Thanks for all the responses and feedback, here's where I'm at. I definitely do not have Spamdyke installed, I'm about to try that.
"Check in logs in /var/log/qmail/smtp for simscan entries, like this:" I just grepped the entire directory and there are no CLEAN entries anywhere. "In my logs in /var/log/qmail/spamd I see entries like this when SpamAssassin analyzes a message:" I don't see anything like that in my logs, this is what my logs look like: @4000000052691c611110d3ec Oct 24 09:10:47.272 [2095] info: spamd: server successfully spawned child process, pid 2364 @4000000052691c611110d7d4 Oct 24 09:10:47.277 [2095] info: spamd: server successfully spawned child process, pid 2365 @4000000052691c611110dbbc Oct 24 09:10:47.279 [2095] info: prefork: child states: II @4000000052730d082650ad7c Oct 31 22:07:58.558 [2095] info: spamd: server killed by SIGTERM, shutting down @4000000052730d100438a294 Oct 31 22:08:06.071 [16622] info: spamd: server started on port 783/tcp (running version 3.3.2) @4000000052730d10043b1b64 Oct 31 22:08:06.071 [16622] info: spamd: server pid: 16622 @4000000052730d10048781fc Oct 31 22:08:06.076 [16622] info: spamd: server successfully spawned child process, pid 16692 @4000000052730d1004dac27c Oct 31 22:08:06.081 [16622] info: spamd: server successfully spawned child process, pid 16693 @4000000052730d1004f07cfc Oct 31 22:08:06.083 [16622] info: prefork: child states: II I'm starting to think my original suspicions are correct... it doesn't appear to be filtering anything at all, just running. On Fri, Nov 1, 2013 at 6:17 PM, Eric Shubert <[email protected]> wrote: > On 11/01/2013 08:45 AM, Tim Whitaker wrote: > >> Hi everybody... I've been running qmail toaster on a fresh CentOS 5.9 >> install for about a month now and all has been well except for one >> thing... spam. I have googled as much as I could to try and figure out >> what my problem might be and I've made some changes but still some >> really annoying spam is coming through with file attachments and such. >> My problem is I can't figure out how to find any logs to tell me if >> SpamAssassin is actually working. I know the service is running. In >> there spirit of giving too much information, here's a bunch of stuff: >> >> cat /etc/tcprules.d/tcp.smtp >> 127.:allow,RELAYCLIENT="",DKSIGN="/var/qmail/control/ >> domainkeys/%/private" >> :allow,BADMIMETYPE="",BADLOADERTYPE="M",CHKUSER_RCPTLIMIT="50",CHKUSER_ >> WRONGRCPTLIMIT="10",QMAILQUEUE="/var/qmail/bin/ >> simscan",DKSIGN="/var/qmail/control/domainkeys/%/private" >> >> cat /var/qmail/control/simcontrol >> :clam=yes,spam=yes,spam_hits=12,attach=.mp3:.src:.bat:.pif >> >> qmailctl stat >> authlib: up (pid 16643) 49008 seconds >> clamd: up (pid 16614) 49008 seconds >> imap4: down 49008 seconds >> imap4-ssl: down 49008 seconds >> pop3: up (pid 16603) 49008 seconds >> pop3-ssl: up (pid 16665) 49008 seconds >> send: up (pid 16626) 49008 seconds >> smtp: up (pid 16635) 49008 seconds >> spamd: up (pid 16622) 49008 seconds >> submission: up (pid 16685) 49007 seconds >> authlib/log: up (pid 16645) 49008 seconds >> clamd/log: up (pid 16616) 49008 seconds >> imap4/log: down 49008 seconds >> imap4-ssl/log: down 49008 seconds >> pop3/log: up (pid 16605) 49008 seconds >> pop3-ssl/log: up (pid 16671) 49008 seconds >> send/log: up (pid 16610) 49008 seconds >> smtp/log: up (pid 16640) 49008 seconds >> spamd/log: up (pid 16631) 49008 seconds >> submission/log: up (pid 16661) 49008 seconds >> >> > Nice thread, everyone. I'm happy to see the community taking such an > active role. > > I'd like to add and reinforce a few things. > > Spamdyke will be included [email protected] in the > forthcoming stock QMT release. It's a must have. If I had to pick a single > anti-spam piece of software, it'd be spamdyke hands down. Sam C (the > author) deserves many kudos for this great product. FWIW, Sam will probably > be modifying the next version to be able to function as an smtp proxy, so > it will be usable by any smtp transport, not just qmail. When that happens, > I expect that spamdyke will become widely adopted. > > I hope that Dspam will be available with a future QMT release, but don't > look for it any time soon. It will likely be implemented along with > amavisd-new, which will replace simscan. > > I'm a little surprised more of you aren't using qmlog. It's a great tool > for examining logs. I often do: > # qmlog -f smtp > to tail the smtp log. qmlog also has powerful search capabilities with the > -lc (log containing) option for searching for any regex. qmlog also nicely > formats the date/time stamp, so you don't need to remember to pipe through > tai64nlocal (which is part of the daemontools package, so should be on > every QMT host). For spamassassin, you might do: > # qmlog -f spamd > to see spmaassassin at work. Of course if you have spamdyke installed, > there won't be a lot to see there. :) Enter the qmlog command by itself to > see all of its options. You'll never need to manually examine logs again. > > While sanesecurity doesn't catch a lot of spam, what it does specialize in > is phishing attempts, which nothing else appears to catch. I do use it. The > only problem I've had is that some phishing attempts are so good at > appearing to be emails from banking institutions that sometimes it blocks > monthly statements from AmExp and Chase. As a work-around I've chosen to > bypass scanning of emails from these institutions. > > Thanks again to everyone for their participation here. Nice work! > > -- > -Eric 'shubes' > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
