AWL problems
Dave Duffner - PSCGi
webalizer at NWCWEB.COM
Wed Apr 27 16:42:13 IST 2005
Martin,
Ensim's whacky modification of the MS/SA package in
their Ensim Pro 4.XX versions (FC 1/2 & RHEL) are not standard
by any means. I've asked 1,000 times for someone to clarify
how the mail is passed through the processes to determine
which 'entity' gets what when in order to fix problems like
this and others where it's tagged strangely.
Ensim does use a fully chrooted environment, which I
know drives everyone insane, but may be part of the problem.
Not sure what Chris is using to know if we match or if he
has a totally different setup with the same problem.
In my case, I'm told mail is handled as follows:
In to MailScanner (currently 4.63 I believe?)
MS checks it against my internal and externally selected BL's
If MS tags it as spam, we changed it to read [Spam-MS]
If it's tagged, depending on the settings it's delivered
as an attachment or dumped at that point.
If it passes cleanly, then it's tossed to SpamAssassin
(currently the 3.02 patch from Ensim version)
SA then uses my rulesets to determine if it is to be
checked and not whitelisted (not AWL'ed)
If pass, then SA performs my ruleset checks for spam
(RulesdeJour & custom rulesets, etc.)
If SA finds it as Spam, tags it [SA-Spam] so we know which
process did what to it.
If passed or below the threshold, delivered to User.
Now, from what little I can gather from Ensim folks &
forums, these processes should be running as 'root'. One thing
that never surfaced until you mentioned it here was the fact
that Ensim (or something) is writing a .spamassassin dir in
each domain and for each user that holds the Bayes & AWL info
along with anything else specific for that User.
Reason here may be that Ensim Pro gives the option to
have spam handling done via the GUI either by just the server
alone or optionally by each User in their GUI. They get to
set the threshold of spam, personal whitelists, etc. and
determine if it should hold spam or just delete it if it's
been tagged by SA. MS tagging is prior to SA handling, so
any options picked by the User would only apply if SA got to
process the mail in question. We have User Spam Controls
turned on as a percentage of our Users like the more direct
control and it saves us hassles of 'censorship' if we were
the only party determining what's spam and what's not.
Again, I did go in and nail the AWL file for the account
I get MailScanner mail to. That did stop the AWL rating from
appearing until it had built a file back up. I can't find a
spot to stop SA from creating that file once I've deleted it,
I'm presuming that's my whole problem there.
As a side note, I've also noticed MS skipping some
e-mails, we don't do a volume where that should be happening
but I did increase some settings that seem to have lowered
the skip rate to a level we can deal with.
There is an option with this Ensim goofy setup to
double-run SA if you change the MailScanner.conf file, but
we have that set to only use the SA prefs file and all those
settings in the MS.conf file are disabled/commented out, etc.
So as far as I can see, the flow above is what's happening
and MS is the lead application in handling mail to be scanned.
Any questions, don't hestitate to fire away!
Thanks,
Dave
> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Martin Hepworth
> Sent: Wednesday, April 27, 2005 11:14 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: AWL problems
>
>
> Dave
>
> the awl will (should) only get created for the user
> MailScanner runs as.
>
> Are you sure you're running SA from the MTA/procmail etc??
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Dave Duffner - PSCGi wrote:
> > See now he's hitting the same wall I am...
> >
> > Even deleting the AWL's for the individual accounts, MS is
> > still compiling the AWL file. And that's with all the
> config points
> > possible turned off, MS indicating that autolearn is disabled.
> >
> > Since deleting the AWL file in the .spamassassin
> dir for each
> > user, it's lowered the point value back down to 0.0 and then starts
> > averaging it back up. Julian's ratings for his posts here
> that I get
> > stopped AWL rating it, then started with a 0.0 and as I get more of
> > his posts I think we're up to a 0.9 rating. Once it sees enough of
> > his posts, it'll be back to tagging his mail until I kill that AWL
> > file in that account's dir again.
> >
> > Chris may not be that far along in the process yet, but it
> > certainly sounds like he's heading in that direction.
> >
> > So either we've got a weird bug or there's some
> setting being
> > overridden or hidden somewhere so deep that it's triggering the AWL
> > ratings again. And with a ton of accounts, that's a serious PIA to
> > have to manually delete AWL files on a constant basis to
> kill it off.
> >
> > I'm open for any suggestions, scripts, cron jobs or
> otherwise
> > to get that fool thing stopped. In our case we're using an Ensim
> > Hosting OS, so we're stuck with 3.XX of SA as any upgrades that
> > might've fixed this would either foul up Ensim or be overwritten in
> > the next half-a'ed upgrade or patch from Ensim for the OS.
> >
> > David J. Duffner
> > President
> > PSCGi
> > Paradise Shore Communications Group
> > www.pscginternet.com
> >
> >
> >
> >>-----Original Message-----
> >>From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> >>Behalf Of Martin Hepworth
> >>Sent: Wednesday, April 27, 2005 10:49 AM
> >>To: MAILSCANNER at JISCMAIL.AC.UK
> >>Subject: Re: AWL problems
> >>
> >>
> >>Chris
> >>
> >>if you're using SA 3.x this doesn't work. You'll need to
> turn it off
> >>in the SA config files.
> >>
> >>--
> >>Martin Hepworth
> >>Snr Systems Administrator
> >>Solid State Logic
> >>Tel: +44 (0)1865 842300
> >>
> >>
> >>Fractal IT Dept. wrote:
> >>
> >>>Hi everyone,
> >>>
> >>>I'm having a problem with ham becoming spam because it
> receives AWL
> >>>points. I'm not sure why this is happening, because in my
> >>>mailscanner.conf file, I have:
> >>>
> >>>SpamAssassin Auto Whitelist = no
> >>>
> >>>Any thoughts as to what could possibly be causing this?
> >>>
> >>>Thanks,
> >>>Chris
> >
> >
> >
> > I--I
> > Message scanned by MailScanner, and is believed to be clean.
> > CONFIDENTIALITY NOTICE: This transmission intended for the
> specified
> > destination and person. If this is not you, this
> > e-mail must be deleted immediately. www.pscginternet.com
> >
> > ------------------------ MailScanner list
> ------------------------ To
> > unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> > mailscanner' in the body of the email. Before posting, read
> the Wiki
> > (http://wiki.mailscanner.info/) and the archives
> > (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential
> and intended solely for the use of the individual or entity
> to whom they are addressed. If you have received this email
> in error please notify the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk with the words: 'leave mailscanner'
> in the body of the email. Before posting, read the Wiki
> (http://wiki.mailscanner.info/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> I--I
> Message scanned by MailScanner, and is believed to be clean.
> CONFIDENTIALITY NOTICE: This transmission intended for the
> specified destination and person. If this is not you, this
> e-mail must be deleted immediately. www.pscginternet.com
>
I--I
Message scanned by MailScanner, and is believed to be clean.
CONFIDENTIALITY NOTICE: This transmission intended for the
specified destination and person. If this is not you, this
e-mail must be deleted immediately. www.pscginternet.com
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner
mailing list