SpamAssassin gumming up the works

[Jeff A. Earickson]

Hi,
   MS 4.28.6 is pretty out-of-date compared to 4.39.6.  If you jumped
from SA 2.6x to 3.0.2, be sure to read the UPGRADE file in the SA
directory and do the Bayes database changes or things won't work
with SA.  Maybe turn off Bayes as a stop-gap measure in 3.0.2 and
see if things start working.  If they do, follow the Bayres db
upgrade instructions.

Jeff Earickson
Colby College

On Sat, 12 Mar 2005, Jason Balicki wrote:

> Date: Sat, 12 Mar 2005 15:31:17 -0600
> From: Jason Balicki <kodak at FRONTIERHOMEMORTGAGE.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: SpamAssassin gumming up the works
>
> First, let me apologize.  I'm rather sick and I'm running a high fever,
> so much
> so that I'm sure I'm probably partially incoherent and not checking obvious
> stuff.
>
> I've been running MailScanner for quite a long time, and when I've run into
> this issue before it's always been a RBL going dark or something that's
> causing the problem.  In this case, I don't think it is.
>
> A little background:  yesterday, my boss called me at home (I'm at home
> sick) and complained that they're getting spam delivered to the users@
> email address, which is an alias for all users.  The real problem is that
> the spam wasn't getting tagged as spam.
>
> First thing's first, I hadn't upgraded MailScanner or SpamAssassin in
> a while, so I got the most recent versions and started plugging away.
> (MailScanner 4.39.6 and Spamassassin 3.0.2 (the tarball says
> 4.0.2, what's up with that?))
>
> The problem that I've run into is that after the upgrade if I enable
> Use Spamassassin = yes in my MailScanner.conf then nothing gets
> delivered.  Well, I lie, if I send a few test messages through, those
> get delivered, but it seems like the first piece of spam (this is
> speculation)
> that I get gums up the works, and after that nothing goes through until
> I set Use SpamAssassin=no.   Then things come through, but, of
> course, there's no spam checks being done.
>
> Here's what I see in the logs:
> Mar 12 15:29:27 mail MailScanner[25723]: Using locktype = flock
> Mar 12 15:29:27 mail MailScanner[25723]: New Batch: Scanning 2 messages,
> 5505 bytes
> Mar 12 15:29:27 mail MailScanner[25723]: MCP Checks completed at 5505
> bytes per second
> Mar 12 15:29:27 mail MailScanner[25723]: Spam Checks: Starting
> Mar 12 15:29:31 mail MailScanner[25727]: SophosSAVI 3.91 (engine 2.28)
> recognizing 101433 viruses
> Mar 12 15:29:31 mail MailScanner[25727]: SophosSAVI using 85 IDE files
> Mar 12 15:29:31 mail MailScanner[25735]: MailScanner E-Mail Virus
> Scanner version 4.28.6 starting...
> Mar 12 15:29:34 mail MailScanner[25725]: Using locktype = flock
> Mar 12 15:29:34 mail MailScanner[25725]: New Batch: Scanning 2 messages,
> 5505 bytes
> Mar 12 15:29:34 mail MailScanner[25725]: MCP Checks completed at 5505
> bytes per second
> Mar 12 15:29:34 mail MailScanner[25725]: Spam Checks: Starting
> Mar 12 15:29:41 mail MailScanner[25737]: MailScanner E-Mail Virus
> Scanner version 4.28.6 starting...
>
> and after more messages come in:
>
> Mar 12 15:36:06 mail MailScanner[25969]: Using locktype = flock
> Mar 12 15:36:06 mail MailScanner[25969]: New Batch: Scanning 5 messages,
> 19152 bytes
> Mar 12 15:36:06 mail MailScanner[25969]: MCP Checks completed at 19152
> bytes per second
> Mar 12 15:36:06 mail MailScanner[25969]: Spam Checks: Starting
> Mar 12 15:36:08 mail MailScanner[25978]: MailScanner E-Mail Virus
> Scanner version 4.28.6 starting...
>
>
> And the number just keeps growing until I set Use SpamAssassin=no.
>
> As I mentioned, usually this is because of an RBL going dark,
> but I've set skip_rbl_checks 1 in my spam.assassin.prefs.conf
> (for testing).
>
> So, how can I trace this to find out where it's failing?  Have
> I done something obviously stupid?  Is there more information I can
> give to help someone help me figure this out?  Any flu remedy
> recommendations?
>
> Again, sorry if I haven't given enough information, but I'm
> not thinking clearly at the moment and any and all help is
> appreciated.
>
> Thanks,
>
> --J(K)
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!