You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "@lbutlr" <kr...@kreme.com> on 2016/04/28 02:38:38 UTC
DCC doesn't seem to be doing anything
I have DCC setup and enabled in SpamAssasin, but the only thing I see logged in maillog each day is:
00:00:00 mail dccifd[7397]: 1.3.158 detected 0 spam, ignored for 0, rejected for 0, and discarded for 0 targets among 0 total messages for <n> targets
which appears every day at midnight.
It it matters, SA is being called by amavis.
--
"If you can't do something smart, do something right."
Re: DCC doesn't seem to be doing anything
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>> On 27.04.16 18:38, @lbutlr wrote:
>>> I have DCC setup and enabled in SpamAssasin, but the only thing I see logged in maillog each day is:
>>>
>>> 00:00:00 mail dccifd[7397]: 1.3.158 detected 0 spam, ignored for 0, rejected for 0, and discarded for 0 targets among 0 total messages for <n> targets
>> On Apr 28, 2016, at 2:34 AM, Matus UHLAR - fantomas <uh...@fantomas.sk> wrote:
>> do you see any DCC_CHECK in spam headers?
On 28.04.16 11:58, @lbutlr wrote:
>A few, but they always seem to be “1.1” and they occur in about a third of the messages in the Spam folder, but the daily report into maillog shows that 0 messages were detected.
>
>X-Spam-Status: Yes, score=11.33 tagged_above=2 required=6.2
> tests=[BAYES_40=-0.5, DCC_CHECK=1.1, FORGED_OUTLOOK_HTML=0.021,
> FORGED_OUTLOOK_TAGS=0.052, HTML_MESSAGE=0.001,
> HTML_MIME_NO_HTML_TAG=0.377, MIME_HEADER_CTYPE_ONLY=0.717,
> MIME_HTML_ONLY=0.723, RCVD_IN_BRBL_LASTEXT=1.449,
great, DCC is working for you!
>> do you have dcc_home set up in SA configuration?
>
>No, I have dcc_path set.
you use dccproc that does not use dccifd. That's why dccifd sees no mail...
>I guess it IS working though, since I see the log in /var/dcc/log is active.
>> If SA does not find dccifd socket, it uses dccproc interface.
>
>dcc 7396 0.0 0.1 11356 2236 - Is 7Apr16 0:00.00 /usr/local/dcc/libexec/dccifd -Idcc -tREP,20 -tCMN,5, -llog -wwhiteclnt -Uuserdirs -SHELO -Smail_host -SSender -SList-ID
>dcc 7397 0.0 0.1 24772 2872 - S 7Apr16 0:56.58 /usr/local/dcc/libexec/dccifd -Idcc -tREP,20 -tCMN,5, -llog -wwhiteclnt -Uuserdirs -SHELO -Smail_host -SSender -SList-ID
SOCKET is not the process. From the Mail::SpamAssassin::Plugin::DCC docs:
dcc_home STRING
This option tells SpamAssassin where to find the dcc homedir. If
not given, it will try to get dcc to specify one, and if that fails
it will try dcc's own default homedir of '/var/dcc'. If "dcc_path"
is not specified, it will default to looking in "dcc_home/bin" for
dcc client instead of relying on SpamAssassin to find it in the
current PATH. If it isn't found there, it will look in the current
PATH. If a "dccifd" socket is found in "dcc_home" or specified
explicitly, it will use that interface instead of "dccproc".
dcc_dccifd_path STRING
This option tells SpamAssassin where to find the dccifd socket. If
"dcc_dccifd_path" is not specified, it will default to looking for
a socket named "dccifd" in a directory "dcc_home". The
"dcc_dccifd_path" can be a Unix socket name (absolute path), or an
INET socket specification in a form "[host]:port" or "host:port",
where a host can be an IPv4 or IPv6 address or a host name, and
port is a TCP port number. In case of an IPv6 address the brackets
are required syntax. If a "dccifd" socket is found, the plugin will
use it instead of "dccproc".
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Spam = (S)tupid (P)eople's (A)dvertising (M)ethod
Re: DCC doesn't seem to be doing anything
Posted by Bowie Bailey <Bo...@BUC.com>.
On 4/29/2016 2:39 AM, @lbutlr wrote:
> On Apr 28, 2016, at 2:30 PM, RW <rw...@googlemail.com> wrote:
>> On Thu, 28 Apr 2016 11:58:47 -0600
>> @lbutlr wrote:
>>
>>
>>>> do you see any DCC_CHECK in spam headers?
>>> A few, but they always seem to be “1.1”
>> What were you expecting? Like almost all SA rules it has a fixed score.
> Since the daily log line specifies a number of blocked messages (always 0) I expected some variation in something. As it stands, the log line appears to be entirely useless.
Just a guess here, but since there are two ways of calling DCC, maybe SA
is using one method and the log entry is giving statistics for the other
method. This would seem to make sense since you see DCC_CHECK results
in the spam headers, but the log entry says 0 messages.
--
Bowie
Re: DCC doesn't seem to be doing anything
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>On Apr 29, 2016, at 1:12 PM, RW <rw...@googlemail.com> wrote:
>> I got the same, it only records the number scanned. I'm not sure what
>> the reason for the zeros is, possibly it's because dccifd isn't
>> working as a proxy.
On 29.04.16 17:59, @lbutlr wrote:
>Thanks. I’ll just ignore the log line.
you can simply stop running dccifd daemon. But I recommend configure it in
SA and run it. Not because of the logs, but I assume it's more effcient
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Spam is for losers who can't get business any other way.
Re: DCC doesn't seem to be doing anything
Posted by "@lbutlr" <kr...@kreme.com>.
On Apr 29, 2016, at 1:12 PM, RW <rw...@googlemail.com> wrote:
> I got the same, it only records the number scanned. I'm not sure what
> the reason for the zeros is, possibly it's because dccifd isn't
> working as a proxy.
Thanks. I’ll just ignore the log line.
--
"Alas, earwax."
Re: DCC doesn't seem to be doing anything
Posted by RW <rw...@googlemail.com>.
On Fri, 29 Apr 2016 00:39:29 -0600
@lbutlr wrote:
> On Apr 28, 2016, at 2:30 PM, RW <rw...@googlemail.com> wrote:
> > On Thu, 28 Apr 2016 11:58:47 -0600
> > @lbutlr wrote:
> >
> >
> >>> do you see any DCC_CHECK in spam headers?
> >>
> >> A few, but they always seem to be “1.1”
> >
> > What were you expecting? Like almost all SA rules it has a fixed
> > score.
>
> Since the daily log line specifies a number of blocked messages
> (always 0) I expected some variation in something. As it stands, the
> log line appears to be entirely useless.
I've never bothered with dccifd because I think it's unlikely that it
makes much difference whether you use dccifd or dccproc compared with
something as heavyweight as SA. But I turned it on and verified it was
being use instead of dccproc.
I got the same, it only records the number scanned. I'm not sure what
the reason for the zeros is, possibly it's because dccifd isn't
working as a proxy.
Re: DCC doesn't seem to be doing anything
Posted by "@lbutlr" <kr...@kreme.com>.
On Apr 28, 2016, at 2:30 PM, RW <rw...@googlemail.com> wrote:
> On Thu, 28 Apr 2016 11:58:47 -0600
> @lbutlr wrote:
>
>
>>> do you see any DCC_CHECK in spam headers?
>>
>> A few, but they always seem to be “1.1”
>
> What were you expecting? Like almost all SA rules it has a fixed score.
Since the daily log line specifies a number of blocked messages (always 0) I expected some variation in something. As it stands, the log line appears to be entirely useless.
--
'I knew the two of you would get along like a house on fire.' Screams,
flames, people running for safety...
Re: DCC doesn't seem to be doing anything
Posted by RW <rw...@googlemail.com>.
On Thu, 28 Apr 2016 11:58:47 -0600
@lbutlr wrote:
> > do you see any DCC_CHECK in spam headers?
>
> A few, but they always seem to be “1.1”
What were you expecting? Like almost all SA rules it has a fixed score.
> and they occur in about a third of the messages in the Spam folder,
In the context of SpamAssassin tests, a third is not "a few". But bear
in mind that it's a bulk mail test rather than a spam test, so it can
hit a lot of ham.
> should I add
>
> dcc_home /var/dcc/
It shouldn't make much difference if this is the default. Try running
"cdcc homedir" to find out.
Re: DCC doesn't seem to be doing anything
Posted by "@lbutlr" <kr...@kreme.com>.
> On Apr 28, 2016, at 2:34 AM, Matus UHLAR - fantomas <uh...@fantomas.sk> wrote:
>
> On 27.04.16 18:38, @lbutlr wrote:
>> I have DCC setup and enabled in SpamAssasin, but the only thing I see logged in maillog each day is:
>>
>> 00:00:00 mail dccifd[7397]: 1.3.158 detected 0 spam, ignored for 0, rejected for 0, and discarded for 0 targets among 0 total messages for <n> targets
>>
>> which appears every day at midnight.
>>
>> It it matters, SA is being called by amavis.
>
> do you see any DCC_CHECK in spam headers?
A few, but they always seem to be “1.1” and they occur in about a third of the messages in the Spam folder, but the daily report into maillog shows that 0 messages were detected.
X-Spam-Status: Yes, score=11.33 tagged_above=2 required=6.2
tests=[BAYES_40=-0.5, DCC_CHECK=1.1, FORGED_OUTLOOK_HTML=0.021,
FORGED_OUTLOOK_TAGS=0.052, HTML_MESSAGE=0.001,
HTML_MIME_NO_HTML_TAG=0.377, MIME_HEADER_CTYPE_ONLY=0.717,
MIME_HTML_ONLY=0.723, RCVD_IN_BRBL_LASTEXT=1.449,
> do you have dcc_home set up in SA configuration?
No, I have dcc_path set.
local.cf:
use_dcc 1
dcc_path /usr/local/bin/dccproc
should I add
dcc_home /var/dcc/
?
I guess it IS working though, since I see the log in /var/dcc/log is active.
> If SA does not find dccifd socket, it uses dccproc interface.
dcc 7396 0.0 0.1 11356 2236 - Is 7Apr16 0:00.00 /usr/local/dcc/libexec/dccifd -Idcc -tREP,20 -tCMN,5, -llog -wwhiteclnt -Uuserdirs -SHELO -Smail_host -SSender -SList-ID
dcc 7397 0.0 0.1 24772 2872 - S 7Apr16 0:56.58 /usr/local/dcc/libexec/dccifd -Idcc -tREP,20 -tCMN,5, -llog -wwhiteclnt -Uuserdirs -SHELO -Smail_host -SSender -SList-ID
--
Moving into the universe
And she's drifting this way and that
Not touching the ground at all
And she's up above the yard
Re: DCC doesn't seem to be doing anything
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 27.04.16 18:38, @lbutlr wrote:
>I have DCC setup and enabled in SpamAssasin, but the only thing I see logged in maillog each day is:
>
>00:00:00 mail dccifd[7397]: 1.3.158 detected 0 spam, ignored for 0, rejected for 0, and discarded for 0 targets among 0 total messages for <n> targets
>
>which appears every day at midnight.
>
>It it matters, SA is being called by amavis.
do you see any DCC_CHECK in spam headers?
do you have dcc_home set up in SA configuration?
If SA does not find dccifd socket, it uses dccproc interface.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
The only substitute for good manners is fast reflexes.