You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Nikos K." <sp...@yahoo.com> on 2007/12/27 13:22:38 UTC
Spamassassin Upgrade
Dear All,
I had a mail server with the following characteristics:
Redhat9 (Kernel 2.4.20-8)
Squirrelmail-1.4.3a-1
Spamassassin 3.0.1.
The mail server was working fine but the spamassassing was missing a lot of
spam messages. So, I tried to upgrade it to version 3.1.8. by installing
the following packages:
spamassassin-3.1.8-1.rh9.rf.i386.rpm
spamassassin-tools-3.1.8-1.rh9.rf.i386.rpm
After some more steps i ended up to:
1) When I run "spamassassin -V" I get: SpamAssassin version 3.1.8 running on
Perl version 5.8.0
2) When I run "sa-learn --dump magic" I get:
0.000 0 3 0 non-token data: bayes db version
0.000 0 1717 0 non-token data: nspam
0.000 0 674 0 non-token data: nham
0.000 0 84131 0 non-token data: ntokens
0.000 0 1108487840 0 non-token data: oldest atime
0.000 0 1198748434 0 non-token data: newest atime
0.000 0 1198749846 0 non-token data: last journal sync
atime
0.000 0 0 0 non-token data: last expiry atime
0.000 0 0 0 non-token data: last expire atime
delta
0.000 0 0 0 non-token data: last expire
reduction co
3)When I run "sa-update" I get no result, but the first time i did it, the
following folder was created: /var/lib/spamassassin/3.001008/
4)When I run "spamassassin --lint" I get no error message.
The PROBLEM is that spamassassin still misses a lot of spam messages and
actually acts like before.
Even if it seems that the new version is running now, I think that the old
spamassassin deals with the incoming emails.
Please take a look in my configuration files below:
--------------------
/etc/procmailrc:
DROPPRIVS=yes
:0fw:
| /usr/bin/spamc
--------------------
/etc/mail/spamassassin/local.cf
required_hits 5
rewrite_header subject ***spam***
report_safe 0
use_bayes 1
bayes_auto_learn 1
ok_locales all
--------------------
I am pretty sure that i am missing something. Is there any way to check if
the incoming emails are handled by the new spamassassin? If indeed the new
spamassassin handles all the incoming emails then why all this training by
sa-update and sa-learn has given no evolution?
Thank you in advance!
Nikos
--
View this message in context: http://www.nabble.com/Spamassassin-Upgrade-tp14512526p14512526.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Spamassassin Upgrade
Posted by Theo Van Dinter <fe...@apache.org>.
On Fri, Dec 28, 2007 at 06:47:55AM -0800, Nikos K. wrote:
> Does it mean that I only have one installed perl?
It is less likely that you have multiple perls, and more likely that you have
multiple Net::DNS modules installed.
> [3706] error: spamd: could not create INET socket on 127.0.0.1:783: Address
> already in use
> spamd: could not create INET socket on 127.0.0.1:783: Address already in use
[...]
> tcp 0 0 127.0.0.1:783 0.0.0.0:* LISTEN
> 3505/spamd.pid
>
> Any suggestions? Why I am not able to restart spamd?
It looks like spamd is still running when you try to start the new one. Make
sure you stop the running one before trying to start a new one.
--
Randomly Selected Tagline:
Adde parvum parvo manus acervus erit.
[Add little to little and there will be a big pile.]
-- Ovid
Re: Feedback on 3.2.4
Posted by Rick Macdougall <ri...@ummm-beer.com>.
Jorge Valdes wrote:
>>
>> No problems with it at all here (around 7 servers upgraded) and the
>> performance is greatly increased. I went from a 1.4 second average
>> scan time to 0.6 seconds average.
>>
>> HTH,
>>
>> Rick
>>
>>
> Is this without network tests?
> Because on my server I had
>
> Begin : 2008-01-01
> End : 2008-01-15
> Summary : 3.1.8
>
> Cnt %% Average Min Max
> ------ ------ ---------- ---------- ----------
> 18968 46.2% 7.837 1.861 10.000
> 16640 40.6% 13.654 10.001 19.999
> 2916 7.1% 23.892 20.003 30.000
> 1379 3.4% 38.132 30.002 59.882
> 184 0.4% 74.994 60.041 89.753
> 37 0.1% 99.552 90.282 118.884
> 904 2.2% 154.578 120.272 364.923
>
> Begin : 2008-01-21
> End : 2008-01-24
> Summary : version 3.2.4
>
> Cnt %% Average Min Max
> ------ ------ ---------- ---------- ----------
> 5302 44.9% 7.431 3.872 10.000
> 4737 40.1% 13.643 10.002 19.998
> 869 7.4% 24.003 20.008 29.982
> 555 4.7% 41.017 30.001 59.947
> 126 1.1% 72.529 60.201 89.941
> 24 0.2% 101.170 90.641 118.022
> 201 1.7% 154.700 120.454 188.119
>
> Because by just the percentages scantime is roughly the same with
> exactly the same hardware.
>
>
Yup, full scanning including network tests and bayes stored in a network
MySQL server.
Hardware is Dell 860s (I believe, could be 850) with 4 gigs of ram and
no second CPU installed.
Regards,
Rick
Re: Feedback on 3.2.4
Posted by Jorge Valdes <jv...@intercom.com.sv>.
Rick Macdougall wrote:
> Skip wrote:
>> Other than the initial reports of performance boost from 3.2.4, I
>> haven't
>> seen much discussion on it as yet. Perhaps it is still too soon to
>> know,
>> but has anyone been seeing other benefits - or identified potential
>> problems?
>>
>
> No problems with it at all here (around 7 servers upgraded) and the
> performance is greatly increased. I went from a 1.4 second average
> scan time to 0.6 seconds average.
>
> HTH,
>
> Rick
>
>
Is this without network tests?
Because on my server I had
Begin : 2008-01-01
End : 2008-01-15
Summary : 3.1.8
Cnt %% Average Min Max
------ ------ ---------- ---------- ----------
18968 46.2% 7.837 1.861 10.000
16640 40.6% 13.654 10.001 19.999
2916 7.1% 23.892 20.003 30.000
1379 3.4% 38.132 30.002 59.882
184 0.4% 74.994 60.041 89.753
37 0.1% 99.552 90.282 118.884
904 2.2% 154.578 120.272 364.923
Begin : 2008-01-21
End : 2008-01-24
Summary : version 3.2.4
Cnt %% Average Min Max
------ ------ ---------- ---------- ----------
5302 44.9% 7.431 3.872 10.000
4737 40.1% 13.643 10.002 19.998
869 7.4% 24.003 20.008 29.982
555 4.7% 41.017 30.001 59.947
126 1.1% 72.529 60.201 89.941
24 0.2% 101.170 90.641 118.022
201 1.7% 154.700 120.454 188.119
Because by just the percentages scantime is roughly the same with
exactly the same hardware.
--
Jorge Valdes
Re: Feedback on 3.2.4
Posted by Rick Macdougall <ri...@ummm-beer.com>.
Skip wrote:
> Other than the initial reports of performance boost from 3.2.4, I haven't
> seen much discussion on it as yet. Perhaps it is still too soon to know,
> but has anyone been seeing other benefits - or identified potential
> problems?
>
No problems with it at all here (around 7 servers upgraded) and the
performance is greatly increased. I went from a 1.4 second average scan
time to 0.6 seconds average.
HTH,
Rick
Feedback on 3.2.4
Posted by Skip <sb...@dmp.com>.
Other than the initial reports of performance boost from 3.2.4, I haven't
seen much discussion on it as yet. Perhaps it is still too soon to know,
but has anyone been seeing other benefits - or identified potential
problems?
- Skip
Re: Spamassassin Upgrade
Posted by "Nikos K." <sp...@yahoo.com>.
When I run "whereis perl" it gives me:
perl: /usr/bin/perl /usr/share/man/man1/perl.1.gz
Does it mean that I only have one installed perl?
Secondly I tried to restart spamd but unfortunately I got:
[3706] error: spamd: could not create INET socket on 127.0.0.1:783: Address
already in use
spamd: could not create INET socket on 127.0.0.1:783: Address already in use
By entering "netstat -luntp | grep 783" I get:
tcp 0 0 127.0.0.1:783 0.0.0.0:* LISTEN
3505/spamd.pid
Any suggestions? Why I am not able to restart spamd?
Thank you guys for helping me understand what is going on...
--
View this message in context: http://www.nabble.com/Spamassassin-Upgrade-tp14512526p14526713.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Spamassassin Upgrade
Posted by Jari Fredriksson <ja...@iki.fi>.
> Dear Matt,
>
> Thank you very much for your reply.
> Let me quote what is happening with Net::DNS.
> When I try to train bayes by entering for example:
>
> sa-learn --no-sync --spam --mbox /home/support/mail/Trash
>
> I get the following message:
>
> dns: Net::DNS version is 0.31, but need 0.34 at
> /usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin/Dns.pm
> line 588. Learned tokens from 12 message(s) (12
> message(s) examined)
>
> The weird thing is that when i am trying to update my
> Net::DNS by typing:
>
> #perl -MCPAN -e shell
> cpan[1]>install Net::DNS
>
> I get the message:
>
> CPAN: Storable loaded ok (v2.06)
> Going to read /root/.cpan/Metadata
> Database was generated on Thu, 27 Dec 2007 05:37:55 GMT
> Net::DNS is up to date (0.61).
>
> ....which makes me believe that something is going wrong
> since the Net::DNS version according the cpan is 0.61 and
> according the sa-learn is 0.31. Am I wrong?
>
> I will now check the X-Spam-Checker-Version header and
> try to go a bit deeper hoping that somewhere there the
> lightness lies. Thank you again for your help.
>
> Best Regards,
> Nikos
How many perls do you have in this machine? /usr/local/bin/perl in addition to /usr/bin/perl maybe? If you have installed perl via cpan, you may have two of them...
Re: Spamassassin Upgrade
Posted by "Nikos K." <sp...@yahoo.com>.
Dear Matt,
Thank you very much for your reply.
Let me quote what is happening with Net::DNS.
When I try to train bayes by entering for example:
sa-learn --no-sync --spam --mbox /home/support/mail/Trash
I get the following message:
dns: Net::DNS version is 0.31, but need 0.34 at
/usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin/Dns.pm line 588.
Learned tokens from 12 message(s) (12 message(s) examined)
The weird thing is that when i am trying to update my Net::DNS by typing:
#perl -MCPAN -e shell
cpan[1]>install Net::DNS
I get the message:
CPAN: Storable loaded ok (v2.06)
Going to read /root/.cpan/Metadata
Database was generated on Thu, 27 Dec 2007 05:37:55 GMT
Net::DNS is up to date (0.61).
....which makes me believe that something is going wrong since the Net::DNS
version according the cpan is 0.61 and according the sa-learn is 0.31. Am I
wrong?
I will now check the X-Spam-Checker-Version header and try to go a bit
deeper hoping that somewhere there the lightness lies. Thank you again for
your help.
Best Regards,
Nikos
--
View this message in context: http://www.nabble.com/Spamassassin-Upgrade-tp14512526p14514774.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Spamassassin Upgrade
Posted by Matt Kettler <mk...@verizon.net>.
Nikos K. wrote:
> Dear All,
>
> I had a mail server with the following characteristics:
> Redhat9 (Kernel 2.4.20-8)
> Squirrelmail-1.4.3a-1
> Spamassassin 3.0.1.
>
> The mail server was working fine but the spamassassing was missing a lot of
> spam messages. So, I tried to upgrade it to version 3.1.8. by installing
> the following packages:
> spamassassin-3.1.8-1.rh9.rf.i386.rpm
> spamassassin-tools-3.1.8-1.rh9.rf.i386.rpm
>
> After some more steps i ended up to:
> 1) When I run "spamassassin -V" I get: SpamAssassin version 3.1.8 running on
> Perl version 5.8.0
> 2) When I run "sa-learn --dump magic" I get:
> 0.000 0 3 0 non-token data: bayes db version
> 0.000 0 1717 0 non-token data: nspam
> 0.000 0 674 0 non-token data: nham
>
>
<snip.. nothing interesting here>
> 3)When I run "sa-update" I get no result, but the first time i did it, the
> following folder was created: /var/lib/spamassassin/3.001008/
>
That's not surprising. You'd only get "results" if there was a ruleset
update. Those don't happen every day, and sometimes months go by before
there's a rule update. Rules are created by hand, tested automatically,
and then a human decides if the rule is performing well enough and
addresses enough of a problem area to warant being published to the
updates. As a result, that's a very sporadic process, and usually a
reaction to either a very impressive rule, or a substantial mutation in
spam behavior.
Also, SA 3.1.8 isn't a member of the current release family for SA. The
current release of SA is 3.2.3, There's a lot of development work on
getting 3.3.0 ready, and the 3.1.x branch is very minimally maintained.
The most recent updates for 3.1.x were on Sept 21, 2007 and Oct 18,
2007. The 3.2 branch got updates on Oct 17, 2007 and Oct 30 2007. So
don't expect updates every time you run sa-update. Even the current SA
doesn't get them very often.
> 4)When I run "spamassassin --lint" I get no error message.
>
> The PROBLEM is that spamassassin still misses a lot of spam messages and
> actually acts like before.
>
Ok, care to post some X-Spam-Status headers?
> Even if it seems that the new version is running now, I think that the old
> spamassassin deals with the incoming emails.
>
Any reason to believe that? Have you restarted spamd since your upgrade?
> Please take a look in my configuration files below:
> --------------------
> /etc/procmailrc:
>
> DROPPRIVS=yes
>
> :0fw:
> | /usr/bin/spamc
> --------------------
> /etc/mail/spamassassin/local.cf
>
> required_hits 5
> rewrite_header subject ***spam***
> report_safe 0
> use_bayes 1
> bayes_auto_learn 1
> ok_locales all
> --------------------
>
> I am pretty sure that i am missing something. Is there any way to check if
> the incoming emails are handled by the new spamassassin?
Yes, look at your X-Spam-Checker-Version header.
> If indeed the new
> spamassassin handles all the incoming emails then why all this training by
> sa-update and sa-learn has given no evolution?
>
Dono, I'd have to at least see what rules your messages are hitting by
looking at an X-Spam-Status header. It could be you have a broken trust
path and a lot of spam is hitting ALL_TRUSTED.
You're also running what still amounts to an "old" version of
spamassassin, although I still run 3.1.x in my production environment
with some added rulesets, and I get decent results.
Are network tests enabled in your SA (ie: do you have Net::DNS installed
so RCVD_FROM_* rules can be tested?)
>