You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Patrick Ben Koetter <p...@state-of-mind.de> on 2009/07/22 14:37:18 UTC
sa-stats.pl and SpamAssassin 3.2.4
I am trying to use (an old) sa-stats.pl to give me spamd generated statistics
for SpamAssassin (3.2.4-1ubuntu1.1), but all I get are zeros.
Is sa-stats.pl broken with recent versions of SpamAssassin? Any things I should look out for?
The log contains data, so I suspect the culprit is either me or sa-stats.pl:
Jul 22 14:18:03 mail01 spamd[24172]: spamd: identified spam (1002.3/5.0) for postmaster>:65534 in 1.1 seconds, 1185 bytes.
Jul 22 14:18:04 mail01 spamd[24172]: spamd: result: Y 1002 - DATE_IN_PAST_96_XX,GTUBE scantime=1.1,size=1185,user=postmaster>,uid=65534,required_score=5.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=46153,mid=<GT...@example.net>,autolearn=no
...
Jul 22 14:20:31 mail01 spamd[24172]: spamd: clean message (3.0/5.0) for news:65534 in 1.3 seconds, 14874 bytes.
Jul 22 14:20:31 mail01 spamd[24172]: spamd: result: . 2 - BAD_ENC_HEADER,HTML_MESSAGE,RDNS_NONE scantime=1.3,size=14874,user=news,uid=65534,required_score=5.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=46168,mid=<zR...@hostname>,autolearn=no
TIA,
p@
--
state of mind
Digitale Kommunikation
http://www.state-of-mind.de
Franziskanerstraße 15 Telefon +49 89 3090 4664
81669 München Telefax +49 89 3090 4666
Amtsgericht München Partnerschaftsregister PR 563
Re: sa-stats.pl and SpamAssassin 3.2.4
Posted by Mike Cappella <li...@cappella.us>.
On 7/22/2009 10:57 AM, MySQL Student wrote:
> Hi,
>
> Are spamd and amavisd-new mutually exclusive?
>
> I'm also trying to use sa-stats.pl, and it is reporting zeros because
> I've just learned it relies on spamd, which I'm apparently not using.
>
Try amavis-logwatch too. Since you're running amavis, you'll get extra
stuff too.
You'll have to strip out your non-standard quarantine tags at the end of
the SPAM lines. See the quick and dirty sed expression below, which
you'll need to modify to suit your needs.
Sorry about the wrapping below. I turned of additional output w/switches:
$ sed 's/, quarantine spam.*$//' maillog | amavis-logwatch --l bayes=0
--notimings
===========================================================================
SpamAssassin Rule Hits: Spam
---------------------------------------------------------------------------
Rank Hits % Msgs % Spam % Ham Score Rule
---- ---- ------ ------ ----- ----- ----
1 1 0.00% 0.00% 0.00% FORGED_YAHOO_RCVD
2 1 0.00% 0.00% 0.00% REPTO_QUOTE_YAHOO
3 1 0.00% 0.00% 0.00% RCVD_NUMERIC_HELO
4 1 0.00% 0.00% 0.00% RCVD_DOUBLE_IP_LOOSE
5 1 0.00% 0.00% 0.00% HEAD_ILLEGAL_CHARS
6 1 0.00% 0.00% 0.00% HTML_TAG_BALANCE_BODY
7 1 0.00% 0.00% 0.00% TVD_RCVD_IP
8 1 0.00% 0.00% 0.00% BODY_8BITS
9 1 0.00% 0.00% 0.00% RDNS_NONE
10 1 0.00% 0.00% 0.00% RCVD_IN_XBL
11 1 0.00% 0.00% 0.00% BAYES_99
12 1 0.00% 0.00% 0.00% MIME_HTML_ONLY_MULTI
13 1 0.00% 0.00% 0.00% TVD_RCVD_IP4
14 1 0.00% 0.00% 0.00% SUBJECT_NEEDS_ENCODING
15 1 0.00% 0.00% 0.00% MPART_ALT_DIFF
16 1 0.00% 0.00% 0.00% RCVD_HELO_IP_MISMATCH
17 1 0.00% 0.00% 0.00% HTML_MESSAGE
18 1 0.00% 0.00% 0.00% SUBJ_ILLEGAL_CHARS
19 1 0.00% 0.00% 0.00% FROM_ILLEGAL_CHARS
20 1 0.00% 0.00% 0.00% MIME_HTML_ONLY
...
===========================================================================
> Here is the relevant log information from line in my mail.log:
>
> Jul 22 00:01:24 mail02 amavis[30729]: (30729-266) SPAM,
> <dk...@yahoo.com> -> <ji...@mydomain.com>, Yes, hits=40.6
> tag1=-300.0 tag2=5.0 kill=5.0 use_bayes=1 tests=BAYES_99, BODY_8BITS,
> BOTNET, FORGED_YAHOO_RCVD, FROM_ILLEGAL_CHARS, HEAD_ILLEGAL_CHARS,
> HTML_IMAGE_RATIO_02, HTML_MESSAGE, HTML_TAG_BALANCE_BODY,
> MIME_HTML_ONLY, MIME_HTML_ONLY_MULTI, MPART_ALT_DIFF, MSGID_RANDY,
> RCVD_DOUBLE_IP_LOOSE, RCVD_HELO_IP_MISMATCH, RCVD_IN_XBL,
> RCVD_NUMERIC_HELO, RDNS_NONE, REPTO_QUOTE_YAHOO,
> SUBJECT_NEEDS_ENCODING, SUBJ_ILLEGAL_CHARS, TVD_RCVD_IP, TVD_RCVD_IP4,
> quarantine spam-d55bdeb21a3775a8f250921df74e14d7-20090722-000123-30729-266
> (spam-quarantine)
>
> Jul 22 00:01:24 mail02 amavis[30729]: (30729-266) TIMING [total 785
> ms] - SMTP EHLO: 1 (0%), SMTP pre-MAIL: 1 (0%), create email.txt: 0
> (0%), SMTP pre-DATA-flush: 1 (0%), SMTP DATA: 80 (10%), body hash: 0
> (0%), mime_decode: 6 (1%), get-file-type: 13 (2%), decompose_part: 1
> (0%), parts: 0 (0%), AV-scan-1: 4 (0%), AV-scan-2: 6 (1%), SA msg
> read: 13 (2%), SA parse: 2 (0%), SA check: 519 (66%), write-header: 25
> (3%), save-to-local-mailbox: 8 (1%), delete email.txt: 105
> (13%),unlink-1-files: 0 (0%), rundown: 0 (0%)
>
> Can sa-stats.pl be configured to parse this output? Other ideas?
>
> Thanks,
> Alex
Re: sa-stats.pl and SpamAssassin 3.2.4
Posted by Bowie Bailey <Bo...@BUC.com>.
MySQL Student wrote:
> Hi,
>
> Are spamd and amavisd-new mutually exclusive?
>
Yes. amavisd-new uses the Perl API directly, so it does not talk to spamd.
> I'm also trying to use sa-stats.pl, and it is reporting zeros because
> I've just learned it relies on spamd, which I'm apparently not using.
>
> Here is the relevant log information from line in my mail.log:
>
> Jul 22 00:01:24 mail02 amavis[30729]: (30729-266) SPAM,
> <dk...@yahoo.com> -> <ji...@mydomain.com>, Yes, hits=40.6
> tag1=-300.0 tag2=5.0 kill=5.0 use_bayes=1 tests=BAYES_99, BODY_8BITS,
> BOTNET, FORGED_YAHOO_RCVD, FROM_ILLEGAL_CHARS, HEAD_ILLEGAL_CHARS,
> HTML_IMAGE_RATIO_02, HTML_MESSAGE, HTML_TAG_BALANCE_BODY,
> MIME_HTML_ONLY, MIME_HTML_ONLY_MULTI, MPART_ALT_DIFF, MSGID_RANDY,
> RCVD_DOUBLE_IP_LOOSE, RCVD_HELO_IP_MISMATCH, RCVD_IN_XBL,
> RCVD_NUMERIC_HELO, RDNS_NONE, REPTO_QUOTE_YAHOO,
> SUBJECT_NEEDS_ENCODING, SUBJ_ILLEGAL_CHARS, TVD_RCVD_IP, TVD_RCVD_IP4,
> quarantine spam-d55bdeb21a3775a8f250921df74e14d7-20090722-000123-30729-266
> (spam-quarantine)
>
> Jul 22 00:01:24 mail02 amavis[30729]: (30729-266) TIMING [total 785
> ms] - SMTP EHLO: 1 (0%), SMTP pre-MAIL: 1 (0%), create email.txt: 0
> (0%), SMTP pre-DATA-flush: 1 (0%), SMTP DATA: 80 (10%), body hash: 0
> (0%), mime_decode: 6 (1%), get-file-type: 13 (2%), decompose_part: 1
> (0%), parts: 0 (0%), AV-scan-1: 4 (0%), AV-scan-2: 6 (1%), SA msg
> read: 13 (2%), SA parse: 2 (0%), SA check: 519 (66%), write-header: 25
> (3%), save-to-local-mailbox: 8 (1%), delete email.txt: 105
> (13%),unlink-1-files: 0 (0%), rundown: 0 (0%)
>
> Can sa-stats.pl be configured to parse this output? Other ideas?
>
Should be easy enough. sa-stats.pl is a fairly simple Perl script, so
you can adjust it yourself if you have any programming ability. I don't
have it on hand at the moment, so I can't tell you exactly what would
need to be done.
--
Bowie
Re: sa-stats.pl and SpamAssassin 3.2.4
Posted by MySQL Student <my...@gmail.com>.
Hi,
Are spamd and amavisd-new mutually exclusive?
I'm also trying to use sa-stats.pl, and it is reporting zeros because
I've just learned it relies on spamd, which I'm apparently not using.
Here is the relevant log information from line in my mail.log:
Jul 22 00:01:24 mail02 amavis[30729]: (30729-266) SPAM,
<dk...@yahoo.com> -> <ji...@mydomain.com>, Yes, hits=40.6
tag1=-300.0 tag2=5.0 kill=5.0 use_bayes=1 tests=BAYES_99, BODY_8BITS,
BOTNET, FORGED_YAHOO_RCVD, FROM_ILLEGAL_CHARS, HEAD_ILLEGAL_CHARS,
HTML_IMAGE_RATIO_02, HTML_MESSAGE, HTML_TAG_BALANCE_BODY,
MIME_HTML_ONLY, MIME_HTML_ONLY_MULTI, MPART_ALT_DIFF, MSGID_RANDY,
RCVD_DOUBLE_IP_LOOSE, RCVD_HELO_IP_MISMATCH, RCVD_IN_XBL,
RCVD_NUMERIC_HELO, RDNS_NONE, REPTO_QUOTE_YAHOO,
SUBJECT_NEEDS_ENCODING, SUBJ_ILLEGAL_CHARS, TVD_RCVD_IP, TVD_RCVD_IP4,
quarantine spam-d55bdeb21a3775a8f250921df74e14d7-20090722-000123-30729-266
(spam-quarantine)
Jul 22 00:01:24 mail02 amavis[30729]: (30729-266) TIMING [total 785
ms] - SMTP EHLO: 1 (0%), SMTP pre-MAIL: 1 (0%), create email.txt: 0
(0%), SMTP pre-DATA-flush: 1 (0%), SMTP DATA: 80 (10%), body hash: 0
(0%), mime_decode: 6 (1%), get-file-type: 13 (2%), decompose_part: 1
(0%), parts: 0 (0%), AV-scan-1: 4 (0%), AV-scan-2: 6 (1%), SA msg
read: 13 (2%), SA parse: 2 (0%), SA check: 519 (66%), write-header: 25
(3%), save-to-local-mailbox: 8 (1%), delete email.txt: 105
(13%),unlink-1-files: 0 (0%), rundown: 0 (0%)
Can sa-stats.pl be configured to parse this output? Other ideas?
Thanks,
Alex