Randomly Not Scanning Messages

[Michael Shuler <mi...@omnilec.com>]

I am using Postfix and Spam Assassin.  For some reason some messages that
are blatantly SPAM are not getting the X-Spam-Score added to them.  They
show that they are received by Postfix (in the header) but they are not
scanned from what I can tell (X-Spam entries).  When I had version 3.1.0 it
was happening quite frequently but since upgrading to 3.1.1 it seems to
happen quite a bit less.  My setup is pretty plain other than I use MySQL
for user prefs.  Any ideas?

Mike

--------------------------------------

Postfix master.cf:

# Spam Filter
spamassassin unix - n n - - pipe
        flags=Rq user=spamass argv=/usr/local/bin/spamfilter.sh -f ${sender}
-- ${recipient}

smtp inet n - n - - smtpd
  -o content_filter=spamassassin:
smtp unix - - n - - smtp
  -o content_filter=spamassassin:

---------------------------------------

spamfilter.sh:

#!/bin/bash
/usr/bin/spamc -u $4 | /usr/sbin/sendmail -i "$@"
exit $?

----------------------------------------

Re: Randomly Not Scanning Messages

[Michael Frotscher <in...@tronserver.dyndns.org>]

On Thursday, 6. April 2006 18:29, Matt Kettler wrote:
> If the guy is in your blacklist, can you just blacklist him at the MTA
> layer?

Yes, that would probably best. I just wanted to have any blacklists etc. in 
one place (i.e. spamassassin) and not two.

> Erm, pre-process the message and feed only the headers to SA? Really ugly.

Weeeell, not really preprocess externally, but assuming SA did a header check 
before processing the whole message, it could tag messages before it needed 
to chew through it. As that is not the case just now, I agree that ignoring 
mails above a given size is a good idea.
-- 
YT,
Michael

Re: Randomly Not Scanning Messages

[Matt Kettler <mk...@evi-inc.com>]

Michael Frotscher wrote:
> On Monday, 3. April 2006 16:35, Matt Kettler wrote:
>> Are the messages involved over 250k? Unless you pass -s with a different
>> size, spamc will bypass scanning for any message over 250k.
> 
> I was wondering about the same thing: I want to filter mails with large 
> attachments from a guy who is in my blacklist. But as said, sa ignores 
> messages above 250k.

If the guy is in your blacklist, can you just blacklist him at the MTA layer? It
will save you a lot of CPU overhead and network bandwidth if you 550 at the time
of the SMTP "MAIL FROM" command.

(note this is called "rejecting" spam, and should not be confused with
"bouncing" spam by generating a post-delivery DSN)


> 
> Is there a way to get spamassassin to examine those messages by header only? 
> That way it wouldn't need to chew through the entire message but still filter 
> out blacklisted addresses.

Erm, pre-process the message and feed only the headers to SA? Really ugly.

Re: Randomly Not Scanning Messages

[Michael Frotscher <in...@tronserver.dyndns.org>]

On Monday, 3. April 2006 16:35, Matt Kettler wrote:
> Are the messages involved over 250k? Unless you pass -s with a different
> size, spamc will bypass scanning for any message over 250k.

I was wondering about the same thing: I want to filter mails with large 
attachments from a guy who is in my blacklist. But as said, sa ignores 
messages above 250k.

Is there a way to get spamassassin to examine those messages by header only? 
That way it wouldn't need to chew through the entire message but still filter 
out blacklisted addresses.
-- 
YT,
Michael

RE: Randomly Not Scanning Messages

[Michael Shuler <mi...@omnilec.com>]

That was it.  Thank you!

----------------------------------------

Michael Shuler, C.E.O.
OmniLEC And BitWise Communications, Inc.
682 High Point Lane
East Peoria, IL 61611
OmniNumber: (309) 670-0575
Fax: (309) 213-3500
E-Mail: Mike@OmniLEC.com
Customer Service: (877) New-Omni 

> -----Original Message-----
> From: Matt Kettler [mailto:mkettler_sa@comcast.net] 
> Sent: Monday, April 03, 2006 9:36 AM
> To: Michael Shuler
> Cc: users@spamassassin.apache.org
> Subject: Re: Randomly Not Scanning Messages
> 
> 
> Michael Shuler wrote:
> > I am using Postfix and Spam Assassin.  For some reason some 
> messages that
> > are blatantly SPAM are not getting the X-Spam-Score added 
> to them.  They
> > show that they are received by Postfix (in the header) but 
> they are not
> > scanned from what I can tell (X-Spam entries).  When I had 
> version 3.1.0 it
> > was happening quite frequently but since upgrading to 3.1.1 
> it seems to
> > happen quite a bit less.  My setup is pretty plain other 
> than I use MySQL
> > for user prefs.  Any ideas?
> >   
> 
> Are the messages involved over 250k? Unless you pass -s with 
> a different
> size, spamc will bypass scanning for any message over 250k. 
> (Note: going
> over 250k will significantly increase spamd's memory usage and scan
> time, so adjust this size with caution).
> 
> 

Re: Randomly Not Scanning Messages

[Matt Kettler <mk...@comcast.net>]

Michael Shuler wrote:
> I am using Postfix and Spam Assassin.  For some reason some messages that
> are blatantly SPAM are not getting the X-Spam-Score added to them.  They
> show that they are received by Postfix (in the header) but they are not
> scanned from what I can tell (X-Spam entries).  When I had version 3.1.0 it
> was happening quite frequently but since upgrading to 3.1.1 it seems to
> happen quite a bit less.  My setup is pretty plain other than I use MySQL
> for user prefs.  Any ideas?
>   

Are the messages involved over 250k? Unless you pass -s with a different
size, spamc will bypass scanning for any message over 250k. (Note: going
over 250k will significantly increase spamd's memory usage and scan
time, so adjust this size with caution).