This is to finish the story of missing e-mails, including the daily log report summaries. As I wrote before, Joe Pruett identified the culprit as SpamAssassin by examining the procmail strace output.
Knowing where the problem originated I had to learn what and how, so I subscribed to the SpamAssassin mail list and received the usual insightful help. The problems seem to be completely resolved now, but I'll be monitoring the situation for another couple of weeks to make sure there's no relapse. There were two SpamAssassin issues that needed to be addressed. The first issue was the log report summaries (pflogsumm and logwatch) and mail list messages (including those to the SA mail list) being tagged by SA as spam. I assume this was a result of something I did inadvertently. For the past several days I exported each false positive to a file, then ran sa-learn on that file specifying the contents as ham. Today both the postfix maillog and logwatch summary reports appeared in my inbox as they should. There were no false positives in the spam-uncaught file today. The second issue that caused false positives (and missing messages when the procmail recipe sent them to /dev/null rather than a holding cell) was the SA rule EMPTY_BODY being invoked and adding +2.5 to the message score. Why a non-empty-body message triggered this rule will probably forever be a mystery. However, this issue is resolved. When I went to add a new rule to local.cf I discovered that the existing version was generated for SpamAssassin-1.3.x, and I'm running SpamAssassin-2.5.2. There was a local.cf.new with many fewer rules in the same /etc/mail/spamsssassin/ directory, so I saved the old version and moved the .new to just local.cf. Immediately, no more EMPTY_BODY scores on the false positives. Looking at the local.cf version would never have occurred to me. This issue has consumed a lot of time and attention for several of us (and many messages on this mail list), but it has also been very informative. Others might benefit from my experiences, but I hope that none of us need to address such issues again. Rich -- Richard B. Shepard, Ph.D. | Integrity Credibility Applied Ecosystem Services, Inc. | Innovation <http://www.appl-ecosys.com> Voice: 503-667-4517 Fax: 503-667-8863 _______________________________________________ PLUG mailing list [email protected] http://lists.pdxlinux.org/mailman/listinfo/plug
