Topic: Spamfilter seems to have stopped working!

[dave simmons]

As an alternative, can you tell me/give me a link to how I can just remove and then reinstall spamassassin?

The positive side of this experience is that I'm learning more about the system.

[brianr]

My own production server is "totally" up to date and SA still works fine (and has been updated from pre-6 over the years)..

The reason that I suggested the sa-updata/gpg key thing was because I had a similar to you situation last week, with another server I look after, and the new set of updates (with the correct gpg key) seemed to fix it.  Spam that was getting 1.2 then started getting 20 odd!

Hope the re-install works

B.

[Mjohnson]

I am certainly experiencing the same problem as you, though not to your same degree.  Please check the following posts for other things to try.  Enabling the RBL seems to be of some assistance.  The RBL is a definite help for me, but the problem of SA not tagging obvious spam remains a puzzle.  Some days very little gets through and then others days the flood gates seem wide open.

http://forums.contribs.org/index.php?topic=37060.0

In my case (SME 7.2 fully updated), the server is being used as a front end to an Exchange Server.  As such I do not know how to "Teach" the Bayes filter mechanism in SME.  We rely upon the junk mail sorting ability of our Outlook Clients, which is frankly very good and is performing quite well.  Only a handful of spam makes it through untagged.

MJ

[dave simmons]

Hi,

Thanks for your reply mjohnson.

Am now up and running on a freshly-installed (but much less powerful) machine.  As the problem only started after I installed upgraded packages via the web interface, I am going to run it for a day or so without applying the patches.

On the one hand it's difficult to believe that only the upgrade caused the problem, but on the other, I don't touch the machine.  That's the beauty of the system -it just runs!  Also if it was the upgrade, loads of people would have the problem.

I had already seen the post referred to in your link, but to be honest, didn't fully understand it.  I'm also nervous about manually typing commands.  The rest of the machine was working fine - web sites, file server, print server etc.  It was just annoying about the spam.

I'm more comfortable doing a reinstall.  Will post my results - good or bad - later

[dunni]

Me too!  I have just migrated from 6.0 to a newly installed 7.2 using procedures described elsewhere.

In my case the whole thing was working perfectly until I installed some dungog contribs - namely smeserver-userpanel, smeserver-userpanels and smeserver-mailsorting.  After that, I get spamassassin behaviour as bad or worse than OP

e.g. on "Megadik" spam

X-Spam-Status: No, hits=1.4 required=4.0
   tests=SARE_ADULT2
X-Spam-Check-By: xyz.polyhedron.com

X-Spam-Status: No, hits=0.0 required=4.0
   tests=
X-Spam-Check-By: xyz.polyhedron.com

Most messages return a score of 0

The only reason I want these panels is for procmail - can I enable procmail without using these things?

[Brave Dave]

Me 3

I've checked and the spam log;
tail -f /var/log/spamd/current | tai64nlocal

reports amongst other things
spamd: result: . 0 - DRUGS_ERECTILE,HTML_MESSAGE,RDNS_DYNAMIC

Would have thought it should have attracted a higher score
SME 7.2
Done the sa-learn thing, reboot etc.

It's like it's not reading the scores properly

[p-jones]

If the spam filters are not working and you have ascertained it is not a "bug" in your system, take it to the bug tracker.

[Brave Dave]

Ok run yum update spamassassin and it seems to have rectified

spamassassin-3.2.2-43.el4 had problem

spamassassin-3.2.3-44.el4 seems good


Guess that's why there are updates 

[dave simmons]

Latest update - running 12 hours on freshly-installed machine.  No spam!

We haven't had a single spam message get through to users, but all the junkmail boxes are also empty.  Does this mean that:

1.  The new machine is throwing the messages away instead of sorting them into junkmail (if so, what about false positives?)
2.  There hasn't been any spam sent (difficult to believe when I see the volume we received over the last 2 days, even on our tiny domain)
3.  The problem is sorted.

Will switch the old machine back on this afternoon, and see what happens then - maybe it was a momentary blip.

Will also try the update suggested by davidbray.

The reason I didn't post to the bug tracker is that I don't know enough about the system to dare suggest there is a fault.  I prefer to believe that it's something I've done wrong.  I had waited 2 days to see if something came up about the problem on the forums, because something as basic as a spam filtering problem (where the system went from trapping several hundred per day to trapping nothing) should affect everyone if it was a bug.  There must be much bigger users (and therefore bigger spam volumes out there) than me.

[dave simmons]

Bizarre.  Have switched on old (problem) machine.  Spam is coming in again (3 mails in 5 minutes!)

Tried update, but yum says that it could not find an update for spamassassin, so I must be running the latest version.

Will have to reinstall the machine. Bugger!

[raem]

dave simmons

> Tried update, but yum says that it could not find an update for spamassassin, so I must be running the latest version.

What output does this give
rpm -qa spamassassin

[dave simmons]

Hello Ray,

Sorry for delay, had already switched off the machine.

Result is:  spamassassin-3.2.3-44.el4

[dave simmons]

A quick follow up - there must be something wrong with my spamassassin configuration.

Here is the header from the last spam mail received:

X-Spam-Status: No, hits=1.4 required=3.0
   tests=SARE_ADULT2

Here is the mail:

Good morning ashleigh
get a MASSIVE penis today

Alexey Siitonen
http://www.planetwo.com/


If I am interpreting the header correctly, sa needs a value of 3 to identify it as spam.  If I look at the e-mail configuration in the server-manager, this value is set at 4???  The reject level at 12.

My wife keeps receiving these mails about penis extensions.  She's threatening to register me???

Am trying to see the funny side.

Note to self:  Buy big hammer or axe

[raem]

dave

Result is:  spamassassin-3.2.3-44.el4

That's OK, what about
rpm -qa smeserver-spamassassin

I have
smeserver-spamassassin-1.4.0-14.el4.sme

Also is spamd running
sv s spamd

[dave simmons]

I have the same version of smeserver-spamassassin.

From the other command i get the following:

run: spamd: (pid 4530) 6304s, normally down; run: log: (pid 2476) 7441s

I have no idea what this means!