FW: score=0 problem: SpamAssassin (not cached, score=0, required 5, autolearn=)

[donald.dawson at bakerbotts.com]

I have noticed that some spam has been creeping in.  We have 4 inbound
MX servers, but only has is experiencing this problem.

We are running SpamAssassin version 3.2.0, Perl version 5.8.3, and
MailScanner version 4.59.4.

Here are the counts of 'is not spam' and 'is spam' with 'score=0,'
(should not happen):

fgrep "score=0," /var/log/maillog | grep 'is not spam' | wc -l -- 649 
fgrep "score=0," /var/log/maillog | grep 'is spam' | wc -l -- 311 

Spamassasin is not showing any errors, and '/usr/bin/spamassassin -D -p
/etc/MailScanner/spam.assassin.prefs.conf --lint' does not show errors.

There are files in /dev/shm/ (.spamassassin*) that are being created,
and some are being left in that directory.  Here is an example of a file
that has been left on this ramdisk fs:

# grep l6PJ1iYV029369 /var/log/maillog 
Jul 25 14:01:51 houmx05 milter-greylist: l6PJ1iYV029369: skipping
greylist because this is the default action,
(from==kimharrison2 at srs.bis.na.blackberry.com>,
rcpt=<tracy.hallenberger at bakerbotts.com>,
addr=smtp02.bis.na.blackberry.com[216.9.248.49]) 
Jul 25 14:01:51 houmx05 sendmail[29369]: l6PJ1iYV029369:
from=<SRS0=R44+k6=MX=tmo.blackberry.net=kimharrison2 at srs.bis.na.blackber
ry.com>, size=654, class=0, nrcpts=1,
msgid=<2074773001-1185390040-cardhu_decombobulator_blackberry.rim.net-11
01465393- at bxe017.bisx.prod.on.blac, proto=ESMTP, daemon=MTA,
relay=smtp02.bis.na.blackberry.com [216.9.248.49]
Jul 25 14:01:51 houmx05 sendmail[29369]: l6PJ1iYV029369: Milter add:
header: X-Null-Tag: 3a576a56bd3b913802bbc7fd4c9f07ad
Jul 25 14:01:51 houmx05 sendmail[29369]: l6PJ1iYV029369: Milter add:
header: X-Greylist: Default is to whitelist mail, not delayed by
milter-greylist-3.0rc3 (houmx05.bakerbotts.com [204.194.98.17]); Wed, 25
Jul 2007 14:01:51 -0500 (CDT)
Jul 25 14:01:51 houmx05 sendmail[29369]: l6PJ1iYV029369:
to=<tracy.hallenberger at bakerbotts.com>, delay=00:00:00, mailer=esmtp,
pri=30654, stat=queued
Jul 25 14:01:53 houmx05 MailScanner[6850]: Message l6PJ1iYV029369 from
216.9.248.49
(srs0=r44+k6=mx=tmo.blackberry.net=kimharrison2 at srs.bis.na.blackberry.co
m) to bakerbotts.com is not spam, SpamAssassin (not cached, score=0,
required 5, autolearn=)
Jul 25 14:01:56 houmx05 sendmail[29452]: l6PJ1iYV029369:
to=<tracy.hallenberger at bakerbotts.com>, delay=00:00:05, xdelay=00:00:00,
mailer=esmtp, pri=120654, relay=housweep01.bakerbotts.net.
[10.20.254.236], dsn=2.0.0, stat=Sent (Message received OK)

# l .spamassassin29421Mvfyimtmp 
-rw-------  1 root root 1307 Jul 25 14:01 .spamassassin29421Mvfyimtmp 
Wed Jul 25 14:12:06 CDT 2007 

I'm wondering if it is a possible problem with the /dev/shm ram disk.
Can spamassassin be pointed to use another directory?

I would appreciate any help you can provide. 

Thanks, 
Donald 

Donald Dawson 
Security Administrator 
Baker Botts L.L.P. 
713-229-2183 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070725/1e7dc3d2/attachment.html