some emails aren't scanned

[Dimitrios <se...@altered.com>]

I've got a big problem here.

Every now and then, i get an influx of incoming emails.

At that time, some of them (around 10 emails every 500 or so)
don't get scanned by SA. I can see this because none of the SA
headers exist in those emails and some of them are spam.

I'm using SA with procmail:

:0fw: spamassassin.lock
* < 512000
| /usr/bin/spamassassin


anyone got any suggestions why some emails dont get scanned?

Re: some emails aren't scanned

[John <li...@slotcar.chicago.il.us>]

On Sat, Jul 17, 2004 at 07:52:17PM -0500, John wrote:

Also, I am not running procmail.  I am using exiscan-acl.

Re: some emails aren't scanned

[John <li...@slotcar.chicago.il.us>]

On Sat, Jul 17, 2004 at 11:33:14AM +0100, Dimitrios wrote:

> anyone got any suggestions why some emails dont get scanned?

I am also running 2.63 and have experienced a problem where
certain mails do not get scanned (no headers are inserted
by SA).

It has occured on 3 mails so far.  This is out of maybe 50.
This is a very low volume server.

I notice that all three emails shared at least one similar
trait: they contained two attatchments (one really small
and the other around 172k).

Any ideas?

Re: some emails aren't scanned

[Dimitrios <se...@altered.com>]

On Sat, 17 Jul 2004 12:28:43 -0400 "Scot L. Harris" <we...@cfl.rr.com> wrote:

> I have had to track a few of these down also.  Some of the un-scanned
> messages were over the size limit I had set similar to your recipe in
> procmail.  You can find this in the maillog file for that message.  I
> believe I tracked some others to spamassassin being restarted ( I think
> at the time some changes to the local.cf file were being made, new
> whitelist entries).  During the time it was being restarted a number of
> messages managed to slip by without being tagged.  Again I found
> evidence of this in the log file.

i haven't been doing any such changes here.


> More recently I had a few messages get by my greylist milter which were
> subsequently caught by spamassassin.  That problem appears to be when
> the system is under load the milter would timeout and the message would
> fall through.  Solution there was to increase the timeouts for the
> milter in the sendmail.mc file.

hmm timeout is indeed a possible problem.
   

Re: some emails aren't scanned

["Scot L. Harris" <we...@cfl.rr.com>]

On Sat, 2004-07-17 at 06:33, Dimitrios wrote:
> I've got a big problem here.
> 
> Every now and then, i get an influx of incoming emails.
> 
> At that time, some of them (around 10 emails every 500 or so)
> don't get scanned by SA. I can see this because none of the SA
> headers exist in those emails and some of them are spam.
> 
> I'm using SA with procmail:
> 
> :0fw: spamassassin.lock
> * < 512000
> | /usr/bin/spamassassin
> 
> 
> anyone got any suggestions why some emails dont get scanned?

I have had to track a few of these down also.  Some of the un-scanned
messages were over the size limit I had set similar to your recipe in
procmail.  You can find this in the maillog file for that message.  I
believe I tracked some others to spamassassin being restarted ( I think
at the time some changes to the local.cf file were being made, new
whitelist entries).  During the time it was being restarted a number of
messages managed to slip by without being tagged.  Again I found
evidence of this in the log file.

More recently I had a few messages get by my greylist milter which were
subsequently caught by spamassassin.  That problem appears to be when
the system is under load the milter would timeout and the message would
fall through.  Solution there was to increase the timeouts for the
milter in the sendmail.mc file.
  
-- 
Scot L. Harris
webid@cfl.rr.com

QOTD:
	"It's been real and it's been fun, but it hasn't been real fun." 

Re: some emails aren't scanned

[Dimitrios <se...@altered.com>]

On Sat, 17 Jul 2004 05:18:52 -0700 "Loren Wilton" <lw...@earthlink.net> wrote:

> I assume you are still using 2.63?  If so, you aren't the first to notice
> this.

indeed.


> One theory:  Mails that score near Bayes-50 won't show a Bayes score.  But
> I'd think they should still possibly show other scores.

i dont think that is the case because not a single SA header is in those emails.

 
> Another theory:  If the machine gets really swamped, it seems that messages
> will get skipped.

its a valid theory, because when i get unscanned emails, they are at a time
of a high number of incoming emails.

 
> Yet another: If network tests are timing out (or maybe just taking too long)
> the processing may get aborted for the message.

another valid theory :]

i'll look at my timeouts.

Re: some emails aren't scanned

[Loren Wilton <lw...@earthlink.net>]

I assume you are still using 2.63?  If so, you aren't the first to notice
this.
There seems to be several theories, but I don't know that anyone has ever
come up with a definitive proof of how this comes about.  Hopefully it will
be gone on 3.0.

One theory:  Mails that score near Bayes-50 won't show a Bayes score.  But
I'd think they should still possibly show other scores.

Another theory:  If the machine gets really swamped, it seems that messages
will get skipped.

Yet another: If network tests are timing out (or maybe just taking too long)
the processing may get aborted for the message.

        Loren