<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=US-ASCII">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7234.20">
<TITLE>FW: score=0 problem: SpamAssassin (not cached, score=0, required 5, autolearn=)</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><SPAN LANG="en-us"><FONT FACE="Arial">I have noticed that some spam has been creeping in. We have 4 inbound MX servers, but only has is experiencing this problem.</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">We are running SpamAssassin version 3.2.0, Perl version 5.8.3, and MailScanner version 4.59.4.</FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">Here are the counts of 'is not spam' and 'is spam' with 'score=0,' (should not happen):</FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">fgrep "score=0," /var/log/maillog | grep 'is not spam' | wc -l -- 649 </FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT FACE="Arial">fgrep "score=0," /var/log/maillog | grep 'is spam' | wc -l -- 311 </FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">Spamassasin is not showing any errors, and '/usr/bin/spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf --lint' does not show errors.</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">There are files in /dev/shm/ (.spamassassin*) that are being created, and some are being left in that directory. Here is an example of a file that has been left on this ramdisk fs:</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial"># grep l6PJ1iYV029369 /var/log/maillog </FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT FACE="Arial">Jul 25 14:01:51 houmx05 milter-greylist: l6PJ1iYV029369: skipping greylist because this is the default action, (from==kimharrison2@srs.bis.na.blackberry.com>, rcpt=<tracy.hallenberger@bakerbotts.com>, addr=smtp02.bis.na.blackberry.com[216.9.248.49]) </FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">Jul 25 14:01:51 houmx05 sendmail[29369]: l6PJ1iYV029369: from=<SRS0=R44+k6=MX=tmo.blackberry.net=kimharrison2@srs.bis.na.blackberry.com>, size=654, class=0, nrcpts=1, msgid=<2074773001-1185390040-cardhu_decombobulator_blackberry.rim.net-1101465393-@bxe017.bisx.prod.on.blac, proto=ESMTP, daemon=MTA, relay=smtp02.bis.na.blackberry.com [216.9.248.49]</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">Jul 25 14:01:51 houmx05 sendmail[29369]: l6PJ1iYV029369: Milter add: header: X-Null-Tag: 3a576a56bd3b913802bbc7fd4c9f07ad</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">Jul 25 14:01:51 houmx05 sendmail[29369]: l6PJ1iYV029369: Milter add: header: X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-3.0rc3 (houmx05.bakerbotts.com [204.194.98.17]); Wed, 25 Jul 2007 14:01:51 -0500 (CDT)</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">Jul 25 14:01:51 houmx05 sendmail[29369]: l6PJ1iYV029369: to=<tracy.hallenberger@bakerbotts.com>, delay=00:00:00, mailer=esmtp, pri=30654, stat=queued</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">Jul 25 14:01:53 houmx05 MailScanner[6850]: Message l6PJ1iYV029369 from 216.9.248.49 (srs0=r44+k6=mx=tmo.blackberry.net=kimharrison2@srs.bis.na.blackberry.com) to bakerbotts.com is not spam, SpamAssassin (<B>not cached, score=0, required 5, autolearn=)</B></FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">Jul 25 14:01:56 houmx05 sendmail[29452]: l6PJ1iYV029369: to=<tracy.hallenberger@bakerbotts.com>, delay=00:00:05, xdelay=00:00:00, mailer=esmtp, pri=120654, relay=housweep01.bakerbotts.net. [10.20.254.236], dsn=2.0.0, stat=Sent (Message received OK)</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial"># l .spamassassin29421Mvfyimtmp </FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT FACE="Arial">-rw------- 1 root root 1307 Jul 25 14:01 .spamassassin29421Mvfyimtmp </FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT FACE="Arial">Wed Jul 25 14:12:06 CDT 2007 </FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">I'm wondering if it is a possible problem with the /dev/shm ram disk. Can spamassassin be pointed to use another directory?</FONT></SPAN></P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">I would appreciate any help you can provide. </FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">Thanks, </FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT FACE="Arial">Donald </FONT></SPAN>
</P>
<P><SPAN LANG="en-us"><FONT FACE="Arial">Donald Dawson </FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT FACE="Arial">Security Administrator </FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT FACE="Arial">Baker Botts L.L.P. </FONT></SPAN>
<BR><SPAN LANG="en-us"><FONT FACE="Arial">713-229-2183 </FONT></SPAN>
</P>
</BODY>
</HTML>