We are running SA 3.01 and the latest MailScanner. Besides the delivered SA rule sets, we have the following:
It's most likely due to bayes expiry.
Requoting a past post of mine on the subject:
------------------------------------------------------------------------------
Mailscanner is inappropriately impatient with SpamAssassin. It's timeouts were designed in the pre-bayes era, and are not designed to accommodate bayes housekeeping chores like expiry and journal syncs.
In the short term, you can help by running a sa-learn --force-expire on your bayes DB.
In the longer term, here's some suggestions I use on my own MailScanner server: (I use all of these together)
1) Increase the spamassassin timeout in MailScanner.conf. Bring it to 60 seconds at least, I have mine set to 120.
2) Set the "Rebuild Bayes Every" parameter in MailScanner.conf. 86400 seconds is a good start. This makes MailScanner invoke SA's bayes housekeeping directly, rather than during a scan of a message.
3) in /etc/mail/spamassassin/local.cf set: bayes_auto_expire 0. This will keep SA from trying to run bayes expires (long and slow) during message handling, but relies on #2 above to allow expiry to occur.
4) I also have a sa-learn --force-expire running as a daily cronjob. I have tested the setup without this measure, and #2 is sufficient to cause expiry to occur. Really this is just a fail-safe to allow expiry to occur even if MailScanner's calls fail to run it properly for some reason.
