Hiyo! Are we talking about messages that have been processed through spamd but not marked, or ones that somehow bypassed spamd altogether? I find an occasional message gets missed by spamd when I *restart* it to pick up on new rules.... :-)
- Charles On Wed, 15 Oct 2003, Martin, Jeffrey wrote: > I have been seeing this also, with 2.55 and 2.6. I had been working with > the theory that it had to do with Postfix's content filter system. but > since you are using procmail, perhaps that is not the case. My guess was > that spamd was taking too long, and the message was getting forwarded > anyway. The frequency went way down when I fixed some of the network > tests and disabled osirusoft and orbs. But I still see 5 or six a day > out of some 300 spams detected. > > -----Original Message----- > From: Rich Puhek [mailto:[EMAIL PROTECTED] > Sent: Wednesday, October 15, 2003 11:25 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] SA 2.60 occasionally does no markup on spam > > > I've been running my email through SA 2.60 to test my installation > before converting all our users. Things have been running great, with > one exception. On occasion, a spam will slip through, with absolutely no > > SA markup in the headers or subject line. > > I've tried manually piping the messages in question through > spamassassin, and I receive "good" output (SA tags the message). > > I call spamc from procmail as follows: > > :0fw > * < 700000 > |/usr/bin/spamc -s 700000 -d <test_machine_ip> -p 783 > > The messages are not overly large, so they're not bypassing the size > limit. > > I turned on debugging in spamd, and didn't see anything too out of the > ordinary, aside from an unable to parse bayes_path message. I did see a > message complaining about the Pyzor response, but SA seems to have > continued running just fine, even learing the message as spam. > > spamd log output is below. Any ideas? > > Thanks! > > --Rich > > Oct 13 12:16:40 stan spamd[21823]: logmsg: connection from smtp.2z.net > [65.126.64.22] at port 33701 > Oct 13 12:16:40 stan spamd[21823]: connection from smtp.2z.net > [65.126.64.22] at port 33701 > Oct 13 12:16:40 stan spamd[21861]: logmsg: info: setuid to rpuhek > succeeded Oct 13 12:16:40 stan spamd[21861]: info: setuid to rpuhek > succeeded Oct 13 12:16:40 stan spamd[21861]: debug: Failed to parse line > in > SpamAssassin configuration, skipping: > bayes_path^I/home/rpuhek/.spamassassin > /bayes > Oct 13 12:16:40 stan spamd[21861]: debug: user has changed > Oct 13 12:16:40 stan spamd[21861]: debug: bayes: 21861 untie-ing Oct 13 > 12:16:40 stan spamd[21861]: debug: bayes: 21861 tie-ing to DB > file R/O /home/rpuhek/.spamassassin/bayes_toks > Oct 13 12:16:40 stan spamd[21861]: debug: bayes: 21861 tie-ing to DB > file R/O /home/rpuhek/.spamassassin/bayes_seen > Oct 13 12:16:40 stan spamd[21861]: debug: bayes: found bayes db version > 2 Oct 13 12:16:40 stan spamd[21861]: debug: Score set 3 chosen. Oct 13 > 12:16:40 stan spamd[21861]: logmsg: processing message > <[EMAIL PROTECTED]> for rpuhek:1000. > Oct 13 12:16:40 stan spamd[21861]: processing message > <[EMAIL PROTECTED]> for rpuhek:1000. > Oct 13 12:16:40 stan spamd[21861]: debug: received-header: parsed as [ > ip=65.126.64.13 rdns=mx1.2z.net helo=wendy.2z.net by=smithers.2z.net id > ent= ] Oct 13 12:16:40 stan spamd[21861]: debug: is Net::DNS::Resolver > available? yes > Oct 13 12:16:40 stan spamd[21861]: debug: looking up PTR record for > '219.145.248.27' > Oct 13 12:16:40 stan spamd[21861]: debug: PTR for '219.145.248.27': '' > Oct 13 12:16:40 stan spamd[21861]: debug: received-header: parsed as [ > ip=219.145.248.27 rdns=219.145.248.27 helo=hotmail.com by=wendy.2z.net > ident= ] Oct 13 12:16:40 stan spamd[21861]: debug: received-header: > relay > 65.126.64.13 trusted? yes > Oct 13 12:16:40 stan spamd[21861]: debug: received-header: relay > 219.145.248.27 trusted? no > Oct 13 12:16:40 stan spamd[21861]: debug: all '*From' addrs: > [EMAIL PROTECTED] > Oct 13 12:16:40 stan spamd[21861]: debug: running header regexp tests; > score so far=0 > Oct 13 12:16:40 stan spamd[21861]: debug: running body-text per-line > regexp tests; score so far=0 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes corpus size: nspam = > 2965, nham = 1347 > Oct 13 12:16:40 stan spamd[21861]: debug: uri tests: Done uriRE Oct 13 > 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *p > = "U*archie_millsqs D*email.com D*com" > Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *M > > = " CLEEPNLFHINIHKLPPBBIKFFMGJAB archie_millsqs email com " > Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *F > > = "U*archie_millsqs D*email.com D*com" > Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for To > > = "U*paula D*2z.net D*net U*oracle D*2z.net D*net U*rh D*2z.net D*net > U*rich D*2z.net D*net" > Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for > MIME-Version = "" > Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for > X-MIMEOLE = "Produced By Microsoft MimeOLE V6.00.2800.1106" > Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *x > > = "Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)" > Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *c > > = "/html" > Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for > Content-Transfer-Encoding = "base64" > Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *r > > = " hotmail.com ([219.145.248]) by wendy.2z.net (8.12.3/8.12.3/Debia > n-6.4) ; " > Oct 13 12:16:40 stan spamd[21861]: debug: tokenize: header tokens for *r > > = " hotmail.com ([219.145.248]) by wendy.2z.net (8.12.3/8.12.3/Debia > n-6.4) ; wendy.2z.net ([127.0.0]) by localhost (wendy [127.0.0]) > > (amavisd-new, port 10024) LMTP id 24727-03; " > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*c:html' => > 0.999948212083847 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'HTo:U*rich' => > 0.999829583179639 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'inches' => > 0.999608806096528 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token > 'HContent-Transfer-Encoding:base64' => 0.999572617946346 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token > 'N:HContent-Transfer-Encoding:baseNN' => 0.999572617946346 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'UD:us' => > 0.999243862520458 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'sk:www.her' => > 0.999231281198003 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'out.html' => > 0.998295202952029 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*p:D*email.com' > => 0.998229885057471 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:NNt' => > 0.997909502262443 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*F:D*email.com' > => 0.997701492537313 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:oN.gif' => > 0.996723404255319 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'HTo:U*rh' => > 0.996723404255319 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'UD:US' => > 0.994296296296296 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:NNh' => > 0.994296296296296 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'o2.gif' => > 0.993492957746479 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:personalN' => > 0.993492957746479 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token '68ps' => > 0.988731707317073 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:NNps' => > 0.988731707317073 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'UD:herbalplus.us' > > => 0.988731707317073 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token '61t' => > 0.988731707317073 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'personal7' => > 0.988731707317073 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:enpN_NN.jpg' => > > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_01.gif' => > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token '6Ces' => > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_06.gif' => > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_05.gif' => > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_04.gif' => > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:NCes' => > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:enpN_NN.gif' => > > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_07.gif' => > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_03.gif' => > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'enp2_02.jpg' => > 0.985096774193548 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'HTo:U*paula' => > 0.978 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:bolikNN' > => 0.958 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'bolik15' > => 0.958 Oct 13 12:16:40 stan spamd[21861]: debug: bayes token > 'N:NNN.N.NNN.NNN' > => 0.958 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token '213.4.130.210' => > > 0.958 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token '63h' => 0.958 Oct > 13 12:16:40 stan spamd[21861]: debug: bayes token 'UD:jpg' => > 0.957009329127376 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:HTo:D*Nz.net' > => 0.920973480044405 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'HTo:D*2z.net' => > 0.920973480044405 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'URI' => > 0.918856256721628 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*r:wendy' => > 0.899008553621719 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*r:LMTP' => > 0.880165402893044 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token > 'HX-MIMEOLE:V6.00.2800.1106' => 0.876131116858853 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*r:Debian-6.4' > => 0.863373622588967 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'Patch' => > 0.860546998525557 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:H*r:NNNNN-NN' > => 0.857492539342216 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*r:10024' => > 0.852099860216912 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*r:amavisd-new' > => 0.852099860216912 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'N:H*r:Debian-N.N' > > => 0.846924216484057 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*x:9.0.2910.0' > => 0.846602418856847 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes token 'H*x:Outlook' => > 0.846254782316645 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes: score = 1 > Oct 13 12:16:40 stan spamd[21861]: debug: bayes: 21861 untie-ing Oct 13 > 12:16:40 stan spamd[21861]: debug: bayes: 21861 untie-ing db_toks Oct 13 > 12:16:40 stan spamd[21861]: debug: bayes: 21861 untie-ing db_seen Oct 13 > 12:16:40 stan spamd[21861]: debug: Razor2 is not available Oct 13 > 12:16:40 stan spamd[21861]: debug: running raw-body-text per-line > regexp tests; score so far=2.837 > Oct 13 12:16:40 stan spamd[21861]: debug: running uri tests; score so > far=4.406 > Oct 13 12:16:40 stan spamd[21861]: debug: uri tests: Done uriRE Oct 13 > 12:16:40 stan spamd[21861]: debug: running full-text regexp > tests; score so far=5.283 > Oct 13 12:16:40 stan spamd[21861]: debug: Razor2 is not available Oct 13 > 12:16:40 stan spamd[21861]: debug: DCCifd is not available: no > r/w dccifd socket found. > Oct 13 12:16:40 stan spamd[21861]: debug: DCC is not available: no > executable dccproc found. > Oct 13 12:16:40 stan spamd[21861]: debug: Pyzor is available: > /usr/bin/pyzor Oct 13 12:16:40 stan spamd[21861]: debug: entering > helper-app run mode Oct 13 12:16:41 stan spamd[21861]: debug: Pyzor: got > response: Traceback > (most recent call last): > Oct 13 12:16:41 stan spamd[21861]: debug: leaving helper-app run mode > Oct 13 12:16:41 stan spamd[21861]: debug: Pyzor: couldn't grok response > "Traceback (most recent call last):" > Oct 13 12:16:41 stan spamd[21861]: debug: all '*To' addrs: [EMAIL PROTECTED] > [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] > Oct 13 12:16:41 stan spamd[21861]: debug: Received: no rDNS for dotcom > HELO: from=219.145.248.27 HELO=hotmail.com > Oct 13 12:16:41 stan spamd[21861]: debug: forged-HELO: > from=219.145.248.27 helo=hotmail.com by=2z.net > Oct 13 12:16:41 stan spamd[21861]: debug: forged-HELO: mismatch on HELO: > > 'hotmail.com' != '219.145.248.27' > Oct 13 12:16:41 stan spamd[21861]: debug: DNS MX records found: 2 Oct 13 > 12:16:41 stan spamd[21861]: debug: rdns/helo mismatch: > helo=hotmail.com rdns=219.145.248.27 > Oct 13 12:16:42 stan spamd[21861]: debug: RBL: success for 14 of 15 > queries Oct 13 12:16:42 stan spamd[21861]: debug: RBL: timeout for znet > after 2 > seconds > Oct 13 12:16:42 stan spamd[21861]: debug: running meta tests; score so > far=14.915 > Oct 13 12:16:42 stan spamd[21861]: debug: auto-learn? ham=0.1, spam=12, > body-hits=7.283, head-hits=11.201 > Oct 13 12:16:42 stan spamd[21861]: debug: auto-learn: currently using > scoreset 3. recomputing score based on scoreset 1. > Oct 13 12:16:42 stan spamd[21861]: debug: Score set 1 chosen. Oct 13 > 12:16:42 stan spamd[21861]: debug: auto-learn: original score: > 15.916, recomputed score: 13.486 > Oct 13 12:16:42 stan spamd[21861]: debug: Score set 3 chosen. Oct 13 > 12:16:42 stan spamd[21861]: debug: auto-learn? yes, spam (13.486 > > 12) > Oct 13 12:16:42 stan spamd[21861]: debug: Learning Spam > Oct 13 12:16:42 stan spamd[21861]: debug: uri tests: Done uriRE Oct 13 > 12:16:42 stan spamd[21861]: debug: lock: 21861 created > /home/rpuhek/.spamassassin/bayes.lock.stan.etnsystems.com.21861 > Oct 13 12:16:42 stan spamd[21861]: debug: lock: 21861 trying to get lock > > on /home/rpuhek/.spamassassin/bayes with 0 retries > Oct 13 12:16:42 stan spamd[21861]: debug: lock: 21861 link to > /home/rpuhek/.spamassassin/bayes.lock: link ok > Oct 13 12:16:42 stan spamd[21861]: debug: bayes: 21861 tie-ing to DB > file R/W /home/rpuhek/.spamassassin/bayes_toks > Oct 13 12:16:42 stan spamd[21861]: debug: bayes: 21861 tie-ing to DB > file R/W /home/rpuhek/.spamassassin/bayes_seen > Oct 13 12:16:42 stan spamd[21861]: debug: bayes: found bayes db version > 2 Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for > *p > = "U*archie_millsqs D*email.com D*com" > Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *M > > = " CLEEPNLFHINIHKLPPBBIKFFMGJAB archie_millsqs email com " > Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *F > > = "U*archie_millsqs D*email.com D*com" > Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for To > > = "U*paula D*2z.net D*net U*oracle D*2z.net D*net U*rh D*2z.net D*net > U*rich D*2z.net D*net" > Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for > MIME-Version = "" > Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for > X-MIMEOLE = "Produced By Microsoft MimeOLE V6.00.2800.1106" > Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *x > > = "Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)" > Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *c > > = "/html" > Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for > Content-Transfer-Encoding = "base64" > Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *r > > = " hotmail.com ([219.145.248]) by wendy.2z.net (8.12.3/8.12.3/Debia > n-6.4) ; " > Oct 13 12:16:42 stan spamd[21861]: debug: tokenize: header tokens for *r > > = " hotmail.com ([219.145.248]) by wendy.2z.net (8.12.3/8.12.3/Debia > n-6.4) ; wendy.2z.net ([127.0.0]) by localhost (wendy [127.0.0]) > > (amavisd-new, port 10024) LMTP id 24727-03; " > Oct 13 12:16:42 stan spamd[21823]: debug: cleaned up kid 21861, pool=6 > > > _________________________________________________________ > > Rich Puhek > ETN Systems Inc. > 2125 1st Ave East > Hibbing MN 55746 > > tel: 218.262.1130 > email: [EMAIL PROTECTED] > _________________________________________________________ > > > > ------------------------------------------------------- > This SF.net email is sponsored by: SF.net Giveback Program. > SourceForge.net hosts over 70,000 Open Source Projects. See the people > who have HELPED US provide better services: Click here: > http://sourceforge.net/supporters.php > _______________________________________________ > Spamassassin-talk mailing list [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > > ------------------------------------------------------- > This SF.net email is sponsored by: SF.net Giveback Program. > SourceForge.net hosts over 70,000 Open Source Projects. > See the people who have HELPED US provide better services: > Click here: http://sourceforge.net/supporters.php > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
