Thank you. I have check my DNS and it appears to resolve the link
correctly. It is just annoying, I think less than 1% of all messages,
are getting this and I'm checking if there is something I can do to
solve this.
Here is a sample message that is causing this:
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 7689 invoked by uid 501); 8 Feb 2008 01:58:00 -0800
Received: from 87.18.202.233 by s1.molsci.org (envelope-from
<[EMAIL PROTECTED]>, uid 509) with
qmail-scanner-2.01st
(clamdscan: 0.92/5545. spamassassin: 3.2.4. perlscan: 2.01st.
Clear:RC:0(87.18.202.233):SA:0(?/?):.
Processed in 50.059824 secs); 08 Feb 2008 09:58:00 -0000
X-Spam-Status: No, hits=? required=?
Received: from host233-202-dynamic.18-87-r.retail.telecomitalia.it
(87.18.202.233)
by mail.molsci.org with SMTP; 8 Feb 2008 01:57:09 -0800
Message-ID: <[EMAIL PROTECTED]>
From: "Lyndon Meisinger" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: It's all about women...and the size of their men
Date: Fri, 8 Feb 2008 10:57:09 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--------=_NextPart_000_0008_01C86A41.59C01C40"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
Incredible Irresistable Insatiable ROCK HARD ALL DAY LONG
Here is the log file this message:
Fri, 08 Feb 2008 01:57:09 PST:7504: +++ starting debugging for
process 7504 (ppid=7491) by uid=509
Fri, 08 Feb 2008 01:57:10 PST:7504: w_c: Total time between DATA
command and "." was 0.000119 secs
Fri, 08 Feb 2008 01:57:10 PST:7504: w_c: elapsed time from start 0.000115 secs
Fri, 08 Feb 2008 01:57:10 PST:7504: g_e_h:
return-path='[EMAIL PROTECTED]',
recips='[EMAIL PROTECTED]'
Fri, 08 Feb 2008 01:57:10 PST:7504: from='"Lyndon Meisinger"
<[EMAIL PROTECTED]>', subj='It's all about
women...and the size of their men', via SMTP from 87.18.202.233
Fri, 08 Feb 2008 01:57:10 PST:7504: clamdscan: finished scan in 0.016914 secs
Fri, 08 Feb 2008 01:58:00 PST:7504: SA: finished scan in 50.011351
secs - hits=?/?
Fri, 08 Feb 2008 01:58:00 PST:7504: p_s: finished scan in 0.008788 secs
Fri, 08 Feb 2008 01:58:00 PST:7504: ini_sc: finished scan of
"/var/spool/qmailscan/tmp/s1.molsci.org12024646297647504"...
Fri, 08 Feb 2008 01:58:00 PST:7504: ------ Process 7504 finished.
Total of 50.197271 secs
Another thing is when I do a sa-learn --spam of this message I get
this message "Learned tokens from 0 message(s) (1 message(s)
examined)". Why I cannot get sa-learn to learn from this message also.
Thank you for your assistance,
Frank
On Thu, 2008-02-07 at 14:57 -0800, fchan wrote:
I'm getting spam scores (ie No, hits=? required=?) from certain types
of spam messages. Most of them have phishing links but I have no
problem with most messages with links. I'm using qmail with
> qmail-scanner-2.01st on RedHat Linux ES5.
> Wed, 06 Feb 2008 09:16:41 PST:18972: clamdscan: finished scan in
0.011407 secs
> Wed, 06 Feb 2008 09:17:26 PST:18972: SA: finished scan in 45.026522
> secs - hits=?/?
Does that mean qmail-scanner forced further processing due to the
timeout, without actually waiting for SA to finish? (Despite the success
suggesting phrase...)
Wed, 06 Feb 2008 09:17:26 PST:18972: p_s: finished scan in 0.020737 secs
Wed, 06 Feb 2008 09:17:26 PST:18972: ini_sc: finished scan of
"/var/spool/qmailscan/tmp/s1.molsci.org120231820076418972"
I have set timeout on qmailscanner for spamc to 45 seconds. Why are,
what I guess, links causing this.
Are you positive this is related to links? SA queries URI blacklists.
Is it possible you have a DNS issue by any chance?
Does spamassassin normally take
this long to scan or should I set it longer? Am I missing some
setting/plugin that is causing this?
No, generally, SA should have been done within that timeout. Depending
on the machine, network and stuff, the average scanning time mentioned
here is a few seconds only.
However, occasionally single messages taking up to 90 seconds or above
have been reported, too. IMHO, this is nothing to worry about, unless
your average is really high. In that case, you might have DNS issues. Or
feeding really large mail through SA. Or, etc.
guenther
--
char *t="[EMAIL PROTECTED]";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
