Feeding rspamd

[japan...@gmail.com]

For a couple days I have building  some scripts to feed spam to rspamd.

Every couple minutes I have some scripts that takes fresh spam, drops it all into a folder and then feed them to rspamd like this:

rspamc -S LOCAL_FUZZY_DENIED -w 10 fuzzy_add /tmp/learn

The process will return success status and hashes for most messages, but I am from time to time seeing this result:

HTTP error: 404, No content to generate fuzzy for flag 11

I have verified the files it is giving the error on actually contain a message.  I suppose the message may be malformed, but unlikely as we are getting our spam feed direct from an email server.

If anyone has any insight or wants to view the samples that toss this error, let me know.

[Alex JOST]

How big is the message? AFAIK fuzzy_check requires a certain size to do
its magic.

--
Alex JOST

[japan...@gmail.com]

Yea, I just figured that out from the rspamd logs.

I am seeing it log entries like this:

2017-07-25 13:45:31 #888(controller) <fea18b>; task; fuzzy_generate_commands: <376197091651-LWUZ...@example.com>, part is shorter than 1000 bytes: 224 (112 * 2.00 bytes), skip fuzzy check

So you are correct, it does not work on small messages.

So far our local fuzzy system is not triggering on anything, hopefully it starts tomorrow once it has a few hundred thousand samples.