Spamd skipping messages on respawn

["Paul R. Ganci" <pr...@mric.coop>]

I am running Spamassassin 3.0.2 on a RaQ 550 using spamd and calling 
spamc from procmail. I have found several instances now where the spamd 
child is respawned just as it is about to start processing a message. 
For example check these log entries:

Jun 15 09:11:05 citlatepetl sendmail[547]: j5FFB5s00547: 
from=<in...@theideabank.com>, size=14614, class=0, nrcpts=1, 
msgid=<03...@DBVZ3W61>, proto=ESMTP, 
daemon=MTA, relay=sta-208-139-195-125.rockynet.com [208.139.195.125]
Jun 15 09:11:05 citlatepetl MailScanner[22211]: New Batch: Forwarding 1 
unscanned messages, 15161 bytes
Jun 15 09:11:05 citlatepetl MailScanner[22211]: Unscanned: Delivered 1 
messages
Jun 15 09:11:05 citlatepetl MailScanner[22211]: Virus and Content 
Scanning: Starting
Jun 15 09:11:06 citlatepetl spamd[30311]: got connection over 
/home/spam-filter/tmp/spamd.sock
Jun 15 09:11:06 citlatepetl spamd[30311]: info: setuid to rlbieber succeeded
Jun 15 09:11:07 citlatepetl spamd[16315]: server hit by SIGCHLD
Jun 15 09:11:07 citlatepetl spamd[16315]: handled cleanup of child pid 30311
Jun 15 09:11:07 citlatepetl spamd[16315]: server successfully spawned 
child process, pid 555
Jun 15 09:11:07 citlatepetl sendmail[549]: j5FFB5s00547: 
to=<rl...@mail.sugarloaf.net>, delay=00:00:02, xdelay=00:00:01, 
mailer=local, pri=134614, dsn=2.0.0, stat=Sent

Note that spamd[30311] was about to process the message when it appears 
spamd[16315] came by, killed it, cleaned up after it and then started a 
new child. Thus spamassassin was never run on the message. Later I 
spoofed the address info@theideabank.com and sent a test message to the 
account in question. The second time everything nearly worked as expected:

Jun 15 19:54:41 citlatepetl sendmail[12465]: j5G1ses12465: 
from=<in...@theideabank.com>, size=1461, class=0, nrcpts=1, 
msgid=<42...@theideabank.com>, proto=ESMTP, daemon=MTA, 
relay=sta-208-139-195-125.rockynet.com [208.139.195.125]
Jun 15 19:54:41 citlatepetl MailScanner[31317]: New Batch: Forwarding 1 
unscanned messages, 1996 bytes
Jun 15 19:54:41 citlatepetl MailScanner[31317]: Unscanned: Delivered 1 
messages
Jun 15 19:54:41 citlatepetl MailScanner[31317]: Virus and Content 
Scanning: Starting
Jun 15 19:54:41 citlatepetl spamd[32349]: got connection over 
/home/spam-filter/tmp/spamd.sock
Jun 15 19:54:41 citlatepetl spamd[32349]: info: setuid to rlbieber succeeded
Jun 15 19:54:41 citlatepetl spamd[32349]: processing message 
<42...@theideabank.com> for rlbieber:540.
Jun 15 19:54:56 citlatepetl spamd[32349]: result: Y 97 - ALL_TRUSTED, 
BAYES_00, DOMAIN_RATIO, ONE_WORD_SUBJECT, SARE_FROM_SPAM_WORD3, 
USER_IN_BLACKLIST scantime=13.2, size=1949, 
mid=<42...@theideabank.com>, bayes=6.10622663543836e-16, 
autolearn=ham
Jun 15 19:54:54 citlatepetl sendmail[12469]: j5G1ses12465: 
to=<rl...@mail.sugarloaf.net>, delay=00:00:13, xdelay=00:00:13, 
mailer=local, pri=121461, dsn=2.0.0, stat=Sent

This time the message was processed, the user_prefs file was refered to 
and the message flagged with a score of 97 per the user's blacklist. 
However, I don't understand the autolearn as ham given the score of 97.

I did a search of the archives and didn't find anything really relevant. 
Is there a problem with 3.0.2 in regards to spamd dying just as it is 
about to process a message? And what's up with the autolearn=ham? Does 
the USER_IN_BLACKLIST not come into play with autolearn?

-- 
Paul (prganci@mric.coop)

Re: Spamd skipping messages on respawn

["Paul R. Ganci" <pr...@mric.coop>]

Paul R. Ganci wrote:

> I am running Spamassassin 3.0.2 on a RaQ 550 using spamd and calling 
> spamc from procmail. I have found several instances now where the 
> spamd child is respawned just as it is about to start processing a 
> message.

Can anybody give me even a wild guess on this one? Believe it or not I 
am getting some spurious spam in because of this problem.

> This time the message was processed, the user_prefs file was refered 
> to and the message flagged with a score of 97 per the user's 
> blacklist. However, I don't understand the autolearn as ham given the 
> score of 97.
>
> IAnd what's up with the autolearn=ham? Does the USER_IN_BLACKLIST not 
> come into play with autolearn?

This part I can answer myself ... RTFM!  From Mail_SpamAssassin_Conf.html:

Note that certain tests are ignored when determining whether a message 
should be trained upon:
    - rules with tflags set to 'learn' (the Bayesian rules)
    - rules with tflags set to 'userconf' (user white/black-listing 
rules, etc)
    - rules with tflags set to 'noautolearn'

-- 
Paul (prganci@mric.coop)