From: "Jason Marshall" <[EMAIL PROTECTED]>
How big are the messages that aren't getting scanned?
Over 250k?
Random sizes, most far smaller than 250k.
And do you have per user rules enabled? If so do any of the user
rules have a rawbody or full rule attribute?
I do; each user has a .spamassassin/user_prefs file. Most of them are
exactly the same. I did notice that I had put a rawbody rule into my
config file some time ago. I've taken it out just now, as it was never
getting hit.
You could check your logfiles. By default spamd logs to the "mail"
facility, so
they should be in your /var/log/maillog.
The emails that are not getting scanned do NOT show up in the logs. The
ones that do get scanned, I can look for by message-id, but not these
ones.
I just noticed that I get "spamd[797]: prefork: child states: IIII" quite
often in the logs. This doesn't look bad to me, but I don't know what
IIII is supposed to mean... Probably nothing.
If the above answers to my questions are "yes" search also for
"PerMsgStatus".
You could well be onto something. I see lots (750+) of these in today's
logs:
Feb 13 18:56:38 ocelot spamd[4200]: Use of uninitialized value in numeric
le (<=) at /usr/local/share/perl/5.8.4/Mail/SpamAssassin/PerMsgStatus.pm
line 2703.
Feb 13 18:56:38 ocelot spamd[4200]: Use of uninitialized value in sprintf
at /usr/local/share/perl/5.8.4/Mail/SpamAssassin/PerMsgStatus.pm line
2707.
Feb 13 18:56:38 ocelot spamd[4200]: Use of uninitialized value in numeric
eq (==) at /usr/local/share/perl/5.8.4/Mail/SpamAssassin/PerMsgStatus.pm
line 430.
Those certainly look like failures to me!
I've turned off the rawbody rule I had in my config file; what are the
chances that that was the fix?
If it was in $USER/.spamassassin/user_prefs it's very good. There is a
workaround if you are using procmail. (If SA does not put headers into
the message run it again. I run it as "spamassassin" rather than the
daemon to be sure. I've seen VERY VERY few sneak through under that regime.
I should have noticed that no one else was whining about the amount of
spam getting through, and if they were getting as much as me (hundreds a
day, untagged) they surely would have!!
I've whined. It SEEMS to trace to a perl bug. In fact it seems to be
related to a perl interaction between threads which should be impossible.
{^_^}
