You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "J. W. Andersen" <jw...@fasytek.dk> on 2007/01/21 21:30:48 UTC
Header processsing not working.
I seem to have a problem processing headers in spamassassin.
First, on every single mail I receive, i get a MISSING_SUBJECT
condition, and the mail does have a valid subject.
Second, I can never make a match in the subject line.
In the local.cf, I have the following:
.......................................................
header HEALTH_SUBJ Subject =~ /health/i
describe HEALTH_SUBJ Subject contains health
score HEALTH_SUBJ 3
....................................................
body HEALTH_BDY /health/i
describe HEALTH_BDY body contains health
score HEALTH_BDY 2.5
...................................................
When receiving a mail with the word "health" in the subject, I do not
get a match on HEALTH_SUBJ,
however, I do get a match on HEALTH_BDY, even though the word only
appears in the subject line,
not in the message body.
Am I severely misunderstanding something ? Such as definitions of header
(subject) and body ?
The Scenario here is SuSE 10. SpamAssassin is 3.1.7 (initially tested
with 3.1.1, same result).
SpamAssassin is invoked from postfix 2.2.10 via amavisd-new 2.4.0.
Any help highly appreciated - tnx in advance.
Regards Joern W. Andersen
Re: Header processsing not working.
Posted by Theo Van Dinter <fe...@apache.org>.
On Tue, Jan 23, 2007 at 06:37:46PM +0100, J. W. Andersen wrote:
> The only problem remaining now is, that if the same pattern is specified
> for a header/subject test and for a body test, I get hits for both
> test, even though
> the pattern tested for only appears in the subject line and not in the
> body.
The Subject is included as the first line in the body for rules fyi.
--
Randomly Selected Tagline:
"Flourescent lights are generating negative ions." - Today's BOFH Excuse
Re: Header processsing not working.
Posted by "J. W. Andersen" <jw...@fasytek.dk>.
Hmm - presently I feel rather stupid...
I found a tip about starting SA in debug-mode from amavis:
amavisd debug-sa
which revealed a few syntax errors in my local.cf, and these caused header
checks to break off prematurely. So now all my header checks work fine,
and the MISSING_SUBJECT hit vanished.
The only problem remaining now is, that if the same pattern is specified
for a header/subject test and for a body test, I get hits for both
test, even though
the pattern tested for only appears in the subject line and not in the
body.
Strange, eh ?
Regards Joern.
Theo Van Dinter wrote:
> On Mon, Jan 22, 2007 at 01:29:22PM +0100, J. W. Andersen wrote:
>
>> which did not hit the spam score. In either case the header is somewhat
>> modified by amavis,
>> but they still look OK to me, as far as I understand RFC2822.
>>
>
> As long as it's still in the proper rfc-related format it's fine.
>
>
>> Is there a way to capture or freeze the message file at the moment it is
>> passed to SA ?
>>
>
> You could write a plugin to do this for you, but there's no standard feature
> that would do it, especially since you're using a third party daemon.
>
>
>> X-Spam-Status: No, score=5.751 tagged_above=3 required=6.3 tests=[AWL=1.774,
>> HEALTH_BDY=2.5, MISSING_SUBJECT=1.345, NO_RECEIVED=-0.001,
>> SPF_PASS=-0.001, TO_CC_NONE=0.134]
>>
> [...]
>
>> Subject: health
>>
>
> Hrm. Yeah, something is definitely messed up. It clearly has a Subject
> header and it works fine if I run it through "spamassassin":
>
> [21577] dbg: check: tests=BAYES_95,TVD_RCVD_SPACE_BRACKET,UNPARSEABLE_RELAY
> [21577] dbg: check: subtests=__CT,__CTE,__CT_TEXT_PLAIN,__ENV_AND_HDR_FROM_MATCH,__HAS_MSGID,__HAS_RCVD,__HAS_SUBJECT,__MIME_VERSION,__MOZILLA_MSGID,__MSGID_OK_HOST,__NONEMPTY_BODY,__SANE_MSGID,__TOCC_EXISTS,__USER_AGENT
>
>
Re: Header processsing not working.
Posted by Theo Van Dinter <fe...@apache.org>.
On Mon, Jan 22, 2007 at 01:29:22PM +0100, J. W. Andersen wrote:
> which did not hit the spam score. In either case the header is somewhat
> modified by amavis,
> but they still look OK to me, as far as I understand RFC2822.
As long as it's still in the proper rfc-related format it's fine.
> Is there a way to capture or freeze the message file at the moment it is
> passed to SA ?
You could write a plugin to do this for you, but there's no standard feature
that would do it, especially since you're using a third party daemon.
> X-Spam-Status: No, score=5.751 tagged_above=3 required=6.3 tests=[AWL=1.774,
> HEALTH_BDY=2.5, MISSING_SUBJECT=1.345, NO_RECEIVED=-0.001,
> SPF_PASS=-0.001, TO_CC_NONE=0.134]
[...]
> Subject: health
Hrm. Yeah, something is definitely messed up. It clearly has a Subject
header and it works fine if I run it through "spamassassin":
[21577] dbg: check: tests=BAYES_95,TVD_RCVD_SPACE_BRACKET,UNPARSEABLE_RELAY
[21577] dbg: check: subtests=__CT,__CTE,__CT_TEXT_PLAIN,__ENV_AND_HDR_FROM_MATCH,__HAS_MSGID,__HAS_RCVD,__HAS_SUBJECT,__MIME_VERSION,__MOZILLA_MSGID,__MSGID_OK_HOST,__NONEMPTY_BODY,__SANE_MSGID,__TOCC_EXISTS,__USER_AGENT
--
Randomly Selected Tagline:
"You can't build a reputation on what you are going to do." - Henry Ford
Re: Header processsing not working.
Posted by "J. W. Andersen" <jw...@fasytek.dk>.
Theo, thanks a lot for explaining this to me. I have tried the mentioned
test with the spamassassin script,
but I am still unable to make the header tests work.
One problem is, that I do not know how to capture the message file in
the moment when SA gets it
I have tested with 2 different message files (attached) , spam1 is from
the amavis quarantine folder,
i.e. this message was quarantined due to high spam score, and spam 2 is
a message from my mailbox,
which did not hit the spam score. In either case the header is somewhat
modified by amavis,
but they still look OK to me, as far as I understand RFC2822.
Is there a way to capture or freeze the message file at the moment it is
passed to SA ?
Regards, Joern
Theo Van Dinter wrote:
> On Sun, Jan 21, 2007 at 10:14:51PM +0100, J. W. Andersen wrote:
>
>>> It sounds more like your system isn't properly passing the message to SA.
>>>
>> As all my body tests seem to work OK, I guess the messages *are* passed
>> to SA. Unless there is
>> reason to believe, that postfix or amavis should block the header part,
>> and let body part through ?
>>
>
> For example, if the first line that SA sees does not look like a mbox/mbx
> separator or header, SA decides there is no header and everything is body.
>
>
>>> Test using the "spamassassin" script. If it works there, your problem is
>>> not SA related.
>>>
>> I could not find a description of the mentioned test - or the script,
>> for that matter, anywhere. Could you give me some hints ?
>>
>
> "spamassassin" is the commandline perl script that lets you run a message
> through. ie:
>
> "spamassassin -D < message_file"
>
> will run a message through in debug mode so you can see what's going on. If
> you don't have a script called "spamassassin" installed, then your SA install
> is broken.
>
>
Re: Header processsing not working.
Posted by Theo Van Dinter <fe...@apache.org>.
On Sun, Jan 21, 2007 at 10:14:51PM +0100, J. W. Andersen wrote:
> >It sounds more like your system isn't properly passing the message to SA.
> As all my body tests seem to work OK, I guess the messages *are* passed
> to SA. Unless there is
> reason to believe, that postfix or amavis should block the header part,
> and let body part through ?
For example, if the first line that SA sees does not look like a mbox/mbx
separator or header, SA decides there is no header and everything is body.
> >Test using the "spamassassin" script. If it works there, your problem is
> >not SA related.
> I could not find a description of the mentioned test - or the script,
> for that matter, anywhere. Could you give me some hints ?
"spamassassin" is the commandline perl script that lets you run a message
through. ie:
"spamassassin -D < message_file"
will run a message through in debug mode so you can see what's going on. If
you don't have a script called "spamassassin" installed, then your SA install
is broken.
--
Randomly Selected Tagline:
Quigley's Law:
Whoever has any authority over you, no matter how small, will
atttempt to use it.
Re: Header processsing not working.
Posted by "J. W. Andersen" <jw...@fasytek.dk>.
Theo Van Dinter wrote:
> On Sun, Jan 21, 2007 at 09:30:48PM +0100, J. W. Andersen wrote:
>
>> Am I severely misunderstanding something ? Such as definitions of header
>> (subject) and body ?
>>
>
> It sounds more like your system isn't properly passing the message to SA.
>
>
As all my body tests seem to work OK, I guess the messages *are* passed
to SA. Unless there is
reason to believe, that postfix or amavis should block the header part,
and let body part through ?
>> The Scenario here is SuSE 10. SpamAssassin is 3.1.7 (initially tested
>> with 3.1.1, same result).
>> SpamAssassin is invoked from postfix 2.2.10 via amavisd-new 2.4.0.
>>
>
> Test using the "spamassassin" script. If it works there, your problem is
> not SA related.
>
>
I could not find a description of the mentioned test - or the script,
for that matter, anywhere. Could you give me some hints ?
Regards, Joern
Re: Header processsing not working.
Posted by Theo Van Dinter <fe...@apache.org>.
On Sun, Jan 21, 2007 at 09:30:48PM +0100, J. W. Andersen wrote:
> Am I severely misunderstanding something ? Such as definitions of header
> (subject) and body ?
It sounds more like your system isn't properly passing the message to SA.
> The Scenario here is SuSE 10. SpamAssassin is 3.1.7 (initially tested
> with 3.1.1, same result).
> SpamAssassin is invoked from postfix 2.2.10 via amavisd-new 2.4.0.
Test using the "spamassassin" script. If it works there, your problem is
not SA related.
--
Randomly Selected Tagline:
"I think animal testing is a terrible idea; they get all nervous and
give the wrong answers." - Unknown