From: Dan Schaefer <d...@performanceadmin.com> Date: Tue, 13 Oct 2009 10:17:43 -0400 Jeff Mincy wrote: > From: Dan Schaefer <d...@performanceadmin.com> > Date: Tue, 13 Oct 2009 09:18:44 -0400 > > Jeff Mincy wrote: > > From: Dan Schaefer <d...@performanceadmin.com> > > Date: Tue, 13 Oct 2009 08:54:29 -0400 > > > > Jason Bertoch wrote: > > > Dan Schaefer wrote: > > >> I just enabled DCC yesterday and everything appears to be working > > >> (DCC is registered). Just to make sure, can someone post an email to > > >> pastebin that has a DCC hit? Thanks. > > >> > > > IIRC, a message with "test" in the subject and body will match, > > > although your logs should tell you what rules are hitting anyway. > > > > Is DCC_CHECK the only DCC rule? Because I didn't find that in my logs > > yesterday. "test" in the subject and "test" in the body only triggered > > TVD_SPACE_RATIO and BAYES_00 from my personal email address to my work > > address. Any other suggestions? > > > > Use > > spamassassin --test-mode --debug dcc < somespammsg > > > > Should print out stuff like: > > > > 08:58:51.617 0.375 0.375 [28903] dbg: dcc: network tests on, registering DCC > > 08:58:54.405 3.164 0.943 [28903] dbg: dcc: dccifd is available: /var/lib/dcc/dccifd > > 08:58:54.585 3.343 0.179 [28903] dbg: dcc: dccifd got response: X-DCC--Metrics: pinky 1356; bulk Body=3 Fuz1=4384 Fuz2=many > > 08:58:54.585 3.343 0.000 [28903] dbg: dcc: listed: BODY=3/20 FUZ1=4384/20 FUZ2=999999/20 > > > > > > -jeff > > > I followed your instructions and received the following: > > [1486] dbg: dcc: network tests on, registering DCC > [1486] dbg: dcc: dccifd is not available: no r/w dccifd socket found > [1486] dbg: dcc: dccproc is not available: no dccproc executable found > [1486] dbg: dcc: dccifd and dccproc are not available, disabling DCC > > After seeing that, I NAT-ed 1023 local to 6277 remote and 6277 remote to > 1023 to my mail server in my firewall. I ran the test again and received > the same message. > > Your firewall is not the problem shown here. SpamAssassin can't find > the dcc socket and executable. Do you have DCC installed? If so, > where is the dccproc executable? Did you start dccifd? Where is the > dccifd socket? SpamAssassin needs to know where they are. You can > use various configuration options to tell SpamAssassin where to look, > for example: > ## DCC options (Admin only) > dcc_home /var/lib/dcc > dcc_dccifd_path /var/lib/dcc/dccifd > dcc_path /usr/bin/dccproc > > -jeff > I did just install DCC, but I don't know if it is installed correctly. And of course, DCC's website is down (http://www.rhyolite.com/anti-spam/dcc/). I used the instructions here instead: http://www.freespamfilter.org/FC4.html#_Toc110999211 Now when I run: spamassassin -t -D dcc < spam_message I get: [2955] dbg: dcc: network tests on, registering DCC [2955] dbg: dcc: dccifd is not available: no r/w dccifd socket found [2955] dbg: dcc: dccproc is available: /usr/bin/dccproc [2955] dbg: dcc: opening pipe: /usr/bin/dccproc -H -x 0 -a 74.86.146.6 < /tmp/.spamassassin2955q6p1Yatmp [2955] dbg: dcc: got response: X-DCC-SIHOPE-DCC-3-Metrics: pony.performanceadmin.com 1085; Body=2 Fuz1=2 Fuz2=many and 2.2 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/) in the report Even though the dccfid socket cannot be found, does this appear to be working correctly?
Yes dccproc is working. You got a hit on DCC_CHECK. You should use dccifd if possible. It is faster. -jeff
