Koozali.org: home of the SME Server

Way too Much SPAM

Offline seb

  • ***
  • 45
  • +0/-0
Way too Much SPAM
« on: August 02, 2007, 04:08:07 PM »
Hi all,

Since Yesterday we are receiving a very hight load of :twisted: SPAM not detected by our 7.2 SME.

Looking at their headers we can see that Spamassassin is working:

X-Spam-Status: No, hits=1.7 required=5.0
   tests=SARE_HTML_USL_OBFU
--
X-Spam-Status: No, hits=0.0 required=5.0
   tests=

Anyone with the same issue?

Thx.
Seb.-

Offline hmuhammad

  • ***
  • 65
  • +0/-0
Way too Much SPAM
« Reply #1 on: August 02, 2007, 06:21:50 PM »
I did a yum update to install the new spamassassin yesterday, and new spam was then sent to the user's junkmail folder.

I notice an even new spamassassin in the available updates today (but I have not installed it yet).
...............

Offline seb

  • ***
  • 45
  • +0/-0
Way too Much SPAM
« Reply #2 on: August 04, 2007, 12:58:45 AM »
Update the Spamassassin today, and SPAM slow down considerably.

Offline compdoc

  • *
  • 226
  • +0/-0
Way too Much SPAM
« Reply #3 on: August 05, 2007, 07:37:27 PM »
Do you have Bayes autolearn enabled, or are you using the trainable form of Bayes? If so, check the /var/log/spamd/current log and look for these entries:

cannot open bayes databases /var/spool/spamd/.spamassassin/bayes_* R/W: tie failed: Permission denied

or (from another server):

cannot open bayes databases /var/spool/spamd/.spamassassin/bayes_* R/W: lock failed: Interrupted system call


For some reason, updates to spamassassin (or possibly other mail updates) changes ownership on one or two of the bayes database files to the wrong value of root, and bayes stops working.

I use these commands to fix it:

chown spamd.spamd /var/spool/spamd/.spamassassin/bayes_*

And sometimes I have to:

chmod 750 /var/spool/spamd/.spamassassin/bayes_*

You can look at current permissions and ownership and make only the needed changes if you want...

Not all of the bayes_* files are altered, but at least one is with certain updates, which is enough to break Bayes filtering...

I'd like to collect a list of problems that can occur in the spamd log and write a program to hunt for them, and possibly correct them. In the past, there werent so many updates, so it was easy to do manually. But since the 7.2 update, there have been a lot of little updates, and I've had to watch the logs more closely...

Offline seb

  • ***
  • 45
  • +0/-0
Re: Way too Much SPAM
« Reply #4 on: August 17, 2007, 04:52:19 PM »
Update the Spamassassin today, and SPAM slow down considerably.

Same again since yesterday!
Try the yum upgrade (Like i did last time and solve the issue with a spamassassin update) but i get "No Packages marked for Update/Obsoletion"

Offline seb

  • ***
  • 45
  • +0/-0
Re: Way too Much SPAM
« Reply #5 on: August 17, 2007, 06:14:01 PM »
compdoc, no i dont use Bayes.

Offline chris burnat

  • *****
  • 1,135
  • +2/-0
    • http://www.burnat.com
Re: Way too Much SPAM
« Reply #6 on: August 18, 2007, 02:09:00 AM »
Seb, there are now two threads on this topic.  So something is possibly happening, and the Devs should be made aware of this without having to trawl the forum. The best course of action is to fill a Bug Report at Bugzilla, and be prepared to follow with information, copy of logs etc.  In this way it will be checked and  fixed if this is  a bug. 
Thanks.
- chris
If it does not work out of the box, please fill in a Bug Report @ Bugzilla (http://bugs.contribs.org)  - check: http://wiki.contribs.org/Bugzilla_Help .  Thanks.

Offline seb

  • ***
  • 45
  • +0/-0
Re: Way too Much SPAM
« Reply #7 on: August 19, 2007, 01:50:16 AM »
Seb, there are now two threads on this topic.  So something is possibly happening, and the Devs should be made aware of this without having to trawl the forum. The best course of action is to fill a Bug Report at Bugzilla, and be prepared to follow with information, copy of logs etc.  In this way it will be checked and  fixed if this is  a bug. 
Thanks.


Done!
http://bugs.contribs.org/show_bug.cgi?id=3306