occasional bayes failure

[Glenn Steen]

2008/5/19 Greg Matthews <gmatt at nerc.ac.uk>:
> On one of my production relays I'm seeing occasional messages come through
> that seem to miss Bayes scanning. What could be the cause of this? The vast
> majority of low and high scoring spam shows a BAYES score but occasionally
> not:
>
> May 19 15:30:24 mailr-w MailScanner[28305]: Message m4JEUIY6031013 from
> 210.35.74.3 (customer.support at britannia.co.uk) to ceh.ac.uk is spam,
> SpamAssassin (cached, score=11.974, required 5, autolearn=spam,
> BOTNET_CLIENT 0.20, BOTNET_CLIENTWORDS 0.20, BOTNET_IPINHOSTNAME 0.30,
> BOTNET_SOHO -0.40, DCC_CHECK 1.70, FORGED_MUA_OUTLOOK 3.12,
> FORGED_OUTLOOK_HTML 0.00, FORGED_OUTLOOK_TAGS 0.00, HTML_MESSAGE 0.00,
> MIME_HTML_ONLY 1.46, MISSING_HEADERS 1.29, MSGID_FROM_MTA_HEADER 0.80,
> MSOE_MID_WRONG_CASE 0.82, RDNS_DYNAMIC 0.10, SPF_SOFTFAIL 0.60,
> URIBL_PH_SURBL 1.79)
>
> I've checked the permissions of /etc/MailScanner/bayes and they are exactly
> like my other two production hosts. I've --restore'd from a bayes backup
> (from another relay) but I'm still seeing occasional log entries with no
> BAYES score.
>
> a --lint run shows nothing out of the ordinary. The only slightly iffy log
> that I've seen is when doing a --force-expire I see this:
>
> dbg: bayes: can't use estimation method for expiry, unexpected
> result, calculating optimal atime delta
>
> but googling for this suggests it is quite common.
>
> I looked for spamassassin timeouts but I dont have any past 1/20 (assume it
> retries up to 20 times) and these dont correspond chronologically with the
> bayes misses. Also, this is not the busiest of the three relays. The busiest
> shows no such problem.
>
> any help appreciated.
>
> GREG
Are all the relevant ones using cached results? If so, SA is never run
on them... That is, after all, the whole point of the SA result
cache:-).
Not sure if that could have something to do with it. Perhaps worth
checking though.

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se