I am running Spamassassin 3.0.2 on a RaQ 550 using spamd and calling
spamc from procmail. I have found several instances now where the spamd
child is respawned just as it is about to start processing a message.
For example check these log entries:
Jun 15 09:11:05 citlatepetl sendmail[547]: j5FFB5s00547:
from=<[EMAIL PROTECTED]>, size=14614, class=0, nrcpts=1,
msgid=<[EMAIL PROTECTED]>, proto=ESMTP,
daemon=MTA, relay=sta-208-139-195-125.rockynet.com [208.139.195.125]
Jun 15 09:11:05 citlatepetl MailScanner[22211]: New Batch: Forwarding 1
unscanned messages, 15161 bytes
Jun 15 09:11:05 citlatepetl MailScanner[22211]: Unscanned: Delivered 1
messages
Jun 15 09:11:05 citlatepetl MailScanner[22211]: Virus and Content
Scanning: Starting
Jun 15 09:11:06 citlatepetl spamd[30311]: got connection over
/home/spam-filter/tmp/spamd.sock
Jun 15 09:11:06 citlatepetl spamd[30311]: info: setuid to rlbieber succeeded
Jun 15 09:11:07 citlatepetl spamd[16315]: server hit by SIGCHLD
Jun 15 09:11:07 citlatepetl spamd[16315]: handled cleanup of child pid 30311
Jun 15 09:11:07 citlatepetl spamd[16315]: server successfully spawned
child process, pid 555
Jun 15 09:11:07 citlatepetl sendmail[549]: j5FFB5s00547:
to=<[EMAIL PROTECTED]>, delay=00:00:02, xdelay=00:00:01,
mailer=local, pri=134614, dsn=2.0.0, stat=Sent
Note that spamd[30311] was about to process the message when it appears
spamd[16315] came by, killed it, cleaned up after it and then started a
new child. Thus spamassassin was never run on the message. Later I
spoofed the address [EMAIL PROTECTED] and sent a test message to the
account in question. The second time everything nearly worked as expected:
Jun 15 19:54:41 citlatepetl sendmail[12465]: j5G1ses12465:
from=<[EMAIL PROTECTED]>, size=1461, class=0, nrcpts=1,
msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA,
relay=sta-208-139-195-125.rockynet.com [208.139.195.125]
Jun 15 19:54:41 citlatepetl MailScanner[31317]: New Batch: Forwarding 1
unscanned messages, 1996 bytes
Jun 15 19:54:41 citlatepetl MailScanner[31317]: Unscanned: Delivered 1
messages
Jun 15 19:54:41 citlatepetl MailScanner[31317]: Virus and Content
Scanning: Starting
Jun 15 19:54:41 citlatepetl spamd[32349]: got connection over
/home/spam-filter/tmp/spamd.sock
Jun 15 19:54:41 citlatepetl spamd[32349]: info: setuid to rlbieber succeeded
Jun 15 19:54:41 citlatepetl spamd[32349]: processing message
<[EMAIL PROTECTED]> for rlbieber:540.
Jun 15 19:54:56 citlatepetl spamd[32349]: result: Y 97 - ALL_TRUSTED,
BAYES_00, DOMAIN_RATIO, ONE_WORD_SUBJECT, SARE_FROM_SPAM_WORD3,
USER_IN_BLACKLIST scantime=13.2, size=1949,
mid=<[EMAIL PROTECTED]>, bayes=6.10622663543836e-16,
autolearn=ham
Jun 15 19:54:54 citlatepetl sendmail[12469]: j5G1ses12465:
to=<[EMAIL PROTECTED]>, delay=00:00:13, xdelay=00:00:13,
mailer=local, pri=121461, dsn=2.0.0, stat=Sent
This time the message was processed, the user_prefs file was refered to
and the message flagged with a score of 97 per the user's blacklist.
However, I don't understand the autolearn as ham given the score of 97.
I did a search of the archives and didn't find anything really relevant.
Is there a problem with 3.0.2 in regards to spamd dying just as it is
about to process a message? And what's up with the autolearn=ham? Does
the USER_IN_BLACKLIST not come into play with autolearn?
--
Paul ([EMAIL PROTECTED])
