Would like to put 3.0.0pre2 in corp production SA-exim problem

[lists <li...@efastfunding.com>]

Sorry for the large post
The reason for this is everytime I put version 2.63 in production it gets
knocked off line due to it eating memory till it dies or just stilling there
hung.  I have recompiled serveral times.  So far I have a few test accounts
using 3.0.0pre2 with great success but I have not tried to switch my entire
load over to it yet so I am not sure how it will handle.  

I am having hell getting the spam to be a attachment local.cf even when I
spec the config at the command line as Sa-exim is throwing a fit which maybe
why

Exim log but not for this the message below but it contains the error
2004-07-15 10:54:46 1Bl8ZD-0001hI-Ix SA: PANIC: SA: could not parse
X-Spam-Status: to extract hits and required. Bad!. Got: 'X-Spam-Status: No,
score=0.9 required=5.0 tests=HTML_80_90,HTML_BADTAG_00_10,
        HTML_MESSAGE,HTML_NONELEMENT_00_10,MIME_MISSING_BOUNDARY
autolearn=no
        version=3.0.0-pre2
' (but message was accepted)

Here is the log output I have it looks basically ok other then white list

Jul 15 11:14:20 antispam spamd[1022]: debug: ---- MIME PARSER START ----
Jul 15 11:14:20 antispam spamd[1022]: debug: main message type:
multipart/alternative
Jul 15 11:14:20 antispam spamd[1022]: debug: parsing multipart, got
boundary: --7602034352295363
Jul 15 11:14:20 antispam spamd[1022]: debug: found part of type text/plain,
boundary: --7602034352295363
Jul 15 11:14:20 antispam spamd[1022]: debug: parsing normal part
Jul 15 11:14:20 antispam spamd[1022]: debug: added part, type: text/plain
Jul 15 11:14:20 antispam spamd[1022]: debug: ---- MIME PARSER END ----
Jul 15 11:14:20 antispam spamd[1022]: debug: decoding: other encoding type
(7bit), ignoring
Jul 15 11:14:20 antispam spamd[1022]: debug: Loading languages file...
Jul 15 11:14:20 antispam spamd[1022]: debug: metadata: X-Languages:
Jul 15 11:14:20 antispam spamd[1022]: debug: uri found:
http://lendersforyou.net/?partid=ftees
Jul 15 11:14:20 antispam spamd[1022]: debug: uri found:
http://lendersforyou.net/st.html
Jul 15 11:14:20 antispam spamd[1022]: debug: URIDNSBL: domains to query:
lendersforyou.net
Jul 15 11:14:20 antispam spamd[1022]: debug: is Net::DNS::Resolver
available? yes
Jul 15 11:14:20 antispam spamd[1022]: debug: Net::DNS version: 0.31
Jul 15 11:14:20 antispam spamd[1022]: debug: all '*From' addrs:
Mauro@msn.com
Jul 15 11:14:20 antispam spamd[1022]: debug: Running tests for priority: 0
Jul 15 11:14:20 antispam spamd[1022]: debug: running header regexp tests;
score so far=0
Jul 15 11:14:20 antispam spamd[1022]: debug: SPF: checking HELO
(helo=host186-110.pool80116.interbusiness.it, ip=80.116.110.186)
Jul 15 11:14:20 antispam spamd[1022]: debug: SPF: trimmed HELO down to
'interbusiness.it'
Jul 15 11:14:20 antispam spamd[1022]: debug: SPF: cannot load or create
Mail::SPF::Query module
Jul 15 11:14:20 antispam spamd[1022]: debug: forged-HELO:
from=pool80116.interbusiness.it helo=pool80116.interbusiness.it
by=efastfunding.com
Jul 15 11:14:20 antispam spamd[1022]: debug: all '*To' addrs:
spam@antispam.efastfunding.com davidt@efastfunding.com
dbarnhart@efastfunding.com vtran@efastfunding.com
Jul 15 11:14:20 antispam spamd[1022]: debug: SPF: relayed through one or
more trusted relays, cannot use header-based Envelope-From, skipping
Jul 15 11:14:20 antispam spamd[1022]: debug: running body-text per-line
regexp tests; score so far=4.484
Jul 15 11:14:20 antispam spamd[1022]: debug: running uri tests; score so
far=5.26
Jul 15 11:14:20 antispam spamd[1022]: debug: Razor2 is available
Jul 15 11:14:20 antispam spamd[1022]: debug: entering helper-app run mode
Jul 15 11:14:21 antispam spamd[1022]: debug: Using results from Razor v2.40
Jul 15 11:14:21 antispam spamd[1022]: debug: Found Razor2 part: part=0
engine=4 ct=0 cf=100
Jul 15 11:14:21 antispam spamd[1022]: debug: leaving helper-app run mode
Jul 15 11:14:21 antispam spamd[1022]: debug: Razor2 results: spam? 1
highest cf score: 100
Jul 15 11:14:21 antispam spamd[1022]: debug: URIDNSBL: domain
"lendersforyou.net" listed (URIBL_AB_SURBL): 127.0.0.54
Jul 15 11:14:21 antispam spamd[1022]: debug: URIDNSBL: domain
"lendersforyou.net" listed (URIBL_WS_SURBL): 127.0.0.54
Jul 15 11:14:21 antispam spamd[1022]: debug: URIDNSBL: domain
"lendersforyou.net" listed (URIBL_OB_SURBL): 127.0.0.54
Jul 15 11:14:21 antispam spamd[1022]: debug: URIDNSBL: domain
"lendersforyou.net" listed (URIBL_SC_SURBL): 127.0.0.54
Jul 15 11:14:21 antispam spamd[1022]: debug: URIDNSBL: query for
lendersforyou.net took 1 seconds to look up
(multi.surbl.org.:lendersforyou.net)
Jul 15 11:14:21 antispam spamd[1022]: debug: URIDNSBL: queries completed: 2
started: 2
Jul 15 11:14:21 antispam spamd[1022]: debug: URIDNSBL: queries active:  at
Thu Jul 15 11:14:21 2004
Jul 15 11:14:21 antispam spamd[1022]: debug: running raw-body-text per-line
regexp tests; score so far=7.037
Jul 15 11:14:21 antispam spamd[1022]: debug: running full-text regexp tests;
score so far=7.037
Jul 15 11:14:21 antispam spamd[1022]: debug: Razor2 is available
Jul 15 11:14:21 antispam spamd[1022]: debug: DCCifd is not available: no r/w
dccifd socket found.
Jul 15 11:14:21 antispam spamd[1022]: debug: Running tests for priority: 500
Jul 15 11:14:21 antispam spamd[1022]: debug: URIDNSBL: queries completed: 2
started: 2
Jul 15 11:14:21 antispam spamd[1022]: debug: URIDNSBL: queries active:  at
Thu Jul 15 11:14:21 2004
Jul 15 11:14:22 antispam spamd[1022]: debug: URIDNSBL: domain
"lendersforyou.net" listed (URIBL_SBL):
"http://www.spamhaus.org/SBL/sbl.lasso?query=SBL16745"
Jul 15 11:14:22 antispam spamd[1022]: debug: URIDNSBL: query for
lendersforyou.net took 2 seconds to look up
(sbl.spamhaus.org.:33.42.143.221)
Jul 15 11:14:22 antispam spamd[1022]: debug: URIDNSBL: domain
"lendersforyou.net" listed (URIBL_SBL):
"http://www.spamhaus.org/SBL/sbl.lasso?query=SBL17144"
Jul 15 11:14:22 antispam spamd[1022]: debug: URIDNSBL: domain
"lendersforyou.net" listed (URIBL_SBL):
"http://www.spamhaus.org/SBL/sbl.lasso?query=SBL17965"
Jul 15 11:14:22 antispam spamd[1022]: debug: URIDNSBL: query for
lendersforyou.net took 2 seconds to look up
(sbl.spamhaus.org.:88.42.143.221)
Jul 15 11:14:22 antispam spamd[1022]: debug: URIDNSBL: queries completed: 2
started: 0
Jul 15 11:14:22 antispam spamd[1022]: debug: URIDNSBL: queries active:  at
Thu Jul 15 11:14:22 2004
Jul 15 11:14:25 antispam spamd[1022]: debug: RBL: success for 15 of 17
queries
Jul 15 11:14:25 antispam spamd[1022]: debug: RBL: timeout for sb after 5
seconds
Jul 15 11:14:25 antispam spamd[1022]: debug: RBL: timeout for
bsp-firsttrusted after 5 seconds
Jul 15 11:14:25 antispam spamd[1022]: debug: running meta tests; score so
far=18.159
Jul 15 11:14:25 antispam spamd[1022]: debug: running header regexp tests;
score so far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: running body-text per-line
regexp tests; score so far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: running uri tests; score so
far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: running raw-body-text per-line
regexp tests; score so far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: running full-text regexp tests;
score so far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: Running tests for priority:
1000
Jul 15 11:14:25 antispam spamd[1022]: debug: running meta tests; score so
far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: running header regexp tests;
score so far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: open of AWL file failed: lock:
1022 cannot create tmp lockfile
/var/spool/mail/.spamassassin/auto-whitelist.lock.antispam.efastunding.com.1
022 for /var/spool/mail/.spamassassin/auto-whitelist.lock: Permission denied
Jul 15 11:14:25 antispam spamd[1022]: debug: Post AWL score: 19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: running body-text per-line
regexp tests; score so far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: running uri tests; score so
far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: running raw-body-text per-line
regexp tests; score so far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: running full-text regexp tests;
score so far=19.492
Jul 15 11:14:25 antispam spamd[1022]: debug: auto-learn? ham=0.1, spam=12,
body-points=5.174, head-points=15.606
Jul 15 11:14:25 antispam spamd[1022]: debug: auto-learn: currently using
scoreset 1.  no need to recompute.
Jul 15 11:14:25 antispam spamd[1022]: debug: auto-learn? yes, spam (19.492 >
12)
Jul 15 11:14:25 antispam spamd[1022]: debug: Learning Spam
Jul 15 11:14:25 antispam spamd[1022]: debug: all '*From' addrs:
Mauro@msn.com
Jul 15 11:14:25 antispam spamd[1022]: debug: all '*To' addrs:
spam@antispam.efastfunding.com davidt@efastfunding.com
dbarnhart@efastfunding.com vtran@efastfunding.com
Jul 15 11:14:25 antispam spamd[1022]: debug: uri found:
http://lendersforyou.net/?partid=ftees
Jul 15 11:14:25 antispam spamd[1022]: debug: uri found:
http://lendersforyou.net/st.html
Jul 15 11:14:25 antispam spamd[1022]: debug: auto-learning failed: lock:
1022 cannot create tmp lockfile
/var/spool/mail/.spamassassin/bayes.lock.antispam.efastunding.com.1022 for
/var/spool/mail/.spamassassin/bayes.lock: Permission denied
Jul 15 11:14:25 antispam spamd[1022]: debug: is spam? score=19.492
required=5
Jul 15 11:14:25 antispam spamd[1022]: debug:
tests=BAD_CREDIT,MIME_BOUND_DD_DIGITS,MSGID_SPAM_CAPS,NO_CREDIT_CHECK,RAZOR2
_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_BY_IP,RCVD_DOUBLE_IP_SPAM,RCVD_IN_NJABL_D
UL,RCVD_IN_SORBS_DUL,URIBL_AB_SURBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,
URIBL_WS_SURBL
Jul 15 11:14:25 antispam spamd[1022]: debug:
subtests=__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__DOUBLE_IP_LOOSE,_
_DOUBLE_IP_SPAM_2,__HAS_MSGID,__HAS_SUBJECT,__MIME_VERSION,__MSGID_OK_HOST,_
_RCVD_IN_NJABL,__RCVD_IN_SORBS,__SANE_MSGID,__SENDERBASE
Jul 15 11:14:25 antispam spamd[1022]: logmsg: identified spam (19.5/5.0) for
nobody:99 in 5.7 seconds, 1397 bytes.
Jul 15 11:14:25 antispam spamd[1022]: identified spam (19.5/5.0) for
nobody:99 in 5.7 seconds, 1397 bytes.
Jul 15 11:14:25 antispam spamd[1022]: logmsg: result: Y 19 -
BAD_CREDIT,MIME_BOUND_DD_DIGITS,MSGID_SPAM_CAPS,NO_CREDIT_CHECK,RAZOR2_CF_RA
NGE_51_100,RAZOR2_CHECK,RCVD_BY_IP,RCVD_DOUBLE_IP_SPAM,RCVD_IN_NJABL_DUL,RCV
D_IN_SORBS_DUL,URIBL_AB_SURBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,URIBL_
WS_SURBL
scantime=5.7,size=1397,mid=<WJ...@hotmail.com>,autolearn=
failed
Jul 15 11:14:25 antispam spamd[1022]: result: Y 19 -
BAD_CREDIT,MIME_BOUND_DD_DIGITS,MSGID_SPAM_CAPS,NO_CREDIT_CHECK,RAZOR2_CF_RA
NGE_51_100,RAZOR2_CHECK,RCVD_BY_IP,RCVD_DOUBLE_IP_SPAM,RCVD_IN_NJABL_DUL,RCV
D_IN_SORBS_DUL,URIBL_AB_SURBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,URIBL_
WS_SURBL
scantime=5.7,size=1397,mid=<WJ...@hotmail.com>,autolearn=
failed
[root@antispam log]#

Re: Would like to put 3.0.0pre2 in corp production SA-exim problem

[Theo Van Dinter <fe...@kluge.net>]

On Thu, Jul 15, 2004 at 11:23:38AM -0500, lists wrote:
> 2004-07-15 10:54:46 1Bl8ZD-0001hI-Ix SA: PANIC: SA: could not parse
> X-Spam-Status: to extract hits and required. Bad!. Got: 'X-Spam-Status: No,
> score=0.9 required=5.0 tests=HTML_80_90,HTML_BADTAG_00_10,
>         HTML_MESSAGE,HTML_NONELEMENT_00_10,MIME_MISSING_BOUNDARY
> autolearn=no
>         version=3.0.0-pre2
> ' (but message was accepted)

yep.  looks like they're looking for 'hits=', but it's 'score=' in 3.0.

The second note in the UPGRADING doc included with 3.0.0, BTW, is quite
clear about this type of thing:

- SpamAssassin 3.0.0 has a significantly different API (Application
  Program Interface) from the 2.x series of code.  This means that if you
  use SpamAssassin through a third-party utility (milter, etc,) you need
  to make sure you have an updated version which supports 3.0.0.

-- 
Randomly Generated Tagline:
"I once witnessed a long-winded, month-long flamewar over the use of
 mice vs. trackballs...It was very silly."
 (By Matt Welsh)