Forums & Blog

http://spamassassin.apache.org/doc.html

I just download the image and configure it accoerdign to readme but my maillog is filled with following messages.

tail /var/log/maillog
Jul 16 08:54:44 savasm dccproc[2966]: continue not asking DCC 417 seconds after failure
Jul 16 08:55:11 savasm dccproc[2967]: continue not asking DCC 390 seconds after failure
Jul 16 08:55:28 savasm dccproc[2968]: continue not asking DCC 373 seconds after failure
Jul 16 08:55:30 savasm dccproc[2969]: continue not asking DCC 371 seconds after failure
Jul 16 08:55:41 savasm dccproc[2970]: continue not asking DCC 360 seconds after failure
Jul 16 08:55:45 savasm dccproc[2971]: continue not asking DCC 356 seconds after failure
Jul 16 08:56:11 savasm dccproc[2972]: continue not asking DCC 330 seconds after failure
Jul 16 08:56:24 savasm dccproc[2975]: continue not asking DCC 317 seconds after failure
Jul 16 08:56:26 savasm dccproc[2976]: continue not asking DCC 315 seconds after failure
Jul 16 08:56:41 savasm dccproc[2979]: continue not asking DCC 300 seconds after failure

#cddc info 

# 07/16/08 09:03:37 PKT  /var/dcc/map
# Re-resolve names after 10:23:31
# 1 total, 0 working servers
# skipping asking DCC server 916 seconds more
# 499 dccproc balance since 09:03:30
IPv6 off

dcc1.dcc-servers.net,-      RTT+1000 ms  anon
#   UNDEFINED

dcc2.dcc-servers.net,-      RTT+1000 ms  anon
#   UNDEFINED

dcc3.dcc-servers.net,-      RTT+1000 ms  anon
#   UNDEFINED

dcc4.dcc-servers.net,-      RTT+1000 ms  anon
#   UNDEFINED

dcc5.dcc-servers.net,-      RTT+1000 ms  anon
#   UNDEFINED

127.0.0.1,-                 RTT-1000 ms  32768 1713811386x363
#  127.0.0.1,-
#      not answering

################
# 07/16/08 09:03:37 PKT  GreyList /var/dcc/map
# Re-resolve names after 10:59:04
# 1 total, 0 working servers
# skipping asking Greylist server 128 seconds more

127.0.0.1,-                 Greylist 32768 1713811386x363
#  127.0.0.1,6276
#      not answering

After uing the sa-update I have noticed that spam detection rate is very low. Before using it most of spam mails were detected by spamassassin but not now. Is it possible to revert back it from old version.

sdewitti:

out of memory

Anybody have any idea?

Increase the memory. You can also try reducing the number of child processes, but if you have a high trafiic rate, you may get traffic jams.

someone_else, 

 i just updated my savasm to 0.1.8 and ive noticed that unlike older versions, this latest release is very aggresive... I used to have the score of 5.5 for tagging spam, now I had to move it to 7.5 because many non-spam messages were being tagged... do you know if this is something to do with the new spamassassin or new settings that are already default in savasm? anyone else has experienced this?

There were no changes in the configuration of SAVASM, thought it is possible that the included version of SpamAssassin has added more tests. Personally, I haven't noticed more false positives in recent times, and I use a base spam score of 4.

I am getting more false positives...

 can you tell me if you have enabled Skip RBL open-relay check

or not?

someone else,

look, this is one of the examples... Its an email I sent myself to a list Im suscribed to and Im getting it as spam, these are the spam headers:

    X-Spam-Status:     Yes, score=6.0 required=6.0 tests=AWL,BAYES_50, FH_HELO_EQ_D_D_D_D,FUZZY_AMBIEN,HELO_DYNAMIC_DHCP,HELO_DYNAMIC_IPADDR, HTML_MESSAGE,MIME_QP_LONG_LINE,RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RDNS_NONE autolearn=no version=3.2.4
    X-Spam-Report:     *  0.9 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address *      [189.160.192.219 listed in dnsbl.sorbs.net] *  1.4 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP) *  0.0 FH_HELO_EQ_D_D_D_D Helo is d-d-d-d *  2.4 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr *      1) *  1.0 FUZZY_AMBIEN BODY: Attempt to obfuscate words in spam *  0.0 HTML_MESSAGE BODY: HTML included in message *  0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60% *      [score: 0.4081] *  1.4 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars *  0.9 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL *      [189.160.192.219 listed in zen.spamhaus.org] *  0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS * -2.1 AWL AWL: From: address is in the auto white-list

someone else, 

 me again...

I keep getting mails that come from my secondary server (that come from web forms) and mail from another server that we have, marked as SPAM HIGH with these headers...

any idea how can I avoid this? 

    X-Spam-Checker-Version:     SpamAssassin 3.2.4 (2008-01-01) on savasm
    X-Spam-Level:     ***************
    X-Smspamc-Saspamrating:     SPAM-HIGH
    X-Spam-Status:     Yes, score=15.8 required=6.0 tests=AWL,BAYES_99, HELO_DYNAMIC_IPADDR2,HELO_DYNAMIC_SPLIT_IP,HTML_MESSAGE,RCVD_NUMERIC_HELO, RDNS_NONE,TVD_RCVD_IP autolearn=spam version=3.2.4
    X-Spam-Report:     *  3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% *      [score: 1.0000] *  4.4 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr *       2) *  3.5 HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split *      IP) *  1.9 TVD_RCVD_IP TVD_RCVD_IP *  2.1 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO *  0.0 HTML_MESSAGE BODY: HTML included in message *  0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS *  0.3 AWL AWL: From: address is in the auto white-list

thanks in advance.

The spam report tells you everything you need to know about the score in question. If you want more detail, you can also check out the test descriptions on the SpamAssassin website, but they're generally quite obvious.

thanks, even when I can see the descriptions and they say what is going on I have bee looking for information on the net and I cant find info on how to solve it so I was just looking for your knowledge and insight in how to try to resolve the issue

 thanks anyway

I did a search but didn't find anything specific on this. I'm trying to set up VMWare with SAVASM, but I can't figure out what I'm supposed to do to set up the network.

Let's say I want the SAVASM machine to use the IP 192.168.0.50

Is that IP supposed to be configured on one of the physical server's network adapters?

This physical server has two NICs, one Private and one Internet. In the VMWare settings, I excluded the Internet NIC from being used for Automatic Bridging.

When I start the SAVASM vm, eth0 fails.

When I go into the 'setup' utility on the SAVASM machine and try to configure the network with the IPs I want to use, after I click OK, nothing seems to happen...if I go back in, all the fields are blank, and ifconfig doesn't show anything I just did.

Can anyone offer any insight as to what I'm doing wrong?

Thanks!

GenNS

Ok, I played around with it some more and got it configured the way I wanted it, and the SM server could ping the SAVASM vm ok. So then I changed the SpamAssassin settings in SM to point to the SAVASM vm and then checked the spool.

Which grew and grew and grew.

I clicked back over to the webmin window for the SAVASM vm, went into Servers > SpamAssassin > Spam Statistics. It had processed 4 messages (yes, four) averaging 30.58 seconds each. Huh?!

I gave the SAVASM vm 512MB and set the startup params to use 10 children.

The physical server it's on (which also runs SM) is a 1.6GHz Xeon w/2GB RAM, typically running at about 14% CPU load.

30+ seconds / message seems, you know, bad.

Thoughts?

Thanks!

someone_else are you still around / reading this? Can you take a look at my message just previous to this one and let me know what you think?

Thanks!