From: "Thomas Booms" <[EMAIL PROTECTED]>
> Loren Wilton schrieb:
>
> >>Well, header I have on detected spams like these (possibly I need to
> >>reconfigure something) to get the above lists:
> >>
> >>X-Spam-Status: No, score=-1.8 required=1.5 tests=BAYES_00,
> >>DATE_IN_FUTURE_03_06 autolearn=ham version=3.0.4
> >>
> >>
> >
> >This says that the message is NOT spam. Bayes in particular is convinced
> >that it was ham, and has auto-learned it as such. It looks like your
Bayes
> >database is corrupt and will need to be rebuilt at some point.
> >
> >However, before doing that, we need to figure out why all this hit was
> >date-in-future.
> >
> >I'm a little concerned that that initial Received header from Qmail may
be
> >keeping SA from analyzing the return headers. This could case a lot fo
the
> >net tests to fail. Hiwever, maybe that header is ok. Others that know
more
> >about received headers than I do will look at it.
> >
> >If that spam had been in English the body text would have nailed it.
> >"Greencard lottery" is pretty much a guaranteed spam indicator all by
> >itself. This looks like a case where a few of the rules for these things
> >could profitably be translated to German, by someone that speaks both
> >languages. (I don't, or I'd just do it.)
> >
> >There is a good chance though that register-usa.com should have hit
SURBL.
> >This makes me think your net tests aren't working. Since this is 3.0.4,
> >they should be by default.
> >
> >Why don't you run "spamassassin --lint -D" and post the output. My guess
is
> >you either have a problem with the Net::DNS version, or init.pre insn't
> >installed correctly. (Of course you might be starting SA with the -L
> >parameter that disables net tests.)
> >
> > Loren
> >
> >
> >
> >
> >
> Here's what you wanted (by spamassassin --lint -D):
>
> spamassassin --lint -D
> debug: SpamAssassin version 3.0.4
> debug: Score set 0 chosen.
> debug: running in taint mode? yes
> debug: Running in taint mode, removing unsafe env vars, and resetting PATH
> debug: PATH included '/sbin', keeping.
> debug: PATH included '/usr/sbin', keeping.
> debug: PATH included '/usr/local/sbin', keeping.
> debug: PATH included '/root/bin', keeping.
> debug: PATH included '/usr/local/bin', keeping.
> debug: PATH included '/usr/local/news/bin', keeping.
> debug: PATH included '/usr/bin', keeping.
> debug: PATH included '/usr/X11R6/bin', keeping.
> debug: PATH included '/bin', keeping.
> debug: PATH included '/var/qmail/bin', keeping.
> debug: PATH included '/usr/local/bin/ezmlm', keeping.
> debug: PATH included '/usr/local/sbin', keeping.
> debug: PATH included '/usr/games', keeping.
> debug: PATH included '/opt/gnome/bin', keeping.
> debug: PATH included '/opt/kde3/bin', keeping.
> debug: PATH included '/usr/lib/java/jre/bin', keeping.
> debug: Final PATH set to:
>
/sbin:/usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:/usr/local/news/bin
:/usr/bin:/usr/X11R6/bin:/bin:/var/qmail/bin:/usr/local/bin/ezmlm:/usr/local
/sbin:/usr/games:/opt/gnome/bin:/opt/kde3/bin:/usr/lib/java/jre/bin
> debug: diag: module installed: DBI, version 1.48
> debug: diag: module installed: DB_File, version 1.811
> debug: diag: module installed: Digest::SHA1, version 2.10
> debug: diag: module installed: IO::Socket::UNIX, version 1.21
> debug: diag: module installed: MIME::Base64, version 3.05
> debug: diag: module installed: Net::DNS, version 0.52
Good version, I believe.
> debug: diag: module not installed: Net::LDAP ('require' failed)
> debug: diag: module installed: Razor2::Client::Agent, version 2.72
> debug: diag: module installed: Storable, version 2.15
> debug: diag: module installed: URI, version 1.35
> debug: ignore: using a test message to lint rules
> debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
> debug: config: read file /etc/mail/spamassassin/init.pre
> debug: using "/usr/share/spamassassin" for default rules dir
> debug: config: read file /usr/share/spamassassin/10_misc.cf
> debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
> debug: config: read file /usr/share/spamassassin/20_body_tests.cf
> debug: config: read file /usr/share/spamassassin/20_compensate.cf
> debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
> debug: config: read file /usr/share/spamassassin/20_drugs.cf
> debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
> debug: config: read file /usr/share/spamassassin/20_head_tests.cf
> debug: config: read file /usr/share/spamassassin/20_html_tests.cf
> debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
> debug: config: read file /usr/share/spamassassin/20_phrases.cf
> debug: config: read file /usr/share/spamassassin/20_porn.cf
> debug: config: read file /usr/share/spamassassin/20_ratware.cf
> debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
> debug: config: read file /usr/share/spamassassin/23_bayes.cf
> debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
> debug: config: read file /usr/share/spamassassin/25_hashcash.cf
> debug: config: read file /usr/share/spamassassin/25_spf.cf
> debug: config: read file /usr/share/spamassassin/25_uribl.cf
> debug: config: read file /usr/share/spamassassin/30_text_de.cf
> debug: config: read file /usr/share/spamassassin/30_text_fr.cf
> debug: config: read file /usr/share/spamassassin/30_text_nl.cf
> debug: config: read file /usr/share/spamassassin/30_text_pl.cf
> debug: config: read file /usr/share/spamassassin/50_scores.cf
> debug: config: read file /usr/share/spamassassin/60_whitelist.cf
> debug: using "/etc/mail/spamassassin" for site rules dir
> debug: config: read file /etc/mail/spamassassin/local.cf
> debug: using "/root/.spamassassin" for user state dir
> debug: using "/root/.spamassassin/user_prefs" for user prefs file
> debug: config: read file /root/.spamassassin/user_prefs
>From here it gets interesting.
> debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
> debug: plugin: registered
> Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38)
> debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
> debug: plugin: registered
> Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8de9e60)
> debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
> debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c)
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38)
> implements 'parse_config'
> debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8de9e60)
> implements 'parse_config'
Seems the BL plugins loaded OK.
> debug: using "/root/.spamassassin" for user state dir
> debug: bayes: 14504 tie-ing to DB file R/O /root/.spamassassin/bayes_toks
> debug: bayes: 14504 tie-ing to DB file R/O /root/.spamassassin/bayes_seen
> debug: bayes: found bayes db version 3
> debug: using "/root/.spamassassin" for user state dir
> debug: bayes: Not available for scanning, only 0 spam(s) in Bayes DB < 200
> debug: bayes: 14504 untie-ing
> debug: bayes: 14504 untie-ing db_toks
> debug: bayes: 14504 untie-ing db_seen
> debug: Score set 1 chosen.
> debug: ---- MIME PARSER START ----
> debug: main message type: text/plain
> debug: parsing normal part
> debug: added part, type: text/plain
> debug: ---- MIME PARSER END ----
> debug: bayes: 14504 tie-ing to DB file R/O /root/.spamassassin/bayes_toks
> debug: bayes: 14504 tie-ing to DB file R/O /root/.spamassassin/bayes_seen
> debug: bayes: found bayes db version 3
> debug: bayes: Not available for scanning, only 0 spam(s) in Bayes DB < 200
> debug: bayes: 14504 untie-ing
> debug: bayes: 14504 untie-ing db_toks
> debug: bayes: 14504 untie-ing db_seen
> debug: metadata: X-Spam-Relays-Trusted:
> debug: metadata: X-Spam-Relays-Untrusted:
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38)
> implements 'parsed_metadata'
> debug: is Net::DNS::Resolver available? yes
> debug: Net::DNS version: 0.52
You do have DNS available.
> debug: trying (3) yahoo.com...
> debug: looking up NS for 'yahoo.com'
> debug: NS lookup of yahoo.com succeeded => Dns available (set
> dns_available to hardcode)
> debug: is DNS available? 1
And DNS works, at least on a simple check.
> debug: decoding: no encoding detected
> debug: URIDNSBL: domains to query:
> debug: all '*From' addrs: [EMAIL PROTECTED]
> debug: Running tests for priority: 0
> debug: running header regexp tests; score so far=0
> debug: registering glue method for check_hashcash_double_spend
> (Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8de9e60))
> debug: registering glue method for check_for_spf_helo_pass
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
> debug: SPF: message was delivered entirely via trusted relays, not
required
> debug: registering glue method for check_hashcash_value
> (Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8de9e60))
> debug: all '*To' addrs:
> debug: registering glue method for check_for_spf_softfail
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
> debug: SPF: message was delivered entirely via trusted relays, not
required
> debug: registering glue method for check_for_spf_pass
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
> debug: registering glue method for check_for_spf_helo_softfail
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
> debug: registering glue method for check_for_spf_fail
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
> debug: registering glue method for check_for_spf_helo_fail
> (Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
> debug: running body-text per-line regexp tests; score so far=-2.623
> debug: running uri tests; score so far=-2.623
Registered SPF tests.
> debug: registering glue method for check_uridnsbl
> (Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38))
> debug: Razor2 is available
> debug: entering helper-app run mode
> razor2 check skipped: No such file or directory Can't read conf file:
> /etc/mail/spamassassin/.razor/razor-agent.conf
Can't run Razor2. It's not available on your machine. So no score.
> debug: leaving helper-app run mode
> debug: Razor2 results: spam? 0 highest cf score: 0
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38)
> implements 'check_tick'
> debug: running raw-body-text per-line regexp tests; score so far=-2.623
> debug: running full-text regexp tests; score so far=-2.623
> debug: Razor2 is available
> debug: Current PATH is:
>
/sbin:/usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:/usr/local/news/bin
:/usr/bin:/usr/X11R6/bin:/bin:/var/qmail/bin:/usr/local/bin/ezmlm:/usr/local
/sbin:/usr/games:/opt/gnome/bin:/opt/kde3/bin:/usr/lib/java/jre/bin
> debug: Pyzor is not available: pyzor not found
Pyzor is also not found. So of course - no pyzor score.
> debug: DCCifd is not available: no r/w dccifd socket found.
DCCifd not there. So it is skipped.
> debug: executable for dccproc was found at /usr/local/bin/dccproc
> debug: DCC is available: /usr/local/bin/dccproc
> debug: entering helper-app run mode
> debug: setuid: helper proc 14505: ruid=0 euid=0
> debug: DCC: got response: X-DCC-NIET-Metrics: host1 1080; Body=3682
> Fuz1=2216208 Fuz2=2216196
> debug: leaving helper-app run mode
> debug: DCC: Listed! BODY: 3682 of 999999 FUZ1: 2216208 of 999999 FUZ2:
> 2216196 of 999999
DCC exists and was run. Not sure what it's report means.
> debug: Running tests for priority: 500
> debug: RBL: success for 1 of 1 queries
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38)
> implements 'check_post_dnsbl'
So all the BL tests ou asked for basically failed because the Razor
and Pyzor facilities were not located on your machine. You will have
to install them. (And you should enable other rules you seem to have
disabled.)
> debug: running meta tests; score so far=-1.25
> debug: running header regexp tests; score so far=0.32
> debug: running body-text per-line regexp tests; score so far=0.32
> debug: running uri tests; score so far=0.32
> debug: running raw-body-text per-line regexp tests; score so far=0.32
> debug: running full-text regexp tests; score so far=0.32
> debug: Running tests for priority: 1000
> debug: running meta tests; score so far=0.32
> debug: running header regexp tests; score so far=0.32
> debug: using "/root/.spamassassin" for user state dir
> debug: lock: 14504 created
> /root/.spamassassin/auto-whitelist.lock.host1.booms-edv.de.14504
> debug: lock: 14504 trying to get lock on
> /root/.spamassassin/auto-whitelist with 0 retries
>
> Thomas
{^_^} Joanne
