SA+MS miss spam, scored with 0.00.

[Steve Barnes]

Hi List

It seems the missing of spam described below may be related to this:

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6050

When running:

spamassassin -x -D
/var/spool/MailScanner/quarantine/20090605/nonspam/8F54D11485.A3CE1

occassionally spamassassin will die with the following error:

[61264] dbg: info: entering helper-app run mode
[61264] warn: spamassassin: killed by SIGPIPE

>From what I can gather, this is caused by Razor2 and perhaps the
result of an intermittent or less-than-ideal Internet connection, as
would definitely be the case for the server in question. As requested
by Justin Mason in the apache issues document, I've been trying to
capture the SIGPIPE event using the following command on FreeBSD:

ktrace -di -t+ -f /tmp/ktrace.log spamassassin -D -x <
/var/spool/MailScanner/quarantine/20090628/nonspam/E63A4114A0.ADA28

but it seems now that I'm looking for it, the bug won't rear its head
(typical). I've disabled Razor2 for the time being in v310.pre to
confirm if that helps.

Anyone else ever see this SIGPIPE event?

Steve

2009/6/9 Scott Silva <ssilva at sgvwater.com>:
> on 6-5-2009 5:51 PM Steve Barnes spake the following:
>> Hi
>>
>> MS 4.77.7
>> SA 3.2.5
>> Postfix 2.6.0
>> FreeBSD 7.2
>>
>> I'm trying to understand why MS and SA missed a spam the first time
>> round (scored with 0.00). Resubmitting from quarantine as root with:
>>
>> spamassassin -x -D <
>> /var/spool/MailScanner/quarantine/20090605/nonspam/8F54D11485.A3CE1
>>
>> it was scored at 11.2. I don't believe it's a case of online checks
>> "catching up" since the majority of rules that matched 2nd time round
>> aren't time-related:
>>
>>  pts rule name              description
>> ---- ----------------------
>> --------------------------------------------------
>>  1.8 SUBJ_ALL_CAPS          Subject is all capitals
>>  1.6 MISSING_HEADERS        Missing To: header
>>  1.4 DCC_CHECK              Listed in DCC
>> (http://rhyolite.com/anti-spam/dcc/)
>>  1.5 MSGID_FROM_MTA_HEADER  Message-Id was added by a relay
>>  0.7 MSOE_MID_WRONG_CASE    MSOE_MID_WRONG_CASE
>>  4.2 FORGED_MUA_OUTLOOK     Forged mail pretending to be from MS Outlook
>>
>> Even without DCC_CHECK, it should have scored 9.8. The SA report contains:
>>
>> not spam, SpamAssassin (not cached, score=0, required 6, autolearn=)
>>
>> I keep seeing this "autolearn=)" truncation in cases where spam is
>> missed. Can anyone else confirm seeing it in their maillog? Otherwise,
>> MS + SA are catching 99% of the other spams coming in. I've included
>> the corresponding maillog entry at the bottom of this message.
>>
>> Thanks
>>
>> Steve
>>
>>
> I think you need the latest version (4.77-10) to fix a bug that crept into
> postfix support.
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>