Richard Hobbs <[EMAIL PROTECTED]> wrote: > >> Hello, >> >> Thank you for this... i've added that line to /etc/apt/sources.list, >> and run an "apt-get update". >> >> However, when i then run "apt-get install spamassassin" it says: >> >> spamassassin is already the newest version. >> >> As mentioned before, i'm actually running 3.0.3-2sarge1. >> >> Any ideas? >> >> The source does appear to have been added correctly, because during >> the "apt-get update" it downloaded several files. >> >> Thanks again, >> Richard. >> >> >> Adam Wilbraham wrote: >>> I've been using 3.1.7 from the sarge backports and its absolutely >>> fine, much better spam catching rates due to the ability to run >>> sa-update. Backports repo is: >>> >>> deb http://www.backports.org/debian sarge-backports main contrib >>> non-free >>> >>> >>> On Mon, 26 Feb 2007 14:55:40 + >>> Richard Hobbs <[EMAIL PROTECTED]> wrote: >>> >>>> Hello, >>>> >>>> Is it just as stable? i.e. ours hasn't hung or crashed so far for >>>> over 200 days... can you say whether this is true of 3.1 via >>>> backports? >>>> >>>> Also, is there an apt repo for 3.1 for sarge? >>>> >>>> Thanks again, >>>> Richard. >>>> >>>> >>>> John Fleming wrote: >>>>> - Original Message - From: "Richard Hobbs" >>>>> <[EMAIL PROTECTED]> >>>>> To: >>>>> Sent: Monday, February 26, 2007 4:54 AM >>>>> Subject: sa-update doesn't exist on my system >>>>> >>>>> >>>>>> Hello, >>>>>> >>>>>> I run a mail server which is using the latest stable spamassassin >>>>>> available through the standard debian repositories - >>>>>> "spamassassin 3.0.3-2sarge1". >>>>> I upgraded Debian sarge from 3.0 to 3.1 via backports - works >>>>> great! >>>>> - John >>>>> >>>>> _ >>>>> This e-mail has been scanned for viruses by Verizon Business >>>>> Internet Managed Scanning Services - powered by MessageLabs. For >>>>> further information visit http://www.mci.com >>>>> >>>>> >>> > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello, Thank you for this... i've added that line to /etc/apt/sources.list, and run an "apt-get update". However, when i then run "apt-get install spamassassin" it says: spamassassin is already the newest version. As mentioned before, i'm actually running 3.0.3-2sarge1. Any ideas? The source does appear to have been added correctly, because during the "apt-get update" it downloaded several files. Thanks again, Richard. Adam Wilbraham wrote: > I've been using 3.1.7 from the sarge backports and its absolutely > fine, much better spam catching rates due to the ability to run > sa-update. Backports repo is: > > deb http://www.backports.org/debian sarge-backports main contrib non-free > > > On Mon, 26 Feb 2007 14:55:40 + > Richard Hobbs <[EMAIL PROTECTED]> wrote: > >> Hello, >> >> Is it just as stable? i.e. ours hasn't hung or crashed so far for over >> 200 days... can you say whether this is true of 3.1 via backports? >> >> Also, is there an apt repo for 3.1 for sarge? >> >> Thanks again, >> Richard. >> >> >> John Fleming wrote: >>> - Original Message - From: "Richard Hobbs" >>> <[EMAIL PROTECTED]> >>> To: >>> Sent: Monday, February 26, 2007 4:54 AM >>> Subject: sa-update doesn't exist on my system >>> >>> >>>> Hello, >>>> >>>> I run a mail server which is using the latest stable spamassassin >>>> available through the standard debian repositories - "spamassassin >>>> 3.0.3-2sarge1". >>> I upgraded Debian sarge from 3.0 to 3.1 via backports - works great! >>> - John >>> >>> _ >>> This e-mail has been scanned for viruses by Verizon Business >>> Internet Managed Scanning Services - powered by MessageLabs. For >>> further information visit http://www.mci.com >>> >>> > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
Re: sa-update doesn't exist on my system
Hello, Is it just as stable? i.e. ours hasn't hung or crashed so far for over 200 days... can you say whether this is true of 3.1 via backports? Also, is there an apt repo for 3.1 for sarge? Thanks again, Richard. John Fleming wrote: > > - Original Message ----- From: "Richard Hobbs" > <[EMAIL PROTECTED]> > To: > Sent: Monday, February 26, 2007 4:54 AM > Subject: sa-update doesn't exist on my system > > >> Hello, >> >> I run a mail server which is using the latest stable spamassassin >> available through the standard debian repositories - "spamassassin >> 3.0.3-2sarge1". > > I upgraded Debian sarge from 3.0 to 3.1 via backports - works great! > - John > > _ > This e-mail has been scanned for viruses by Verizon Business Internet > Managed Scanning Services - powered by MessageLabs. For further > information visit http://www.mci.com > > -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
sa-update doesn't exist on my system
Hello, I run a mail server which is using the latest stable spamassassin available through the standard debian repositories - "spamassassin 3.0.3-2sarge1". As you can imagine, having not done an update of the rules for a very long time, it's pretty useless these days, so i was wondering how "sa-update" worked. BUT... the "sa-update" command doesn't seem to exist on my system... any ideas? Thanks in advance, Richard. -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Email: [EMAIL PROTECTED] Web: http://www.toshiba-europe.com/research/ Tel: +44 1223 376964Mobile: +44 7811 803377
RE: Whitelist not working...
Hello, Thank you for your reply, and apologies for my delay in replying again. If these emails are never going to match the whitelist, is there a way I can always allow emails from certain addresses in a fool-proof way? The addresses I need to allow though are very unlikely to be spoofed, so this isn't too much of a concern. Thanks again, Richard. -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Web: http://www.toshiba-europe.com/research/ Email: [EMAIL PROTECTED] Tel: +44 1223 376964Mobile: +44 7811 803377 > -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: 18 August 2005 18:18 > To: Richard Hobbs > Cc: users@spamassassin.apache.org > Subject: Re: Whitelist not working... > > > > > > Richard Hobbs wrote: > > Hello, > > > > Here are the headers of one of the emails from a receipient in the > > whitelist. I have replaced sensitive information with > and @ symbols > > with [at] in case this gets archived anywhere. > > > > > > > > It all looks normal to me... Any ideas? > > Well it looks normal, but it doesn't look like it should > match your whitelist. > > I see a from address that matches inmac.co.uk, but I don't > see a received: > header that matches inmac.co.uk. In order to be whitelisted > the message must > match BOTH clauses. > > Thus, this message will NEVER match: > > def_whitelist_from_rcvd [EMAIL PROTECTED] inmac.co.uk > > In fact, what appears to be their server (164.38.196.85) > doesn't have any RDNS > entry, so their mail will *never* be able to match any > whitelist_from_rcvd > commands at all. Ever. > > > > _ > This e-mail has been scanned for viruses by MCI's Internet > Managed Scanning Services - powered by MessageLabs. For > further information visit http://www.mci.com > > _ This e-mail has been scanned for viruses by MCI's Internet Managed Scanning Services - powered by MessageLabs. For further information visit http://www.mci.com
RE: Whitelist not working...
Hello, Here are the headers of one of the emails from a receipient in the whitelist. I have replaced sensitive information with and @ symbols with [at] in case this gets archived anywhere. Received: from mail19.messagelabs.com ([193.109.254.3]) by mail.crl.toshiba.co.uk with smtp (Exim 4.50) id 1E52NZ-WN-54 for richard.hobbs[at]crl.toshiba.co.uk; Tue, 16 Aug 2005 15:25:27 +0100 X-VirusChecked: Checked X-Env-Sender: [at]Inmac.co.uk X-Msg-Ref: server-5.tower-19.messagelabs.com!1124202053!34334569!1 X-StarScan-Version: 5.4.15; banners=-,-,crl.toshiba.co.uk X-Originating-IP: [193.109.254.163] Received: (qmail 27475 invoked from network); 16 Aug 2005 14:20:53 - Received: from mail30.messagelabs.com (193.109.254.163) by server-5.tower-19.messagelabs.com with SMTP; 16 Aug 2005 14:20:53 - X-VirusChecked: Checked X-Env-Sender: [at]Inmac.co.uk X-Msg-Ref: server-13.tower-30.messagelabs.com!1124202050!0!1 X-StarScan-Version: 5.4.15; banners=.,-,- X-Originating-IP: [164.38.196.85] Received: (qmail 12189 invoked from network); 16 Aug 2005 14:20:50 - Received: from unknown (HELO pcwbmg02.pcwbhq.co.uk) (164.38.196.85) by server-13.tower-30.messagelabs.com with SMTP; 16 Aug 2005 14:20:50 - Received: from pcwb.com ([164.38.196.51]) by pcwbmg02.pcwbhq.co.uk with Microsoft SMTPSVC(6.0.3790.0); Tue, 16 Aug 2005 15:20:46 +0100 To: richard.hobbs[at]crl.toshiba.co.uk From: [at]Inmac.co.uk Subject: Sales Quotation Date: Tue, 16 Aug 2005 15:23:14 +0100 Date: Tue, 16 Aug 2005 15:23:14 +0100 Message-ID: X-OriginalArrivalTime: 16 Aug 2005 14:20:46.0850 (UTC) FILETIME=[B1D3A620:01C5A26D] It all looks normal to me... Any ideas? Thanks again, Richard. -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Web: http://www.toshiba-europe.com/research/ Email: [EMAIL PROTECTED] Tel: +44 1223 376964Mobile: +44 7811 803377 > -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: 16 August 2005 19:22 > To: Richard Hobbs > Cc: users@spamassassin.apache.org > Subject: Re: Whitelist not working... > > Richard Hobbs wrote: > > Hello, > > > > In an attempt to always allow emails from particular > domains, I have added > > the following lines into "/etc/spamassassin/local.cf": > > > > def_whitelist_from_rcvd [EMAIL PROTECTED] inmac.co.uk > > def_whitelist_from_rcvd [EMAIL PROTECTED] Inmac.co.uk > > def_whitelist_from_rcvd [EMAIL PROTECTED] domain.co.jp > > > > But, they are being ignored. Any ideas? > > What does one of the Received: headers look like? My guess is > if you're having > problems with them matching it's the rcvd part. > > Either that or the From: is in a non-matching format, ie: > [EMAIL PROTECTED] > > > > > Also, are they case sensitive? i.e. if I always allow > [EMAIL PROTECTED] will it > > block [EMAIL PROTECTED] as well? > > They are case insensitive. > > > _ > This e-mail has been scanned for viruses by MCI's Internet > Managed Scanning Services - powered by MessageLabs. For > further information visit http://www.mci.com > > _ This e-mail has been scanned for viruses by MCI's Internet Managed Scanning Services - powered by MessageLabs. For further information visit http://www.mci.com
Whitelist not working...
Hello, In an attempt to always allow emails from particular domains, I have added the following lines into "/etc/spamassassin/local.cf": def_whitelist_from_rcvd [EMAIL PROTECTED] inmac.co.uk def_whitelist_from_rcvd [EMAIL PROTECTED] Inmac.co.uk def_whitelist_from_rcvd [EMAIL PROTECTED] domain.co.jp But, they are being ignored. Any ideas? Also, are they case sensitive? i.e. if I always allow [EMAIL PROTECTED] will it block [EMAIL PROTECTED] as well? Thanks in advance, Richard. -- Richard Hobbs (Systems Administrator) Toshiba Research Europe Ltd. - Speech Technology Group Web: http://www.toshiba-europe.com/research/ Email: [EMAIL PROTECTED] Tel: +44 1223 376964Mobile: +44 7811 803377 _ This e-mail has been scanned for viruses by MCI's Internet Managed Scanning Services - powered by MessageLabs. For further information visit http://www.mci.com
