bigevil usage... confused

[Daniel Bird]

Jeff A. Earickson wrote:

>Julian,
>   "ls -lu" shows that /etc/mail/spamassassin/bigevil.cf (perms = 644)
>isn't being used, even though the local.cf symlink in /etc/mail/spamassassin
>(pointing to /opt/MailScanner/etc/spam.assassin.prefs.conf) is.  The
>times differ substantially.  But if I run the lint command (below),
>then both local.cf and bigevil.cf have their times updated, even though
>the lint output make no explicit mention of bigevil.cf.  Still no
>references to bigevil in the syslog for SA.  Running SA 2.61;  now I'm
>very confused.  Maybe I missed some incantation when I built/installed 2.61.
>Or maybe I have to refer to bigevil.cf somehow in spam.assassin.prefs.conf.
>Any more ideas?
>
>
>
SA will read any .cf file in the following locations (as per man
Mail::SpamAsaassin::Conf)
/etc/mail/spamassassin
/usr/share/spamassassin

The latter being where the default cf files live. The default config
file read from invoking SA from the command line is local.cf (in
/etc/mail/spamassassin). For our install, this is linked to
/etc/MailScanner/spam.assassin.prefs.conf, so when sa is run from the
command line the MS prefs file is used.

Now, the easiest way I've found to check if  additional rules are
working is to do :

spamassassin -D -t < sample-mail-known-to-match-rule> then check the
output for the rule name.

Here's the output some debug, from a server which I **know** is using
evilrules:

debug: using "/usr/share/spamassassin" for default rules dir
debug: using "/etc/mail/spamassassin" for site rules dir
debug: using "/root/.spamassassin" for user state dir
debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file
debug: using "/root/.spamassassin" for user state dir
<snip>
 pts rule name              description
---- ----------------------
--------------------------------------------------
3.0 BigEvilList_6          URI: Generated BigEvilList_6
<snip>

As you can see, also no mention of bigevil, rather just the directories
that will be looked in for SA rules, but the sample mail matched on a
big evil rule

Also, just because I haven't seen it mentioned, don't forget you may
need to restart MailScanner.

Hope this may help.
Dan

>Jeff
>
>On Sat, 20 Dec 2003, Julian Field wrote:
>
>
>
>>Date: Sat, 20 Dec 2003 11:59:22 +0000
>>From: Julian Field <mailscanner at ECS.SOTON.AC.UK>
>>Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
>>To: MAILSCANNER at JISCMAIL.AC.UK
>>Subject: Re: bigevil usage... confused
>>
>>At 03:09 20/12/2003, you wrote:
>>
>>
>>>Gang,
>>>   I've been following the "bigevil.cf" thread...  I
>>>downloaded it and put it into /etc/mail/spamassassin,
>>>then did
>>>
>>>spamassassin -D -p /opt/MailScanner/etc/spam.assassin.prefs.conf --lint
>>>
>>>and saw:
>>>
>>>debug: using "/opt/perl5/share/spamassassin" for default rules dir
>>>debug: using "/etc/opt/mail/spamassassin" for site rules dir
>>>debug: using "/home/admin/jaearick/.spamassassin" for user state dir
>>>debug: using "/opt/MailScanner/etc/spam.assassin.prefs.conf" for user
>>>prefs file
>>>
>>>with *no* reference to bigevil.cf anywhere in the output.
>>>
>>>Hmmm...  I looked in /etc/opt/mail/spamassassin and found another
>>>local.cf file.  So I blew away this directory and made a symlink for
>>>this dir pointing to /etc/mail/spamassassin.  This directory contains
>>>a symlink for local.cf, which points to
>>>/opt/MailScanner/etc/spam.assassin.prefs.conf
>>>
>>>Tried the lint run again, still no reference to bigevil.cf in the output.
>>>Should I see one?  What have I snarled up here?  How to see if bigevil
>>>is getting used (no references to BigEvilList in the SA syslogging
>>>either).  Help.
>>>
>>>
>>Never forget that Unix filesystems log the time each file was last accessed.
>>So if you wait a couple of minutes, run your lint command, and then do
>>ls -lu /etc/mail/spamassassin
>>then it will print the "last used" time instead of the last modification
>>time. If the datestamp is now and not a couple of minutes ago, then the
>>file has been read by something.
>>
>>Very simple technique, but occasionally extremely useful.
>>--
>>Julian Field
>>www.MailScanner.info
>>Professional Support Services at www.MailScanner.biz
>>MailScanner thanks transtec Computers for their support
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>
>>
>
>
>




This message has been scanned for viruses and dangerous
content by MailScanner at danbird.net and is believed to be clean.