You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by NFN Smith <wo...@mail.com> on 2010/10/29 20:02:11 UTC
Rule works in testing, but not hitting live mail
I'm seeing some amount traffic with obfuscated content in To: lines,
where the display name is shown as a angled bracket. For example:
To: "<"<...@example.com>
I've been playing with a rule to identify this particular pattern (and
score in metas):
header LR_OBSC_RECIPS To =~ /\"\<\"/
When run this one in testing, I'm getting scores on the messages I feed
to it, but when live mail with this pattern comes through, the rule
isn't hitting.
As far as I'm aware, my testing methodology is working correctly, and I
do pass samples of received messages against test copies of new rules
for nearly all of my new rules before applying them to my working servers.
In my testing setup (running Debian), I have a working directory, where
I have symlinks to all the rulesets in /usr/share/spamassassin. I also
have a .cf file in the working directory where I copy a new rule. When
I test a rule, I use a script that pipes a message through spamassassin:
spamassassin -t -D -C . 2> ./debug.log
When I'm satisfied from my testing that the rule is working correctly,
then I apply it to my production servers.
Any ideas as to why my rule is hitting in testing, but not on live mail?
Is there something I'm missing in my rule syntax, or something that
I'm not doing correctly in my testing methodology?
Smith
Re: Rule works in testing, but not hitting live mail
Posted by Kris Deugau <kd...@vianet.ca>.
NFN Smith wrote:
> Lawrence @ Rogers wrote:
>
>> Are you running it against an e-mail with a known match? Using
>> spamassassin -D -t sample-spam.txt and having sample-spam.txt contain
>> the complete e-mail including headers?
>
> Yes, it's a known match. I can take a full copy of a received message
> (with headers, although my servers strip Received: headers of inbound
> messages before they're written to mailboxes).
I have to ask: Why?
Maybe your header-munging is mangling the To:?
> Thus, a message that
> passes through a server where the rule is included in production
> configurations will show plenty of hits on other SpamAssassin rules
> (including ones I've added myself), but not this particular rule. From
> there, I can take the same message, and pipe through spamassassin -D -t
> (using the same config file), I do get a hit on the rule.
.. or not, if your call to SA in production is after the header-munging,
but passing the message file through SA manually works OK.
Check your manual test configuration *very* carefully against the way
you call SA in production; if a rule works <here> but not <there>, SA
is treating that rule, or file full of rules, different for some reason.
-kgd
Re: Rule works in testing, but not hitting live mail
Posted by NFN Smith <wo...@mail.com>.
Lawrence @ Rogers wrote:
> Are you running it against an e-mail with a known match? Using
> spamassassin -D -t sample-spam.txt and having sample-spam.txt contain
> the complete e-mail including headers?
Yes, it's a known match. I can take a full copy of a received message
(with headers, although my servers strip Received: headers of inbound
messages before they're written to mailboxes). Thus, a message that
passes through a server where the rule is included in production
configurations will show plenty of hits on other SpamAssassin rules
(including ones I've added myself), but not this particular rule. From
there, I can take the same message, and pipe through spamassassin -D -t
(using the same config file), I do get a hit on the rule.
>
> Are you sure the machine in question doesn't have 2 copies of SA
> installed (I have seen this before on cPanel servers, one installed via
> CPAN and the other via RPM)
>
Maybe not impossible, but very unlikely. This one is a Debian server,
where installation has been done from the lenny-backports repository. I
don't remember if we have any CPAN modules currently installed, but we
go to CPAN only if specific individual modules aren't available via
normal Debian repositories.
I'm going to take a look at Jon Hardin's suggestion to look at what he's
got in his sandbox.
Smith
Re: Rule works in testing, but not hitting live mail
Posted by "Lawrence @ Rogers" <la...@nl.rogers.com>.
On 29/10/2010 4:06 PM, NFN Smith wrote:
> Lawrence @ Rogers wrote:
>> On 29/10/2010 3:32 PM, NFN Smith wrote:
>>> header LR_OBSC_RECIPS To =~ /\"\<\"/
>
>> Is this rule being used standalone, or as part of a meta rule? Do you
>> have a score declared for it? If so, what is it?
>
> Right now, I'm scoring at 1.25 points. Thus, it's not a hidden rule.
> Also, in testing, not only is the rule showing as expected in the
> SpamAssassinReport.txt attachment, the debug log is also showing that
> the rule is firing correctly.
>
>>> Oct 29 18:30:18.807 [27696] dbg: rules: ran header rule
>>> LR_OBSC_RECIPS ======> got hit: ""<""
>
>
>> Does spamassassin --lint report any errors at the end of its output?
>
> I double-checked, and a --lint check comes up clean.
>
> When I apply rules updates to working configurations, I use a script,
> and part of that script includes a --lint check. If --lint complains,
> then I don't replicate the update to my production servers.
>
> Smith
>
>
>
Are you running it against an e-mail with a known match? Using
spamassassin -D -t sample-spam.txt and having sample-spam.txt contain
the complete e-mail including headers?
Are you sure the machine in question doesn't have 2 copies of SA
installed (I have seen this before on cPanel servers, one installed via
CPAN and the other via RPM)
Re: Rule works in testing, but not hitting live mail
Posted by NFN Smith <wo...@mail.com>.
Lawrence @ Rogers wrote:
> On 29/10/2010 3:32 PM, NFN Smith wrote:
>> header LR_OBSC_RECIPS To =~ /\"\<\"/
> Is this rule being used standalone, or as part of a meta rule? Do you
> have a score declared for it? If so, what is it?
Right now, I'm scoring at 1.25 points. Thus, it's not a hidden rule.
Also, in testing, not only is the rule showing as expected in the
SpamAssassinReport.txt attachment, the debug log is also showing that
the rule is firing correctly.
>> Oct 29 18:30:18.807 [27696] dbg: rules: ran header rule LR_OBSC_RECIPS ======> got hit: ""<""
> Does spamassassin --lint report any errors at the end of its output?
I double-checked, and a --lint check comes up clean.
When I apply rules updates to working configurations, I use a script,
and part of that script includes a --lint check. If --lint complains,
then I don't replicate the update to my production servers.
Smith
Re: Rule works in testing, but not hitting live mail
Posted by "Lawrence @ Rogers" <la...@nl.rogers.com>.
On 29/10/2010 3:32 PM, NFN Smith wrote:
> header LR_OBSC_RECIPS To =~ /\"\<\"/
Is this rule being used standalone, or as part of a meta rule? Do you
have a score declared for it? If so, what is it?
Does spamassassin --lint report any errors at the end of its output?
Cheers,
Lawrence
Re: Rule works in testing, but not hitting live mail
Posted by John Hardin <jh...@impsec.org>.
On Fri, 29 Oct 2010, NFN Smith wrote:
> I'm seeing some amount traffic with obfuscated content in To: lines,
> where the display name is shown as a angled bracket. For example:
>
> To: "<"<...@example.com>
Just FYI, I have a rule for that in my sandbox. It hit six messages in the
current nightly masscheck spam corpus. :)
When that becomes a more common practice the rule should autopromote...
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
2 days until Halloween