Strange mail causing 2.64 to not scan or scan really long?

[Matt <mh...@gmail.com>]

Normally spamassassin works great.. but this one e-mail seems to cause
it to take forever (600 seconds?) and then get passed through with a
score of (?/?) <-- I assume that is because something timedout and
passed it along?
What's going on?



Return-Path: <Du...@obscured.com>
Delivered-To: mhoppes@obscured.com
Received: (qmail 19286 invoked by uid 509); 15 Oct 2004 19:10:50 -0000
Received: from 216.141.109.4 by smtp4-ha.obscured.com (envelope-from
<Du...@obscured.com>, uid 503) with qmail-scanner-1.23
 (clamdscan: 0.75.1. spamassassin: 2.64.  
 Clear:RC:0(216.141.109.4):SA:0(?/?):. 
 Processed in 600.185242 secs); 15 Oct 2004 19:10:50 -0000
X-Spam-Status: No, hits=? required=?
Received: from translation.obscured.com (HELO fw1-ap06.obscured.com)
([216.141.109.4])
          (envelope-sender <Du...@obscured.com>)
          by 0 (qmail-ldap-1.03) with SMTP
          for <mh...@obscured.com>; 15 Oct 2004 19:00:49 -0000
Received: From fw1-ex04.obscured.com ([172.16.5.55]) by
fw1-ap06.obscured.com (WebShield SMTP v4.5 MR1a);
	id 1097864980463; Fri, 15 Oct 2004 13:29:40 -0500
Received: from fw1-ex04.obscured.com ([172.16.5.148]) by
fw1-ex04.obscured.com with Microsoft SMTPSVC(6.0.3790.0); Fri, 15 Oct
2004 13:29:25 -0500
Received: from ra1-ad01.obscured.com ([192.168.9.250]) by
fw1-ex04.obscured.com with Microsoft SMTPSVC(6.0.3790.0); Fri, 15 Oct
2004 13:29:24 -0500
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.132
Content-Class: urn:content-classes:message
Subject: RE: Problem with Mail?
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Fri, 15 Oct 2004 14:29:23 -0400
Message-ID: <B5...@ra1-ad01.obscured.com>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: Problem with Mail?
thread-index: AcSvpdPjK6iINjJWQQWdVehj1wUvDgDPs2Nw
Importance: normal
Priority: normal
From: "Durman, Michael R." <Du...@obscured.com>
To: "Matt" <mh...@obscured.com>
Return-Path: <Du...@obscured.com>
X-OriginalArrivalTime: 15 Oct 2004 18:29:24.0919 (UTC)
FILETIME=[E5B29470:01C4B2E4]

Yes,

Apparently, the problem still exists.  Our IT guy says that they see an
email only being sent once.  He said once it leaves our WebShield
server, he doesn't know or have control of what happens beyond that. =20

I haven't had any issues of multiple emails from anybody else that I
email either internal or external.

Our IT guy is on vacation this week, but will contact you if needed next
week.=20

-----Original Message-----
From: Matt [mailto:mhoppes@obscured.domain.com]=20
Sent: Monday, October 11, 2004 11:20 AM
To: Durman, Michael R.
Subject: Problem with Mail?

Michael,
I was told your mail server is having problems communicating with ours?=20
   Can I assist you in some way?  I am the mail server administrator.=20
Feel free to call me or e-mail me.  I will be out from 12 until 1pm EDT
for lunch.
--=20

Re: Strange mail causing 2.64 to not scan or scan really long?

[Michael Barnes <mb...@compsci.wm.edu>]

On Fri, Oct 15, 2004 at 04:51:29PM -0400, Matt wrote:
> Normally spamassassin works great.. but this one e-mail seems to cause
> it to take forever (600 seconds?) and then get passed through with a
> score of (?/?) <-- I assume that is because something timedout and
> passed it along?
> What's going on?

Are you using bayes?  If so, it might be the bug that I believe still
exists in 3.0 where the bayes tokens are due to expire and SA goes into
an infinite loop until it hits the 600 default timeout and just fails,
or maybe its looping in the bayesdb and it never finishes, either way
its not desired behavior.

I've mailed about this before and got no response.  If you run
spamassassin -D you should see some warning message like aiee,
bayes_atime not right or something to that affect.

What I did to get around this problem was to put a cron job to force
expire the bayes tokens twice a month, and the problem went away.

The cron job command was simply:

sa-learn --force-expire

Mike

-- 
/-----------------------------------------\
| Michael Barnes <mb...@compsci.wm.edu> |
| UNIX Systems Administrator              |
| College of William and Mary             |
| Phone: (757) 879-3930                   |
\-----------------------------------------/

Re: Strange mail causing 2.64 to not scan or scan really long?

[Loren Wilton <lw...@earthlink.net>]

> What's odd is it DOES take 600 seconds every time it's sent.. what's

> I am using
> bayes, so I will check on that when I get into the office on Monday..
> could be that bug...

If it happens every time on THIS mail, it probably isn't the bayes problem.
That tends to hit randomly.

The resend once an hour could be because you are timing out and failing to
process the message, so he sees a send failure and tries again in an hour.

This sounds like a broken rule.  You should probably post the message
someplace where others can try and see if they hit the same thing.  Would
also help if you list the rules files you are using.  If you munge the mail
before posting it someplace, do check to see if running the munged mail
through SA still gets the 600 second timeout problem.

Of course, it could be a local rule of yours that is causing the problem,
assuming you have any.

        Loren

Re: Strange mail causing 2.64 to not scan or scan really long?

[Matt <mh...@gmail.com>]

What's odd is it DOES take 600 seconds every time it's sent.. what's
additionally wierd is this person's mail server keeps sending the
message over and over.. once an hour... (we're working on that with
him).  He's the only one in the millions of emails we handle every day
that is having this issue.. some WebShield and Exchange (anyone else
ever heard of this problem)?  But yeah, it is every time.  I am using
bayes, so I will check on that when I get into the office on Monday..
could be that bug... not a huge deal really, unless alot of e-mails
are able to cause this to happen, then it could potentially lag the
mail server I would think.


On Sat, 16 Oct 2004 01:43:30 -0700, Loren Wilton <lw...@earthlink.net> wrote:
> > Normally spamassassin works great.. but this one e-mail seems to cause
> > it to take forever (600 seconds?) and then get passed through with a
> > score of (?/?) <-- I assume that is because something timedout and
> 
> It isn't claer to me if you included the whole email or just the headers.
> In any case it would be better as an attachment if anyone wanted to test it,
> since the formatting wouldn't get messed up by line wrapping and the like.
> 
> This sounds like you have a rule (possibly several) that aren't as well
> written as they should be, and are triggering a pathelogical case from the
> text of that message.  They could be your local rules, SARE rules (this
> happened once already with a SARE rule some months ago), or possibly
> (although rather unlikely) even a standard release SA rule.
> 
> All of the above is assuming that this one mail message really does take 600
> seconds every time you try it, and not just that it happened to take 600
> seconds once.
> 
>         Loren
> 
>

Re: Strange mail causing 2.64 to not scan or scan really long?

[Loren Wilton <lw...@earthlink.net>]

> Normally spamassassin works great.. but this one e-mail seems to cause
> it to take forever (600 seconds?) and then get passed through with a
> score of (?/?) <-- I assume that is because something timedout and

It isn't claer to me if you included the whole email or just the headers.
In any case it would be better as an attachment if anyone wanted to test it,
since the formatting wouldn't get messed up by line wrapping and the like.

This sounds like you have a rule (possibly several) that aren't as well
written as they should be, and are triggering a pathelogical case from the
text of that message.  They could be your local rules, SARE rules (this
happened once already with a SARE rule some months ago), or possibly
(although rather unlikely) even a standard release SA rule.

All of the above is assuming that this one mail message really does take 600
seconds every time you try it, and not just that it happened to take 600
seconds once.

        Loren

Re: Strange mail causing 2.64 to not scan or scan really long?

[Matt Kettler <mk...@evi-inc.com>]

At 04:51 PM 10/15/2004, Matt wrote:
>Normally spamassassin works great.. but this one e-mail seems to cause
>it to take forever (600 seconds?) and then get passed through with a
>score of (?/?) <-- I assume that is because something timedout and
>passed it along?
>What's going on?

Have you tried turning on -D and running the mail through? the debug output 
might tell you where it's hanging.

As for the message you sent, I was able to run it through just fine, but 
you sent the thing as an inline-text instead of as an attachment, so it 
could have been "fixed" by my MUA, your MUA, or any mailserver between us. 
In the future, attach messages as files, don't inline them.

I also suspect that you may have fixed the problem by changing everything 
to "obscured.com", so it's probably better for you to test anyway.