I have been seeing this also, with 2.55 and 2.6. I had been working with the theory that it had to do with Postfix's content filter system. but since you are using procmail, perhaps that is not the case. My guess was that spamd was taking too long, and the message was getting forwarded anyway. The frequency went way down when I fixed some of the network tests and disabled osirusoft and orbs. But I still see 5 or six a day out of some 300 spams detected.
-----Original Message----- From: Rich Puhek [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 15, 2003 11:25 AM To: [EMAIL PROTECTED] Subject: [SAtalk] SA 2.60 occasionally does no markup on spam I've been running my email through SA 2.60 to test my installation before converting all our users. Things have been running great, with one exception. On occasion, a spam will slip through, with absolutely no SA markup in the headers or subject line. I've tried manually piping the messages in question through spamassassin, and I receive "good" output (SA tags the message). I call spamc from procmail as follows: :0fw * < 700000 |/usr/bin/spamc -s 700000 -d <test_machine_ip> -p 783 The messages are not overly large, so they're not bypassing the size limit. I turned on debugging in spamd, and didn't see anything too out of the ordinary, aside from an unable to parse bayes_path message. I did see a message complaining about the Pyzor response, but SA seems to have continued running just fine, even learing the message as spam. spamd log output is below. Any ideas? Thanks! --Rich Oct 13 12:16:40 stan spamd[21823]: logmsg: connection from smtp.2z.net [65.126.64.22] at port 33701 Oct 13 12:16:40 stan spamd[21823]: connection from smtp.2z.net [65.126.64.22] at port 33701 Oct 13 12:16:40 stan spamd[21861]: logmsg: info: setuid to rpuhek succeeded Oct 13 12:16:40 stan spamd[21861]: info: setuid to rpuhek succeeded Oct 13 12:16:40 stan spamd[21861]: debug: Failed to parse line in SpamAssassin configuration, skipping: bayes_path^I/home/rpuhek/.spamassassin /bayes Oct 13 12:16:40 stan spamd[21861]: debug: user has changed Oct 13 12:16:40 stan spamd[21861]: debug: bayes: 21861 untie-ing Oct 13 12:16:40 stan spamd[21861]: debug: bayes: 21861 tie-ing to DB file R/O /home/rpuhek/.spamassassin/bayes_toks Oct 13 12:16:40 stan spamd[21861]: debug: bayes: 21861 tie-ing to DB file R/O /home/rpuhek/.spamassassin/bayes_seen Oct 13 12:16:40 stan spamd[21861]: debug: bayes: found bayes db version 2 Oct 13 12:16:40 stan spamd[21861]: debug: Score set 3 chosen. Oct 13 12:16:40 stan spamd[21861]: logmsg: processing message <[EMAIL PROTECTED]> for rpuhek:1000. Oct 13 12:16:40 stan spamd[21861]: processing message <[EMAIL PROTECTED]> for rpuhek:1000. Oct 13 12:16:40 stan spamd[21861]: debug: received-header: parsed as [ ip=65.126.64.13 rdns=mx1.2z.net helo=wendy.2z.net by=smithers.2z.net id ent= ] Oct 13 12:16:40 stan spamd[21861]: debug: is Net::DNS::Resolver available? yes Oct 13 12:16:40 stan spamd[21861]: debug: looking up PTR record for '219.145.248.27' Oct 13 12:16:40 stan spamd[21861]: debug: PTR for '219.145.248.27': '' Oct 13 12:16:40 stan spamd[21861]: debug: received-header: parsed as [ ip=219.145.248.27 rdns=219.145.248.27 helo=hotmail.com by=wendy.2z.net ident= ] Oct 13 12:16:40 stan spamd[21861]: debug: received-header: relay 65.126.64.13 trusted? yes Oct 13 12:16:40 stan spamd[21861]: debug: received-header: relay 219.145.248.27 trusted? no Oct 13 12:16:40 stan spamd[21861]: debug: all '*From' addrs: [EMAIL PROTECTED] Oct 13 12:16:40 stan spamd[21861]: debug: running header regexp tests; score so far=0 Oct 13 12:16:40 stan spamd[21861]: debug: running body-text per-line regexp tests; score so far=0 Oct 13 12:16:40 stan spamd[21861]: debug: bayes corpus size: nspam = 2965, nham = 1347 Oct 13 12:16:40 stan spamd[21861]: debug: uri tests: Done uriRE Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *p = "U*archie_millsqs D*email.com D*com" Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *M = " CLEEPNLFHINIHKLPPBBIKFFMGJAB archie_millsqs email com " Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *F = "U*archie_millsqs D*email.com D*com" Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for To = "U*paula D*2z.net D*net U*oracle D*2z.net D*net U*rh D*2z.net D*net U*rich D*2z.net D*net" Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for MIME-Version = "" Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for X-MIMEOLE = "Produced By Microsoft MimeOLE V6.00.2800.1106" Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *x = "Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)" Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *c = "/html" Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for Content-Transfer-Encoding = "base64" Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *r = " hotmail.com ([219.145.248]) by wendy.2z.net (8.12.3/8.12.3/Debia n-6.4) ; " Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *r = " hotmail.com ([219.145.248]) by wendy.2z.net (8.12.3/8.12.3/Debia n-6.4) ; wendy.2z.net ([127.0.0]) by localhost (wendy [127.0.0]) (amavisd-new, port 10024) LMTP id 24727-03; " Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*c:html' => 0.999948212083847 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'HTo:U*rich' => 0.999829583179639 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'inches' => 0.999608806096528 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'HContent-Transfer-Encoding:base64' => 0.999572617946346 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:HContent-Transfer-Encoding:baseNN' => 0.999572617946346 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'UD:us' => 0.999243862520458 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'sk:www.her' => 0.999231281198003 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'out.html' => 0.998295202952029 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*p:D*email.com' => 0.998229885057471 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:NNt' => 0.997909502262443 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*F:D*email.com' => 0.997701492537313 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:oN.gif' => 0.996723404255319 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'HTo:U*rh' => 0.996723404255319 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'UD:US' => 0.994296296296296 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:NNh' => 0.994296296296296 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'o2.gif' => 0.993492957746479 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:personalN' => 0.993492957746479 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token '68ps' => 0.988731707317073 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:NNps' => 0.988731707317073 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'UD:herbalplus.us' => 0.988731707317073 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token '61t' => 0.988731707317073 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'personal7' => 0.988731707317073 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:enpN_NN.jpg' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_01.gif' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token '6Ces' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_06.gif' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_05.gif' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_04.gif' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:NCes' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:enpN_NN.gif' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_07.gif' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_03.gif' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_02.jpg' => 0.985096774193548 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'HTo:U*paula' => 0.978 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:bolikNN' => 0.958 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'bolik15' => 0.958 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:NNN.N.NNN.NNN' => 0.958 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token '213.4.130.210' => 0.958 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token '63h' => 0.958 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'UD:jpg' => 0.957009329127376 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:HTo:D*Nz.net' => 0.920973480044405 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'HTo:D*2z.net' => 0.920973480044405 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'URI' => 0.918856256721628 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*r:wendy' => 0.899008553621719 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*r:LMTP' => 0.880165402893044 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'HX-MIMEOLE:V6.00.2800.1106' => 0.876131116858853 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*r:Debian-6.4' => 0.863373622588967 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'Patch' => 0.860546998525557 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:H*r:NNNNN-NN' => 0.857492539342216 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*r:10024' => 0.852099860216912 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*r:amavisd-new' => 0.852099860216912 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:H*r:Debian-N.N' => 0.846924216484057 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*x:9.0.2910.0' => 0.846602418856847 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*x:Outlook' => 0.846254782316645 Oct 13 12:16:40 stan spamd[21861]: debug: bayes: score = 1 Oct 13 12:16:40 stan spamd[21861]: debug: bayes: 21861 untie-ing Oct 13 12:16:40 stan spamd[21861]: debug: bayes: 21861 untie-ing db_toks Oct 13 12:16:40 stan spamd[21861]: debug: bayes: 21861 untie-ing db_seen Oct 13 12:16:40 stan spamd[21861]: debug: Razor2 is not available Oct 13 12:16:40 stan spamd[21861]: debug: running raw-body-text per-line regexp tests; score so far=2.837 Oct 13 12:16:40 stan spamd[21861]: debug: running uri tests; score so far=4.406 Oct 13 12:16:40 stan spamd[21861]: debug: uri tests: Done uriRE Oct 13 12:16:40 stan spamd[21861]: debug: running full-text regexp tests; score so far=5.283 Oct 13 12:16:40 stan spamd[21861]: debug: Razor2 is not available Oct 13 12:16:40 stan spamd[21861]: debug: DCCifd is not available: no r/w dccifd socket found. Oct 13 12:16:40 stan spamd[21861]: debug: DCC is not available: no executable dccproc found. Oct 13 12:16:40 stan spamd[21861]: debug: Pyzor is available: /usr/bin/pyzor Oct 13 12:16:40 stan spamd[21861]: debug: entering helper-app run mode Oct 13 12:16:41 stan spamd[21861]: debug: Pyzor: got response: Traceback (most recent call last): Oct 13 12:16:41 stan spamd[21861]: debug: leaving helper-app run mode Oct 13 12:16:41 stan spamd[21861]: debug: Pyzor: couldn't grok response "Traceback (most recent call last):" Oct 13 12:16:41 stan spamd[21861]: debug: all '*To' addrs: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] Oct 13 12:16:41 stan spamd[21861]: debug: Received: no rDNS for dotcom HELO: from=219.145.248.27 HELO=hotmail.com Oct 13 12:16:41 stan spamd[21861]: debug: forged-HELO: from=219.145.248.27 helo=hotmail.com by=2z.net Oct 13 12:16:41 stan spamd[21861]: debug: forged-HELO: mismatch on HELO: 'hotmail.com' != '219.145.248.27' Oct 13 12:16:41 stan spamd[21861]: debug: DNS MX records found: 2 Oct 13 12:16:41 stan spamd[21861]: debug: rdns/helo mismatch: helo=hotmail.com rdns=219.145.248.27 Oct 13 12:16:42 stan spamd[21861]: debug: RBL: success for 14 of 15 queries Oct 13 12:16:42 stan spamd[21861]: debug: RBL: timeout for znet after 2 seconds Oct 13 12:16:42 stan spamd[21861]: debug: running meta tests; score so far=14.915 Oct 13 12:16:42 stan spamd[21861]: debug: auto-learn? ham=0.1, spam=12, body-hits=7.283, head-hits=11.201 Oct 13 12:16:42 stan spamd[21861]: debug: auto-learn: currently using scoreset 3. recomputing score based on scoreset 1. Oct 13 12:16:42 stan spamd[21861]: debug: Score set 1 chosen. Oct 13 12:16:42 stan spamd[21861]: debug: auto-learn: original score: 15.916, recomputed score: 13.486 Oct 13 12:16:42 stan spamd[21861]: debug: Score set 3 chosen. Oct 13 12:16:42 stan spamd[21861]: debug: auto-learn? yes, spam (13.486 > 12) Oct 13 12:16:42 stan spamd[21861]: debug: Learning Spam Oct 13 12:16:42 stan spamd[21861]: debug: uri tests: Done uriRE Oct 13 12:16:42 stan spamd[21861]: debug: lock: 21861 created /home/rpuhek/.spamassassin/bayes.lock.stan.etnsystems.com.21861 Oct 13 12:16:42 stan spamd[21861]: debug: lock: 21861 trying to get lock on /home/rpuhek/.spamassassin/bayes with 0 retries Oct 13 12:16:42 stan spamd[21861]: debug: lock: 21861 link to /home/rpuhek/.spamassassin/bayes.lock: link ok Oct 13 12:16:42 stan spamd[21861]: debug: bayes: 21861 tie-ing to DB file R/W /home/rpuhek/.spamassassin/bayes_toks Oct 13 12:16:42 stan spamd[21861]: debug: bayes: 21861 tie-ing to DB file R/W /home/rpuhek/.spamassassin/bayes_seen Oct 13 12:16:42 stan spamd[21861]: debug: bayes: found bayes db version 2 Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *p = "U*archie_millsqs D*email.com D*com" Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *M = " CLEEPNLFHINIHKLPPBBIKFFMGJAB archie_millsqs email com " Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *F = "U*archie_millsqs D*email.com D*com" Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for To = "U*paula D*2z.net D*net U*oracle D*2z.net D*net U*rh D*2z.net D*net U*rich D*2z.net D*net" Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for MIME-Version = "" Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for X-MIMEOLE = "Produced By Microsoft MimeOLE V6.00.2800.1106" Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *x = "Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)" Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *c = "/html" Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for Content-Transfer-Encoding = "base64" Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *r = " hotmail.com ([219.145.248]) by wendy.2z.net (8.12.3/8.12.3/Debia n-6.4) ; " Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *r = " hotmail.com ([219.145.248]) by wendy.2z.net (8.12.3/8.12.3/Debia n-6.4) ; wendy.2z.net ([127.0.0]) by localhost (wendy [127.0.0]) (amavisd-new, port 10024) LMTP id 24727-03; " Oct 13 12:16:42 stan spamd[21823]: debug: cleaned up kid 21861, pool=6 _________________________________________________________ Rich Puhek ETN Systems Inc. 2125 1st Ave East Hibbing MN 55746 tel: 218.262.1130 email: [EMAIL PROTECTED] _________________________________________________________ ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
