You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Craig <cc...@unitedwayqc.org> on 2006/12/06 23:51:06 UTC
SA not firing on every email
Yes I have asked this question previously, but with not as much detail.
MY ENVIRONMENT
SA 3.1.7
running on Windows 2000
Using Bayes
In the past 2 days my email server has received 14,973 email messages, Spamassassin has scanned 10,951 of those messages, and my users have received @ 250 spam messages.
Most of those spam messages have Subjects like;
- All love enhancers on one portal!
- Full of health? Then don't click!
- Need medicine? All here!
and my favorite
- She wants a better sex? All you need's here!
Why does SA fire on some emails (10,951) and not others (4,022)
If I run any of these captured emails through manually, they score 50+ points.
Below is the header info from one such email.
MAIL FROM:<st...@quasarman.biz>
RCPT TO:<rw...@unitedwayqc.org>
Received: from friend (pool-68-239-67-125.res.east.verizon.net [68.239.67.125])
by United_Way.unitedwayqc.org with ESMTP; Tue, 05 Dec 2006 12:27:42 -0600
Message-ID: <00...@your-f78bf48ce2>
From: "Peter" <st...@quasarman.biz>
To: <rw...@unitedwayqc.org>
Subject: She wants a better sex? All you need's here!
Re: SA not firing on every email
Posted by guenther <gu...@rudersport.de>.
On Thu, 2006-12-07 at 03:12 -0700, Jason Marshall wrote:
> > Perhaps SA was too busy and those messages timed out and weren't scanned ?
> > Maybe those messages were greater than 250K (default max scan size) ?
>
> I have the same sort of problem, though it's on linux rather than windows.
> Several emails sneak through when the server is busy.
This most likely is not the same issue as the OP has,
> I write to spam quarantine, mail spool, and bayes databases over NFS, and
> sometimes the NFS server gets busy.
>
> I understand that spamassassin times out, but i'm running spamc with the
> -x option, which is supposed to, rather than pass the message through
> un-filtered, bounce it back to sendmail to try again. Is an appropriate
> return code not being set when spamc times out, maybe? Or does the -x
> option no longer work?
>
> >From the manpage:
>
> -x Disables the 'safe fallback' error-recovery method, which passes
> through the unaltered message if an error occurs. Instead, exit
> with an error code, and let the MTA queue up the mails for a retry
> later. See also "EXIT CODES".
>
> >From my .procmailrc:
procmail ist not an MTA, but an MDA (Mail Transport or Delivery Agent
respectively). procmail processes your mail and delivers it. According
to your receipts, correctly. ;)
> :0fw
> | /usr/local/bin/spamc -x
You're using spamc as a filter. There is no fallback receipt what to do
when the filter finishes unsuccessful (based on the exit code).
> :0:
> * ^X-Spam-Status: YES
> mail/spamfile
Filter finished unsuccessful, mail not altered, hence no such header. So
let's move on and check the next receipt...
> Am I missing something obvious? thanks anyone!
The fact that procmail is not an MTA and does not queue mails (see the
description of the spamc -x option above).
...guenther
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: SA not firing on every email
Posted by Jason Marshall <ma...@spots.ab.ca>.
> Perhaps SA was too busy and those messages timed out and weren't scanned ?
> Maybe those messages were greater than 250K (default max scan size) ?
I have the same sort of problem, though it's on linux rather than windows.
Several emails sneak through when the server is busy.
I write to spam quarantine, mail spool, and bayes databases over NFS, and
sometimes the NFS server gets busy.
I understand that spamassassin times out, but i'm running spamc with the
-x option, which is supposed to, rather than pass the message through
un-filtered, bounce it back to sendmail to try again. Is an appropriate
return code not being set when spamc times out, maybe? Or does the -x
option no longer work?
>From the manpage:
-x Disables the 'safe fallback' error-recovery method, which passes
through the unaltered message if an error occurs. Instead, exit
with an error code, and let the MTA queue up the mails for a retry
later. See also "EXIT CODES".
>From my .procmailrc:
:0fw
| /usr/local/bin/spamc -x
:0:
* ^X-Spam-Status: YES
mail/spamfile
Am I missing something obvious? thanks anyone!
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
| Jason Marshall, marshalj@spots.ab.ca. Spots InterConnect, Inc. Calgary, AB |
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Re: SA not firing on every email
Posted by Craig <cc...@unitedwayqc.org>.
Thanks for your reply
Its not that the server is to busy-I can put any one of those emails in the receive directory when no other emails are in the que-and being scanned and it still gets passed through.
Size is not an issue, the emails are 26k.
More details-
I have spamassassin intigrated with Guinevere, and Groupwise is my mail application.
Any and all suggestions are welcome!
>>> Rick Macdougall <ri...@ummm-beer.com> 12/06/2006 5:01 PM >>>
Craig wrote:
> Yes I have asked this question previously, but with not as much detail.
>
> MY ENVIRONMENT
> SA 3.1.7
> running on Windows 2000
> Using Bayes
>
> In the past 2 days my email server has received 14,973 email messages,
> Spamassassin has scanned 10,951 of those messages, and my users have
> received @ 250 spam messages.
>
> Most of those spam messages have Subjects like;
> - All love enhancers on one portal!
> - Full of health? Then don't click!
> - Need medicine? All here!
> and my favorite
> - She wants a better sex? All you need's here!
>
> Why does SA fire on some emails (10,951) and not others (4,022)
> If I run any of these captured emails through manually, they score 50+
> points.
>
Hi,
Perhaps SA was too busy and those messages timed out and weren't scanned
? Maybe those messages were greater than 250K (default max scan size) ?
I'd personally go with option 1 but I don't know your server setup, how
many children you allow with spamd and how busy your server is.
Regards,
Rick
Re: SA not firing on every email
Posted by Rick Macdougall <ri...@ummm-beer.com>.
Craig wrote:
> Yes I have asked this question previously, but with not as much detail.
>
> MY ENVIRONMENT
> SA 3.1.7
> running on Windows 2000
> Using Bayes
>
> In the past 2 days my email server has received 14,973 email messages,
> Spamassassin has scanned 10,951 of those messages, and my users have
> received @ 250 spam messages.
>
> Most of those spam messages have Subjects like;
> - All love enhancers on one portal!
> - Full of health? Then don't click!
> - Need medicine? All here!
> and my favorite
> - She wants a better sex? All you need's here!
>
> Why does SA fire on some emails (10,951) and not others (4,022)
> If I run any of these captured emails through manually, they score 50+
> points.
>
Hi,
Perhaps SA was too busy and those messages timed out and weren't scanned
? Maybe those messages were greater than 250K (default max scan size) ?
I'd personally go with option 1 but I don't know your server setup, how
many children you allow with spamd and how busy your server is.
Regards,
Rick