You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "help@nantucket.net" <he...@nantucket.net> on 2004/10/08 18:55:28 UTC
SA logging
Hey all:
running SA 2.6 on Linux with Sendmail.
Im sure SA should be logging something to somewhere, probably maillog right?
Well I dont have anything in the maillog from SA. Am I missing something?
Anyone help me debug why it's not logging?
Re: SA logging
Posted by Jim Maul <jm...@elih.org>.
help@nantucket.net wrote:
> Thank you, appeared to work great, logging to maillog and all, the problem
> now becomes where it's putting spam.
>
> previously my procmailrc looked like this:
>
> :0fw
> | /usr/bin/spamassassin
> :0
> * ^X-Spam-Status: Yes
> $HOME/spam
>
> which routed spam to the users spam folder
>
> when i change it to:
> :0fw
> * < 256000
> | /usr/bin/spamc
>
> it doesnt do that anymore. Is there a way to route it back to the
> /user/spam?
>
>
I never used procmail but i would assume you should have left everything
the same except change /usr/bin/spamassassin to /usr/bin/spamc
-Jim
Re: SA logging
Posted by "help@nantucket.net" <he...@nantucket.net>.
Thanks guys, problem was i commented out the old stuff:
#:0fw
#| /usr/bin/spamassasin
#:0
when i needed to leave the second :0 uncommented....d'oh!
thanks again
> From: Morris Jones <mo...@whiteoaks.com>
> Date: Fri, 8 Oct 2004 13:19:01 -0700 (PDT)
> To: "help@nantucket.net" <he...@nantucket.net>
> Cc: Matt Kettler <mk...@evi-inc.com>, <us...@spamassassin.apache.org>
> Subject: Re: SA logging
>
> You have two separate things happening in two recipes:
>
> The first recipe:
>
>> :0fw
>> | /usr/bin/spamassassin
>
> Adds the X-SpamStatus: header to the email. The second recipe:
>
>> :0
>> * ^X-Spam-Status: Yes
>> $HOME/spam
>
> Delivers email with the specified header to $HOME/spam.
>
> The problem I was addressing was in the first recipe. Instead of
> what you have, it should be:
>
> :0fw
> * < 256000
> | /usr/bin/spamc
>
> Note that there are two differences between my version and yours:
>
> 1. The line "* < 256000" only feeds email under 256,000 bytes to
> Spamassassin.
> 2. The third line, using /usr/bin/spamc instead of
> /usr/bin/spamassassin, makes use of the spamd daemon instead
> of individual instances of spamassassin.
>
> I only gave you the change required for the first recipe. You still
> have to deliver the spam to the right place, which means that the
> full procmailrc entry needs to be:
>
> ----------------------- cut here ------------------------------
> # Pass the message through the spamassassin daemon and mark up
> # for spam status
>
> :0fw
> * < 256000
> | /usr/bin/spamc
>
> # Deliver spam marked email into user's spam folder
>
> :0
> * ^X-Spam-Status: Yes
> $HOME/spam
>
> ----------------------- cut here ------------------------------
>
> The additional blank lines and comments add some clarity.
>
> Best regards,
> Mojo
>
> On Fri, 8 Oct 2004, help@nantucket.net wrote:
>
>> Thank you, appeared to work great, logging to maillog and all, the problem
>> now becomes where it's putting spam.
>>
>> previously my procmailrc looked like this:
>>
>> :0fw
>> | /usr/bin/spamassassin
>> :0
>> * ^X-Spam-Status: Yes
>> $HOME/spam
>>
>> which routed spam to the users spam folder
>>
>> when i change it to:
>> :0fw
>> * < 256000
>> | /usr/bin/spamc
>>
>> it doesnt do that anymore. Is there a way to route it back to the
>> /user/spam?
>>
>>
>>
>>> From: Morris Jones <mo...@whiteoaks.com>
>>> Date: Fri, 8 Oct 2004 12:25:15 -0700 (PDT)
>>> To: "help@nantucket.net" <he...@nantucket.net>
>>> Cc: Matt Kettler <mk...@evi-inc.com>, <us...@spamassassin.apache.org>
>>> Subject: Re: SA logging
>>>
>>> His information is all correct.
>>>
>>> Change your procmailrc lines so they're something like this:
>>>
>>> # Pass through spamassassin
>>> :0fw
>>> * < 256000
>>> | /usr/bin/spamc
>>>
>>> Mojo
>>>
>>> On Fri, 8 Oct 2004, help@nantucket.net wrote:
>>>
>>>> Thank you Matt!
>>>>
>>>> You're info is great, but I'm sure you dont mind if I take your disclaimer
>>>> seriously.
>>>>
>>>> Before I go on, anyone that uses spamd confirm this info...?
>>>>
>>>>
>>>>> From: Matt Kettler <mk...@evi-inc.com>
>>>>> Date: Fri, 08 Oct 2004 13:48:40 -0400
>>>>> To: "help@nantucket.net" <he...@nantucket.net>,
>>>>> <us...@spamassassin.apache.org>
>>>>> Subject: Re: SA logging
>>>>>
>>>>> At 01:16 PM 10/8/2004, help@nantucket.net wrote:
>>>>>> Yea, ive been asked this before. I inherited this setup, so Im trying to
>>>>>> work that out.
>>>>>>
>>>>>> i can restart SA by using rc.d/init.d/spamassassin
>>>>>>
>>>>>> it shows in ps aux as /usr/bin/spamd -d -c -a
>>>>>>
>>>>>> and when mail comes in it shows as
>>>>>> /usr/bin/perl -T -w /usr/bin/spamassassin
>>>>>>
>>>>>>
>>>>>> is that helpful?
>>>>>
>>>>> Yes, I dug back in your old emails. You're calling spamassassin (plain)
>>>>> from procmail. Although you are starting spamd, you're not using spamc, so
>>>>> that's a complete waste at the moment.
>>>>>
>>>>> Suggestion:
>>>>>
>>>>> modify rc.d/init.d/spamassassin to add a -m parameter to spamd to limit
>>>>> the
>>>>> number of children it can spawn. Probably -m 5 to start, but you can
>>>>> estimate the correct value by looking at how big spamd is, and how much
>>>>> free ram you have using top or ps. Don't let spamd spawn more than will
>>>>> fit
>>>>> in free ram or it will end up choking your server to death.
>>>>>
>>>>> If your existing call to spamassassin in procmailrc doesn't use the -a
>>>>> parameter, remove the -a from spamd to match (-a enables the
>>>>> auto-whitelist
>>>>> score-averaging system in 2.6x)
>>>>>
>>>>> modify your procmailrc to use spamc instead of spamassassin. It's much
>>>>> faster, has lower CPU overhead, and you'll end up with logging in syslog
>>>>> as
>>>>> spamd processes them.
>>>>>
>>>>> Disclaimer: I don't actually use spamd so I'm no expert at it, I use
>>>>> MailScanner which calls the API directly. You might wish to solicit advice
>>>>> on the list about converting to using spamd.
>>>>>
>>>>>
>>>>>
>>>>
>>>
>>> --
>>> Morris Jones <*>
>>> Monrovia, CA
>>> mojo@whiteoaks.com
>>> http://www.whiteoaks.com
>>>
>>
>
> --
> Morris Jones <*>
> Monrovia, CA
> mojo@whiteoaks.com
> http://www.whiteoaks.com
>
Re: SA logging
Posted by Morris Jones <mo...@whiteoaks.com>.
You have two separate things happening in two recipes:
The first recipe:
> :0fw
> | /usr/bin/spamassassin
Adds the X-SpamStatus: header to the email. The second recipe:
> :0
> * ^X-Spam-Status: Yes
> $HOME/spam
Delivers email with the specified header to $HOME/spam.
The problem I was addressing was in the first recipe. Instead of
what you have, it should be:
:0fw
* < 256000
| /usr/bin/spamc
Note that there are two differences between my version and yours:
1. The line "* < 256000" only feeds email under 256,000 bytes to
Spamassassin.
2. The third line, using /usr/bin/spamc instead of
/usr/bin/spamassassin, makes use of the spamd daemon instead
of individual instances of spamassassin.
I only gave you the change required for the first recipe. You still
have to deliver the spam to the right place, which means that the
full procmailrc entry needs to be:
----------------------- cut here ------------------------------
# Pass the message through the spamassassin daemon and mark up
# for spam status
:0fw
* < 256000
| /usr/bin/spamc
# Deliver spam marked email into user's spam folder
:0
* ^X-Spam-Status: Yes
$HOME/spam
----------------------- cut here ------------------------------
The additional blank lines and comments add some clarity.
Best regards,
Mojo
On Fri, 8 Oct 2004, help@nantucket.net wrote:
> Thank you, appeared to work great, logging to maillog and all, the problem
> now becomes where it's putting spam.
>
> previously my procmailrc looked like this:
>
> :0fw
> | /usr/bin/spamassassin
> :0
> * ^X-Spam-Status: Yes
> $HOME/spam
>
> which routed spam to the users spam folder
>
> when i change it to:
> :0fw
> * < 256000
> | /usr/bin/spamc
>
> it doesnt do that anymore. Is there a way to route it back to the
> /user/spam?
>
>
>
> > From: Morris Jones <mo...@whiteoaks.com>
> > Date: Fri, 8 Oct 2004 12:25:15 -0700 (PDT)
> > To: "help@nantucket.net" <he...@nantucket.net>
> > Cc: Matt Kettler <mk...@evi-inc.com>, <us...@spamassassin.apache.org>
> > Subject: Re: SA logging
> >
> > His information is all correct.
> >
> > Change your procmailrc lines so they're something like this:
> >
> > # Pass through spamassassin
> > :0fw
> > * < 256000
> > | /usr/bin/spamc
> >
> > Mojo
> >
> > On Fri, 8 Oct 2004, help@nantucket.net wrote:
> >
> >> Thank you Matt!
> >>
> >> You're info is great, but I'm sure you dont mind if I take your disclaimer
> >> seriously.
> >>
> >> Before I go on, anyone that uses spamd confirm this info...?
> >>
> >>
> >>> From: Matt Kettler <mk...@evi-inc.com>
> >>> Date: Fri, 08 Oct 2004 13:48:40 -0400
> >>> To: "help@nantucket.net" <he...@nantucket.net>,
> >>> <us...@spamassassin.apache.org>
> >>> Subject: Re: SA logging
> >>>
> >>> At 01:16 PM 10/8/2004, help@nantucket.net wrote:
> >>>> Yea, ive been asked this before. I inherited this setup, so Im trying to
> >>>> work that out.
> >>>>
> >>>> i can restart SA by using rc.d/init.d/spamassassin
> >>>>
> >>>> it shows in ps aux as /usr/bin/spamd -d -c -a
> >>>>
> >>>> and when mail comes in it shows as
> >>>> /usr/bin/perl -T -w /usr/bin/spamassassin
> >>>>
> >>>>
> >>>> is that helpful?
> >>>
> >>> Yes, I dug back in your old emails. You're calling spamassassin (plain)
> >>> from procmail. Although you are starting spamd, you're not using spamc, so
> >>> that's a complete waste at the moment.
> >>>
> >>> Suggestion:
> >>>
> >>> modify rc.d/init.d/spamassassin to add a -m parameter to spamd to limit the
> >>> number of children it can spawn. Probably -m 5 to start, but you can
> >>> estimate the correct value by looking at how big spamd is, and how much
> >>> free ram you have using top or ps. Don't let spamd spawn more than will fit
> >>> in free ram or it will end up choking your server to death.
> >>>
> >>> If your existing call to spamassassin in procmailrc doesn't use the -a
> >>> parameter, remove the -a from spamd to match (-a enables the auto-whitelist
> >>> score-averaging system in 2.6x)
> >>>
> >>> modify your procmailrc to use spamc instead of spamassassin. It's much
> >>> faster, has lower CPU overhead, and you'll end up with logging in syslog as
> >>> spamd processes them.
> >>>
> >>> Disclaimer: I don't actually use spamd so I'm no expert at it, I use
> >>> MailScanner which calls the API directly. You might wish to solicit advice
> >>> on the list about converting to using spamd.
> >>>
> >>>
> >>>
> >>
> >
> > --
> > Morris Jones <*>
> > Monrovia, CA
> > mojo@whiteoaks.com
> > http://www.whiteoaks.com
> >
>
--
Morris Jones <*>
Monrovia, CA
mojo@whiteoaks.com
http://www.whiteoaks.com
Re: SA logging
Posted by "help@nantucket.net" <he...@nantucket.net>.
Thank you, appeared to work great, logging to maillog and all, the problem
now becomes where it's putting spam.
previously my procmailrc looked like this:
:0fw
| /usr/bin/spamassassin
:0
* ^X-Spam-Status: Yes
$HOME/spam
which routed spam to the users spam folder
when i change it to:
:0fw
* < 256000
| /usr/bin/spamc
it doesnt do that anymore. Is there a way to route it back to the
/user/spam?
> From: Morris Jones <mo...@whiteoaks.com>
> Date: Fri, 8 Oct 2004 12:25:15 -0700 (PDT)
> To: "help@nantucket.net" <he...@nantucket.net>
> Cc: Matt Kettler <mk...@evi-inc.com>, <us...@spamassassin.apache.org>
> Subject: Re: SA logging
>
> His information is all correct.
>
> Change your procmailrc lines so they're something like this:
>
> # Pass through spamassassin
> :0fw
> * < 256000
> | /usr/bin/spamc
>
> Mojo
>
> On Fri, 8 Oct 2004, help@nantucket.net wrote:
>
>> Thank you Matt!
>>
>> You're info is great, but I'm sure you dont mind if I take your disclaimer
>> seriously.
>>
>> Before I go on, anyone that uses spamd confirm this info...?
>>
>>
>>> From: Matt Kettler <mk...@evi-inc.com>
>>> Date: Fri, 08 Oct 2004 13:48:40 -0400
>>> To: "help@nantucket.net" <he...@nantucket.net>,
>>> <us...@spamassassin.apache.org>
>>> Subject: Re: SA logging
>>>
>>> At 01:16 PM 10/8/2004, help@nantucket.net wrote:
>>>> Yea, ive been asked this before. I inherited this setup, so Im trying to
>>>> work that out.
>>>>
>>>> i can restart SA by using rc.d/init.d/spamassassin
>>>>
>>>> it shows in ps aux as /usr/bin/spamd -d -c -a
>>>>
>>>> and when mail comes in it shows as
>>>> /usr/bin/perl -T -w /usr/bin/spamassassin
>>>>
>>>>
>>>> is that helpful?
>>>
>>> Yes, I dug back in your old emails. You're calling spamassassin (plain)
>>> from procmail. Although you are starting spamd, you're not using spamc, so
>>> that's a complete waste at the moment.
>>>
>>> Suggestion:
>>>
>>> modify rc.d/init.d/spamassassin to add a -m parameter to spamd to limit the
>>> number of children it can spawn. Probably -m 5 to start, but you can
>>> estimate the correct value by looking at how big spamd is, and how much
>>> free ram you have using top or ps. Don't let spamd spawn more than will fit
>>> in free ram or it will end up choking your server to death.
>>>
>>> If your existing call to spamassassin in procmailrc doesn't use the -a
>>> parameter, remove the -a from spamd to match (-a enables the auto-whitelist
>>> score-averaging system in 2.6x)
>>>
>>> modify your procmailrc to use spamc instead of spamassassin. It's much
>>> faster, has lower CPU overhead, and you'll end up with logging in syslog as
>>> spamd processes them.
>>>
>>> Disclaimer: I don't actually use spamd so I'm no expert at it, I use
>>> MailScanner which calls the API directly. You might wish to solicit advice
>>> on the list about converting to using spamd.
>>>
>>>
>>>
>>
>
> --
> Morris Jones <*>
> Monrovia, CA
> mojo@whiteoaks.com
> http://www.whiteoaks.com
>
Re: SA logging
Posted by Morris Jones <mo...@whiteoaks.com>.
His information is all correct.
Change your procmailrc lines so they're something like this:
# Pass through spamassassin
:0fw
* < 256000
| /usr/bin/spamc
Mojo
On Fri, 8 Oct 2004, help@nantucket.net wrote:
> Thank you Matt!
>
> You're info is great, but I'm sure you dont mind if I take your disclaimer
> seriously.
>
> Before I go on, anyone that uses spamd confirm this info...?
>
>
> > From: Matt Kettler <mk...@evi-inc.com>
> > Date: Fri, 08 Oct 2004 13:48:40 -0400
> > To: "help@nantucket.net" <he...@nantucket.net>, <us...@spamassassin.apache.org>
> > Subject: Re: SA logging
> >
> > At 01:16 PM 10/8/2004, help@nantucket.net wrote:
> >> Yea, ive been asked this before. I inherited this setup, so Im trying to
> >> work that out.
> >>
> >> i can restart SA by using rc.d/init.d/spamassassin
> >>
> >> it shows in ps aux as /usr/bin/spamd -d -c -a
> >>
> >> and when mail comes in it shows as
> >> /usr/bin/perl -T -w /usr/bin/spamassassin
> >>
> >>
> >> is that helpful?
> >
> > Yes, I dug back in your old emails. You're calling spamassassin (plain)
> > from procmail. Although you are starting spamd, you're not using spamc, so
> > that's a complete waste at the moment.
> >
> > Suggestion:
> >
> > modify rc.d/init.d/spamassassin to add a -m parameter to spamd to limit the
> > number of children it can spawn. Probably -m 5 to start, but you can
> > estimate the correct value by looking at how big spamd is, and how much
> > free ram you have using top or ps. Don't let spamd spawn more than will fit
> > in free ram or it will end up choking your server to death.
> >
> > If your existing call to spamassassin in procmailrc doesn't use the -a
> > parameter, remove the -a from spamd to match (-a enables the auto-whitelist
> > score-averaging system in 2.6x)
> >
> > modify your procmailrc to use spamc instead of spamassassin. It's much
> > faster, has lower CPU overhead, and you'll end up with logging in syslog as
> > spamd processes them.
> >
> > Disclaimer: I don't actually use spamd so I'm no expert at it, I use
> > MailScanner which calls the API directly. You might wish to solicit advice
> > on the list about converting to using spamd.
> >
> >
> >
>
--
Morris Jones <*>
Monrovia, CA
mojo@whiteoaks.com
http://www.whiteoaks.com
Re: SA logging
Posted by "help@nantucket.net" <he...@nantucket.net>.
Thank you Matt!
You're info is great, but I'm sure you dont mind if I take your disclaimer
seriously.
Before I go on, anyone that uses spamd confirm this info...?
> From: Matt Kettler <mk...@evi-inc.com>
> Date: Fri, 08 Oct 2004 13:48:40 -0400
> To: "help@nantucket.net" <he...@nantucket.net>, <us...@spamassassin.apache.org>
> Subject: Re: SA logging
>
> At 01:16 PM 10/8/2004, help@nantucket.net wrote:
>> Yea, ive been asked this before. I inherited this setup, so Im trying to
>> work that out.
>>
>> i can restart SA by using rc.d/init.d/spamassassin
>>
>> it shows in ps aux as /usr/bin/spamd -d -c -a
>>
>> and when mail comes in it shows as
>> /usr/bin/perl -T -w /usr/bin/spamassassin
>>
>>
>> is that helpful?
>
> Yes, I dug back in your old emails. You're calling spamassassin (plain)
> from procmail. Although you are starting spamd, you're not using spamc, so
> that's a complete waste at the moment.
>
> Suggestion:
>
> modify rc.d/init.d/spamassassin to add a -m parameter to spamd to limit the
> number of children it can spawn. Probably -m 5 to start, but you can
> estimate the correct value by looking at how big spamd is, and how much
> free ram you have using top or ps. Don't let spamd spawn more than will fit
> in free ram or it will end up choking your server to death.
>
> If your existing call to spamassassin in procmailrc doesn't use the -a
> parameter, remove the -a from spamd to match (-a enables the auto-whitelist
> score-averaging system in 2.6x)
>
> modify your procmailrc to use spamc instead of spamassassin. It's much
> faster, has lower CPU overhead, and you'll end up with logging in syslog as
> spamd processes them.
>
> Disclaimer: I don't actually use spamd so I'm no expert at it, I use
> MailScanner which calls the API directly. You might wish to solicit advice
> on the list about converting to using spamd.
>
>
>
Re: SA logging
Posted by Matt Kettler <mk...@evi-inc.com>.
At 01:16 PM 10/8/2004, help@nantucket.net wrote:
>Yea, ive been asked this before. I inherited this setup, so Im trying to
>work that out.
>
>i can restart SA by using rc.d/init.d/spamassassin
>
>it shows in ps aux as /usr/bin/spamd -d -c -a
>
>and when mail comes in it shows as
>/usr/bin/perl -T -w /usr/bin/spamassassin
>
>
>is that helpful?
Yes, I dug back in your old emails. You're calling spamassassin (plain)
from procmail. Although you are starting spamd, you're not using spamc, so
that's a complete waste at the moment.
Suggestion:
modify rc.d/init.d/spamassassin to add a -m parameter to spamd to limit the
number of children it can spawn. Probably -m 5 to start, but you can
estimate the correct value by looking at how big spamd is, and how much
free ram you have using top or ps. Don't let spamd spawn more than will fit
in free ram or it will end up choking your server to death.
If your existing call to spamassassin in procmailrc doesn't use the -a
parameter, remove the -a from spamd to match (-a enables the auto-whitelist
score-averaging system in 2.6x)
modify your procmailrc to use spamc instead of spamassassin. It's much
faster, has lower CPU overhead, and you'll end up with logging in syslog as
spamd processes them.
Disclaimer: I don't actually use spamd so I'm no expert at it, I use
MailScanner which calls the API directly. You might wish to solicit advice
on the list about converting to using spamd.
Re: SA logging
Posted by "help@nantucket.net" <he...@nantucket.net>.
Yea, ive been asked this before. I inherited this setup, so Im trying to
work that out.
i can restart SA by using rc.d/init.d/spamassassin
it shows in ps aux as /usr/bin/spamd -d -c -a
and when mail comes in it shows as
/usr/bin/perl -T -w /usr/bin/spamassassin
is that helpful?
> From: Matt Kettler <mk...@evi-inc.com>
> Date: Fri, 08 Oct 2004 13:03:59 -0400
> To: "help@nantucket.net" <he...@nantucket.net>, <us...@spamassassin.apache.org>
> Subject: Re: SA logging
>
> At 12:55 PM 10/8/2004, help@nantucket.net wrote:
>> Im sure SA should be logging something to somewhere, probably maillog right?
>> Well I dont have anything in the maillog from SA. Am I missing something?
>> Anyone help me debug why it's not logging?
>
> How are you calling SA?
>
> If you're using spamc/spamd then spamd will generate syslog messages.
>
> If you're using a call to the plain spamassassin command line, it won't log.
>
> Most integration tools (mailscanner, amavis, etc) do their own logging.
>
Re: SA logging
Posted by Matt Kettler <mk...@evi-inc.com>.
At 12:55 PM 10/8/2004, help@nantucket.net wrote:
>Im sure SA should be logging something to somewhere, probably maillog right?
>Well I dont have anything in the maillog from SA. Am I missing something?
>Anyone help me debug why it's not logging?
How are you calling SA?
If you're using spamc/spamd then spamd will generate syslog messages.
If you're using a call to the plain spamassassin command line, it won't log.
Most integration tools (mailscanner, amavis, etc) do their own logging.