Re: First run score: 25.7 Second: 2.6
Tue Jul 20 16:12:4516:11:43 2010 [-7196] warn: error creatingdbg: async: starting: URI-DNSBL, DNSBL:multi.surbl.org.:garden.com (timeout 15.0s, min 3.0s) Tue Jul 20 16:11:43 2010 [-7196] dbg: dns: URIBL_PH_SURBL lookup start Tue Jul 20 16:11:43 2010 [-7196] dbg: dns: providing a DNS resolver socket: Unknown error at /C:\NET\SpamAssassinWin32-EX\spamd.exeMail/SpamAssassin/DnsResolver.pm line 235, GEN16 line 68.callback for id: 24451/garden.com.multi.uribl.com/A/IN Tue Jul 20 16:12:4516:11:43 2010 [-7196] warn: plugin: eval failed: Can't call method send on an undefined value at /C:\NET\SpamAssassinWin32-EX\spamd.exeMail/SpamAssassin/DnsResolver.pm line 410, GEN16 line 68.dbg: async: starting: URI-DNSBL, DNSBL:multi.uribl.com.:garden.com (timeout 15.0s, min 3.0s) * * * * I'm posting diff output; as you see some online checks couldn't done after errors at DnsResolver.pm line 235 and at DnsResolver.pm line 410 Those missed checks cost me 12 points: Tue Jul 20 16:11:43 2010 [-7196] dbg: rules: running head tests; score so far=0far=12.019 What can I do? On Tue, Jul 20, 2010 at 4:56 PM, Emin Akbulut eminakbu...@gmail.com wrote: OK I've found the wrong score's log however I'm not very familiar with SA debug logs, I've added both correct 18 point and wrong 5.5 point' logs. I also added processed messages. http://rapidshare.com/files/407987154/spamd-logs.rar * * http://rapidshare.com/files/407987154/spamd-logs.rar*I used the online diff tool: * *http://www.quickdiff.com/index.php* * * *It looks like a few problems occured, * *before **running head tests; * *score so far=12.019 vs far=0* * * * * * * On Tue, Jul 20, 2010 at 3:48 PM, Martin Gregorie mar...@gregorie.orgwrote: On Tue, 2010-07-20 at 14:53 +0300, Emin Akbulut wrote: Does not spamd 3.3.1 (JAM) support logging? I want to log some info... When run under Linux it logs to /var/log/maillog. Does the DOS/Windows version write log messages to stderr or does it just suppress them? My recent scores on same input : )
Re: First run score: 25.7 Second: 2.6
On 14.07.10 15:42, Emin Akbulut wrote: I run SA Win32 port 3.3.1 by JAM Software on Windows Server 2008 64 bit. Spamassassin.exe always calculates the same score, coz User_Prefs file is under my docs (C:\Users\ea\.spamassassin) However spamd.exe -which runs as service- calculates the right score at first time then score goes very low at subsequent checks. [...] These are only seen after first erun: MISSING_DATE,MISSING_MID,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL_LASTEXT, RCVD_IN_PBL,RCVD_IN_XBL,RDNS_NONE,TO_NO_BRKTS_NORDNS_HTML,T_SURBL_MULTI1, T_SURBL_MULTI2,T_SURBL_MULTI3,T_SURBL_MULTI4,T_URIBL_BLACK_OVERLAP, URIBL_AB_SURBL,URIBL_BLACK,URIBL_DBL_SPAM,URIBL_JP_SURBL,URIBL_OB_SURBL, URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=unavailable version=3.3.1 MISSING_DATE,MISSING_MID indicate that the message was received without the Date: and Message-Id: headers. Some MTA's tend to add the, which causes SA checking to be less effective I have already bugged debian's sendmail not to add To: header if there's none, the same reason. We could do the same for those headers if sendmail can (not to) do that. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Depression is merely anger without enthusiasm.
Re: First run score: 25.7 Second: 2.6
P.S: In my case all tests done in same input, but outputs have different scores. Does not spamd 3.3.1 (JAM) support logging? I want to log some info... My recent scores on same input : ) OK X-Spam-Status: No, score=5.7 required=6.3 tests=BAYES_50,HTML_IMAGE_ONLY_32, OK X-Spam-Status: No, score=5.7 required=6.3 tests=BAYES_50,HTML_IMAGE_ONLY_32, RESTARTED X-Spam-Status: Yes, score=17.8 required=6.3 tests=BAYES_50,HTML_IMAGE_ONLY_32, OK X-Spam-Status: Yes, score=17.8 required=6.3 tests=BAYES_50,HTML_IMAGE_ONLY_32, OK X-Spam-Status: Yes, score=17.8 required=6.3 tests=BAYES_50,HTML_IMAGE_ONLY_32, OK X-Spam-Status: No, score=5.7 required=6.3 tests=BAYES_50,HTML_IMAGE_ONLY_32, OK X-Spam-Status: No, score=5.7 required=6.3 tests=BAYES_50,HTML_IMAGE_ONLY_32, OK X-Spam-Status: No, score=3.1 required=6.3 tests=BAYES_50,HTML_IMAGE_ONLY_32, OK X-Spam-Status: No, score=5.7 required=6.3 tests=BAYES_50,HTML_IMAGE_ONLY_32, On Tue, Jul 20, 2010 at 2:44 PM, Matus UHLAR - fantomas uh...@fantomas.skwrote: On 14.07.10 15:42, Emin Akbulut wrote: I run SA Win32 port 3.3.1 by JAM Software on Windows Server 2008 64 bit. Spamassassin.exe always calculates the same score, coz User_Prefs file is under my docs (C:\Users\ea\.spamassassin) However spamd.exe -which runs as service- calculates the right score at first time then score goes very low at subsequent checks. [...] These are only seen after first erun: MISSING_DATE,MISSING_MID,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL_LASTEXT, RCVD_IN_PBL,RCVD_IN_XBL,RDNS_NONE,TO_NO_BRKTS_NORDNS_HTML,T_SURBL_MULTI1, T_SURBL_MULTI2,T_SURBL_MULTI3,T_SURBL_MULTI4,T_URIBL_BLACK_OVERLAP, URIBL_AB_SURBL,URIBL_BLACK,URIBL_DBL_SPAM,URIBL_JP_SURBL,URIBL_OB_SURBL, URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=unavailable version=3.3.1 MISSING_DATE,MISSING_MID indicate that the message was received without the Date: and Message-Id: headers. Some MTA's tend to add the, which causes SA checking to be less effective I have already bugged debian's sendmail not to add To: header if there's none, the same reason. We could do the same for those headers if sendmail can (not to) do that. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Depression is merely anger without enthusiasm.
RE: [SpamAssassin] Re: First run score: 25.7 Second: 2.6
From: Emin Akbulut [mailto:eminakbu...@gmail.com] Sent: Tuesday, July 20, 2010 1:54 PM To: users@spamassassin.apache.org P.S: In my case all tests done in same input, but outputs have different scores. Does not spamd 3.3.1 (JAM) support logging? I want to log some info... JAM Software GmbH Gesch?ftsf?hrer: Joachim Marder Max-Planck-Str. 22 * 54296 Trier * Germany Tel: 0651-145 653 -0 * Fax: 0651-145 653 -29 Handelsregister Nr. HRB 4920 (AG Wittlich) http://www.jam-software.de
RE: [SpamAssassin] Re: First run score: 25.7 Second: 2.6
From: Emin Akbulut [mailto:eminakbu...@gmail.com] Sent: Tuesday, July 20, 2010 1:54 PM To: users@spamassassin.apache.org P.S: In my case all tests done in same input, but outputs have different scores. Does not spamd 3.3.1 (JAM) support logging? I want to log some info... My recent scores on same input : ) Erm, sorry for the first mail, nabble is down and Outlook is kind of stupid when responding to mailing lists ;) Back to topic: I already gave you a hint how to enable debugging for spamd last Friday, you should more carefully read your email. So again: -Original Message- From: Support SpamAssassin [mailto:spamassas...@jam-software.com] Sent: Friday, July 16, 2010 4:39 PM To: users@spamassassin.apache.org Subject: [SpamAssassin] Re: First run score: 25.7 Second: 2.6 -Original Message- From: Charles Gregory Now if I have to GUESS on insufficient data, I would suspect that the 'port' of spamd to Windows(?) does not properly tidy up its children when finished. The fact that it crashes certainly points in this direction. May I presume that you did a 'full' memory test? The port is running fine, did a test with the same message: First run: 17,4, triggered autolearn spam Any run after this: 19,4 You may want to start spamd from console instead of using this batch stuff. Not sure if this causes the problem, but it's another source of error. But what would REALLY help: Open the console Locate your spamd.exe type: spamd.exe -D --syslog=spamd.log Now scan your mail a few times. Open the spamd.log located beside your spamd.exe and copy the whole content to http://pastebin.com/ This will give us a good chance to identify the problem. Daniel JAM Software GmbH Gesch?ftsf?hrer: Joachim Marder Max-Planck-Str. 22 * 54296 Trier * Germany Tel: 0651-145 653 -0 * Fax: 0651-145 653 -29 Handelsregister Nr. HRB 4920 (AG Wittlich) http://www.jam-software.de
Re: First run score: 25.7 Second: 2.6
On Tue, 2010-07-20 at 14:53 +0300, Emin Akbulut wrote: Does not spamd 3.3.1 (JAM) support logging? I want to log some info... When run under Linux it logs to /var/log/maillog. Does the DOS/Windows version write log messages to stderr or does it just suppress them? My recent scores on same input : ) OK X-Spam-Status: No, score=5.7 required=6.3 tests=BAYES_50,HTML_IMAGE_ONLY_32, If this was extracted from the message headers its incomplete: there is at least one additional line. You should be posting the group of lines that starts with the X-Spam-Status line and ends with the line containing autolearn=. Martin
Re: First run score: 25.7 Second: 2.6
OK I've found the wrong score's log however I'm not very familiar with SA debug logs, I've added both correct 18 point and wrong 5.5 point' logs. I also added processed messages. http://rapidshare.com/files/407987154/spamd-logs.rar * * http://rapidshare.com/files/407987154/spamd-logs.rar*I used the online diff tool: * *http://www.quickdiff.com/index.php* * * *It looks like a few problems occured, * *before **running head tests; * *score so far=12.019 vs far=0* * * * * * * On Tue, Jul 20, 2010 at 3:48 PM, Martin Gregorie mar...@gregorie.orgwrote: On Tue, 2010-07-20 at 14:53 +0300, Emin Akbulut wrote: Does not spamd 3.3.1 (JAM) support logging? I want to log some info... When run under Linux it logs to /var/log/maillog. Does the DOS/Windows version write log messages to stderr or does it just suppress them? My recent scores on same input : )
Re: [sa] Re: First run score: 25.7 Second: 2.6
I've used SA/spamd.exe for a while because it calculates very high scores on spams. -I thought- Then spams have appeared in people's inboxes and I needed to examine. I've used another batch file to log spamd spam scores. The commandline is: C:\NET\SpamAssassinWin32-EX\winspamc.exe C:\NET\SpamAssassinWin32-EX\realspam3.txt | Find X-Spam-Status: recover.log I ran the same command in a few seconds. Here are the newest results: 16.07.2010, 12:07:48 RESTARTED X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:08:13 OK X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:08:21 OK X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:09:44 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:09:57 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:10:00 OK X-Spam-Status: Yes, score=24.4 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:10:13 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, OK means SA is alive, RESTARTED means spamd.exe crashed or port 783 non-responsive restarted. On Thu, Jul 15, 2010 at 7:20 PM, Charles Gregory cgreg...@hwcn.org wrote: On Thu, 15 Jul 2010, Emin Akbulut wrote: spamassassin.exe always calculates the same/correct score. Good... Goood. pamd second run reports only a few tests. Is it OK? I mean spamd runs all test but only adds which one increases score to it's report? Or these tests are processed tests list only? First run has tons of tests, second run has only 5 tests. I am presuming, by your description that the exact same *unmodified* file is passing through spamc/spamd all three times, and that there are no other variables. The spamc calls are literalyl one after the other, with no change of userid or other change that would possibly lead toa different set of configuration files being read. So this means that it is spamd itself that is 'different' on the second execution. You are going to need to enable verbose logging for spamd and do these three tests and see what messages appear in the logs (presumably) showing a failure to load config files on the second run. Is it possiblt that the file LOCKING on your system prevents spamd from accessing certain files under certain circumstances? What happens if you run ANY other messaeg through spamc as the 'second' run, and then run the third one on the orignial file? Is spamd sensitie to it being the same messaeg or just messes up on 8whatever* the second message would happen to be? Timing or content? - C
Re: [sa] Re: First run score: 25.7 Second: 2.6
Emin Akbulut wrote: I've used SA/spamd.exe for a while because it calculates very high scores on spams. -I thought- Then spams have appeared in people's inboxes and I needed to examine. I've used another batch file to log spamd spam scores. The commandline is: C:\NET\SpamAssassinWin32-EX\winspamc.exe C:\NET\SpamAssassinWin32-EX\realspam3.txt | Find X-Spam-Status: recover.log I ran the same command in a few seconds. Here are the newest results: 16.07.2010, 12:07:48 RESTARTED X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:08:13 OK X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:08:21 OK X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:09:44 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:09:57 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:10:00 OK X-Spam-Status: Yes, score=24.4 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 12:10:13 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, Still looks like some sort of DNS based issue. Anyway, could you please paste the raw mail? I'll feed our spamd with it. Since we use the same binaries, this should give a first advice if it's really the SpamAssassin which is causing the problem. As already started, you could also try to enable debug output for Spamd, just start the executable with --debug --syslog=spamd.log parameter. Daniel -- View this message in context: http://old.nabble.com/First-run-score%3A-25.7-Second%3A-2.6-tp29161519p29181827.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: First run score: 25.7 Second: 2.6
On Fri, 16 Jul 2010, Emin Akbulut wrote: X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, X-Spam-Status: Yes, score=24.4 required=6.3 tests=HTML_IMAGE_ONLY_32, (liberally snipped) There are commas at the end of these lines, implying you have trimmed the rest of the list of tests that account for the different scores. Go back and assemble the FULL logs, so that we can see the difference in what tests fire and what tests don't. Now if I have to GUESS on insufficient data, I would suspect that the 'port' of spamd to Windows(?) does not properly tidy up its children when finished. The fact that it crashes certainly points in this direction. May I presume that you did a 'full' memory test? To verify this situation, try running the same test as before, but leave a one minute gap between each run/test (and with no other spamd calls during that time interval!) so that we can see what happens when the spamd children have time to properly terminate. - C Ps. I'm not researching this deeply, so I may trip over some minor aspect of spamd coding/behaviour that the developers will call me on, I'm sure. :)
Re: First run score: 25.7 Second: 2.6
-Original Message- From: Charles Gregory Now if I have to GUESS on insufficient data, I would suspect that the 'port' of spamd to Windows(?) does not properly tidy up its children when finished. The fact that it crashes certainly points in this direction. May I presume that you did a 'full' memory test? The port is running fine, did a test with the same message: First run: 17,4, triggered autolearn spam Any run after this: 19,4 You may want to start spamd from console instead of using this batch stuff. Not sure if this causes the problem, but it's another source of error. But what would REALLY help: Open the console Locate your spamd.exe type: spamd.exe -D --syslog=spamd.log Now scan your mail a few times. Open the spamd.log located beside your spamd.exe and copy the whole content to http://pastebin.com/ This will give us a good chance to identify the problem. Daniel JAM Software GmbH Gesch?ftsf?hrer: Joachim Marder Max-Planck-Str. 22 * 54296 Trier * Germany Tel: 0651-145 653 -0 * Fax: 0651-145 653 -29 Handelsregister Nr. HRB 4920 (AG Wittlich) http://www.jam-software.de
Re: First run score: 25.7 Second: 2.6
In my first post, SA addition to message is included. I am including all header lines this time; I noticed SA has added first lines in one result, and has added lines somewhere in the middle in other result. :P I've restarted spamd after test # 1. TEST1.TXT: It takes less than 2 seconds -- X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on WebServer X-Spam-Level: * X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, HTML_IMAGE_RATIO_02,HTML_MESSAGE,LOCALPART_IN_SUBJECT,MIME_HTML_ONLY, MISSING_DATE,MISSING_MID,RDNS_NONE,TO_NO_BRKTS_NORDNS_HTML autolearn=no version=3.3.1 Received: from [41.251.163.175] ([41.251.150.113]) by izsmmmo.com with MailEnable ESMTP; Tue, 13 Jul 2010 13:29:35 +0300 From: SexMeds from USA ferdi.to...@izsmmmo.com To: ferdi.to...@izsmmmo.com Subject: ferdi.tosun, special 70% bonus for you. was climatological causes its has Content-Type: text/html; charset=utf-8 MIME-Version: 1.0 Return-Path: ferdi.to...@izsmmmo.com TEST2.TXT: This one takes more than 4 seconds. -- Received: from localhost by WebServer with SpamAssassin (version 3.3.1); Fri, 16 Jul 2010 17:26:36 +0300 From: SexMeds from USA ferdi.to...@izsmmmo.com To: ferdi.to...@izsmmmo.com Subject: ferdi.tosun, special 70% bonus for you. was climatological causes its has X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on WebServer X-Spam-Flag: YES X-Spam-Level: ** X-Spam-Status: Yes, score=22.7 required=6.3 tests=HTML_IMAGE_ONLY_32, HTML_IMAGE_RATIO_02,HTML_MESSAGE,LOCALPART_IN_SUBJECT,MIME_HTML_ONLY, MISSING_DATE,MISSING_MID,RCVD_IN_BRBL_LASTEXT,RCVD_IN_PBL,RCVD_IN_XBL, RDNS_NONE,TO_NO_BRKTS_NORDNS_HTML,T_SURBL_MULTI1,T_SURBL_MULTI2, T_SURBL_MULTI3,T_SURBL_MULTI4,URIBL_AB_SURBL,URIBL_DBL_SPAM,URIBL_JP_SURBL, URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=unavailable version=3.3.1 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=--=_4C406C1C.11A6 I also have a monitoring logs; here are the last 1 hour: -- 16.07.2010, 16:35:00 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 16:40:00 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 16:45:00 OK X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 16:50:00 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 16:55:00 OK X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 17:00:00 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 17:05:00 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 17:10:00 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 17:15:00 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 17:20:00 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 17:25:00 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 17:30:00 OK X-Spam-Status: Yes, score=22.7 required=6.3 tests=HTML_IMAGE_ONLY_32, 16.07.2010, 17:35:00 OK X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, On Fri, Jul 16, 2010 at 5:11 PM, Charles Gregory cgreg...@hwcn.org wrote: On Fri, 16 Jul 2010, Emin Akbulut wrote: X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, X-Spam-Status: No, score=5.5 required=6.3 tests=HTML_IMAGE_ONLY_32, X-Spam-Status: Yes, score=24.4 required=6.3 tests=HTML_IMAGE_ONLY_32, (liberally snipped) There are commas at the end of these lines, implying you have trimmed the rest of the list of tests that account for the different scores. Go back and assemble the FULL logs, so that we can see the difference in what tests fire and what tests don't. Now if I have to GUESS on insufficient data, I would suspect that the 'port' of spamd to Windows(?) does not properly tidy up its children when finished. The fact that it crashes certainly points in this direction. May I presume that you did a 'full' memory test? To verify this situation, try running the same test as before, but leave a one minute gap between each run/test (and with no other spamd calls during that time interval!) so that we can see what happens when the spamd children have time to properly terminate. - C Ps. I'm not researching this deeply, so I may trip over some minor aspect of spamd coding/behaviour that the developers will call me on, I'm sure. :)
Re: First run score: 25.7 Second: 2.6
On Fri, 2010-07-16 at 10:11 -0400, Charles Gregory wrote: Now if I have to GUESS on insufficient data, I would suspect that the 'port' of spamd to Windows(?) does not properly tidy up its children when finished. The fact that it crashes certainly points in this direction. May I presume that you did a 'full' memory test? To verify this situation, try running the same test as before, but leave a one minute gap between each run/test (and with no other spamd calls during that time interval!) so that we can see what happens when the spamd children have time to properly terminate. You might also do a pair of test runs with the same set of test data and the options shown: - one with --max-children=1 which should force sequential scans using the same child. This will pick up any cruft being left in the child process by the previous message. - one with --max-children=1 and --max-conn-per-child=1 which should force a newly spawned child to be used for every message. Any differences between the two runs would point to left-over cruft being the problem. Martin
Re: First run score: 25.7 Second: 2.6
I've stopped the mail server MTA during I was testing, so spamd has checked only one message at same time. It looks totaly random : ) Is the only difference between spamassassin.exe spamd.exe their very own User_Prefs config files? On Fri, Jul 16, 2010 at 5:54 PM, Martin Gregorie mar...@gregorie.orgwrote: Any differences between the two runs would point to left-over cruft being the problem. Martin
Re: First run score: 25.7 Second: 2.6
On Fri, 2010-07-16 at 18:07 +0300, Emin Akbulut wrote: I've stopped the mail server MTA during I was testing, so spamd has checked only one message at same time. It looks totaly random : ) Is the only difference between spamassassin.exe spamd.exe their very own User_Prefs config files? No. spamassassin processes one message and quits - its meant to be used in a script or a procmail recipe. spamd is a server that processes many messages sent to it by spamc during its lifetime. Spamc does the following for every message: receives a message to scan via stdin opens a connection to spamd sends the message to spamd receives the annotated message back from spamd closes the connection writes the annotated message to stdout IOW, if you develop a script or pipeline using spamasassin you can replace it with spamc and the script will work just as before but faster (assuming you've started spamd!) Martin
Re: First run score: 25.7 Second: 2.6
I knew what you mentioned, I mean do they use same engine, algorithm, you name it... I think that If both use same Perl code then the only remaining diffrence is User_Prefs like things... BTW, I want to thank you all who spent time and answered us here, passionately : ) I felt I'm not alone here and live with same addiction to both solve own other's problems. Thank you people!!! On Fri, Jul 16, 2010 at 7:34 PM, Martin Gregorie mar...@gregorie.orgwrote: On Fri, 2010-07-16 at 18:07 +0300, Emin Akbulut wrote: I've stopped the mail server MTA during I was testing, so spamd has checked only one message at same time. It looks totaly random : ) Is the only difference between spamassassin.exe spamd.exe their very own User_Prefs config files? No. spamassassin processes one message and quits - its meant to be used in a script or a procmail recipe. spamd is a server that processes many messages sent to it by spamc during its lifetime. Spamc does the following for every message: receives a message to scan via stdin opens a connection to spamd sends the message to spamd receives the annotated message back from spamd closes the connection writes the annotated message to stdout IOW, if you develop a script or pipeline using spamasassin you can replace it with spamc and the script will work just as before but faster (assuming you've started spamd!) Martin
Re: First run score: 25.7 Second: 2.6
On Fri, 2010-07-16 at 21:50 +0300, Emin Akbulut wrote: I knew what you mentioned, I mean do they use same engine, algorithm, you name it... That's a developer question, but I'd be surprised if it doesn't. The Linux spamd executable is just a Perl script with the usual executable script's first line, '#!/usr/bin/perl -T -w' Martin
Re: First run score: 25.7 Second: 2.6
It's possible, the local DNS server becomes non-responsive -hate Microsoft- restarting DNS service is not solution, I have to restart machine. *** I DIDN'T VERIFY IT'S THE ROOT CAUSE OR NOT *** I also have spamd crash problem, it crashes very often: Application: spamd.exe, version 3.3.1.2, timestamp 0x4b75db31, modul IPHLPAPI.DLL_unloaded, version 0.0.0.0, timestamp 0x49e037a4, code 0xc005, error loc 0x74f83386, eventid 0xe98, app startup 0x01cb23e00ec14618. So, I wrote a batch file which one checks and recovers the service, if necessary, in every 5 minutes. I use free cryping.exe utility. --- Recover-Spamassassin.bat --- c: cd \NET\Services cryping -port 783 127.0.0.1 | Find 100%% nul @If ErrorLevel 1 Goto OK :RESTART @echo Restarting Spamassassin MTA services... @call restart-spamassassinmta.bat @echo Done! @echo %Date%, %Time%, RESTARTED recover.log @GoTo EXIT :OK @echo Everything seems OK! @echo %Date%, %Time%, OK recover.log @GoTo EXIT :EXIT @rem pause nul On Thu, Jul 15, 2010 at 2:58 AM, Matt Kettler mkettler...@verizon.netwrote: On 7/14/2010 11:27 AM, Emin Akbulut wrote: I noticed randomly while I was testing SA. All I did is below: WinSpamC realspam.txt result1.txt NET STOP Spamassassin NET START Spamassassin WinSpamC realspam.txt result2.txt WinSpamC realspam.txt result3.txt result1: under 6.3 result2: very high result3: under 6.3 That is quite strange.. sounds like you've got DNS timeout problems. Might want to check the DNS settings on your machine and make sure all of the listed DNS servers are working and are capable of properly resolving internet hosts. SpamAssassin will *NOT* query every DNS server in your setup. It will pick one, and query it. If it gets no response, SA goes with that and does NOT ask the other DNS servers. So if there's a dead DNS server in your config, that's not so good for SA.
Re: First run score: 25.7 Second: 2.6
Emin Akbulut wrote: I also have spamd crash problem, it crashes very often: Application: spamd.exe, version 3.3.1.2, timestamp 0x4b75db31, modul IPHLPAPI.DLL_unloaded, version 0.0.0.0, timestamp 0x49e037a4, code 0xc005, error loc 0x74f83386, eventid 0xe98, app startup 0x01cb23e00ec14618. This is a known issue when using a 64-bit Windows. It seems to appear when mail load increases and additional childs have to be spawned in a relatively short time. I already told ActiveState about this, but they guess it's a problem in this specific dll when running a 32-bit application in 64-bit context. So nothing that could yet be worked around by tweaking the SpamAssassin source. You may want to solve this by increasing your --max-spare, at least this works for our servers. Daniel -- View this message in context: http://old.nabble.com/First-run-score%3A-25.7-Second%3A-2.6-tp29161519p29169818.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: First run score: 25.7 Second: 2.6
On 15-Jul-2010, at 00:59, Daniel Lemke wrote: You may want to solve this by increasing your --max-spare, at least this works for our servers. Or sneaking in one night and ninja-installing FreeBSD/Linux on all those windows boxes… Not that I'm suggesting that, of course. :D -- Q: Does anyone know how many LOCs were in the Space Shuttle' codebase? A: 45. It was written in perl (paraphrased Slashdot discussion)
Re: First run score: 25.7 Second: 2.6
I don't know the default --max-spare value if any and what do you suggest, Daniel? Our MTA thread limit is 6. On Thu, Jul 15, 2010 at 9:59 AM, Daniel Lemke le...@jam-software.comwrote: Emin Akbulut wrote: I also have spamd crash problem, it crashes very often: Application: spamd.exe, version 3.3.1.2, timestamp 0x4b75db31, modul IPHLPAPI.DLL_unloaded, version 0.0.0.0, timestamp 0x49e037a4, code 0xc005, error loc 0x74f83386, eventid 0xe98, app startup 0x01cb23e00ec14618. This is a known issue when using a 64-bit Windows. It seems to appear when mail load increases and additional childs have to be spawned in a relatively short time. I already told ActiveState about this, but they guess it's a problem in this specific dll when running a 32-bit application in 64-bit context. So nothing that could yet be worked around by tweaking the SpamAssassin source. You may want to solve this by increasing your --max-spare, at least this works for our servers. Daniel -- View this message in context: http://old.nabble.com/First-run-score%3A-25.7-Second%3A-2.6-tp29161519p29169818.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: First run score: 25.7 Second: 2.6
LuKreme wrote: On 15-Jul-2010, at 00:59, Daniel Lemke wrote: You may want to solve this by increasing your --max-spare, at least this works for our servers. Or sneaking in one night and ninja-installing FreeBSD/Linux on all those windows boxes… Not that I'm suggesting that, of course. :D Oh great, we have a volunteer ;) You certainly right, but we use this Windows ports of SpamAssassin mostly in combination with some Exchange extensions for (Windows) Small Business Servers. By this, they just have make one or two decisions for the installer, and that's it. Forcing somebody to set up a VM or even a real unix box would be quite overshot. Emin Akbulut wrote: I don't know the default --max-spare value if any and what do you suggest, Daniel? Our MTA thread limit is 6. If nothing set, spamd starts with two children. Of course, optimum depends on your mail load, but if its really the fork emulation that is killing your daemon, try to set up to 4 or 5. I've set it to 5 on our production, enough to handle a mail for every second or so. Daniel -- View this message in context: http://old.nabble.com/First-run-score%3A-25.7-Second%3A-2.6-tp29161519p29170201.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: First run score: 25.7 Second: 2.6
On Wed, 14 Jul 2010, Matt Kettler wrote: On 7/14/2010 11:27 AM, Emin Akbulut wrote: I noticed randomly while I was testing SA. All I did is below: WinSpamC realspam.txt result1.txt NET STOP Spamassassin NET START Spamassassin WinSpamC realspam.txt result2.txt WinSpamC realspam.txt result3.txt result1: under 6.3 result2: very high result3: under 6.3 That is quite strange.. sounds like you've got DNS timeout problems. No, it's something more than that. Go back to the original test and there are other tests that stop firing like that FROM_IN_SUBJECT. It almost seems like some of his spamd children are failing to load all their parameters. Noting the frequent crashes mentioned in another post, I would say that there is something to it. I suggest to OP that he try the spamassassin executable, to see if this score anomaly repeats itself. If it is only happening on spamd, then somehow those crashes point to a problem. If the load is not to high, he could even use spamassassin for production. I do. And 99% of the time it works fine (Footnote for people who will inevitably ask: My glue doesn't seem to like the way spamc returns the original mail.) - C
Re: First run score: 25.7 Second: 2.6
spamassassin.exe always calculates the same/correct score. spamd second run reports only a few tests. Is it OK? I mean spamd runs all test but only adds which one increases score to it's report? Or these tests are processed tests list only? First run has tons of tests, second run has only 5 tests. On Thu, Jul 15, 2010 at 4:08 PM, Charles Gregory cgreg...@hwcn.org wrote: On Wed, 14 Jul 2010, Matt Kettler wrote: On 7/14/2010 11:27 AM, Emin Akbulut wrote: I noticed randomly while I was testing SA. All I did is below: WinSpamC realspam.txt result1.txt NET STOP Spamassassin NET START Spamassassin WinSpamC realspam.txt result2.txt WinSpamC realspam.txt result3.txt result1: under 6.3 result2: very high result3: under 6.3 That is quite strange.. sounds like you've got DNS timeout problems. No, it's something more than that. Go back to the original test and there are other tests that stop firing like that FROM_IN_SUBJECT. It almost seems like some of his spamd children are failing to load all their parameters. Noting the frequent crashes mentioned in another post, I would say that there is something to it. I suggest to OP that he try the spamassassin executable, to see if this score anomaly repeats itself. If it is only happening on spamd, then somehow those crashes point to a problem. If the load is not to high, he could even use spamassassin for production. I do. And 99% of the time it works fine (Footnote for people who will inevitably ask: My glue doesn't seem to like the way spamc returns the original mail.) - C
Re: [sa] Re: First run score: 25.7 Second: 2.6
On Thu, 15 Jul 2010, Emin Akbulut wrote: spamassassin.exe always calculates the same/correct score. Good... Goood. pamd second run reports only a few tests. Is it OK? I mean spamd runs all test but only adds which one increases score to it's report? Or these tests are processed tests list only? First run has tons of tests, second run has only 5 tests. I am presuming, by your description that the exact same *unmodified* file is passing through spamc/spamd all three times, and that there are no other variables. The spamc calls are literalyl one after the other, with no change of userid or other change that would possibly lead toa different set of configuration files being read. So this means that it is spamd itself that is 'different' on the second execution. You are going to need to enable verbose logging for spamd and do these three tests and see what messages appear in the logs (presumably) showing a failure to load config files on the second run. Is it possiblt that the file LOCKING on your system prevents spamd from accessing certain files under certain circumstances? What happens if you run ANY other messaeg through spamc as the 'second' run, and then run the third one on the orignial file? Is spamd sensitie to it being the same messaeg or just messes up on 8whatever* the second message would happen to be? Timing or content? - C
First run score: 25.7 Second: 2.6
I run SA Win32 port 3.3.1 by JAM Software on Windows Server 2008 64 bit. Spamassassin.exe always calculates the same score, coz User_Prefs file is under my docs (C:\Users\ea\.spamassassin) However spamd.exe -which runs as service- calculates the right score at first time then score goes very low at subsequent checks. spamd runs under system account and it's User_Prefs file is located under C:\Windows\SysWOW64\config\systemprofile\.spamassassin I have no idea why spamd calculates different scores. I hope someone here knows the reason has a solution. Thanks. First run: --- X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on WebServer X-Spam-Flag: YES X-Spam-Level: * X-Spam-Status: Yes, score=25.7 required=6.3 tests=HTML_IMAGE_ONLY_32, HTML_IMAGE_RATIO_02,HTML_MESSAGE,LOCALPART_IN_SUBJECT,MIME_HTML_ONLY, MISSING_DATE,MISSING_MID,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL_LASTEXT, RCVD_IN_PBL,RCVD_IN_XBL,RDNS_NONE,TO_NO_BRKTS_NORDNS_HTML,T_SURBL_MULTI1, T_SURBL_MULTI2,T_SURBL_MULTI3,T_SURBL_MULTI4,T_URIBL_BLACK_OVERLAP, URIBL_AB_SURBL,URIBL_BLACK,URIBL_DBL_SPAM,URIBL_JP_SURBL,URIBL_OB_SURBL, URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=unavailable version=3.3.1 Next runs: --- X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on WebServer X-Spam-Level: ** X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, HTML_IMAGE_RATIO_02,HTML_MESSAGE,LOCALPART_IN_SUBJECT,MIME_HTML_ONLY autolearn=unavailable version=3.3.1
Re: First run score: 25.7 Second: 2.6
On 7/14/2010 8:42 AM, Emin Akbulut wrote: I run SA Win32 port 3.3.1 by JAM Software on Windows Server 2008 64 bit. Spamassassin.exe always calculates the same score, coz User_Prefs file is under my docs (C:\Users\ea\.spamassassin) However spamd.exe -which runs as service- calculates the right score at first time then score goes very low at subsequent checks. spamd runs under system account and it's User_Prefs file is located under C:\Windows\SysWOW64\config\systemprofile\.spamassassin I have no idea why spamd calculates different scores. I hope someone here knows the reason has a solution. Thanks. First run: --- X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on WebServer X-Spam-Flag: YES X-Spam-Level: * X-Spam-Status: Yes, score=25.7 required=6.3 tests=HTML_IMAGE_ONLY_32, HTML_IMAGE_RATIO_02,HTML_MESSAGE,LOCALPART_IN_SUBJECT,MIME_HTML_ONLY, MISSING_DATE,MISSING_MID,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL_LASTEXT, RCVD_IN_PBL,RCVD_IN_XBL,RDNS_NONE,TO_NO_BRKTS_NORDNS_HTML,T_SURBL_MULTI1, T_SURBL_MULTI2,T_SURBL_MULTI3,T_SURBL_MULTI4,T_URIBL_BLACK_OVERLAP, URIBL_AB_SURBL,URIBL_BLACK,URIBL_DBL_SPAM,URIBL_JP_SURBL,URIBL_OB_SURBL, URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=unavailable version=3.3.1 Next runs: --- X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on WebServer X-Spam-Level: ** X-Spam-Status: No, score=2.6 required=6.3 tests=HTML_IMAGE_ONLY_32, HTML_IMAGE_RATIO_02,HTML_MESSAGE,LOCALPART_IN_SUBJECT,MIME_HTML_ONLY autolearn=unavailable version=3.3.1 What sticks out to me is that most of the missing score hits on the second run are from blacklists. It seems like the second run is doing local tests only. Are you sure they are running the same way? Can you tell us how each of these tests are run? I assume the first one is the automatic test when the email is received and the second is a manual call to spamc? -- Bowie
Re: First run score: 25.7 Second: 2.6
On Wed, 14 Jul 2010, Bowie Bailey wrote: First run: --- X-Spam-Status: Yes, score=25.7 required=6.3 tests=HTML_IMAGE_ONLY_32, HTML_IMAGE_RATIO_02,HTML_MESSAGE,LOCALPART_IN_SUBJECT What sticks out to me is that most of the missing score hits on the second run are from blacklists. Quite true. What also sticks out to me is that test LOCALPART_IN_SUBJECT disappers which means that the headers on the second run are substantially different from the headers on the first run. SOMETHING is severely mangling the mail between the two runs, and quite obviously this degrades spamassassin's capability to detect spam. I suppose I should ask (of the OP) WHY there are two runs at all? - C
Re: First run score: 25.7 Second: 2.6
Emin Akbulut wrote: However spamd.exe -which runs as service- calculates the right score at first time then score goes very low at subsequent checks. spamd runs under system account and it's User_Prefs file is located under C:\Windows\SysWOW64\config\systemprofile\.spamassassin I have no idea why spamd calculates different scores. I hope someone here knows the reason has a solution. What parameters did you start spamd with? Daniel -- View this message in context: http://old.nabble.com/First-run-score%3A-25.7-Second%3A-2.6-tp29161519p29162415.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: First run score: 25.7 Second: 2.6
I noticed randomly while I was testing SA. All I did is below: WinSpamC realspam.txt result1.txt NET STOP Spamassassin NET START Spamassassin WinSpamC realspam.txt result2.txt WinSpamC realspam.txt result3.txt result1: under 6.3 result2: very high result3: under 6.3 On Wed, Jul 14, 2010 at 5:08 PM, Daniel Lemke le...@jam-software.comwrote: Emin Akbulut wrote: However spamd.exe -which runs as service- calculates the right score at first time then score goes very low at subsequent checks. spamd runs under system account and it's User_Prefs file is located under C:\Windows\SysWOW64\config\systemprofile\.spamassassin I have no idea why spamd calculates different scores. I hope someone here knows the reason has a solution. What parameters did you start spamd with? Daniel -- View this message in context: http://old.nabble.com/First-run-score%3A-25.7-Second%3A-2.6-tp29161519p29162415.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: First run score: 25.7 Second: 2.6
On 7/14/2010 11:27 AM, Emin Akbulut wrote: I noticed randomly while I was testing SA. All I did is below: WinSpamC realspam.txt result1.txt NET STOP Spamassassin NET START Spamassassin WinSpamC realspam.txt result2.txt WinSpamC realspam.txt result3.txt result1: under 6.3 result2: very high result3: under 6.3 That is quite strange.. sounds like you've got DNS timeout problems. Might want to check the DNS settings on your machine and make sure all of the listed DNS servers are working and are capable of properly resolving internet hosts. SpamAssassin will *NOT* query every DNS server in your setup. It will pick one, and query it. If it gets no response, SA goes with that and does NOT ask the other DNS servers. So if there's a dead DNS server in your config, that's not so good for SA.
