Jeff Mincy wrote:
From: Dan Schaefer <d...@performanceadmin.com>
Date: Tue, 13 Oct 2009 10:17:43 -0400
Jeff Mincy wrote:
> From: Dan Schaefer <d...@performanceadmin.com>
> Date: Tue, 13 Oct 2009 09:18:44 -0400
>
> Jeff Mincy wrote:
> > From: Dan Schaefer <d...@performanceadmin.com>
> > Date: Tue, 13 Oct 2009 08:54:29 -0400
> >
> > Jason Bertoch wrote:
> > > Dan Schaefer wrote:
> > >> I just enabled DCC yesterday and everything appears to be working
> > >> (DCC is registered). Just to make sure, can someone post an email to
> > >> pastebin that has a DCC hit? Thanks.
> > >>
> > > IIRC, a message with "test" in the subject and body will match,
> > > although your logs should tell you what rules are hitting anyway.
> >
> > Is DCC_CHECK the only DCC rule? Because I didn't find that in my logs
> > yesterday. "test" in the subject and "test" in the body only triggered
> > TVD_SPACE_RATIO and BAYES_00 from my personal email address to my work
> > address. Any other suggestions?
> >
> > Use
> > spamassassin --test-mode --debug dcc < somespammsg
> >
> > Should print out stuff like:
> >
> > 08:58:51.617 0.375 0.375 [28903] dbg: dcc: network tests on,
registering DCC
> > 08:58:54.405 3.164 0.943 [28903] dbg: dcc: dccifd is available:
/var/lib/dcc/dccifd
> > 08:58:54.585 3.343 0.179 [28903] dbg: dcc: dccifd got response:
X-DCC--Metrics: pinky 1356; bulk Body=3 Fuz1=4384 Fuz2=many
> > 08:58:54.585 3.343 0.000 [28903] dbg: dcc: listed: BODY=3/20
FUZ1=4384/20 FUZ2=999999/20
> >
> >
> > -jeff
> >
> I followed your instructions and received the following:
>
> [1486] dbg: dcc: network tests on, registering DCC
> [1486] dbg: dcc: dccifd is not available: no r/w dccifd socket found
> [1486] dbg: dcc: dccproc is not available: no dccproc executable found
> [1486] dbg: dcc: dccifd and dccproc are not available, disabling DCC
>
> After seeing that, I NAT-ed 1023 local to 6277 remote and 6277 remote to
> 1023 to my mail server in my firewall. I ran the test again and received
> the same message.
>
> Your firewall is not the problem shown here. SpamAssassin can't find
> the dcc socket and executable. Do you have DCC installed? If so,
> where is the dccproc executable? Did you start dccifd? Where is the
> dccifd socket? SpamAssassin needs to know where they are. You can
> use various configuration options to tell SpamAssassin where to look,
> for example:
> ## DCC options (Admin only)
> dcc_home /var/lib/dcc
> dcc_dccifd_path /var/lib/dcc/dccifd
> dcc_path /usr/bin/dccproc
>
> -jeff
>
I did just install DCC, but I don't know if it is installed correctly.
And of course, DCC's website is down
(http://www.rhyolite.com/anti-spam/dcc/). I used the instructions here
instead: http://www.freespamfilter.org/FC4.html#_Toc110999211
Now when I run:
spamassassin -t -D dcc < spam_message
I get:
[2955] dbg: dcc: network tests on, registering DCC
[2955] dbg: dcc: dccifd is not available: no r/w dccifd socket found
[2955] dbg: dcc: dccproc is available: /usr/bin/dccproc
[2955] dbg: dcc: opening pipe: /usr/bin/dccproc -H -x 0 -a 74.86.146.6 <
/tmp/.spamassassin2955q6p1Yatmp
[2955] dbg: dcc: got response: X-DCC-SIHOPE-DCC-3-Metrics:
pony.performanceadmin.com 1085; Body=2 Fuz1=2 Fuz2=many
and
2.2 DCC_CHECK Listed in DCC
(http://rhyolite.com/anti-spam/dcc/)
in the report
Even though the dccfid socket cannot be found, does this appear to be
working correctly?
Yes dccproc is working. You got a hit on DCC_CHECK.
You should use dccifd if possible. It is faster.
-jeff
I added the following lines to my local.cf and everything seems to be
working now
dcc_home /etc/dcc
dcc_dccifd_path /etc/dcc/dccifd
I now get:
[4817] dbg: dcc: network tests on, registering DCC
[4817] dbg: dcc: dccifd is available: /etc/dcc/dccifd
[4817] dbg: dcc: dccifd got response: X-DCC-SIHOPE-DCC-3-Metrics:
pony.performanceadmin.com 1085; Body=4 Fuz1=4 Fuz2=many
Thanks for everyone's help.
--
Dan Schaefer
Web Developer/Systems Analyst
Performance Administration Corp.
