[AMaViS-user] amavis not running spamassassin since upgrade
Ryan McGuire
I recently upgarded to amavisd-new-2.6.1 and am now having issues
with spamassassin. No incoming messages are being scanned and the mail
header is not being modified. I pasted the syslog messages and
relevant amavis config below. This has always worked in the past. Any
ideas?
Amavis config snippet:
defang_spam = 1;
$remove_existing_x_scanned_headers = 0;
$remove_existing_spam_headers = 1;
$spam_check_negative_ttl = 10*60; # time to remember that mail was not spam
$spam_check_positive_ttl = 30*60; # time to remember that mail was spam
$sa_local_tests_only = 0; # only tests which do not require internet access?
$sa_mail_body_size_limit = undef; # don't waste time on SA if mail is larger
$sa_tag_level_deflt = 3.4; # add spam info headers if at, or above
that level;
$sa_tag2_level_deflt = 6.1; # add 'spam detected' headers at that level to
$sa_kill_level_deflt = 8.01; # triggers spam evasive actions
$sa_spam_subject_tag = '***SPAM*** '; # (defaults to undef, disabled)
@spam_subject_tag_maps = ('[possible-spam:_SCORE_] ');
@spam_subject_tag2_maps = ('***SPAM*** _SCORE_ (_REQD_) ');
@spam_subject_tag3_maps = ('***BLATANT*SPAM**** _SCORE_ (_REQD_) ');
$sa_spam_modifies_subj = 1; # in @spam_modifies_subj_maps, default is true
$sa_spam_level_char = '*'; # char for X-Spam-Level bar, defaults to '*';
$sa_spam_report_header = 1; # insert X-Spam-Report header field? default false
Syslog:
keg mail 14:41:39 postfix/smtpd
postfix/smtpd[10040]: connect from sonussf2.sonusnet.com[208.45.178.27]
keg mail 14:41:39 postfix/smtpd postfix/smtpd[10040]:
EE7478200D: client=sonussf2.sonusnet.com[208.45.178.27]
keg mail 14:41:40 postfix/cleanup
postfix/cleanup[10044]: EE7478200D:
message-id=<1223491240.19899.46.camel@doubleshot>
keg mail 14:41:40 postfix/qmgr postfix/qmgr[7276]:
EE7478200D: from=<rmcg...@sonusnet.com>, size=1048, nrcpt=1 (queue
active)
keg mail 14:41:40 amavis amavis[8979]: (08979-03)
ESMTP::10024 /var/amavis/tmp/amavis-20081008T130500-08979:
<rmcg...@sonusnet.com> -> <ry...@rdmnetworks.com> SIZE=1048 Received:
from mail.rdmnetworks.com ([127.0.0.1]) by localhost
(mail.rdmnetworks.com [127.0.0.1]) (amavisd-new, port 10024) with
ESMTP for <ry...@rdmnetworks.com>; Wed, 8 Oct 2008 14:41:40 -0400 (EDT)
keg mail 14:41:40 postfix/smtpd postfix/smtpd[10040]:
disconnect from sonussf2.sonusnet.com[208.45.178.27]
keg mail 14:41:40 amavis amavis[8979]: (08979-03) smtp
connection cache, dt: 2177.9, state: 0
keg mail 14:41:40 amavis amavis[8979]: (08979-03)
Checking: t0qfdcWQFGHA [208.45.178.27] <rmcg...@sonusnet.com> ->
<ry...@rdmnetworks.com>
keg mail 14:41:40 amavis amavis[8979]: (08979-03) p001
1 Content-Type: text/plain, size: 17 B, name:
keg local6 14:41:40 clamd clamd[17958]: SelfCheck:
Database status OK.
keg auth 14:41:44 postfix/smtpd postfix/smtpd[10049]:
sql_select option missing
keg auth 14:41:44 postfix/smtpd postfix/smtpd[10049]:
auxpropfunc error no mechanism available
keg auth 14:41:44 postfix/smtpd postfix/smtpd[10049]:
_sasl_plugin_load failed on sasl_auxprop_plug_init for plugin: sql
keg mail 14:41:44 postfix/smtpd postfix/smtpd[10049]:
connect from unknown[127.0.0.1]
keg mail 18:41:44 postfix/smtpd postfix/smtpd[10049]:
6DAF482019: client=unknown[127.0.0.1]
keg mail 14:41:44 postfix/cleanup
postfix/cleanup[10044]: 6DAF482019:
message-id=<1223491240.19899.46.camel@doubleshot>
keg mail 14:41:44 postfix/qmgr postfix/qmgr[7276]:
6DAF482019: from=<rmcg...@sonusnet.com>, size=1499, nrcpt=1 (queue
active)
keg mail 18:41:44 postfix/smtpd postfix/smtpd[10049]:
disconnect from unknown[127.0.0.1]
keg mail 14:41:44 amavis amavis[8979]: (08979-03) FWD
via SMTP: <rmcg...@sonusnet.com> -> <ry...@rdmnetworks.com>,BODY=7BIT
250 2.0.0 Ok, id=08979-03, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok:
queued as 6DAF482019
keg mail 14:41:44 amavis amavis[8979]: (08979-03)
Passed CLEAN, [208.45.178.27] [24.62.227.44] <rmcg...@sonusnet.com>
-> <ry...@rdmnetworks.com>, Message-ID:
<1223491240.19899.46.camel@doubleshot>, mail_id: t0qfdcWQFGHA, Hits:
2.726, size: 1047, queued_as: 6DAF482019, 4407 ms
keg mail 14:41:44 postfix/qmgr postfix/qmgr[7276]:
EE7478200D: removed
--
Ryan D. McGuire
c: (508) 517-1841
h: (214) 432-6834
ry...@rdmnetworks.com
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
AMaViS-user mailing list
AMaVi...@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
Mark Martinec
> I recently upgarded to amavisd-new-2.6.1 and am now having issues
> with spamassassin. No incoming messages are being scanned and the
> mail header is not being modified. I pasted the syslog messages and
> relevant amavis config below. This has always worked in the past.
> Passed CLEAN, [208.45.178.27] [24.62.227.44]
> <rmcg...@sonusnet.com> -> <ry...@rdmnetworks.com>,
> Message-ID: <1223491240.19899.46.camel@doubleshot>,
> mail_id: t0qfdcWQFGHA, Hits: 2.726,
> size: 1047, queued_as: 6DAF482019, 4407 ms
Somehow the 2.726 score points were still collected, which might
indicated that SpamAssassin is still being called, but perhaps
does not function as before. Increasing $log_level and examining
amavisd log would tell if SA is being called or not.
If SA is being called but does not give the same score as if
called from a commad line (as user vscan) on the same message:
# su vscan -c 'spamassassin -t -D <test.msg'
then it is worth comparing SA log from the above command,
to that which is emitted when amavisd is started as:
amavisd debug-sa
The usual culprits are SA config files or rules directory
being inaccessible or in wrong places. This is reported
early in SA log.
Mark
Ryan McGuire
Here are some verbose logs... It does look like it is getting scanned,
the X-Spam headers are just not being added:
http://pastebin.rdmnetworks.com/6
Thanks for the help!!
-Ryan
Quoting "Mark Martinec" <Mark.Marti...@ijs.si>:
--
Ryan D. McGuire
c: (508) 517-1841
h: (214) 432-6834
ry...@rdmnetworks.com
Mark Martinec
> Here are some verbose logs...
What happened to that log? Its partly bottom-up and
partly top-down in larger sections.
> It does look like it is getting scanned,
> the X-Spam headers are just not being added:
That's a classical one, the recipient's domain rdmnetworks.com
is not listed as a local domain:
headers CLUSTERING: NEW CLUSTER <ry...@rdmnetworks.com>:
score=3.252, tag=0, tag2=0, local=0, bl=, s=, mangle=
^^^^^^^
Spam headers are only inserted for inbound mail,
i.e. for recipients which match @local_domains_maps.
Ryan McGuire
Sorry about the logs, I have everything on my network going to a mysql
database for phpsyslogng, sometimes sequencing is off, and I also
dumped them to a file and ran tac to reverse the order. I put them
newest -> oldest this time as they appear in phpsyslogng.
http://pastebin.rdmnetworks.com/11
I recently removed the local domain map while I was troubleshooting,
it was always in there ,as it is in this example...
Thanks!
-Ryan
Quoting "Mark Martinec" <Mark.Marti...@ijs.si>:
--
Ryan D. McGuire
c: (508) 517-1841
h: (214) 432-6834
ry...@rdmnetworks.com
Mark Martinec
> The way I prefer to set it up is to have:
>
> '[possible-spam:_SCORE_]' added to the subject if it is above a value
> (let's say 4.9) which is currently defined in $sa_tag_level_deflt.
> ...
> I then want '***SPAM*** _SCORE_ (_REQD_) ' added if it hits
> $sa_tag2_level_deflt
> ...
> And the X-Spam* headers added NO MATTER WHAT..
>
> If I set $sa_tag_level_deflt to undef I get the X-Spam headers added
> every time (which is good) but every single email gets the
> possible-spam header that is defined in $sa_tag_level_deflt. If I set
> this value to 4.9 I get the desired subject header added but the
> X-Spam headers do not get added below this score (4.9).
> How would I go about having the X-Spam* headers added unconditionally
$sa_tag_level_deflt = undef;
> but every single email gets the
> possible-spam header that is defined in $sa_tag_level_deflt
That can be turned off:
@spam_subject_tag_maps = ();
> '[possible-spam:_SCORE_]' added to the subject if it is above a value
> (let's say 4.9) which is currently defined in $sa_tag_level_deflt.
$sa_tag2_level_deflt = 4.9;
@spam_subject_tag2_maps = ('[possible-spam:_SCORE_] ');
> I then want '***SPAM*** _SCORE_ (_REQD_) ' added if it hits
> $sa_tag2_level_deflt
$sa_tag3_level_deflt = 8;
@spam_subject_tag3_maps = ('***SPAM*** _SCORE_ (_REQD_) ');
> while at the same time being able to have Possible-Spam added at 4.9
> (or whatever number) and **SPAM** for tag2
The following is hard-wired:
- tag level starts adding X-Spam header fields;
- tag2 level labels passed mail as spam: turns NO into a YES,
and adds recipient address extensions if enabled;
- kill level blocks mail (unless *_lover) and quarantines it
> and the "evasive actions" at my kill level?
It is non-configurable, "evasive actions" are always at kill level.
> To simplify my question, is there a way to tell amavis to keep
> X-Spam-Flag set to NO until it reaches tag3?
Here is the requirement than cannot be met without
tweaking the code.
> Or as another option is there a way I can have an intermediary level
> in-between the default and tag2 just for the purpose of adding
> Possible-Spam at a non-spam level and keeping the headers in-tact
> below possible-spam so it always shows the spam headers?
There are two possibilities, but each requires tweaking the code.
- Either moving the NO/YES point from tag2 to tag3 threshold
(and keeping tag=undef, tag2=possible-spam, tag3=spam);
or
- Modifying adding of X-Spam header fields to happen regardless
of tag level (and using tag=possible-spam, tag2=spam)
The following change to 2.6.1 will probably achieve it:
--- amavisd~ 2008-06-29 02:37:58.000000000 +0200
+++ amavisd 2008-10-20 19:53:37.000000000 +0200
@@ -11125,4 +11125,5 @@
my($bypassed) = $r->bypass_spam_checks;
my($do_tag) = $r->is_in_contents_category(CC_CLEAN,1);
+ $do_tag = 1; # unconditionally
my($do_tag2) = $r->is_in_contents_category(CC_SPAMMY);
my($do_kill) = $r->is_in_contents_category(CC_SPAM);
Mark