SA+MS miss spam, scored with 0.00.

[Steve Barnes]

Forgot to mention, the failing of spamassassin with the SIGPIPE
warning also results in temp files being orphaned in the spamassassin
temp dir as defined in MailScanner.conf:

SpamAssassin Temporary Dir = /var/spool/MailScanner/incoming/SpamAssassin-Temp

ls -l /var/spool/MailScanner/incoming/SpamAssassin-Temp

-rw-------  1 postfix  mail  198554 Jun 28 06:14 .spamassassin87819Huzwttmp

>From mailwatch, the corresponding message operations entry:

28/06/09 06:14:45  	stopkolvz at peacebasecamp.com  	user at domain.com
The US government hands out over 4Billion in grants every year
	337.8Kb  	0.00  	Clean

Steve

2009/6/29 Steve Barnes <pumzika at gmail.com>:
> Hi List
>
> It seems the missing of spam described below may be related to this:
>
> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6050
>
> When running:
>
> spamassassin -x -D
> /var/spool/MailScanner/quarantine/20090605/nonspam/8F54D11485.A3CE1
>
> occassionally spamassassin will die with the following error:
>
> [61264] dbg: info: entering helper-app run mode
> [61264] warn: spamassassin: killed by SIGPIPE
>
> From what I can gather, this is caused by Razor2 and perhaps the
> result of an intermittent or less-than-ideal Internet connection, as
> would definitely be the case for the server in question. As requested
> by Justin Mason in the apache issues document, I've been trying to
> capture the SIGPIPE event using the following command on FreeBSD:
>
> ktrace -di -t+ -f /tmp/ktrace.log spamassassin -D -x <
> /var/spool/MailScanner/quarantine/20090628/nonspam/E63A4114A0.ADA28
>
> but it seems now that I'm looking for it, the bug won't rear its head
> (typical). I've disabled Razor2 for the time being in v310.pre to
> confirm if that helps.
>
> Anyone else ever see this SIGPIPE event?
>
> Steve
>
> 2009/6/9 Scott Silva <ssilva at sgvwater.com>:
>> on 6-5-2009 5:51 PM Steve Barnes spake the following:
>>> Hi
>>>
>>> MS 4.77.7
>>> SA 3.2.5
>>> Postfix 2.6.0
>>> FreeBSD 7.2
>>>
>>> I'm trying to understand why MS and SA missed a spam the first time
>>> round (scored with 0.00). Resubmitting from quarantine as root with:
>>>
>>> spamassassin -x -D <
>>> /var/spool/MailScanner/quarantine/20090605/nonspam/8F54D11485.A3CE1
>>>
>>> it was scored at 11.2. I don't believe it's a case of online checks
>>> "catching up" since the majority of rules that matched 2nd time round
>>> aren't time-related:
>>>
>>>  pts rule name              description
>>> ---- ----------------------
>>> --------------------------------------------------
>>>  1.8 SUBJ_ALL_CAPS          Subject is all capitals
>>>  1.6 MISSING_HEADERS        Missing To: header
>>>  1.4 DCC_CHECK              Listed in DCC
>>> (http://rhyolite.com/anti-spam/dcc/)
>>>  1.5 MSGID_FROM_MTA_HEADER  Message-Id was added by a relay
>>>  0.7 MSOE_MID_WRONG_CASE    MSOE_MID_WRONG_CASE
>>>  4.2 FORGED_MUA_OUTLOOK     Forged mail pretending to be from MS Outlook
>>>
>>> Even without DCC_CHECK, it should have scored 9.8. The SA report contains:
>>>
>>> not spam, SpamAssassin (not cached, score=0, required 6, autolearn=)
>>>
>>> I keep seeing this "autolearn=)" truncation in cases where spam is
>>> missed. Can anyone else confirm seeing it in their maillog? Otherwise,
>>> MS + SA are catching 99% of the other spams coming in. I've included
>>> the corresponding maillog entry at the bottom of this message.
>>>
>>> Thanks
>>>
>>> Steve
>>>
>>>
>> I think you need the latest version (4.77-10) to fix a bug that crept into
>> postfix support.
>>
>>
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>>
>>
>