Mailing List Archive: Qmail: users

spamassassin

Index | Next | Previous | View Threaded

kirk at icapsolutions

May 20, 2009, 8:34 PM

Post #1 of 7 (1728 views)
Permalink

spamassassin

I've been getting several messages like this one with "SA:0(?/?)" in the
header. Any clues as to why this is happening? Here's the full header:

Return-Path: <Mikeqy [at] greatnewschannel>
Delivered-To: kirk [at] icapsolutions
Received: (qmail 23703 invoked by uid 515); 21 May 2009 02:23:02 +0000
Received: from 76.73.61.43 by papa.icapsolutions.com (envelope-from
<Mikeqy [at] greatnewschannel>, uid 513) with qmail-scanner-2.05
(clamdscan: 0.86/8541. spamassassin: 3.2.5.
Clear:RC:0(76.73.61.43):SA:0(?/?):.
Processed in 1.69304 secs); 21 May 2009 02:23:02 -0000
X-Spam-Status: No, score=? required=?
X-Spam-Level:
X-Qmail-Scanner-Mail-From: Mikeqy [at] greatnewschannel via
papa.icapsolutions.com
X-Qmail-Scanner-Rcpt-To: kirk [at] icapsolutions
X-Qmail-Scanner: 2.05 (Clear:RC:0(76.73.61.43):SA:0(?/?):. Processed in
1.69304 secs)
Received: from unknown (HELO mx17.greatnewschannel.com) (76.73.61.43)
by mail.icapsolutions.com with SMTP; 21 May 2009 02:22:48 +0000
Reply-To: <Mikeqy [at] greatnewschannel>
To: <kirk [at] icapsolutions>
X-mailer:http://greatnewschannel.com/yew/yjfptkqjhvcvmcv/kf/
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_extPart_000_0466_01C99C43.7C6B79D0"
X-Mailer: Microsoft Office Outlook 12.0
Content-Language: en-us
Subject: Term Life With No Physical
From: "ELifePolicy" <bkri489isvz [at] greatnewschannel>
Date: Wed, 20 May 2009 20:21:03 -0700
Message-Id: <20090520202103.hzwhjyscvwls [at] mx17>

Thx,
Kirk

kyle-qmail at memoryhole

May 20, 2009, 8:43 PM

Post #2 of 7 (1646 views)
Permalink

Re: spamassassin [In reply to]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Wednesday, May 20 at 08:34 PM, quoth Kirk:
>I've been getting several messages like this one with "SA:0(?/?)" in the
>header.

Isn't that a qmail-scanner-specific header?

>X-Spam-Status: No, score=? required=?

Here's the immediate reason: spamassassin is generating bogus
X-Spam-Status headers.

Chances are it's because your SpamAssassin configs are broken. You
probably want to run spamassassin with the --lint or --debug arguments
to track down where it's getting lost.

In any case, this isn't a qmail-related problem. A
spamassassin-specific mailing list would probably be able to give you
better advice and would be able to walk you through whatever issues
you find.

~Kyle
- --
Moral indignation is jealousy with a halo.
-- H. G. Wells
-----BEGIN PGP SIGNATURE-----
Comment: Thank you for using encryption!

iQIcBAEBCAAGBQJKFM3oAAoJECuveozR/AWejREP/2vUZ/moza173c0xxkkJZTWi
bi52XORqwIyFhn96i90NLSyybuViawmNaOfnzafRRnUz47o8HBIbveNT4KIWvlAB
U6ZTQMplZ8u3256Vk3eqI3BApGPylKECgRt8PXV1DNNNa8ybSjaS1GFDN4xtVHId
07kY2CySwEN4RR+w7F/xLFRallfcEQXyE4KyP06Niu07TsIBOOet51hfuiHwucOz
lGj/EDyQHYnuGgtbG2F+uIHCTiihodrZC4gQ0ZEf1BOOSF/S2hcS6ydXVoXNR0UR
VfEADSDtQy5kDtTYOcaw0FIHJwV4QZqK2Cyvqhh/jql+spduoQL47R3MYAqEl1S+
N5UjDXO9jxU1PGBnRoATHBLzz1sZPG5qdqfJBp7KeTrVVxTlElKM9aAqUB1AIXfT
gc0Xy9FWsXnN2x4JDZ9c91Fh7EP9rhi/A0vbWDoES04rezTa4lrksMin6Gu+eNG6
gs2f59V8nsclZul8lnJ52c0YXydjdTFiBzyQ9wxGsbsKGLpgzGCcchqGR9drVNB4
zLQda7e3cfew4kP/K1xbOmkvmSWSFKwO0omlNH/2G7yNg28p+UCF9K/sPGDhYpwA
9lfTbsBi3Vw3h2hpQFqM2UnrVSEqN8lFXCNB9oyZxZtDtgWCwFEI7pxXNbbsk190
ZJSQwIi2kMXQ4D0wqrDh
=Kpt+
-----END PGP SIGNATURE-----

kirk at icapsolutions

May 21, 2009, 7:56 AM

Post #3 of 7 (1637 views)
Permalink

RE: spamassassin [In reply to]

Thanks Kyle, I know this probably wasn't the correct list, but your advice
led me to the problem. It was the "my $sa_maxsize='256000';" which is too
small. So I increased it to 512000 and will monitor it in debug mode to
hopefully catch any other issues.

Thx
Kirk

> -----Original Message-----
> From: Kyle Wheeler [mailto:kyle-qmail [at] memoryhole]
> Sent: Wednesday, May 20, 2009 8:44 PM
> To: qmail [at] list
> Subject: Re: spamassassin
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On Wednesday, May 20 at 08:34 PM, quoth Kirk:
> >I've been getting several messages like this one with "SA:0(?/?)" in the
> >header.
>
> Isn't that a qmail-scanner-specific header?
>
> >X-Spam-Status: No, score=? required=?
>
> Here's the immediate reason: spamassassin is generating bogus
> X-Spam-Status headers.
>
> Chances are it's because your SpamAssassin configs are broken. You
> probably want to run spamassassin with the --lint or --debug arguments
> to track down where it's getting lost.
>
> In any case, this isn't a qmail-related problem. A
> spamassassin-specific mailing list would probably be able to give you
> better advice and would be able to walk you through whatever issues
> you find.
>
> ~Kyle
> - --
> Moral indignation is jealousy with a halo.
> -- H. G. Wells
> -----BEGIN PGP SIGNATURE-----
> Comment: Thank you for using encryption!
>
> iQIcBAEBCAAGBQJKFM3oAAoJECuveozR/AWejREP/2vUZ/moza173c0xxkkJZTWi
> bi52XORqwIyFhn96i90NLSyybuViawmNaOfnzafRRnUz47o8HBIbveNT4KIWvlAB
> U6ZTQMplZ8u3256Vk3eqI3BApGPylKECgRt8PXV1DNNNa8ybSjaS1GFDN4xtVHId
> 07kY2CySwEN4RR+w7F/xLFRallfcEQXyE4KyP06Niu07TsIBOOet51hfuiHwucOz
> lGj/EDyQHYnuGgtbG2F+uIHCTiihodrZC4gQ0ZEf1BOOSF/S2hcS6ydXVoXNR0UR
> VfEADSDtQy5kDtTYOcaw0FIHJwV4QZqK2Cyvqhh/jql+spduoQL47R3MYAqEl1S+
> N5UjDXO9jxU1PGBnRoATHBLzz1sZPG5qdqfJBp7KeTrVVxTlElKM9aAqUB1AIXfT
> gc0Xy9FWsXnN2x4JDZ9c91Fh7EP9rhi/A0vbWDoES04rezTa4lrksMin6Gu+eNG6
> gs2f59V8nsclZul8lnJ52c0YXydjdTFiBzyQ9wxGsbsKGLpgzGCcchqGR9drVNB4
> zLQda7e3cfew4kP/K1xbOmkvmSWSFKwO0omlNH/2G7yNg28p+UCF9K/sPGDhYpwA
> 9lfTbsBi3Vw3h2hpQFqM2UnrVSEqN8lFXCNB9oyZxZtDtgWCwFEI7pxXNbbsk190
> ZJSQwIi2kMXQ4D0wqrDh
> =Kpt+
> -----END PGP SIGNATURE-----

kyle-qmail at memoryhole

May 21, 2009, 8:13 AM

Post #4 of 7 (1648 views)
Permalink

Re: spamassassin [In reply to]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Thursday, May 21 at 07:56 AM, quoth Kirk:
> Thanks Kyle, I know this probably wasn't the correct list, but your advice
> led me to the problem. It was the "my $sa_maxsize='256000';" which is too
> small. So I increased it to 512000 and will monitor it in debug mode to
> hopefully catch any other issues.

Interesting... my version of SpamAssassin (3.2.5) simply doesn't
generate X-Spam-* headers for messages that are too large.

In any case, I'd be very cautious about fussing with your maximum
message size. Because SpamAssassin does a lot of regex analysis,
decomposes the MIME structure, and just generally expands each message
in memory, it can very easily use a LOT more memory than you expect,
especially if the message is rather complicated or has several layers
of encoding. (In testing, I've been able to reliably trigger the
OOMKiller with a single SpamAssassin instance; though admittedly it
was analyzing a 210MB message.) In any event, unless you're refusing
large messages at the MTA level (e.g. by putting a low number in
/var/qmail/control/databytes), you will eventually get messages that
are just large enough that SpamAssassin doesn't want to scan them. So,
it would be wise to figure out what you want to do with such messages
ahead of time.

~Kyle
- --
Necessity is the plea for every infringement of human freedom. It is
the argument of tyrants; it is the creed of slaves.
-- William Pitt the Younger
-----BEGIN PGP SIGNATURE-----
Comment: Thank you for using encryption!

iQIcBAEBCAAGBQJKFW+aAAoJECuveozR/AWeyX0QALNpW1kksYQCW0s40ZWnRCJm
0n5DXdcrRftGtO49T6XhaythGhu3VEQLakTkrCXTbjy+Pt6HjspensGdNG40NOxQ
h1zPN8zzTT00gzYcZ2pVF0jxMaFN4tzaxc+1HTFMqlvujM6Uyds3n60HaD6x20d+
CNUZ9Cyw308TasqNn5t3anaPtY/xSMRF+fu7tIrZvyXM5tl0MNeSvY/wwzmH01fz
S+e5RC/067O9TlEPSb6joJuXdjjKrjcQ4VQCsBZRU7C51e31HOs1XDulFqzAOsLp
Pke6xcv7aynA/hIsVQU9QOR6GOGW4qEYCv9ldC1qaGDc8ykmCCvdl17Go8IlnDAk
J+sn+kwkOMNxtujQunIX4W7IXez29Omf1OSuFwEXS1b1ULUb/3Flm7M4FPs7FMnb
hQb1Mj9xgGEMc7bnf9yKqyMY1l9diciBIAx94+P9X3FAA6saDDi/BP27tcm7Y6YA
pRsMNB6/kVkOD1KKQmCpZeGEYDDmdfW1HPWcCKJ6ZtMTsf3aJYdFCruO2CqckDtR
spm9Q4A7EEzoGzO3dw9j80BQmgpy60QJ0le7q2ZHhn/INDhv0UA9hxtf85b7Gwud
5qgfxi1tD30cuRZ5LEqPCoRbW+Ph0u61+iE/qzkDFK7z2Y7BT/A2en+2JPUOXdx0
ipE0b6xRykReH0ie+bMR
=I/uE
-----END PGP SIGNATURE-----

mducharme at cybergeneration

May 21, 2009, 8:27 AM

Post #5 of 7 (1638 views)
Permalink

RE: spamassassin [In reply to]

> -----Message d'origine-----
> De�: Kirk [mailto:kirk [at] icapsolutions]
> Envoy�: 21 mai 2009 10:57
> ��: qmail [at] list
> Objet�: RE: spamassassin
>
> Thanks Kyle, I know this probably wasn't the correct list, but your advice
> led me to the problem. It was the "my $sa_maxsize='256000';" which is too
> small. So I increased it to 512000 and will monitor it in debug mode to
> hopefully catch any other issues.
>
> Thx
> Kirk

Hi Kirk

We have seen similar issues when our servers was on high load, I mean 60+
SMTP sessions at the same time would produce a lot of "SA:0(?/?)" since
SpamAssassin was taking too much resources and some of them were getting
killed (SA processes).

Some ideas :

- get a more powerful machine
- lower concurrent SMTP sessions
- split domains hosting across multiple servers
- spread the incoming SMTP load between multiple servers (we use iptables
here to split the load between multiple qmail + SA servers).

Good luck

Maxime

>
>
> > -----Original Message-----
> > From: Kyle Wheeler [mailto:kyle-qmail [at] memoryhole]
> > Sent: Wednesday, May 20, 2009 8:44 PM
> > To: qmail [at] list
> > Subject: Re: spamassassin
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA256
> >
> > On Wednesday, May 20 at 08:34 PM, quoth Kirk:
> > >I've been getting several messages like this one with "SA:0(?/?)" in
> the
> > >header.
> >
> > Isn't that a qmail-scanner-specific header?
> >
> > >X-Spam-Status: No, score=? required=?
> >
> > Here's the immediate reason: spamassassin is generating bogus
> > X-Spam-Status headers.
> >
> > Chances are it's because your SpamAssassin configs are broken. You
> > probably want to run spamassassin with the --lint or --debug arguments
> > to track down where it's getting lost.
> >
> > In any case, this isn't a qmail-related problem. A
> > spamassassin-specific mailing list would probably be able to give you
> > better advice and would be able to walk you through whatever issues
> > you find.
> >
> > ~Kyle
> > - --
> > Moral indignation is jealousy with a halo.
> > -- H. G. Wells
> > -----BEGIN PGP SIGNATURE-----
> > Comment: Thank you for using encryption!
> >
> > iQIcBAEBCAAGBQJKFM3oAAoJECuveozR/AWejREP/2vUZ/moza173c0xxkkJZTWi
> > bi52XORqwIyFhn96i90NLSyybuViawmNaOfnzafRRnUz47o8HBIbveNT4KIWvlAB
> > U6ZTQMplZ8u3256Vk3eqI3BApGPylKECgRt8PXV1DNNNa8ybSjaS1GFDN4xtVHId
> > 07kY2CySwEN4RR+w7F/xLFRallfcEQXyE4KyP06Niu07TsIBOOet51hfuiHwucOz
> > lGj/EDyQHYnuGgtbG2F+uIHCTiihodrZC4gQ0ZEf1BOOSF/S2hcS6ydXVoXNR0UR
> > VfEADSDtQy5kDtTYOcaw0FIHJwV4QZqK2Cyvqhh/jql+spduoQL47R3MYAqEl1S+
> > N5UjDXO9jxU1PGBnRoATHBLzz1sZPG5qdqfJBp7KeTrVVxTlElKM9aAqUB1AIXfT
> > gc0Xy9FWsXnN2x4JDZ9c91Fh7EP9rhi/A0vbWDoES04rezTa4lrksMin6Gu+eNG6
> > gs2f59V8nsclZul8lnJ52c0YXydjdTFiBzyQ9wxGsbsKGLpgzGCcchqGR9drVNB4
> > zLQda7e3cfew4kP/K1xbOmkvmSWSFKwO0omlNH/2G7yNg28p+UCF9K/sPGDhYpwA
> > 9lfTbsBi3Vw3h2hpQFqM2UnrVSEqN8lFXCNB9oyZxZtDtgWCwFEI7pxXNbbsk190
> > ZJSQwIi2kMXQ4D0wqrDh
> > =Kpt+
> > -----END PGP SIGNATURE-----
>

gburnore at databasix

May 21, 2009, 10:59 AM

Post #6 of 7 (1647 views)
Permalink

RE: spamassassin [In reply to]

> From: Kyle Wheeler [mailto:kyle-qmail [at] memoryhole]
> Sent: Thursday, May 21, 2009 11:14 AM
> To: qmail [at] list
> Subject: Re: spamassassin
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On Thursday, May 21 at 07:56 AM, quoth Kirk:
> > Thanks Kyle, I know this probably wasn't the correct list, but your
> advice
> > led me to the problem. It was the "my $sa_maxsize='256000';" which is
> too
> > small. So I increased it to 512000 and will monitor it in debug mode to
> > hopefully catch any other issues.
>
> Interesting... my version of SpamAssassin (3.2.5) simply doesn't
> generate X-Spam-* headers for messages that are too large.
>

FYI, the ?/? message usually occurs when you run out of memory for
spamassassin to properly do it's job. Chances are ANY change you make will
cause the spam / threshold numbers to re-appear for a time as restarting
spamassassin is actually what fixes it.

ajai at bitblit

May 21, 2009, 11:09 AM

Post #7 of 7 (1635 views)
Permalink

RE: spamassassin [In reply to]

On Thu, 21 May 2009, Kirk wrote:

> Thanks Kyle, I know this probably wasn't the correct list, but your advice
> led me to the problem. It was the "my $sa_maxsize='256000';" which is too
> small. So I increased it to 512000 and will monitor it in debug mode to
> hopefully catch any other issues.

We only send messages < 640000 bytes to SA (though all messages get pushed
through clamav).

--
Aj.

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads