mailscanner not calling spamassassin?

Wed Nov 24 12:28:54 GMT 2004

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

The mail logs show this for a batch. I have mailscanner running on a
test server at the moment and am using mail taken from the real mail
server and copying it into the queue.
**********************************************************************************

Nov 24 13:12:45 uncledeadly MailScanner[28189]: MailScanner E-Mail Virus
Scanner version 4.35.11 starting...
Nov 24 13:12:47 uncledeadly MailScanner[28189]: lock.pl sees Config
LockType =  posix
Nov 24 13:12:47 uncledeadly MailScanner[28189]: lock.pl sees have_module
=  0
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Using locktype = posix
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Creating hardcoded
struct_flock subroutine for linux (Linux-type)
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Apparently invalid line
in queue file!- continuing anyway.
Nov 24 13:12:47 uncledeadly MailScanner[28189]: New Batch: Scanning 4
messages, 50809 bytes
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Created attachment dirs
for 4 messages
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Spam Checks: Starting
Nov 24 13:12:47 uncledeadly MailScanner[28189]: SpamAssassin returned 0
Nov 24 13:12:47 uncledeadly MailScanner[28189]: Message 1CWtY9-0005JX-5v
from xxxxxx (xxxxxx at xxxxxx.ie) to xxxxxx.com is not spam, SpamAssassin
(score=0, required 4.55)
Nov 24 13:12:48 uncledeadly MailScanner[28189]: SpamAssassin returned 0
Nov 24 13:12:48 uncledeadly MailScanner[28189]: Message 1CWtZj-0005KP-8y
from xxxxxx (xxxxxx at xxxxxx.ie) to xxxxxx.com is not spam, SpamAssassin
(score=0, required 4.55)
Nov 24 13:12:48 uncledeadly MailScanner[28189]: SpamAssassin returned 0
Nov 24 13:12:48 uncledeadly MailScanner[28189]: Message 1CWtOC-0005GA-CB
from 127.0.0.1 (result: 509) to  is not spam, SpamAssassin (score=0,
required 4.55)
Nov 24 13:12:48 uncledeadly MailScanner[28189]: SpamAssassin returned 0
Nov 24 13:12:48 uncledeadly MailScanner[28189]: Message 1CWtz2-0005Ug-JF
from xxxxxx (xxxxxx at xxxxxx.ie) to xxxxxx.com is not spam, SpamAssassin
(score=0, required 4.55)
Nov 24 13:12:50 uncledeadly MailScanner[28189]: Virus and Content
Scanning: Starting
Nov 24 13:12:50 uncledeadly MailScanner[28189]: Commencing scanning by
trend...
Nov 24 13:12:50 uncledeadly MailScanner[28189]: Completed scanning by trend
Nov 24 13:12:50 uncledeadly MailScanner[28189]: About to deliver 4 messages
Nov 24 13:12:50 uncledeadly MailScanner[28189]: Uninfected: Delivered 4
messages
Nov 24 13:12:50 uncledeadly MailScanner[28189]: MailScanner child dying
of old age

This is a copy of the headers section of the mail:
**********************************************************************************

178P Received: from xxxxxx.com ([xxxxxx])
        by xxxxxx.xxxxxx.ie with esmtp (Exim 4.34)
        id 1CWtz2-0005Ug-JF
        for xxxxxx at xxxxxx.com; Wed, 24 Nov 2004 10:02:44 +0000
130  Received: (from xxxxxx at xxxxxx)
        by xxxxxx.com (xxxxxx) id iAOA6ACj098278;
        Wed, 24 Nov 2004 03:06:10 -0700 (MST)
095  X-Authentication-Warning: newsvendor.com: newsvend set sender to
xxxxxx at xxxxxx.ie using -f
197  Received: from xxxxxx.ie (xxxxxx.ie [xxxxxx])
        by xxxxxx.com (xxxxxx) with ESMTP id iAOA69LB098246
        for <xxxxxx at xxxxxx.ie>; Wed, 24 Nov 2004 03:06:09 -0700 (MST)
124  Received: from xxxxxx (xxx.xxx.xxx.xxx) by xxxxxx (NPlex 2.0.108)
for xxxxxx at xxxxxx.ie; 24 Nov 2004 10:02:35 +0000
056I Message-ID: <xxxxxx>
045F From: "xxxxxx" <xxxxxx at xxxxxx.ie>
021T To: <xxxxxx at xxxxxx.ie>
085  Subject: Blah Blah Blah Blah Blah Blah Blah Blah Blah
038  Date: Wed, 24 Nov 2004 10:05:56 -0000
018  MIME-Version: 1.0
048  Content-Type: text/plain;
        charset="iso-8859-1"
032  Content-Transfer-Encoding: 7bit
014  X-Priority: 3
026  X-MSMail-Priority: Normal
051  X-Mailer: Microsoft Outlook Express 6.00.2800.1409
057  X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
029S Sender: xxxxxx at xxxxxx.ie
017  Precedence: bulk
025R Reply-To: xxxxxx at xxxxxx.ie
034  X--MailScanner: Found to be clean
041  X-MailScanner-From: xxxxxx at xxxxxx.ie

And heres a debug message from using spamassassin on one of the messages
individually. It gives a non zero result.
**********************************************************************************
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/bin/X11', keeping.
debug: Final PATH set to:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11
debug: using "/usr/share/spamassassin" for default rules dir
debug: using "/etc/spamassassin" for site rules dir
debug: using "/root/.spamassassin" for user state dir
debug: using "/root/.spamassassin/user_prefs" for user prefs file
debug: Failed to parse line in SpamAssassin configuration, skipping:
Spam Score Number Format = %5.2f
debug: bayes: 29101 tie-ing to DB file R/O
/var/lib/MailScanner/bayes/bayes_toks
debug: bayes: 29101 tie-ing to DB file R/O
/var/lib/MailScanner/bayes/bayes_seen
debug: bayes: found bayes db version 2
debug: Score set 3 chosen.
debug: Initialising learner
debug: running header regexp tests; score so far=0
debug: running body-text per-line regexp tests; score so far=3.916
debug: bayes corpus size: nspam = 3105, nham = 287
debug: uri tests: Done uriRE
debug: tokenize: header tokens for X-Mail-Format-Warning = "Bad RFC2822
header formatting in 1CWtOC-0005GA-CB-D"
debug: tokenize: header tokens for Client = "xxxxxxxxxxxxxx "
debug: tokenize: header tokens for <Result = "509>"
debug: tokenize: header tokens for Message = "That"
debug: tokenize: header tokens for X-Mail-Format-Warning = "Bad RFC2822
header formatting in 1CWtOC-0005GA-CB-D Bad RFC2822 header formatting in XX"
debug: tokenize: header tokens for https =
"//xxxxxxxxxxxxxx/xxxxxxxxxxxxxx/xxxxxxxxxxxxxx?g=xxxxxxxxxxxxxx"
debug: bayes token '509' => 0.00444628099173554
debug: bayes token 'HX-Mail-Format-Warning:Bad' => 0.988731707317073
debug: bayes token 'HX-Mail-Format-Warning:formatting' => 0.988731707317073
debug: bayes token 'HX-Mail-Format-Warning:RFC2822' => 0.988731707317073
debug: bayes token 'N:HX-Mail-Format-Warning:RFCNNNN' => 0.988731707317073
debug: bayes token 'HX-Mail-Format-Warning:header' => 0.988731707317073
debug: bayes token 'sk:X-MailS' => 0.0173548387096774
debug: bayes token '032' => 0.978
debug: bayes token '034' => 0.978
debug: bayes token 'MailScanner' => 0.112757412645574
debug: bayes token 'Found' => 0.142825979212285
debug: bayes: score = 0.598227219027678
debug: Syncing Bayes journal and expiring old tokens...
debug: lock: 29101 created
/var/lib/MailScanner/bayes/bayes.lock.xxxxxxxxxxxxxx.xxxxxxxxxxxxxx.ie.29101
debug: lock: 29101 trying to get lock on
/var/lib/MailScanner/bayes/bayes with 0 retries
debug: lock: 29101 link to /var/lib/MailScanner/bayes/bayes.lock: link ok
debug: bayes: 29101 tie-ing to DB file R/W
/var/lib/MailScanner/bayes/bayes_toks
debug: bayes: 29101 tie-ing to DB file R/W
/var/lib/MailScanner/bayes/bayes_seen
debug: bayes: found bayes db version 2
debug: synced Bayes databases from journal in 0 seconds: 11 unique
entries (11 total entries)
debug: bayes: 29101 untie-ing
debug: bayes: 29101 untie-ing db_toks
debug: bayes: 29101 untie-ing db_seen
debug: bayes: files locked, now unlocking lock
debug: unlock: 29101 unlink /var/lib/MailScanner/bayes/bayes.lock
debug: Syncing complete.
debug: bayes: 29101 untie-ing
debug: bayes: 29101 untie-ing db_toks
debug: Razor2 is not available
debug: running raw-body-text per-line regexp tests; score so far=3.916
debug: running uri tests; score so far=3.916
debug: uri tests: Done uriRE
debug: running full-text regexp tests; score so far=3.916
debug: Razor2 is not available
debug: Current PATH is:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11
debug: Pyzor is not available: pyzor not found
debug: DCCifd is not available: no r/w dccifd socket found.
debug: DCC is not available: no executable dccproc found.
debug: all '*From' addrs:
debug: all '*To' addrs:
debug: running meta tests; score so far=3.916
debug: is spam? score=3.917 required=4.7
tests=BAYES_56,DATE_MISSING,FROM_NO_LOWER
X-Mail-Format-Warning: Bad RFC2822 header formatting in 1CWtOC-0005GA-CB-D
Client: irishnation
<Result: 509>
Message: That
X-Mail-Format-Warning: Bad RFC2822 header formatting in XX
xxxxxxxxxxxxxxxxxxxxx
X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on
        xxxxxxxxxxxxxx.xxxxxxxxxxxxxx.ie
X-Spam-Level: ***
X-Spam-Status: No, hits=3.9 required=4.7 tests=BAYES_56,DATE_MISSING,
        FROM_NO_LOWER autolearn=no version=2.64

034  X--MailScanner: Found to be clean
032  X-MailScanner-From: result: 509

Brendan Cody-Kenny | brendan.codykenny at realexpayments.com
Network Administrator
Realex Payments

The Forum, 29-32 Glasthule Rd, Glasthule, Co Dublin, Ireland
t: +353 1 2808559 | f: +353 1 2808538

This mail and any documents attached are classified as confidential and are intended for use by the addressee(s) only unless otherwise indicated. If you are not an intended recipient of this email, you must not use, disclose, copy, distribute or retain this message or any part of it. If you have received this email in error, please notify us immediately and delete all copies of this email from your computer system(s).

Ugo Bellavance wrote:

> Brendan Cody-Kenny wrote:
>
>> Hello all,
>> I have been having some very annoying trouble lately with mailscanner
>> using spamassassin. As far as I have looked (which is pretty far) I have
>> correct settings for mailscanner and spamassassin. (spamassassin 2.64
>> and mailscanner 4.35.11)
>>
>> The problem is that mailscanner does not appear to be calling
>> spamassassin properly but is not generating any logs to indicate the
>> problem. I thought mailscanner was calling spamassassin and it was
>> returning 0 everytime but it turned out that "Always Include
>> SpamAssassin Report = yes" was giving every message a score of 0. After
>> changing this it appears that mailscanner is not running spamassassin at
>> all. I used strace on mailscanner and sifted though the results but
>> could not find anything conclusinve. A test of spamassassin from the
>> command line on a message returns a reasonable result (other than 0) for
>> a message but mailscanner is not doing this. I have included
>> Mailscanner.conf and spam.assassin.prefs.conf. Can anyone help? I hope
>> it is something really simple that I have misssed but I have been
>> looking at it for so long now that its invisible to me.
>
>
> What do you have in the headers?
>
> What do you get when you run MailScanner in debug with "Debut
> SpamaAssasin = yes"
>
> ?
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!