pyzor;razor;dcc = CPU at 100%

[Robert Voigtländer <r....@gmx.de>]

HI.

I have problems using pyzor;razor;dcc with SA. As soon as I activate one of
them the incomming mail gets to spamd and never goes further. The CPU load
goes to 99% and the message stays at the queue.

without debuging /var/log/mail/info reports:
Jul  3 16:34:05 server spamd[6725]: processing message
<20040703203404.DF9408D35@*************> for spamfilter:500.

with debugin on:
Jul  3 16:11:35 server spamd[6178]: debug: entering helper-app run mode


Does someone has an idea what the probelm could be?

Thanks
Robert



My system:

Mandrake 10
postfix, vm-pop3d, SA.

implementation of SA:

----
/etc/postfix/master.cf

smtp    inet    n       -       y       -       -       smtpd -o
content_filter=spamfilter


spamfilter unix - n n - - pipe
  flags=Rq user=spamfilter argv=/usr/bin/postfixfilter -f ${sender} --
${recipient}

-----

------
/usr/bin/postfixfilter


#!/bin/bash
/usr/bin/spamc | /usr/sbin/sendmail -i "$@"
exit $?

-------

--------
/etc/mail/spamassassin/local.cf

required_hits 5.00   # minimise false positives, let spam through
rewrite_subject 1
always_add_headers 1
always_add_report 1
spam_level_stars 1
subject_tag ***SPAM:
report_safe 1   # move the spam to an attachment of a new message
use_terse_report 0
dns_available yes   # this is faster than the default 'test'

skip_rbl_checks 0
use_pyzor 0  #as soon as enabled cpu 99%
use_razor2 0  #as soon as enabled cpu 99%
use_bayes 1
use_dcc 0  #as soon as enabled cpu 99%
bayes_auto_learn 1
bayes_auto_learn_threshold_nonspam -3.0
bayes_auto_learn_threshold_spam 10.0


----------



-----Original Message-----
From: Jim Maul [mailto:jmaul@elih.org]
Sent: Samstag, 3. Juli 2004 19:48
To: dougie@highmoor.co.uk
Cc: spamassassin-users@incubator.apache.org
Subject: Re: Spoofed bounces being autolearned as ham


Quoting Dougie Nisbet <do...@highmoor.co.uk>:

> I've just rejoined this mailing list after a long period of letting SA do
its
> job quietly in the backround. Any FPs of spam or ham I've simply
re-learned
> using sa-learn. However over the last week I've been receiving quite a
flurry
> of bounced emails (of spoofed spam using my domain name) that I'm having
some
> trouble with. I'm currently re-familiarizing myself with my SA setup -
it's
> being doing the job so well for so long that I've forgotten it's there.
>
> The way I work is to have a couple of folders in kmail for spam to learn.
I
> have an overnight cron job that checks these folders and runs sa-learn on
> them. Occassionally I look through an unfiltered account and feed some
more
> ham to SA to try keep the spam/ham learning ratio a bit more even. It
> generally works ok.
>
> I'm not quite sure how to proceed with my current burst of spams that are
> coming through. What is a bit worrying to me is the auto-learning as ham,
> even for a fairly modest score. In the example below the email has been
> autolearned as ham even though it only has a a score of -0.9. I'm
re-learning
> them as spam as they come in but I'm not sure how much effect it's having.
> Unfortunately it looks like highmoor.co.uk is being hit at the moment as
all
> the bounces have a spoofed but theoretically valid
> randomrubbish@highmoor.co.uk type email address.
>
> I'm browsing through http://wiki.apache.org/spamassassin/BayesFaq at the
> moment trying to get back up to speed with SA but if anyone has any useful
> pointers in the meantime I'd be grateful.
>
> Thanks,
>
>

sa-learn is a great tool but unfortunately, the longer you use it the less
effective it is.  What you might want to do is expire the bayes database
occasionally and start over with the learning.  Bayes is SO much more
accurate
when it is up to date.  Spam techniques change so often that old rules in a
bayes database actually end up doing more harm than good.  I'd be willing to
bet that if you cleared the database and started over with newer mails
to train
on, you'd have much better results.

Jim