Re: SA Windows Version stable? (was: How to update 3.1.7 to new version)

[Matthias Haegele <mh...@linuxrocks.dyndns.org>]

Sg schrieb:
> Hi
>      I am using SA 3.1.7 in MS Exchange Server. Yesterday 80,000 spam
> messages cloggin the system. Can anyone tell me, why suddenly getting lot of
> spam mails. we need to update the SA or update the rules.. Please tell me
> how to update SA in windows?

btw:
What are your experiences with SA on Windows Platform, since i am not 
using it for now. Would you recommended it or are there too many caveats?

(On a few Windows Servers i run a small SA/Postfix Server as a VMWare 
Guest ...)

-- 
Gruesse/Greetings
MH


Dont send mail to: ubecatcher@linuxrocks.dyndns.org
--

RE: SA Windows Version stable?

[Bret Miller <br...@wcg.org>]

>What are your experiences with SA on Windows Platform, since i am not 
>using it for now. Would you recommended it or are there too many caveats?

I have run SA on Windows for several years. Most built-in stuff works just
fine. With a couple small modifications, you can even store your bayes and
awl stuff in MSSQL.

DCC/Razor/Pyzor don't work. It's difficult to get stuff that needs to
compile to actually compile-- for example, DomainKeys support is not a
straightforward install though it can be done.

I'm not sure sa-compile works. I started working on the compatibility issues
at one point, but our stated direction for email is now outsourcing, so I'm
not spending time debugging SA but getting stuff integrated with the new
email solution.

I find SA to be rather CPU-intensive, and have had many days this year where
email got backlogged by a couple hours and was unable to catch up during
business hours. Of course, the CPU load can be lessened by running less
rules, but doing so makes SA less effective as well. We've had to opt for
less effective so that we don't get overloaded as often.  I'm not sure these
are entirely Windows issues, though.

I don't see SA crashing like it used to on Windows. It's been very stable
that way. However, some email messages take a long time to process, so make
sure your timeout value is set really high. I'm thankful that we've gotten
the multithreading issues resolved to the point where one message doesn't
hold up the rest any longer.

I would recommend it if you've got the power to spare.

Bret

Re: SA UNPARSEABLE_RELAY when host name in ( ) causes whitelist_from_rcvd to be ignored

[SM <sm...@resistor.net>]

At 03:57 12-03-2008, Steve Radich wrote:
>I'm unclear if this is RFC compliant or not, the specs DO say in Section
>3.8.2 "environments may not conform eactly to this specification" - see
>other RFC references..

SpamAssassin doesn't verify RFC compliance.

>The following line causes UNPARSEABLE_RELAY:
>
>Received: from host1.internal (host1.internal) by host2.internal
>(63.218.155.52) with ESMTP id m27NKoCv031779 for <so...@domain.com>;
>Fri, 7 Mar 2008 17:20:50 -0600
>
>Simply changing the host IP to host1.internal in ( ) as below causes it
>to parse:
>
>  Received: from host1.internal (63.218.155.52) by host2.internal
>(63.218.155.52) with ESMTP id m27NKoCv031779 for <so...@domain.com>;
>Fri, 7 Mar 2008 17:20:50 -0600
>
>We have a site that we whitelist via whitelist_from_rcvd so when we get
>UNPARSEABLE_RELAY it ignores the whitelist. This SEEMS like a bug in
>spamassassin.

I suggest using the Received line that is parsed correctly.   If it's 
a mail server adding the Received line, you could file a bug report.

Regards,
-sm 

SA UNPARSEABLE_RELAY when host name in ( ) causes whitelist_from_rcvd to be ignored

[Steve Radich <st...@bitshop.com>]

I'm unclear if this is RFC compliant or not, the specs DO say in Section
3.8.2 "environments may not conform eactly to this specification" - see
other RFC references..

The following line causes UNPARSEABLE_RELAY:

Received: from host1.internal (host1.internal) by host2.internal
(63.218.155.52) with ESMTP id m27NKoCv031779 for <so...@domain.com>;
Fri, 7 Mar 2008 17:20:50 -0600

Simply changing the host IP to host1.internal in ( ) as below causes it
to parse:

 Received: from host1.internal (63.218.155.52) by host2.internal
(63.218.155.52) with ESMTP id m27NKoCv031779 for <so...@domain.com>;
Fri, 7 Mar 2008 17:20:50 -0600

We have a site that we whitelist via whitelist_from_rcvd so when we get
UNPARSEABLE_RELAY it ignores the whitelist. This SEEMS like a bug in
spamassassin.

RFC specs I read include:

    Section 4.1.3 Address Literals is the format, basically just IP
address.
    Section 3.8.2:""Received:" fields of messages originating from other
environments may not conform exactly to this specification..."
    Section 4.4 Page 51: 
        Extended-Domain = Domain /
               ( Domain FWS "(" TCP-info ")" ) /
               ( Address-literal FWS "(" TCP-info ")" )

        TCP-info = Address-literal / ( Domain FWS Address-literal )
          ; Information derived by server from TCP connection
          ; not client EHLO.


Steve Radich - http://www.aspdeveloper.net /
http://www.virtualserverfaq.com 
BitShop, Inc. - Development, Training, Hosting, Troubleshooting -
http://www.bitshop.com