sa-learn issue

[Juliano Simões <ju...@axios.com.br>]

Our SA 3.0.1 site-wide setup was working fine until recently,
when we noticed that bayes stopped learning new messages
submitted as ham/spam via:

$ cat <ham_mess> | /usr/bin/sa-learn --ham --no-sync --single --local
or
$ cat <spam_mess> | /usr/bin/sa-learn --spam --no-sync --single --local

Although the above commands shows:
"Learned from 1 message(s) (1 message(s) examined).",
our spamd stats remain virtually unchanged, even after
"sa-learn --force-expire" or "sa-learn --sync".

$ sa-learn --dump magic
0.000    0          3    0  non-token data: bayes db version
0.000    0     832495    0  non-token data: nspam
0.000    0      16375    0  non-token data: nham
0.000    0     490287    0  non-token data: ntokens
0.000    0 1098888091    0  non-token data: oldest atime
0.000    0 1101206282    0  non-token data: newest atime
0.000    0 1098943589    0  non-token data: last journal sync atime
0.000    0 1098931483    0  non-token data: last expiry atime
0.000    0      43200    0  non-token data: last expire atime delta
0.000    0     168592    0  non-token data: last expire reduction count

Bayes files are chowned 0700 and bayes_journal is shrunk  after
sync, so I don't think this is a permission related problem.

Our DB files are rather large (bayes_seen: 86 MB, bayes_toks: 11 MB)
and we use the following in local.cf in order to tame opportunistic
syncing (sa-learn --sync is run every couple of hours):

bayes_expiry_max_db_size 300000
bayes_auto_expire 0

Two questions:

1. Can this be due to corruption of bayes DB files?

2. Is there some kind of threshold that we may have reached?

Thanks in advance.

Regards,

Juliano Simões
Gerente de Tecnologia
Axios Tecnologia e Serviços
http://www.axios.com.br
juliano@axios.com.br
+55 41 324-1993