You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chase James <cj...@bgadd.org> on 2006/06/28 00:50:34 UTC
SpamAssassin local rules not executing
I'm using sa-exim to run checks against incoming mail at SMTP time. It seems
to be working great, except it won't run my custom rules in
/etc/spamassassin/local.cf. It seems to be responding to my custom settings
though. I'm using SpamAssassin version 3.0.3 running on Perl version 5.8.4
on Debian Sarge. Here is a sample of some of my rules:
#custom rules
body CSTM_INFINEX_VEN /infinex/
score CSTM_INFINEX_VEN 2.0
body CSTM_FONT_SIZE_EQLS_2 /<td><font size\=2>/
score CSTM_FONT_SIZE_EQLS_2 .1
I appreciate any help.
Sincerely,
Chase James
RE: SpamAssassin local rules not executing
Posted by Chase James <cj...@bgadd.org>.
Issue resolved. I needed to 'cat /var/log/syslog | grep CSTM' to debug my
rules. I'm getting my packages confused: spamassassin notices are in
/var/log/syslog while sa-exim notices are in exim's mainlog and rejectlog.
SA-Exim only logs the rules an email matches in rejectlog, and that only
happens when the email is rejected. So syslog is where to go to debug
things. Thanks for the help.
-----Original Message-----
From: jdow [mailto:jdow@earthlink.net]
Sent: Saturday, July 01, 2006 8:45 PM
To: users@spamassassin.apache.org
Subject: Re: SpamAssassin local rules not executing
1) Are these meant to be global rules or user rules? I presume the
latter from your phrasing below.
2) Are you putting the rules into "~/.spamassassin/user_prefs"?
3) How are you running SpamAssassin? That can make a serious difference
regarding whether or not SpamAssassin can access your user directory
for your email tests. If it cannot you must reconfigure the other
parts of your email system.
If you are running in a jail you MIGHT get away with creating within
that jail a /home/<users>/.spamassassin/ for each user. Copy the
actual user_prefs file for each user into their respective directories
created above. Then link that user_prefs file back to the user's own
~/.spamassassin/user_prefs for editing. This seems ugly to me. But it
does preserve the jail's integrity.
{^_^}
----- Original Message -----
From: "Chase James" <cj...@bgadd.org>
> Theo,
>
> Well, I took the allow_user_rules line out. Some of my rules are:
>
> #custom rules
> body CSTM_INFINEX_VEN /infinex/
> describe CSTM_INFINEX_VEN Message mentions Infinex Ventures
> score CSTM_INFINEX_VEN 2.0
>
> body CSTM_FONT_SIZE_EQLS_2 /<td><font size\=2>/
> describe CSTM_FONT_SIZE_EQLS_2 Message contains html for small fonts
> score CSTM_FONT_SIZE_EQLS_2 .1
>
> header CSTM_SBJCT_MARKEDSPAM Subject =~ /\bSPAM:\b/i
> describe CSTM_SBJCT_MARKEDSPAM Message has the word SPAM in subject
> score CSTM_SBJCT_MARKEDSPAM 3.0
>
> body CSTM_ORGASM /orgasm/
> describe CSTM_ORGASM Message contains the word orgasm
> score CSTM_ORGASM 2.0
>
> When I grep my rejectlog for mentions of CSTM, nothing comes up. But I'm
> still getting spam with these attributes. Thanks for your help.
>
> - Chase
>
> -----Original Message-----
> From: Theo Van Dinter [mailto:felicity@apache.org]
>
> On Thu, Jun 29, 2006 at 04:54:13PM -0400, Chase James wrote:
>> The first site rules file loaded is init.pre, the last file loaded,
> though,
>> is:
>>
>> debug: using "/etc/spamassassin" for site rules dir
>> debug: config: read file /etc/spamassassin/local.cf
>>
>> But it seems like its being read. Should I put the rules in init.pre? I
>> enabled allow_user_rules and restarted spamd, but that doesn't seem to
> have
>> worked...
>
> Well, it's not clear what you're trying to do. allow_user_rules lets
users
> have rules in their ~/.spamassassin/user_prefs file. If you're not using
> that, don't turn the function on!
>
> *.pre files are mainly for loading plugins which needs to occur before any
> rule processing. Don't put rules in there.
>
> Can you define "doesn't seem to have worked"? If the file is read,
> and --lint
> shows no errors, your rules are being used. Whether or not the match the
> input message is a different question...
>
> --
> Randomly Generated Tagline:
> "A Young Eel is called this." - Jeopardy Question
> "What is a baby eel Alex." - Theo's Response
Re: SpamAssassin local rules not executing
Posted by jdow <jd...@earthlink.net>.
1) Are these meant to be global rules or user rules? I presume the
latter from your phrasing below.
2) Are you putting the rules into "~/.spamassassin/user_prefs"?
3) How are you running SpamAssassin? That can make a serious difference
regarding whether or not SpamAssassin can access your user directory
for your email tests. If it cannot you must reconfigure the other
parts of your email system.
If you are running in a jail you MIGHT get away with creating within
that jail a /home/<users>/.spamassassin/ for each user. Copy the
actual user_prefs file for each user into their respective directories
created above. Then link that user_prefs file back to the user's own
~/.spamassassin/user_prefs for editing. This seems ugly to me. But it
does preserve the jail's integrity.
{^_^}
----- Original Message -----
From: "Chase James" <cj...@bgadd.org>
> Theo,
>
> Well, I took the allow_user_rules line out. Some of my rules are:
>
> #custom rules
> body CSTM_INFINEX_VEN /infinex/
> describe CSTM_INFINEX_VEN Message mentions Infinex Ventures
> score CSTM_INFINEX_VEN 2.0
>
> body CSTM_FONT_SIZE_EQLS_2 /<td><font size\=2>/
> describe CSTM_FONT_SIZE_EQLS_2 Message contains html for small fonts
> score CSTM_FONT_SIZE_EQLS_2 .1
>
> header CSTM_SBJCT_MARKEDSPAM Subject =~ /\bSPAM:\b/i
> describe CSTM_SBJCT_MARKEDSPAM Message has the word SPAM in subject
> score CSTM_SBJCT_MARKEDSPAM 3.0
>
> body CSTM_ORGASM /orgasm/
> describe CSTM_ORGASM Message contains the word orgasm
> score CSTM_ORGASM 2.0
>
> When I grep my rejectlog for mentions of CSTM, nothing comes up. But I'm
> still getting spam with these attributes. Thanks for your help.
>
> - Chase
>
> -----Original Message-----
> From: Theo Van Dinter [mailto:felicity@apache.org]
>
> On Thu, Jun 29, 2006 at 04:54:13PM -0400, Chase James wrote:
>> The first site rules file loaded is init.pre, the last file loaded,
> though,
>> is:
>>
>> debug: using "/etc/spamassassin" for site rules dir
>> debug: config: read file /etc/spamassassin/local.cf
>>
>> But it seems like its being read. Should I put the rules in init.pre? I
>> enabled allow_user_rules and restarted spamd, but that doesn't seem to
> have
>> worked...
>
> Well, it's not clear what you're trying to do. allow_user_rules lets users
> have rules in their ~/.spamassassin/user_prefs file. If you're not using
> that, don't turn the function on!
>
> *.pre files are mainly for loading plugins which needs to occur before any
> rule processing. Don't put rules in there.
>
> Can you define "doesn't seem to have worked"? If the file is read,
> and --lint
> shows no errors, your rules are being used. Whether or not the match the
> input message is a different question...
>
> --
> Randomly Generated Tagline:
> "A Young Eel is called this." - Jeopardy Question
> "What is a baby eel Alex." - Theo's Response
Re: SpamAssassin local rules not executing
Posted by jdow <jd...@earthlink.net>.
By the way, Chase, you MAY be bogged down in a misunderstanding. The
system local rules are ALWAYS enabled. Put them into a file with a
name that ends in ".cf" and is in the same directory as the working
local.cf file. System rules are ALWAYS allowed. Individual user rules
are not. (Rules in the system spamassassin directory apply globally
not per user. You cannot place individual user rules there.)
Individual user rules always go into the user's ".spamassassin" directory
in a file named "user_prefs".
Now, if you are running this on a Windows machine some of the locations
mentioned may be different. Please let folks know and maybe another
person with a Windows installation can help you in more detail.
{^_^}
----- Original Message -----
From: "Chase James" <cj...@bgadd.org>
> Theo,
>
> Well, I took the allow_user_rules line out. Some of my rules are:
>
> #custom rules
> body CSTM_INFINEX_VEN /infinex/
> describe CSTM_INFINEX_VEN Message mentions Infinex Ventures
> score CSTM_INFINEX_VEN 2.0
>
> body CSTM_FONT_SIZE_EQLS_2 /<td><font size\=2>/
> describe CSTM_FONT_SIZE_EQLS_2 Message contains html for small fonts
> score CSTM_FONT_SIZE_EQLS_2 .1
>
> header CSTM_SBJCT_MARKEDSPAM Subject =~ /\bSPAM:\b/i
> describe CSTM_SBJCT_MARKEDSPAM Message has the word SPAM in subject
> score CSTM_SBJCT_MARKEDSPAM 3.0
>
> body CSTM_ORGASM /orgasm/
> describe CSTM_ORGASM Message contains the word orgasm
> score CSTM_ORGASM 2.0
>
> When I grep my rejectlog for mentions of CSTM, nothing comes up. But I'm
> still getting spam with these attributes. Thanks for your help.
>
> - Chase
>
> -----Original Message-----
> From: Theo Van Dinter [mailto:felicity@apache.org]
>
> On Thu, Jun 29, 2006 at 04:54:13PM -0400, Chase James wrote:
>> The first site rules file loaded is init.pre, the last file loaded,
> though,
>> is:
>>
>> debug: using "/etc/spamassassin" for site rules dir
>> debug: config: read file /etc/spamassassin/local.cf
>>
>> But it seems like its being read. Should I put the rules in init.pre? I
>> enabled allow_user_rules and restarted spamd, but that doesn't seem to
> have
>> worked...
>
> Well, it's not clear what you're trying to do. allow_user_rules lets users
> have rules in their ~/.spamassassin/user_prefs file. If you're not using
> that, don't turn the function on!
>
> *.pre files are mainly for loading plugins which needs to occur before any
> rule processing. Don't put rules in there.
>
> Can you define "doesn't seem to have worked"? If the file is read,
> and --lint
> shows no errors, your rules are being used. Whether or not the match the
> input message is a different question...
>
> --
> Randomly Generated Tagline:
> "A Young Eel is called this." - Jeopardy Question
> "What is a baby eel Alex." - Theo's Response
Re: >From header being added..???
Posted by qqqq <qq...@usermail.com>.
>>The latter part is correct if the mail is going to be
| placed in a unix-style flat-file mailbox, but the former is wrong:
| The "From " line, if any, should not be added until final delivery of
| the message to the mailbox file.
|
Interesting....
I am using Procmail to deliver via Maildir format. I didn't want to use Maildrop due to all the
custom procmail rules I have. What's strange is it doesn't happen on all emailings. From what I
can tell, only mailings sent from outlook but I'm not 100% sure about that.
QQQQ
Re: >From header being added..???
Posted by Bart Schaefer <ba...@gmail.com>.
On 7/2/06, QQQQ <qq...@usermail.com> wrote:
>
> I'm not 100% positive this is even a SA issue but it is driving me up the wall. Some mailings are having this added right after the
> SA report. It usually isn't an issue except that some user fetch their mail from Exchange and these mailings are showing up munged.
Did you recently change from SA 3.0 or earlier to 3.1? In 3.1 SA
began inserting its headers at the TOP of the filtered message header,
rather than at the end. This is more closely conformant to the IETF
mail standards and helps reduce breakage of message signature schemes
such as DKIM.
The point is that you may have had a problem with mail processing for
a while, and the behavior of earlier versions of SA simply masked it.
> X-Spam-Report:
> * 1.5 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
> * 1.8 FUZZY_AFFORDABLE BODY: Attempt to obfuscate words in spam
> *ALL rules removed for simplicity*
> >From userid Sun Jul 2 23:47:35 2006
> Return-Path: userid@domain.com
> Received: from k5u5r1
>
> See the >From header?
In all likelyhood this was a "From " line (with no leading ">") at the
time SA was handed the message, and was rewritten as a ">From " line
by the local delivery processing after SA was already finished with
the message. The latter part is correct if the mail is going to be
placed in a unix-style flat-file mailbox, but the former is wrong:
The "From " line, if any, should not be added until final delivery of
the message to the mailbox file.
Look at the processing that's upstream of spamassassin or spamc. In
particular check whether the message is ever written to a file and
then read back in to the processing stream. The culprit is likely to
be whatever does that write.
>From header being added..???
Posted by QQQQ <qq...@usermail.com>.
All,
I'm not 100% positive this is even a SA issue but it is driving me up the wall. Some mailings are having this added right after the
SA report. It usually isn't an issue except that some user fetch their mail from Exchange and these mailings are showing up munged.
Here is an example:
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on DOMAIN
X-Spam-Level: ***********************
X-Spam-Status: Yes, score=24.0 required=5.2 tests=DATE_IN_FUTURE_06_12,
DCC_CHECK,DIGEST_MULTIPLE,FUZZY_AFFORDABLE,FUZZY_MEDICATION,
FUZZY_PRICES,HTML_IMAGE_ONLY_24,HTML_MESSAGE,RAZOR2_CF_RANGE_51_100,
RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,RCVD_IN_SORBS_DUL,
SARE_SPEC_LEO_MEDS,UPPERCASE_25_50,URIBL_BLACK,URIBL_SBL
autolearn=disabled version=3.1.0
X-Spam-Report:
* 1.5 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
* 1.8 FUZZY_AFFORDABLE BODY: Attempt to obfuscate words in spam
*ALL rules removed for simplicity*
>>From userid Sun Jul 2 23:47:35 2006
Return-Path: userid@domain.com
Received: from k5u5r1
See the >From header?
Any thoughts?
TIA
Re: SpamAssassin local rules not executing
Posted by Loren Wilton <lw...@earthlink.net>.
> #custom rules
> body CSTM_INFINEX_VEN /infinex/
> describe CSTM_INFINEX_VEN Message mentions Infinex Ventures
> score CSTM_INFINEX_VEN 2.0
s/b ok
> body CSTM_FONT_SIZE_EQLS_2 /<td><font size\=2>/
> describe CSTM_FONT_SIZE_EQLS_2 Message contains html for small fonts
> score CSTM_FONT_SIZE_EQLS_2 .1
won't work - needs to be rawbody or full rule.
Besides, there are both standard and SARE rules already for tiny fonts.
This rule isn't particularly good, since it is testing for a 'medium' font,
which is pretty standard thing to have.
> header CSTM_SBJCT_MARKEDSPAM Subject =~ /\bSPAM:\b/i
> describe CSTM_SBJCT_MARKEDSPAM Message has the word SPAM in subject
> score CSTM_SBJCT_MARKEDSPAM 3.0
s/b ok
> body CSTM_ORGASM /orgasm/
> describe CSTM_ORGASM Message contains the word orgasm
> score CSTM_ORGASM 2.0
prolly should have \b on each size to be safe
> When I grep my rejectlog for mentions of CSTM, nothing comes up. But I'm
> still getting spam with these attributes. Thanks for your help.
1. Did you lint your rules?
2. Did you restart SA?
3. Does the rules file have the right permissions for SA to read it?
4. Did you do a 'spamassassin -D --lint' and look at what it says are the
rules directories?
5. Try manually putting a complete spam with headers in a text file and
then manually do
spamassassin -t <myspam.txt
And see what it says for rules hit.
Loren
RE: SpamAssassin local rules not executing
Posted by Chase James <cj...@bgadd.org>.
Theo,
Well, I took the allow_user_rules line out. Some of my rules are:
#custom rules
body CSTM_INFINEX_VEN /infinex/
describe CSTM_INFINEX_VEN Message mentions Infinex Ventures
score CSTM_INFINEX_VEN 2.0
body CSTM_FONT_SIZE_EQLS_2 /<td><font size\=2>/
describe CSTM_FONT_SIZE_EQLS_2 Message contains html for small fonts
score CSTM_FONT_SIZE_EQLS_2 .1
header CSTM_SBJCT_MARKEDSPAM Subject =~ /\bSPAM:\b/i
describe CSTM_SBJCT_MARKEDSPAM Message has the word SPAM in subject
score CSTM_SBJCT_MARKEDSPAM 3.0
body CSTM_ORGASM /orgasm/
describe CSTM_ORGASM Message contains the word orgasm
score CSTM_ORGASM 2.0
When I grep my rejectlog for mentions of CSTM, nothing comes up. But I'm
still getting spam with these attributes. Thanks for your help.
- Chase
-----Original Message-----
From: Theo Van Dinter [mailto:felicity@apache.org]
Sent: Thursday, June 29, 2006 5:05 PM
To: spamassassin
Subject: Re: SpamAssassin local rules not executing
On Thu, Jun 29, 2006 at 04:54:13PM -0400, Chase James wrote:
> The first site rules file loaded is init.pre, the last file loaded,
though,
> is:
>
> debug: using "/etc/spamassassin" for site rules dir
> debug: config: read file /etc/spamassassin/local.cf
>
> But it seems like its being read. Should I put the rules in init.pre? I
> enabled allow_user_rules and restarted spamd, but that doesn't seem to
have
> worked...
Well, it's not clear what you're trying to do. allow_user_rules lets users
have rules in their ~/.spamassassin/user_prefs file. If you're not using
that, don't turn the function on!
*.pre files are mainly for loading plugins which needs to occur before any
rule processing. Don't put rules in there.
Can you define "doesn't seem to have worked"? If the file is read,
and --lint
shows no errors, your rules are being used. Whether or not the match the
input message is a different question...
--
Randomly Generated Tagline:
"A Young Eel is called this." - Jeopardy Question
"What is a baby eel Alex." - Theo's Response
Re: SpamAssassin local rules not executing
Posted by Theo Van Dinter <fe...@apache.org>.
On Thu, Jun 29, 2006 at 04:54:13PM -0400, Chase James wrote:
> The first site rules file loaded is init.pre, the last file loaded, though,
> is:
>
> debug: using "/etc/spamassassin" for site rules dir
> debug: config: read file /etc/spamassassin/local.cf
>
> But it seems like its being read. Should I put the rules in init.pre? I
> enabled allow_user_rules and restarted spamd, but that doesn't seem to have
> worked...
Well, it's not clear what you're trying to do. allow_user_rules lets users
have rules in their ~/.spamassassin/user_prefs file. If you're not using
that, don't turn the function on!
*.pre files are mainly for loading plugins which needs to occur before any
rule processing. Don't put rules in there.
Can you define "doesn't seem to have worked"? If the file is read, and --lint
shows no errors, your rules are being used. Whether or not the match the
input message is a different question...
--
Randomly Generated Tagline:
"A Young Eel is called this." - Jeopardy Question
"What is a baby eel Alex." - Theo's Response
RE: SpamAssassin local rules not executing
Posted by Chase James <cj...@bgadd.org>.
Matt,
The first site rules file loaded is init.pre, the last file loaded, though,
is:
debug: using "/etc/spamassassin" for site rules dir
debug: config: read file /etc/spamassassin/local.cf
But it seems like its being read. Should I put the rules in init.pre? I
enabled allow_user_rules and restarted spamd, but that doesn't seem to have
worked...
-----Original Message-----
From: Matt Kettler [mailto:mkettler_sa@comcast.net]
Sent: Wednesday, June 28, 2006 9:51 AM
To: Chase James
Cc: spamassassin
Subject: Re: SpamAssassin local rules not executing
Chase James wrote:
> I'm using sa-exim to run checks against incoming mail at SMTP time. It
seems
> to be working great, except it won't run my custom rules in
> /etc/spamassassin/local.cf.
Check to see if /etc/spamassassin is your site rules dir.. SA will
automatically hunt for several different directories and use the first
one of them it finds...
try running spamassassin --lint -D. The site rules dir should be
mentioned near the top of the output.
Also, if you use spamd, amavis or MailScanner they need to be restarted
for site rules changes to take effect.
Re: SpamAssassin local rules not executing
Posted by Matt Kettler <mk...@comcast.net>.
Chase James wrote:
> I'm using sa-exim to run checks against incoming mail at SMTP time. It seems
> to be working great, except it won't run my custom rules in
> /etc/spamassassin/local.cf.
Check to see if /etc/spamassassin is your site rules dir.. SA will
automatically hunt for several different directories and use the first
one of them it finds...
try running spamassassin --lint -D. The site rules dir should be
mentioned near the top of the output.
Also, if you use spamd, amavis or MailScanner they need to be restarted
for site rules changes to take effect.