Local State Dir - /var/lib/spamassassin - SARE rules no hits

[Glenn Steen]

2008/11/26 Daniel Flensburg <Daniel.Flensburg at iris.se>:
> Ok, running spamassassin -D -t /var/spool/MailScanner/quarantine/20081126/spam/5CADB8739E.14348, gives me:
>
> [3924] dbg: config: using "/etc/spamassassin" for site rules pre files
> [3924] dbg: config: read file /etc/spamassassin/init.pre
> [3924] dbg: config: read file /etc/spamassassin/v310.pre
> [3924] dbg: config: read file /etc/spamassassin/v312.pre
> [3924] dbg: config: using "/var/lib/spamassassin/3.001004" for sys rules pre files
> [3924] dbg: config: read file /var/lib/spamassassin/3.001004/saupdates_openprotect_com.pre
> [3924] dbg: config: read file /var/lib/spamassassin/3.001004/updates_spamassassin_org.pre
> [3924] dbg: config: using "/var/lib/spamassassin/3.001004" for default rules dir
> [3924] dbg: config: read file /var/lib/spamassassin/3.001004/70_sare_adult_cf_sare_sa-update_dostech_net.cf
> [...]
> [3924] dbg: config: read file /var/lib/spamassassin/3.001004/saupdates_openprotect_com.cf
> [3924] dbg: config: read file /var/lib/spamassassin/3.001004/sought_rules_yerp_org.cf
> [3924] dbg: config: read file /var/lib/spamassassin/3.001004/updates_spamassassin_org.cf
> [3924] dbg: config: using "/etc/spamassassin" for site rules dir
> [3924] dbg: config: read file /etc/spamassassin/FuzzyOcr.cf
> [3924] dbg: config: read file /etc/spamassassin/mailscanner.cf
> [3924] dbg: config: read file /etc/spamassassin/pdfinfo.cf
> [3924] dbg: config: using "/var/spool/postfix/.spamassassin" for user state dir
> [3924] dbg: config: mkdir /var/spool/postfix/.spamassassin failed: mkdir /var/spool/postfix/.spamassassin: Permission denied at /usr/share/perl5/Mail/SpamAssassin.pm line 1491
> [3924] dbg: config: Permission denied
> [3924] dbg: config: using "/var/spool/postfix/.spamassassin" for user state dir
> [3924] dbg: config: mkdir /var/spool/postfix/.spamassassin failed: mkdir /var/spool/postfix/.spamassassin: Permission denied at /usr/share/perl5/Mail/SpamAssassin.pm line 1491
> [3924] dbg: config: Permission denied
> [3924] warn: config: cannot write to /var/spool/postfix/.spamassassin/user_prefs: No such file or directory
> [3924] warn: config: failed to create default user preference file /var/spool/postfix/.spamassassin/user_prefs
> [3924] dbg: config: using "/var/spool/postfix/.spamassassin/user_prefs" for user prefs file
>
>
> BUT the settings in MailScanner.conf is:
>
> SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin
>
That setting would only work if postfix can read and write it... Can
it? It seems to revert to the default. You could
mkdir ~postfix/.spamassassin
chown postfix.postfix ~postfix/.spamassassin
or something similar (as root), to get past that problem.

> I just created the .spamassassin in the /var/spool/postfix folder and now spamassassin does not complain.

Hm, perhaps I should start reading the whole message before giving advice:-):-)

> however If I check a message in MailWatch I get:
>
> cached  not
>        resultat=-1.507
> 2       krav
> -2.60   BAYES_00        Bayesian spam probability is 0 to 1%
> 1.09    EXTRA_MPART_TYPE        Header has extraneous Content-type:...type= entry
> 0.00    HTML_MESSAGE    HTML included in message
>
> checking same message with spamassassin -D -t /var/spool/MailScanner/quarantine/20081126/nonspam/F2F6E873B0.90E15
>
> gives me:
>
> Content analysis details:   (3.6 points, 5.0 required)
>
>  pts rule name              description
> ---- ---------------------- --------------------------------------------------
>  1.1 EXTRA_MPART_TYPE       Header has extraneous Content-type:...type= entry
>  1.8 SARE_SPEC_REPLICA_OBFU BODY: Rolex with obfuscated replica
>  0.3 SARE_WEOFFER           BODY: Offers Something
>  0.1 TW_HM                  BODY: Odd Letter Triples with HM
>  0.0 HTML_MESSAGE           BODY: HTML included in message
> -1.1 BAYES_05               BODY: Bayesian spam probability is 1 to 5%
>                            [score: 0.0115]
>  1.4 SARE_GIF_ATTACH        FULL: Email has a inline gif
>
> What can be the problem? I'm thinking my Apache user is perhaps missing permissions somewhere and cannot present the right result? Could this be the case? Look also at the differens scores 1.09/1.1 and Bayes hit 00/05

For some reason your MS instance of SA doesn't seem to think it can do
network tests... or rather DNS-based tests.
Do you have the mailscanner.cf symlink?
Do you try "force" dns to on, or do you rely on it being detected?

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se