Spam assassin timeouts
vinayan KP
mailwatch.kp at gmail.com
Wed Dec 10 09:33:02 GMT 2008
Dear Ram,
Thank you very much for your mail. I learned linux just recently I am
not an expert. I normally used to try things whenever I get time but
now I hardly have any time these days to sit and feel dont have enough
knowledge to fix this problem. A third party installed and configured
mailscanner for us couple of years back but that company does not
exist anymore. Hope you would be able to help me out.
The following are the size of bayes file. Are thse alright? The
bayes_seen file is too large but it was like this for a long time and
was working alright.
-rw------- 1 root root 9.4K Dec 10 14:29 bayes_journal
-rw-rw-rw- 1 root root 5.7K Dec 10 14:29 bayes.mutex
-rw------- 1 root root 167M Dec 10 14:26 bayes_seen
-rw------- 1 root root 9.7M Dec 10 14:28 bayes_toks
-rw------- 1 root root 12K Dec 9 10:35 bayes_toks.expire10686
-rw------- 1 root root 12K Dec 10 00:12 bayes_toks.expire11495
-rw------- 1 root root 12K Dec 8 19:22 bayes_toks.expire11824
-rw------- 1 root root 12K Dec 8 20:40 bayes_toks.expire13768
-rw------- 1 root root 12K Dec 10 07:48 bayes_toks.expire28490
-rw------- 1 root root 12K Dec 7 21:22 bayes_toks.expire31832
-rw------- 1 root root 0 Dec 2 04:04 __db.bayes_toks.expire12682
-rw------- 1 root root 12K Nov 27 18:58 __db.bayes_toks.expire14247
-rw------- 1 root root 12K Sep 6 06:22 __db.bayes_toks.expire15605
-rw------- 1 root root 12K Nov 14 14:38 __db.bayes_toks.expire15684
-rw------- 1 root root 4.0K Sep 2 07:48 __db.bayes_toks.expire1745
-rw------- 1 root root 12K Dec 2 08:39 __db.bayes_toks.expire20880
-rw------- 1 root root 12K Dec 6 00:18 __db.bayes_toks.expire23304
-rw------- 1 root root 0 Dec 4 16:39 __db.bayes_toks.expire23851
-rw------- 1 root root 0 Oct 26 19:52 __db.bayes_toks.expire24361
-rw------- 1 root root 0 Sep 2 04:52 __db.bayes_toks.expire29096
-rw------- 1 root root 12K Nov 11 17:37 __db.bayes_toks.expire30758
-rw------- 1 root root 12K Oct 23 18:31 __db.bayes_toks.expire31745
-rw------- 1 root root 4.0K Dec 9 05:28 __db.bayes_toks.expire32018
-rw------- 1 root root 0 Nov 21 04:07 __db.bayes_toks.expire32087
-rw------- 1 root root 12K Dec 5 15:17 __db.bayes_toks.expire3656
-rw------- 1 root root 0 Dec 4 05:45 __db.bayes_toks.expire5747
-rw------- 1 root root 12K Oct 22 16:03 __db.bayes_toks.expire7440
-rw------- 1 root root 12K Nov 26 16:21 __db.bayes_toks.expire7458
-rw------- 1 root root 0 Sep 18 00:39 __db.bayes_toks.expire9575
-rw-r--r-- 1 root root 1.5K Dec 8 13:23 user_prefs
Today I found that not all messages are getting through with out
scanning but a majority of them are getting delivered with out getting
scanned. Those mails which are getting checked are properly tagged as
spam if they are actually spam,but a lot of spam mails gets through,
those apparantly are not scanned, as genuine mails thogh they are
actually spam.
As you said this is the output of
# spamassass -D -t < /path/somemail.eml 2>&1 | tee /tmp/sa_timeout.log
[13354] dbg: logger: adding facilities: all
[13354] dbg: logger: logging level is DBG
[13354] dbg: generic: SpamAssassin version 3.1.0
[13354] dbg: config: score set 0 chosen.
[13354] dbg: util: running in taint mode? yes
[13354] dbg: util: taint mode: deleting unsafe environment variables,
resetting PATH
[13354] dbg: util: PATH included '/usr/kerberos/sbin', keeping
[13354] dbg: util: PATH included '/usr/kerberos/bin', keeping
[13354] dbg: util: PATH included '/usr/local/sbin', keeping
[13354] dbg: util: PATH included '/usr/local/bin', keeping
[13354] dbg: util: PATH included '/sbin', keeping
[13354] dbg: util: PATH included '/bin', keeping
[13354] dbg: util: PATH included '/usr/sbin', keeping
[13354] dbg: util: PATH included '/usr/bin', keeping
[13354] dbg: util: PATH included '/usr/X11R6/bin', keeping
[13354] dbg: util: final PATH set to:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
[13354] dbg: dns: is Net::DNS::Resolver available? yes
[13354] dbg: dns: Net::DNS version: 0.49
[13354] dbg: dns: name server: 192.168.0.9, family: 2, ipv6: 0
[13354] dbg: config: using "/etc/mail/spamassassin" for site rules pre files
[13354] dbg: config: read file /etc/mail/spamassassin/init.pre
[13354] dbg: config: read file /etc/mail/spamassassin/v310.pre
[13354] dbg: config: using "/usr/share/spamassassin" for sys rules pre files
[13354] dbg: config: using "/usr/share/spamassassin" for default rules dir
[13354] dbg: config: read file /usr/share/spamassassin/10_misc.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_advance_fee.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_anti_ratware.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_body_tests.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_compensate.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_drugs.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_head_tests.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_html_tests.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_meta_tests.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_net_tests.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_phrases.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_porn.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_ratware.cf
[13354] dbg: config: read file /usr/share/spamassassin/20_uri_tests.cf
[13354] dbg: config: read file /usr/share/spamassassin/23_bayes.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_accessdb.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_antivirus.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_body_tests_es.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_body_tests_pl.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_dcc.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_domainkeys.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_hashcash.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_pyzor.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_razor2.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_replace.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_spf.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_textcat.cf
[13354] dbg: config: read file /usr/share/spamassassin/25_uribl.cf
[13354] dbg: config: read file /usr/share/spamassassin/30_text_de.cf
[13354] dbg: config: read file /usr/share/spamassassin/30_text_fr.cf
[13354] dbg: config: read file /usr/share/spamassassin/30_text_it.cf
[13354] dbg: config: read file /usr/share/spamassassin/30_text_nl.cf
[13354] dbg: config: read file /usr/share/spamassassin/30_text_pl.cf
[13354] dbg: config: read file /usr/share/spamassassin/30_text_pt_br.cf
[13354] dbg: config: read file /usr/share/spamassassin/50_scores.cf
[13354] dbg: config: read file /usr/share/spamassassin/60_awl.cf
[13354] dbg: config: read file /usr/share/spamassassin/60_whitelist.cf
[13354] dbg: config: read file /usr/share/spamassassin/60_whitelist_spf.cf
[13354] dbg: config: read file /usr/share/spamassassin/60_whitelist_subject.cf
[13354] dbg: config: using "/etc/mail/spamassassin" for site rules dir
[13354] dbg: config: read file /etc/mail/spamassassin/local.cf
[13354] dbg: config: read file /etc/mail/spamassassin/mailscanner.cf
[13354] dbg: config: using "/root/.spamassassin" for user state dir
[13354] dbg: config: using "/root/.spamassassin/user_prefs" for user prefs file
[13354] dbg: config: read file /root/.spamassassin/user_prefs
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
[13354] dbg: plugin: registered
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9f4abd8)
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
[13354] dbg: plugin: registered
Mail::SpamAssassin::Plugin::Hashcash=HASH(0x9f696f4)
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
[13354] dbg: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x9f89828)
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor from @INC
[13354] dbg: pyzor: network tests on, attempting Pyzor
[13354] dbg: plugin: registered
Mail::SpamAssassin::Plugin::Pyzor=HASH(0x9f9d9bc)
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::SpamCop from @INC
[13354] dbg: reporter: network tests on, attempting SpamCop
[13354] dbg: plugin: registered
Mail::SpamAssassin::Plugin::SpamCop=HASH(0xa0179d8)
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::AWL from @INC
[13354] dbg: plugin: registered Mail::SpamAssassin::Plugin::AWL=HASH(0xa0466f4)
[13354] dbg: plugin: loading
Mail::SpamAssassin::Plugin::AutoLearnThreshold from @INC
[13354] dbg: plugin: registered
Mail::SpamAssassin::Plugin::AutoLearnThreshold=HASH(0xa1e4fe4)
[13354] dbg: plugin: loading
Mail::SpamAssassin::Plugin::WhiteListSubject from @INC
[13354] dbg: plugin: registered
Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0xa1efc20)
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEHeader from @INC
[13354] dbg: plugin: registered
Mail::SpamAssassin::Plugin::MIMEHeader=HASH(0xa1f9a3c)
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::ReplaceTags from @INC
[13354] dbg: plugin: registered
Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0xa2093c8)
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::RelayCountry from @INC
[13354] dbg: plugin: registered
Mail::SpamAssassin::Plugin::RelayCountry=HASH(0x9ee4fc4)
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
[13354] dbg: plugin: did not register
Mail::SpamAssassin::Plugin::SPF=HASH(0x9ee5000), already registered
[13354] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
[13354] dbg: plugin: did not register
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9f899b4), already
registered
[13354] dbg: config: adding redirector regex:
/^http:\/\/chkpt\.zdnet\.com\/chkpt\/\w+\/(.*)$/i
[13354] dbg: config: adding redirector regex:
/^http:\/\/www(?:\d+)?\.nate\.com\/r\/\w+\/(.*)$/i
[13354] dbg: config: adding redirector regex:
/^http:\/\/.+\.gov\/(?:.*\/)?externalLink\.jhtml\?.*url=(.*?)(?:&.*)?$/i
[13354] dbg: config: adding redirector regex:
/^http:\/\/redir\.internet\.com\/.+?\/.+?\/(.*)$/i
[13354] dbg: config: adding redirector regex:
/^http:\/\/(?:.*?\.)?adtech\.de\/.*(?:;|\|)link=(.*?)(?:;|$)/i
[13354] dbg: config: adding redirector regex:
m'^http.*?/redirect\.php\?.*(?<=[?&])goto=(.*?)(?:$|[&\#])'i
[13354] dbg: config: adding redirector regex:
m'^https?:/*(?:[^/]+\.)?emf\d\.com/r\.cfm.*?&r=(.*)'i
[13354] info: config: failed to parse line, skipping: dcc_path
/usr/local/bin/dccproc
[13354] dbg: plugin:
Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0xa2093c8) implements
'finish_parsing_end'
[13354] dbg: replacetags: replacing tags
[13354] dbg: replacetags: done replacing tags
[13354] dbg: config: using "/root/.spamassassin" for user state dir
[13354] dbg: bayes: tie-ing to DB file R/O /root/.spamassassin/bayes_toks
[13354] dbg: bayes: tie-ing to DB file R/O /root/.spamassassin/bayes_seen
[13354] dbg: bayes: found bayes db version 3
[13354] dbg: bayes: opportunistic call attempt skipped, found fresh
running expire magic token
[13354] dbg: config: score set 3 chosen.
[13354] dbg: dns: dns_available set to yes in config file, skipping test
[13354] dbg: metadata: X-Spam-Relays-Trusted:
[13354] dbg: metadata: X-Spam-Relays-Untrusted:
[13354] dbg: plugin:
Mail::SpamAssassin::Plugin::RelayCountry=HASH(0x9ee4fc4) implements
'extract_metadata'
[13354] dbg: metadata: X-Relay-Countries:
[13354] dbg: message: ---- MIME PARSER START ----
[13354] dbg: message: main message type: text/plain
[13354] dbg: message: parsing normal part
[13354] dbg: message: added part, type: text/plain
[13354] dbg: message: ---- MIME PARSER END ----
[13354] dbg: message: no encoding detected
[13354] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9f4abd8) implements
'parsed_metadata'
[13354] dbg: uri: parsed uri found, fedora.cdelinux.org
[13354] dbg: uri: cleaned parsed uri, http://fedora.cdelinux.org
[13354] dbg: uri: cleaned parsed uri, fedora.cdelinux.org
[13354] dbg: uri: parsed domain, cdelinux.org
[13354] dbg: uri: parsed uri found, http://fedora.cdelinux.org
[13354] dbg: uri: cleaned parsed uri, http://fedora.cdelinux.org
[13354] dbg: uri: parsed domain, cdelinux.org
[13354] dbg: uri: parsed uri found, mailto:aftbrc at econdse.org
[13354] dbg: uri: cleaned parsed uri, mailto:aftbrc at econdse.org
[13354] dbg: uri: parsed domain, econdse.org
[13354] dbg: uri: parsed uri found, mailto:aftbrc at econdse.org
[13354] dbg: uri: parsed domain, econdse.org
[13354] dbg: uri: parsed uri found, mailto:aftbrc at econdse.org
[13354] dbg: uri: parsed domain, econdse.org
[13354] dbg: uri: parsed uri found, mailto:aftbrc at econdse.org
[13354] dbg: uri: parsed domain, econdse.org
[13354] dbg: uri: parsed uri found, fedora.cdelinux.org
[13354] dbg: uri: parsed domain, cdelinux.org
[13354] dbg: uri: parsed uri found, http://fedora.cdelinux.org
[13354] dbg: uri: parsed domain, cdelinux.org
[13354] dbg: uri: parsed uri found, fedora.cdelinux.org
[13354] dbg: uri: parsed domain, cdelinux.org
[13354] dbg: uri: parsed uri found, http://fedora.cdelinux.org
[13354] dbg: uri: parsed domain, cdelinux.org
[13354] dbg: uri: parsed uri found, mail.econdse.org
[13354] dbg: uri: cleaned parsed uri, http://mail.econdse.org
[13354] dbg: uri: cleaned parsed uri, mail.econdse.org
[13354] dbg: uri: parsed domain, econdse.org
[13354] dbg: uri: parsed uri found, http://mail.econdse.org
[13354] dbg: uri: cleaned parsed uri, http://mail.econdse.org
[13354] dbg: uri: parsed domain, econdse.org
[13354] dbg: uri: parsed uri found, mailto:aftbrc at econdse.org
[13354] dbg: uri: parsed domain, econdse.org
[13354] dbg: uri: parsed uri found, mailto:aftbrc at econdse.org
[13354] dbg: uri: parsed domain, econdse.org
[13354] dbg: uri: parsed uri found, fedora.cdelinux.org
[13354] dbg: uri: parsed domain, cdelinux.org
[13354] dbg: uri: parsed uri found, http://fedora.cdelinux.org
[13354] dbg: uri: parsed domain, cdelinux.org
[13354] dbg: uri: parsed uri found, fedora.cdelinux.org
[13354] dbg: uri: parsed domain, cdelinux.org
[13354] dbg: uri: parsed uri found, http://fedora.cdelinux.org
[13354] dbg: uri: parsed domain, cdelinux.org
[13354] dbg: uri: parsed uri found, mailto:sivakumah at ifg.com
[13354] dbg: uri: cleaned parsed uri, mailto:sivakumah at ifg.com
[13354] dbg: uri: parsed domain, ifg.com
[13354] dbg: uri: parsed uri found, mailto:aftbrc at econdse.org
[13354] dbg: uri: parsed domain, econdse.org
[13354] dbg: uri: parsed uri found,
mailto:1843019db925$3312bb48$61f0e2a9 at ifg.com
[13354] dbg: uri: cleaned parsed uri,
mailto:1843019db925$3312bb48$61f0e2a9 at ifg.com
[13354] dbg: uri: parsed domain, ifg.com
[13354] dbg: uri: parsed uri found, mailto:sivakumah at ifg.com
[13354] dbg: uri: parsed domain, ifg.com
[13354] dbg: uri: parsed uri found, mailto:aftbrc at econdse.org
[13354] dbg: uri: parsed domain, econdse.org
[13354] dbg: uri: parsed uri found, mailto:sivakumah at ifg.com
[13354] dbg: uri: parsed domain, ifg.com
[13354] dbg: uri: parsed uri found, http://pufigfeb.com/
[13354] dbg: uri: cleaned parsed uri, http://pufigfeb.com/
[13354] dbg: uri: parsed domain, pufigfeb.com
[13354] dbg: uri: parsed uri found, http://www.mailscanner.info/
[13354] dbg: uri: cleaned parsed uri, http://www.mailscanner.info/
[13354] dbg: uri: parsed domain, mailscanner.info
[13354] dbg: uridnsbl: domain mailscanner.info in skip list
[13354] dbg: uridnsbl: domains to query: cdelinux.org econdse.org pufigfeb.com
[13354] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set sblxbl-notfirsthop
[13354] dbg: dns: checking RBL sa-accredit.habeas.com., set habeas-firsttrusted
[13354] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set sblxbl
[13354] dbg: dns: checking RBL sa-other.bondedsender.org., set bsp-untrusted
[13354] dbg: dns: checking RBL combined.njabl.org., set njabl-notfirsthop
[13354] dbg: dns: checking RBL combined.njabl.org., set njabl
[13354] dbg: dns: checking RBL
combined-HIB.dnsiplists.completewhois.com., set whois
[13354] dbg: dns: checking RBL list.dsbl.org., set dsbl-notfirsthop
[13354] dbg: dns: checking RBL bl.spamcop.net., set spamcop
[13354] dbg: dns: checking RBL sa-trusted.bondedsender.org., set
bsp-firsttrusted
[13354] dbg: dns: checking RBL
combined-HIB.dnsiplists.completewhois.com., set whois-notfirsthop
[13354] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs-notfirsthop
[13354] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs
[13354] dbg: dns: checking RBL iadb.isipp.com., set iadb-firsttrusted
[13354] dbg: check: running tests for priority: 0
[13354] dbg: rules: running header regexp tests; score so far=0
[13354] dbg: plugin: registering glue method for
check_hashcash_double_spend
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x9f696f4))
[13354] dbg: plugin: registering glue method for
check_for_spf_helo_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ee5000))
[13354] dbg: spf: message was delivered entirely via trusted relays,
not required
[13354] dbg: eval: all '*From' addrs:
[13354] dbg: plugin: registering glue method for
check_subject_in_blacklist
(Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0xa1efc20))
[13354] dbg: plugin: registering glue method for check_hashcash_value
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x9f696f4))
[13354] dbg: eval: all '*To' addrs:
[13354] dbg: plugin: registering glue method for check_for_spf_neutral
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ee5000))
[13354] dbg: spf: message was delivered entirely via trusted relays,
not required
[13354] dbg: plugin: registering glue method for
check_for_spf_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ee5000))
[13354] dbg: rules: ran eval rule NO_RELAYS ======> got hit
[13354] dbg: plugin: registering glue method for check_for_spf_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ee5000))
[13354] dbg: plugin: registering glue method for
check_for_spf_helo_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ee5000))
[13354] dbg: rules: ran eval rule __ENV_AND_HDR_FROM_MATCH ======> got hit
[13354] dbg: plugin: registering glue method for
check_for_def_spf_whitelist_from
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ee5000))
[13354] dbg: spf: cannot get Envelope-From, cannot use SPF
[13354] dbg: spf: def_spf_whitelist_from: could not find useable envelope sender
[13354] dbg: plugin: registering glue method for check_for_spf_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ee5000))
[13354] dbg: rules: ran eval rule __UNUSABLE_MSGID ======> got hit
[13354] dbg: plugin: registering glue method for
check_subject_in_whitelist
(Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0xa1efc20))
[13354] dbg: plugin: registering glue method for
check_for_spf_whitelist_from
(Mail::SpamAssassin::Plugin::SPF=HASH(0x9ee5000))
[13354] dbg: spf: spf_whitelist_from: could not find useable envelope sender
[13354] dbg: rules: running body-text per-line regexp tests; score so far=-0.001
[13354] dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "-"
[13354] dbg: rules: ran body rule REPLICA_WATCH ======> got hit:
"Replica=20=0A= Rolex"
[13354] dbg: uri: running uri tests; score so far=2.899
[13354] dbg: rules: ran uri rule INFO_TLD ======> got hit: ".info/"
[13354] dbg: bayes: opportunistic call attempt skipped, found fresh
running expire magic token
[13354] dbg: bayes: corpus size: nspam = 350493, nham = 175182
[13354] dbg: bayes: score = 9.71445146547012e-15
[13354] dbg: bayes: opportunistic call attempt skipped, found fresh
running expire magic token
[13354] dbg: config: using "/root/.spamassassin" for user state dir
[13354] dbg: bayes: untie-ing
[13354] dbg: bayes: untie-ing db_toks
[13354] dbg: bayes: untie-ing db_seen
[13354] dbg: plugin: registering glue method for check_uridnsbl
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9f899b4))
[13354] dbg: rules: ran eval rule BAYES_00 ======> got hit
[13354] dbg: rules: running raw-body-text per-line regexp tests; score
so far=1.573
[13354] dbg: rules: running full-text regexp tests; score so far=1.573
[13354] dbg: plugin: registering glue method for check_pyzor
(Mail::SpamAssassin::Plugin::Pyzor=HASH(0x9f9d9bc))
[13354] dbg: pyzor: pyzor is not available: no pyzor executable found
[13354] dbg: pyzor: no pyzor found, disabling Pyzor
[13354] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9f4abd8) implements
'check_tick'
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: query for cdelinux.org took 33 seconds to look
up (multi.surbl.org.:cdelinux.org)
[13354] dbg: uridnsbl: queries completed: 1 started: 0
[13354] dbg: uridnsbl: queries active: DNSBL=2 NS=3 at Wed Dec 10 14:40:26 2008
[13354] dbg: check: running tests for priority: 500
[13354] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9f4abd8) implements
'check_post_dnsbl'
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: queries completed: 1 started: 1
[13354] dbg: uridnsbl: queries active: DNSBL=2 NS=2 at Wed Dec 10 14:40:26 2008
[13354] dbg: uridnsbl: waiting 2 seconds for URIDNSBL lookups to complete
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: queries completed: 1 started: 2
[13354] dbg: uridnsbl: queries active: A=1 DNSBL=2 NS=1 at Wed Dec 10
14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: domain "pufigfeb.com" listed (URIBL_AB_SURBL):
127.0.0.118
[13354] dbg: uridnsbl: domain "pufigfeb.com" listed (URIBL_WS_SURBL):
127.0.0.118
[13354] dbg: uridnsbl: domain "pufigfeb.com" listed (URIBL_JP_SURBL):
127.0.0.118
[13354] dbg: uridnsbl: domain "pufigfeb.com" listed (URIBL_OB_SURBL):
127.0.0.118
[13354] dbg: uridnsbl: domain "pufigfeb.com" listed (URIBL_SC_SURBL):
127.0.0.118
[13354] dbg: uridnsbl: query for pufigfeb.com took 33 seconds to look
up (multi.surbl.org.:pufigfeb.com)
[13354] dbg: uridnsbl: queries completed: 1 started: 0
[13354] dbg: uridnsbl: queries active: A=3 DNSBL=1 NS=1 at Wed Dec 10
14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: queries completed: 1 started: 2
[13354] dbg: uridnsbl: queries active: A=3 DNSBL=1 at Wed Dec 10 14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: query for econdse.org took 33 seconds to look
up (multi.surbl.org.:econdse.org)
[13354] dbg: uridnsbl: queries completed: 1 started: 0
[13354] dbg: uridnsbl: queries active: A=5 at Wed Dec 10 14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: queries completed: 1 started: 2
[13354] dbg: uridnsbl: queries active: A=4 at Wed Dec 10 14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: queries completed: 1 started: 1
[13354] dbg: uridnsbl: queries active: A=3 DNSBL=2 at Wed Dec 10 14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: queries completed: 1 started: 1
[13354] dbg: uridnsbl: queries active: A=2 DNSBL=3 at Wed Dec 10 14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: queries completed: 1 started: 1
[13354] dbg: uridnsbl: queries active: A=1 DNSBL=4 at Wed Dec 10 14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: queries completed: 1 started: 0
[13354] dbg: uridnsbl: queries active: DNSBL=5 at Wed Dec 10 14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: query for cdelinux.org took 33 seconds to look
up (sbl.spamhaus.org.:9.0.168.192)
[13354] dbg: uridnsbl: queries completed: 1 started: 0
[13354] dbg: uridnsbl: queries active: DNSBL=4 at Wed Dec 10 14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: query for cdelinux.org took 33 seconds to look
up (sbl.spamhaus.org.:8.0.168.192)
[13354] dbg: uridnsbl: queries completed: 1 started: 0
[13354] dbg: uridnsbl: queries active: DNSBL=3 at Wed Dec 10 14:40:26 2008
[13354] dbg: uridnsbl: select found 1 socks ready
[13354] dbg: uridnsbl: domain "pufigfeb.com" listed (URIBL_SBL):
"http://www.spamhaus.org/SBL/sbl.lasso?query=SBL69622"
[13354] dbg: uridnsbl: query for pufigfeb.com took 35 seconds to look
up (sbl.spamhaus.org.:2.96.176.94)
[13354] dbg: uridnsbl: queries completed: 1 started: 0
[13354] dbg: uridnsbl: queries active: DNSBL=2 at Wed Dec 10 14:40:28 2008
[13354] dbg: uridnsbl: done waiting for URIDNSBL lookups to complete
[13354] dbg: uridnsbl: aborting remaining lookups
[13354] dbg: rules: running meta tests; score so far=20.757
[13354] dbg: rules: running header regexp tests; score so far=22.703
[13354] dbg: rules: running body-text per-line regexp tests; score so far=22.703
[13354] dbg: uri: running uri tests; score so far=22.703
[13354] dbg: rules: running raw-body-text per-line regexp tests; score
so far=22.703
[13354] dbg: rules: running full-text regexp tests; score so far=22.703
[13354] dbg: check: running tests for priority: 1000
[13354] dbg: rules: running meta tests; score so far=22.703
[13354] dbg: rules: running header regexp tests; score so far=22.703
[13354] dbg: plugin: registering glue method for
check_from_in_auto_whitelist
(Mail::SpamAssassin::Plugin::AWL=HASH(0xa0466f4))
[13354] dbg: rules: running body-text per-line regexp tests; score so far=22.703
[13354] dbg: uri: running uri tests; score so far=22.703
[13354] dbg: rules: running raw-body-text per-line regexp tests; score
so far=22.703
[13354] dbg: rules: running full-text regexp tests; score so far=22.703
[13354] dbg: plugin:
Mail::SpamAssassin::Plugin::AutoLearnThreshold=HASH(0xa1e4fe4)
implements 'autolearn_discriminator'
[13354] dbg: learn: auto-learn: currently using scoreset 3,
recomputing score based on scoreset 1
[13354] dbg: learn: auto-learn: message score: 22.703, computed score
for autolearn: 20.122
[13354] dbg: learn: auto-learn? ham=0.1, spam=12, body-points=18.643,
head-points=0, learned-points=-2.599
[13354] dbg: learn: auto-learn? no: scored as spam but too few head
points (0 < 3)
[13354] dbg: check: is spam? score=22.703 required=5
[13354] dbg: check:
tests=BAYES_00,INFO_TLD,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS,REPLICA_WATCH,TO_CC_NONE,URIBL_AB_SURBL,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL
[13354] dbg: check:
subtests=__ENV_AND_HDR_FROM_MATCH,__NONEMPTY_BODY,__UNUSABLE_MSGID
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on fedora.cdelinux.org
X-Spam-Level: **********************
X-Spam-Status: Yes, score=22.7 required=5.0 tests=BAYES_00,INFO_TLD,
MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS,REPLICA_WATCH,TO_CC_NONE,
URIBL_AB_SURBL,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,
URIBL_WS_SURBL autolearn=no version=3.1.0
X-Spam-Report:
* -0.0 NO_RELAYS Informational: message was not relayed via SMTP
* 2.9 REPLICA_WATCH BODY: Message talks about a replica watch
* 1.3 INFO_TLD URI: Contains an URL in the INFO top-level domain
* -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
* [score: 0.0000]
* 1.6 URIBL_SBL Contains an URL listed in the SBL blocklist
* [URIs: pufigfeb.com]
* 3.8 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
* [URIs: pufigfeb.com]
* 4.1 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
* [URIs: pufigfeb.com]
* 2.1 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
* [URIs: pufigfeb.com]
* 3.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
* [URIs: pufigfeb.com]
* 4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
* [URIs: pufigfeb.com]
* 1.8 MISSING_SUBJECT Missing Subject: header
* -0.0 NO_RECEIVED Informational: message has no Received headers
* 0.1 TO_CC_NONE No To: or Cc: header
This is a MIME-encapsulated message
Subject: [SPAM]
X-Spam-Prev-Subject: (nonexistent)
--mBA0bKRY024855.1228869441/fedora.cdelinux.org
The original message was received at Wed, 10 Dec 2008 05:53:29 +0530
from [123.4.212.104]
----- The following addresses had permanent fatal errors -----
<aftbrc at econdse.org>
(reason: 550 5.1.1 <aftbrc at econdse.org>: Recipient address
rejected: User unknown in local recipient table)
----- Transcript of session follows -----
... while talking to mail.econdse.org.:
>>> DATA
<<< 550 5.1.1 <aftbrc at econdse.org>: Recipient address rejected: User
unknown in local recipient table
550 5.1.1 <aftbrc at econdse.org>... User unknown
<<< 554 5.5.1 Error: no valid recipients
--mBA0bKRY024855.1228869441/fedora.cdelinux.org
Content-Type: message/delivery-status
Reporting-MTA: dns; fedora.cdelinux.org
Arrival-Date: Wed, 10 Dec 2008 05:53:29 +0530
Final-Recipient: RFC822; aftbrc at econdse.org
Action: failed
Status: 5.1.1
Remote-MTA: DNS; mail.econdse.org
Diagnostic-Code: SMTP; 550 5.1.1 <aftbrc at econdse.org>: Recipient
address rejected: User unknown in local recipient table
Last-Attempt-Date: Wed, 10 Dec 2008 06:07:21 +0530
--mBA0bKRY024855.1228869441/fedora.cdelinux.org
Content-Type: message/rfc822
Return-Path: <sivakumah at ifg.com>
Received: from localhost ([123.4.212.104])
by fedora.cdelinux.org (8.13.4/8.13.4) with ESMTP id mBA0NSO1024395
for <aftbrc at econdse.org>; Wed, 10 Dec 2008 05:53:29 +0530
Message-ID: <1843019db925$3312bb48$61f0e2a9 at ifg.com>
From: "=?windows-1251?B?VGFnIEhldWVyIFdhdGNoZXM=?=" <sivakumah at ifg.com>
To: <aftbrc at econdse.org>
Subject: =?windows-1251?B?T2ZmaWNpbmUgUGFuZXJhaSBXYXRjaGVz?=
Date: Wed, 10 Dec 3609 08:29:57 +0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=----=_NextPart_000_0023_A1_87FD81A6.4603DD82
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-yoursite-MailScanner-Information: Please contact the ISP for more information
X-yoursite-MailScanner: Found to be clean
X-yoursite-MailScanner-From: sivakumah at ifg.com
X-Spam-Status: No
This is a multi-part message in MIME format.
------=_NextPart_000_0023_A1_87FD81A6.4603DD82
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
=0A=
=0A=
=0A=
Replica=20=0A=
Rolex models of the latest Baselworld 2009=20=0A=
designs have just been launched on our replica sites.=20=0A=
These are the first run of the=20=0A=
2009 models with inner Rolex inscriptions and better bands and cases.=20=0A=
=0A=
Only limited to 1000 pieces worldwide, they are expected to sell out within=
a=20=0A=
month.=20=0A=
Browse our shop=0A=
=0A=
--=20=0A=
This message has been scanned for viruses and=0A=
dangerous content by MailScanner, and is=0A=
believed to be clean.=0A=
=0A=
------=_NextPart_000_0023_A1_87FD81A6.4603DD82
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><HTML><HEAD>=
=0A=
<META http-equiv=3DContent-Type content=3D"text/html; iso-8859-1"><META con=
tent=3D"MSHTML 6.00.2900.2180" name=3DGENERATOR><STYLE></STYLE>=0A=
</HEAD><BODY bgColor=3D#ffffff>=0A=
<P align=3D"center"><FONT size=3D"3" face=3D"Arial"><FONT color=3D"#FF0000"=
><B>Replica=20=0A=
Rolex</B> </FONT><B><FONT color=3D"#FF0000">models of the latest Baselworld=
2009=20=0A=
designs have just been launched on our replica sites. </FONT></B></FONT></P>=
=0A=
<P align=3D"center"><B><FONT size=3D"3" face=3D"Arial">These are the first =
run of the=20=0A=
2009 models with inner Rolex inscriptions and better bands and cases. <BR>=
=0A=
Only limited to 1000 pieces worldwide, they are expected to sell out within=
a=20=0A=
month. </FONT></B></P>=0A=
<P align=3D"center"><B><A href=3D"http://pufigfeb.com/"></FONT><FONT face=
=3D"Arial">Browse our shop</A></B></P>=0A=
</BODY><br />--=20=0A=
<br />This message has been scanned for viruses and=0A=
<br />dangerous content by=0A=
<a href=3D"http://www.mailscanner.info/"><b>MailScanner</b></a>, and is=0A=
<br />believed to be clean.=0A=
</HTML>=0A=
------=_NextPart_000_0023_A1_87FD81A6.4603DD82--
--------
--mBA0bKRY024855.1228869441/fedora.cdelinux.org--
Spam detection software, running on the system "fedora.cdelinux.org", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
y for details.
Content preview: The original message was received at Wed, 10 Dec 2008
05:53:29 +0530 from [123.4.212.104] ----- The following addresses had
permanent fatal errors ----- <aftbrc at econdse.org> (reason: 550 5.1.1
<aftbrc at econdse.org>: Recipient address rejected: User unknown in local
recipient table) [...]
Content analysis details: (22.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 NO_RELAYS Informational: message was not relayed via SMTP
2.9 REPLICA_WATCH BODY: Message talks about a replica watch
1.3 INFO_TLD URI: Contains an URL in the INFO top-level domain
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000]
1.6 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: pufigfeb.com]
3.8 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: pufigfeb.com]
4.1 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: pufigfeb.com]
2.1 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: pufigfeb.com]
3.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: pufigfeb.com]
4.5 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: pufigfeb.com]
1.8 MISSING_SUBJECT Missing Subject: header
-0.0 NO_RECEIVED Informational: message has no Received headers
0.1 TO_CC_NONE No To: or Cc: header
I took this when spam assassin was timing out. Any idea whats happening ?
Looking forward for you valuable suggestion.
Thanks in advance
Vinu
On Mon, Dec 8, 2008 at 6:09 PM, ram <ram at netcore.co.in> wrote:
> On Mon, 2008-12-08 at 17:09 +0530, vinayan KP wrote:
>> Hello,
>>
>> We use a mailscanner installed almost three years ago and was working
>> perfectly till last week detecting and tagging each and every spam
>> mail correctly and letting only genuine mails untagged.
>>
>> Since last week I could see each user is getting a lot of spam mails
>> with out getting tagged as {Spam?} and I could see from the log the
>> following lines.
>>
>> Dec 8 16:54:13 fedora MailScanner[2162]: SpamAssassin timed out (with
>> no network checks) and was killed, failure 16 of 20
>> Dec 8 16:54:13 fedora MailScanner[2087]: SpamAssassin timed out (with
>> no network checks) and was killed, failure 19 of 20
>> Dec 8 16:54:18 fedora MailScanner[2050]: SpamAssassin timed out (with
>> no network checks) and was killed, failure 13 of 20
>> Dec 8 16:54:21 fedora MailScanner[2230]: SpamAssassin timed out (with
>> no network checks) and was killed, failure 15 of 20
>
>
>
> Lookup this List archive .. this has been asked multiple times here
> Usually it is DNS , but you seem to have these tests off already
>
> * Did you check your Bayes size
>
> * What is the h/w configuration on this server and what is the traffic
> (Remember h/w is usually much cheaper than wasting too much time trying
> to diagnose a load issue unless it is obvious )
>
>
> Anyway When you machine starts timing out SA
> run
> spamassass -D -t < /path/somemail.eml 2>&1 | tee /tmp/sa_timeout.log
>
> The logfile should give you enough inputs, else post it here
>
>
>
>
>
>
>
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
More information about the MailScanner
mailing list