Spamassassin doing 20% of Job

[Steve Downes <st...@kingswayelec.co.uk>]

Hi All,

I'm using spamassassin v 3.03 perl 5.8.4 as supplied with Debian
stable in conjuction with a postfix-procmail-dovecot setup.

It is picking up about 20% of receives spam & the general setup
(procmail etc) appears to be OK. I am getting error messages in syslog
of which the example below is typical. I have looked at the locations
given in the error messages & I'm afraid they are beyond my simple
brain. Can anybody give me any pointers please?

Steve

----------------------------------

Jul  5 09:10:08 server1 spamd[4888]: connection from localhost.localdomain [127.0.0.1] at port 44441 
Jul  5 09:10:08 server1 spamd[4888]: info: setuid to steve succeeded 
Jul  5 09:10:08 server1 spamd[4888]: processing message <20...@web60224.mail.yahoo.com> aka <8H...@murphy> for steve:1000. 
Jul  5 09:10:08 server1 spamd[4888]: Use of uninitialized value in hash element at /usr/share/perl5/Mail/SpamAssassin/Message/Metadata/Received.pm line 321, <GEN136> line 242. 
Jul  5 09:10:08 server1 spamd[4888]: Use of uninitialized value in hash element at /usr/share/perl5/Mail/SpamAssassin/Message/Metadata/Received.pm line 322, <GEN136> line 242. 
Jul  5 09:10:08 server1 spamd[4888]: Use of uninitialized value in hash element at /usr/share/perl5/Mail/SpamAssassin/Message/Metadata/Received.pm line 321, <GEN136> line 242. 
Jul  5 09:10:08 server1 spamd[4888]: Use of uninitialized value in hash element at /usr/share/perl5/Mail/SpamAssassin/Message/Metadata/Received.pm line 322, <GEN136> line 242. 
Jul  5 09:10:08 server1 spamd[4888]: Use of uninitialized value in pattern match (m//) at /usr/share/perl5/Mail/SpamAssassin/Message/Metadata/Received.pm line 210, <GEN136> line 242. 
Jul  5 09:10:08 server1 spamd[4888]: Use of uninitialized value in pattern match (m//) at /usr/share/perl5/Mail/SpamAssassin/Message/Metadata/Received.pm line 212, <GEN136> line 242. 
Jul  5 09:10:08 server1 spamd[4888]: Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Mail/SpamAssassin/Message/Metadata/Received.pm line 213, <GEN136> line 242. 
Jul  5 09:10:08 server1 spamd[4888]: Failed to run DNS_FROM_AHBL_RHSBL RBL SpamAssassin test, skipping:__(Can't call method "bgsend" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 112, <GEN136> line 242._) 
Jul  5 09:10:08 server1 spamd[4888]: Failed to run NO_DNS_FOR_FROM RBL SpamAssassin test, skipping:__(Can't call method "bgsend" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 141, <GEN136> line 242._) 
Jul  5 09:10:08 server1 spamd[4888]: Failed to run __RFC_IGNORANT_ENVFROM RBL SpamAssassin test, skipping:__(Can't call method "bgsend" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 112, <GEN136> line 242._) 
Jul  5 09:10:08 server1 postfix/smtpd[1579]: disconnect from localhost.localdomain[127.0.0.1]
Jul  5 09:10:08 server1 spamd[4888]: clean message (0.0/4.0) for steve:1000 in 0.2 seconds, 9984 bytes. 
Jul  5 09:10:08 server1 spamd[4888]: result: .  0 - AWL scantime=0.2,size=9984,mid=<20...@murphy>,autolearn=failed 
Jul  5 09:10:08 server1 postfix/local[1583]: 9FBAC2B9F7: to=<st...@localhost>, relay=local, delay=0, status=sent (delivered to command: procmail -a "$EXTENSION")

----------------------------------------

Re: Spamassassin doing 20% of Job

[Bob Proulx <bo...@proulx.com>]

Steve Downes wrote:
> I'm using spamassassin v 3.03 perl 5.8.4 as supplied with Debian
> stable in conjuction with a postfix-procmail-dovecot setup.

I am also using spamassassin-3.0.3 stock from Debian Sarge.

> It is picking up about 20% of receives spam & the general setup
> (procmail etc) appears to be OK.

Wow.  It is doing much better than that here.  But I have the Bayes
engine running and with training it will adapt to new spam fairly
well.  The stock bayes scores are a little weak / concervative though.
I personally up the BAYES_95 and BAYES_99 scores to 4.5 and 5.0 to
give them some teeth.  That is probably why it is working so much
better for me.

> I am getting error messages in syslog of which the example below is
> typical. I have looked at the locations given in the error messages
> & I'm afraid they are beyond my simple brain. Can anybody give me
> any pointers please?

I am not seeing the errors on my machine that you are seeing.  The
"Use of uninitialized value" in this case looks like DNS data is not
being looked up correctly.  You might want to double check your DNS
capability.  Spamassassin uses the Net::DNS library.  You might want
to check the integrity of that package installation.

  sudo apt-get install debsums
  debsums -a -c libnet-dns-perl

The other errors appear to be related and are probably cascade
failures.

You say things are working though.  Hmm...  Not sure I would want to
do something too drastic in that case.  If you are getting results
then I would probably just keep going.

As far as upgrading to the current spamassassin goes, check out
http://www.backports.org/ for offical backports for Debian.  You can
get SpamAssassin 3.1.3 from there with a minimum of other upgrades.
See the instructions here on how to set that up.

  http://www.backports.org/instructions.html

Personally I follow the instructions listed there which say: "Another
way is to skip the second entry in /etc/apt/preferences and use
apt-get -t sarge-backports install spamasssin which is easier when the
package requires additional backports."  That works best for me.  The
SA upgrade also requires upgrades to libio-zlib-perl,
libio-string-perl, libarchive-tar-perl, and libsocket6-perl.

Do make sure you set up your preferences file for default "pinning"
deactivating things in general.  Otherwise you will destabilize your
system by installing everything.  You probably don't want that.  And
if you do then you probably want "unstable" instead of stable
backports.  :-)

After setting this up and installing a version other than one from
"stable" from there on out any upgrades that become available on
www.backports.org will be offered to you during an "upgrade" because
of the described pinning configuration.  That is generally what you
want.  If 3.1.4 appears there an apt-get upgrade will offer it.

Bob