Multiple Ruleset Locations - Cleanup Needed?

[David Goldsmith <dg...@sans.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We have had SpamAssassin running for sometime.  Until yesterday, we were
 currently running 3.1.0 and were (and still are) using the RulesDuJour
script to pull updated SARE rulesets as well.

After updating to SpamAssassin 3.1.3 yesterday, and browsing through the
Wiki site some more, I came across sa-update.  I ran sa-update and it
created /var/lib/spamassassin/3.001003/ with the
updates_spamassassin_org channel information.  There are newer versions
of most of the SA-include rulesets there compared to what was in our
/etc/mail/spamassassin directory.

After reading through the mailing list postings of the last month or so
dealing with sa-update, I realized we also have a
/usr/share/spamassassin directory which now contains the SA_rulesets
from 3.1.3.

So I have 3 directories with SA-included rulesets

/etc/mail/spamassin - 3.1.0 rules from Dec 2005
/usr/share/spamassassin - 3.1.3 rules dated Jun 5 2006
/var/lib/spamassassin/3.001003/... - update 407357 to 3.1.3 rules

When I run 'spamassassin -LD --lint', I see it try to load the following
types of files from the following locations:

config: using "/etc/mail/spamassassin" for site rules pre files
config: using "/var/lib/spamassassin/3.001003" for sys rules pre files
config: using "/var/lib/spamassassin/3.001003" for default rules dir
config: using "/etc/mail/spamassassin" for site rules dir

In /etc/mail/spamassassin, any rules we have added or score adjustments
have been made in either local.cf or in *.cf files we have created.

Questions:

1) Are the SA-included ##_<string>.cf files needed in all 3 locations or
can the 'older' files in /etc/mail/spamassassin and
/usr/share/spamassassin be removed?

2) Do the rulesets in the multiple files get merged or does only the
first/last copy of the same name get used?

To test the behavior wrt Q2, I created a dave.cf file in both
/etc/mail/spamassassin and /var/lib/spamassassin/...   I created a rule
that matched on my email address.  The rules were named DGOLDSMITH1
(/etc/mail/spamassassin) and DGOLDSMITH2 (var/lib/spamassassin/...) so
they would be unique.

After restarting SA, and running some messages through, only to
DGOLDSMITH1 rule is getting matched.

Thanks,
Dave


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3rc2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEhZDx417vU8/9QfkRAgVmAJ9uN37TfDMPfI7p9XxsFStAyAp3SACcDATA
XyLs06IEGHmaBDobh3mU1rM=
=xSjj
-----END PGP SIGNATURE-----

Re: Multiple Ruleset Locations - Cleanup Needed?

[Theo Van Dinter <fe...@apache.org>]

On Tue, Jun 06, 2006 at 10:28:01AM -0400, David Goldsmith wrote:
> So I have 3 directories with SA-included rulesets
> 
> /etc/mail/spamassin - 3.1.0 rules from Dec 2005

That should just have your site-wide config, not a full set of rules.

> /usr/share/spamassassin - 3.1.3 rules dated Jun 5 2006

Standard with the install.

> /var/lib/spamassassin/3.001003/... - update 407357 to 3.1.3 rules

From sa-update.

> 1) Are the SA-included ##_<string>.cf files needed in all 3 locations or
> can the 'older' files in /etc/mail/spamassassin and
> /usr/share/spamassassin be removed?

I don't know why you put any standard files in /etc/mail/spamassassin at all,
so they can go (just leave your own configs in there).  Leave
/usr/share/spamassassin, that's the default rules that come with the SA
install (good if you don't use sa-update, or something wipes the sa-update
dir, or ...)

> 2) Do the rulesets in the multiple files get merged or does only the
> first/last copy of the same name get used?

Only the last version of any specific rulename gets used.

-- 
Randomly Generated Tagline:
Assembly line workers do it over and over.