Re: Spam coming thru w/high score & different SA version
From: "Jim Maul" <[EMAIL PROTECTED]>
Tracey Gates wrote:
I checked and did find 2 spamd files. One was in /usr/bin with the
latest install date. The other one was in /etc/rc.d/init.d with the
older install date. I backed up the older files and replaced the ones
that are in the init.d directory with the ones from the /usr/bin
directory. (replaced the spamassassin and spamd files). I then stopped
and restarted spamd. I checked emails that came in after the restart of
spamd and they still say version 3.0.2. I'm guessing I'm still missing
something?
Any suggestions?
Yeah, the one in /usr/bin is the actual file. The one you see in
/etc/rc.d/init.d is a startup script for spamd. These are NOT the same
thing. You do NOT want to copy /usr/bin/spamd to
/etc/rc.d/init.d/spamd! What you did will cause spamd to not start up
on reboot anymore. I would undo what you did and look around some more
for another copy. the one in init.d is not what your looking for.
ls /usr/lib/perl5/site_perl/*/Mail/SpamAssassin*
ls /usr/sbin/spam*
ls /usr/local/sbin/spam*
If the first shows TWO SpamAssassin.pm modules you're toast.
If the second two tests both show spamd and spamassassin you're toast.
If you are toast you need to back out BOTH SpamAssassin installs, to
make sure you are clean, then install the newer one.
{^_^}
RE: Spam coming thru w/high score & different SA version
I had to restart CGPSA and it picked up the new version of 3.1.1. I hope now that it will catch the spam emails better that I have been having problems with. :-) Tracey Gates Lead Developer [EMAIL PROTECTED] 1350 South Boulder, Third Floor / Tulsa, OK 74119-3203 Phone 918-663-0991 / Fax 918-663-0840 This communication is intended only for the recipient(s) named above; may be confidential and/or legally privileged; and, must be treated as such in accordance with state and federal laws. If you are not the intended recipient, you are hereby notified that any use of this communication, or any of its contents, is prohibited. If you have received this communication in error, please reply to the sender and then delete the message from your computer system immediately. -Original Message- From: Jim Maul [mailto:[EMAIL PROTECTED] Sent: Thursday, April 27, 2006 1:21 PM To: Tracey Gates Cc: users@spamassassin.apache.org Subject: Re: Spam coming thru w/high score & different SA version Tracey Gates wrote: > OK. Sorry, I'm a novice at all of this admin stuff. I replaced the > old files back and restarted spamd again. I did a find for spamd and > here is my results: > > [EMAIL PROTECTED] /]# find ./ -name spamd > find: ./proc/9832/fd: No such file or directory > ./etc/rc.d/init.d/spamd ./usr/bin/spamd > ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.0.2/spamd > ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.0.2/spamd/spamd > ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.0.2/blib/script/spamd > ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.1.1/spamd > ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.1.1/spamd/spamd > ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.1.1/blib/script/spamd > ./home/administrator/Mail-SpamAssassin-3.0.2/spamd > ./home/administrator/Mail-SpamAssassin-3.0.2/spamd/spamd > ./home/administrator/Mail-SpamAssassin-3.0.2/blib/script/spamd > > Am I looking for the correct file? I don't see what it might be > picking up the wrong version. > Ah, wait! I just went back and re-read the original email. You said: >I'm running on a RedHat ES 3.0 using CommuniGatePro and CGPSA. The >CGPSA.conf file points to the correct directories for my SA >installation. Any suggestions would be a great help. This link: http://www.tffenterprises.com/cgpsa/ says: >The filter works efficiently, by directly using the SpamAssassin API. >It does not rely on a daemon process such as spamd or on the execution >of shell scripts (as the usual process for utilizing SpamAssassin with >CommuniGate servers does). It can safely be used with multiple >CommuniGate Pro enqueuer threads. So... basically, your not using spamd. Looking for another copy of it is pointless. It seems you have 2 copies of the SpamAssassin API laying around. -Jim
Re: Spam coming thru w/high score & different SA version
Tracey Gates wrote: OK. Sorry, I'm a novice at all of this admin stuff. I replaced the old files back and restarted spamd again. I did a find for spamd and here is my results: [EMAIL PROTECTED] /]# find ./ -name spamd find: ./proc/9832/fd: No such file or directory ./etc/rc.d/init.d/spamd ./usr/bin/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.0.2/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.0.2/spamd/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.0.2/blib/script/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.1.1/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.1.1/spamd/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.1.1/blib/script/spamd ./home/administrator/Mail-SpamAssassin-3.0.2/spamd ./home/administrator/Mail-SpamAssassin-3.0.2/spamd/spamd ./home/administrator/Mail-SpamAssassin-3.0.2/blib/script/spamd Am I looking for the correct file? I don't see what it might be picking up the wrong version. Ah, wait! I just went back and re-read the original email. You said: >I'm running on a RedHat ES 3.0 using CommuniGatePro and CGPSA. The >CGPSA.conf file points to the correct directories for my SA >installation. Any suggestions would be a great help. This link: http://www.tffenterprises.com/cgpsa/ says: >The filter works efficiently, by directly using the SpamAssassin API. >It does not rely on a daemon process such as spamd or on the execution >of shell scripts (as the usual process for utilizing SpamAssassin with >CommuniGate servers does). It can safely be used with multiple >CommuniGate Pro enqueuer threads. So... basically, your not using spamd. Looking for another copy of it is pointless. It seems you have 2 copies of the SpamAssassin API laying around. -Jim
RE: Spam coming thru w/high score & different SA version
OK. Sorry, I'm a novice at all of this admin stuff. I replaced the old files back and restarted spamd again. I did a find for spamd and here is my results: [EMAIL PROTECTED] /]# find ./ -name spamd find: ./proc/9832/fd: No such file or directory ./etc/rc.d/init.d/spamd ./usr/bin/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.0.2/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.0.2/spamd/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.0.2/blib/script/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.1.1/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.1.1/spamd/spamd ./usr/src/redhat/BUILD/Mail-SpamAssassin-3.1.1/blib/script/spamd ./home/administrator/Mail-SpamAssassin-3.0.2/spamd ./home/administrator/Mail-SpamAssassin-3.0.2/spamd/spamd ./home/administrator/Mail-SpamAssassin-3.0.2/blib/script/spamd Am I looking for the correct file? I don't see what it might be picking up the wrong version. Confused Tracey Gates Lead Developer [EMAIL PROTECTED] 1350 South Boulder, Third Floor / Tulsa, OK 74119-3203 Phone 918-663-0991 / Fax 918-663-0840 This communication is intended only for the recipient(s) named above; may be confidential and/or legally privileged; and, must be treated as such in accordance with state and federal laws. If you are not the intended recipient, you are hereby notified that any use of this communication, or any of its contents, is prohibited. If you have received this communication in error, please reply to the sender and then delete the message from your computer system immediately. -Original Message- From: Jim Maul [mailto:[EMAIL PROTECTED] Sent: Thursday, April 27, 2006 12:59 PM To: Tracey Gates; users@spamassassin.apache.org Subject: Re: Spam coming thru w/high score & different SA version Tracey Gates wrote: > I checked and did find 2 spamd files. One was in /usr/bin with the > latest install date. The other one was in /etc/rc.d/init.d with the > older install date. I backed up the older files and replaced the ones > that are in the init.d directory with the ones from the /usr/bin > directory. (replaced the spamassassin and spamd files). I then > stopped and restarted spamd. I checked emails that came in after the > restart of spamd and they still say version 3.0.2. I'm guessing I'm > still missing something? > > Any suggestions? > Yeah, the one in /usr/bin is the actual file. The one you see in /etc/rc.d/init.d is a startup script for spamd. These are NOT the same thing. You do NOT want to copy /usr/bin/spamd to /etc/rc.d/init.d/spamd! What you did will cause spamd to not start up on reboot anymore. I would undo what you did and look around some more for another copy. the one in init.d is not what your looking for. -Jim
Re: Spam coming thru w/high score & different SA version
Tracey Gates wrote: > I checked and did find 2 spamd files. One was in /usr/bin with the > latest install date. The other one was in /etc/rc.d/init.d with the > older install date. ACCK /etc/rc.d/init.d is your INIT SCRIPTS! It should NEVER contain binaries or ordinary programs. Just the init scripts that start anything that needs to run as a daemon. Restore the original /etc/rc.d/init.d file. It is NOT the same as the spamd file from /usr/bin.. It's not even close to the same. (take a look, the init one should be a shell script, the /usr/bin one should be a perl program)
Re: Spam coming thru w/high score & different SA version
Tracey Gates wrote: I checked and did find 2 spamd files. One was in /usr/bin with the latest install date. The other one was in /etc/rc.d/init.d with the older install date. I backed up the older files and replaced the ones that are in the init.d directory with the ones from the /usr/bin directory. (replaced the spamassassin and spamd files). I then stopped and restarted spamd. I checked emails that came in after the restart of spamd and they still say version 3.0.2. I'm guessing I'm still missing something? Any suggestions? Yeah, the one in /usr/bin is the actual file. The one you see in /etc/rc.d/init.d is a startup script for spamd. These are NOT the same thing. You do NOT want to copy /usr/bin/spamd to /etc/rc.d/init.d/spamd! What you did will cause spamd to not start up on reboot anymore. I would undo what you did and look around some more for another copy. the one in init.d is not what your looking for. -Jim
RE: Spam coming thru w/high score & different SA version
I checked and did find 2 spamd files. One was in /usr/bin with the latest install date. The other one was in /etc/rc.d/init.d with the older install date. I backed up the older files and replaced the ones that are in the init.d directory with the ones from the /usr/bin directory. (replaced the spamassassin and spamd files). I then stopped and restarted spamd. I checked emails that came in after the restart of spamd and they still say version 3.0.2. I'm guessing I'm still missing something? Any suggestions? Tracey Gates Lead Developer [EMAIL PROTECTED] 1350 South Boulder, Third Floor / Tulsa, OK 74119-3203 Phone 918-663-0991 / Fax 918-663-0840 This communication is intended only for the recipient(s) named above; may be confidential and/or legally privileged; and, must be treated as such in accordance with state and federal laws. If you are not the intended recipient, you are hereby notified that any use of this communication, or any of its contents, is prohibited. If you have received this communication in error, please reply to the sender and then delete the message from your computer system immediately. -Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 26, 2006 3:12 PM To: Tracey Gates Cc: users@spamassassin.apache.org Subject: Re: Spam coming thru w/high score & different SA version Tracey Gates wrote: > OK. Now I understand the high (actually negative) score but what > about the version difference? Anyone have any idea about that issue? Possible double-install. One in /usr/ and one in /usr/local?
Re: Spam coming thru w/high score & different SA version
Tracey Gates wrote: > OK. Now I understand the high (actually negative) score but what about > the version difference? Anyone have any idea about that issue? Possible double-install. One in /usr/ and one in /usr/local?
RE: Spam coming thru w/high score & different SA version
OK. Now I understand the high (actually negative) score but what about the version difference? Anyone have any idea about that issue? Tracey Gates Lead Developer [EMAIL PROTECTED] 1350 South Boulder, Third Floor / Tulsa, OK 74119-3203 Phone 918-663-0991 / Fax 918-663-0840 This communication is intended only for the recipient(s) named above; may be confidential and/or legally privileged; and, must be treated as such in accordance with state and federal laws. If you are not the intended recipient, you are hereby notified that any use of this communication, or any of its contents, is prohibited. If you have received this communication in error, please reply to the sender and then delete the message from your computer system immediately. -Original Message- From: Dale Morin [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 26, 2006 2:31 PM To: Tracey Gates Cc: users@spamassassin.apache.org Subject: Re: Spam coming thru w/high score & different SA version > I got this email with a high score of 101.6 and the version as 3.0.2. > I have my score limit set to 3.5 in my local.cf file. Why wasn't this > detected as spam? > > HEADER OF PROBLEM EMAIL: > > X-Spam-Status: No, score=-101.6 required=3.5 > tests=BAYES_00,FM_NO_STYLE, HTML_80_90,HTML_MESSAGE,USER_IN_WHITELIST > autolearn=no version=3.0.2 Sorry, Tracey, the score is a MINUS 101.6. The USER_IN_WHITELIST probably subtracted 100 from the score. -- Dale Morin, Mustang Internet Services, Inc. "Support Without Compromise" email: [EMAIL PROTECTED]
RE: Spam coming thru w/high score & different SA version
DOH! Thanks Dale for pointing that out. Of course I didn't see the negative sign. Tracey Gates Lead Developer [EMAIL PROTECTED] 1350 South Boulder, Third Floor / Tulsa, OK 74119-3203 Phone 918-663-0991 / Fax 918-663-0840 This communication is intended only for the recipient(s) named above; may be confidential and/or legally privileged; and, must be treated as such in accordance with state and federal laws. If you are not the intended recipient, you are hereby notified that any use of this communication, or any of its contents, is prohibited. If you have received this communication in error, please reply to the sender and then delete the message from your computer system immediately. -Original Message- From: Dale Morin [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 26, 2006 2:31 PM To: Tracey Gates Cc: users@spamassassin.apache.org Subject: Re: Spam coming thru w/high score & different SA version > I got this email with a high score of 101.6 and the version as 3.0.2. > I have my score limit set to 3.5 in my local.cf file. Why wasn't this > detected as spam? > > HEADER OF PROBLEM EMAIL: > > X-Spam-Status: No, score=-101.6 required=3.5 > tests=BAYES_00,FM_NO_STYLE, HTML_80_90,HTML_MESSAGE,USER_IN_WHITELIST > autolearn=no version=3.0.2 Sorry, Tracey, the score is a MINUS 101.6. The USER_IN_WHITELIST probably subtracted 100 from the score. -- Dale Morin, Mustang Internet Services, Inc. "Support Without Compromise" email: [EMAIL PROTECTED]
Re: Spam coming thru w/high score & different SA version
> I got this email with a high score of 101.6 and the version as 3.0.2. I > have my score limit set to 3.5 in my local.cf file. Why wasn't this > detected as spam? > > HEADER OF PROBLEM EMAIL: > > X-Spam-Status: No, score=-101.6 required=3.5 tests=BAYES_00,FM_NO_STYLE, > HTML_80_90,HTML_MESSAGE,USER_IN_WHITELIST autolearn=no version=3.0.2 Sorry, Tracey, the score is a MINUS 101.6. The USER_IN_WHITELIST probably subtracted 100 from the score. -- Dale Morin, Mustang Internet Services, Inc. "Support Without Compromise" email: [EMAIL PROTECTED]
Spam coming thru w/high score & different SA version
Title: Message I got this email with a high score of 101.6 and the version as 3.0.2. I have my score limit set to 3.5 in my local.cf file. Why wasn't this detected as spam? Also when I run spamassassin -v on my server I get the version as 3.1.1 but the email header has 3.0.2 as the version? Did I miss something in my upgrade last week? HEADER OF PROBLEM EMAIL: Return-Path: <[EMAIL PROTECTED]>Received: by yoursummit.com (CommuniGate Pro PIPE 4.3.8) with PIPE id 3130662; Wed, 26 Apr 2006 13:38:30 -0500Received: from [88.0.181.15] (HELO dpra.com) by yoursummit.com (CommuniGate Pro SMTP 4.3.8) with SMTP id 3130660 for [EMAIL PROTECTED]; Wed, 26 Apr 2006 13:38:24 -0500Received-SPF: none receiver=yoursummit.com; client-ip=88.0.181.15; [EMAIL PROTECTED]Message-ID: <[EMAIL PROTECTED]>Reply-To: "Ezra Defeo" <[EMAIL PROTECTED]>From: "Ezra Defeo" <[EMAIL PROTECTED]>To: [EMAIL PROTECTED]Subject: Re: good AMBvtENDate: Wed, 26 Apr 2006 11:38:03 -0700MIME-Version: 1.0Content-Type: multipart/alternative; boundary="=_NextPart_000_0001_01C66925.E0D8AA40"X-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express 6.00.2800.1106X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on yoursummit.comX-Spam-Level: X-Spam-Status: No, score=-101.6 required=3.5 tests=BAYES_00,FM_NO_STYLE, HTML_80_90,HTML_MESSAGE,USER_IN_WHITELIST autolearn=no version=3.0.2X-TFF-CGPSA-Version: 1.4X-TFF-CGPSA-Filter: Scanned Tracey GatesLead Developer[EMAIL PROTECTED] 1350 South Boulder, Third Floor / Tulsa, OK 74119-3203Phone 918-663-0991 / Fax 918-663-0840 This communication is intended only for the recipient(s) named above; may be confidential and/or legally privileged; and, must be treated as such in accordance with state and federal laws. If you are not the intended recipient, you are hereby notified that any use of this communication, or any of its contents, is prohibited. If you have received this communication in error, please reply to the sender and then delete the message from your computer system immediately.
Spam coming thru w/high score & different SA version
Title: Message I got this email with a high score of 101.6 and the version as 3.0.2. I have my score limit set to 3.5 in my local.cf file. Why wasn't this detected as spam? Also when I run spamassassin -v on my server I get the version as 3.1.1 but the email header has 3.0.2 as the version? Did I miss something in my upgrade last week? I'm running on a RedHat ES 3.0 using CommuniGatePro and CGPSA. The CGPSA.conf file points to the correct directories for my SA installation. Any suggestions would be a great help. HEADER OF PROBLEM EMAIL: Return-Path: <[EMAIL PROTECTED]>Received: by mydomain.com (CommuniGate Pro PIPE 4.3.8) with PIPE id 3130662; Wed, 26 Apr 2006 13:38:30 -0500Received: from [88.0.181.15] (HELO dpra.com) by mydomain.com (CommuniGate Pro SMTP 4.3.8) with SMTP id 3130660 for tgates@mydomain.com; Wed, 26 Apr 2006 13:38:24 -0500Received-SPF: none receiver=yoursummit.com; client-ip=88.0.181.15; [EMAIL PROTECTED]Message-ID: <[EMAIL PROTECTED]>Reply-To: "Ezra Defeo" <[EMAIL PROTECTED]>From: "Ezra Defeo" <[EMAIL PROTECTED]>To: tgates@mydomain.comSubject: Re: good AMBvtENDate: Wed, 26 Apr 2006 11:38:03 -0700MIME-Version: 1.0Content-Type: multipart/alternative; boundary="=_NextPart_000_0001_01C66925.E0D8AA40"X-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express 6.00.2800.1106X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on mydomain.comX-Spam-Level: X-Spam-Status: No, score=-101.6 required=3.5 tests=BAYES_00,FM_NO_STYLE, HTML_80_90,HTML_MESSAGE,USER_IN_WHITELIST autolearn=no version=3.0.2X-TFF-CGPSA-Version: 1.4X-TFF-CGPSA-Filter: Scanned Tracey GatesLead Developer[EMAIL PROTECTED] 1350 South Boulder, Third Floor / Tulsa, OK 74119-3203Phone 918-663-0991 / Fax 918-663-0840 This communication is intended only for the recipient(s) named above; may be confidential and/or legally privileged; and, must be treated as such in accordance with state and federal laws. If you are not the intended recipient, you are hereby notified that any use of this communication, or any of its contents, is prohibited. If you have received this communication in error, please reply to the sender and then delete the message from your computer system immediately.
