sa-update - what files actually change?

[bignose]

Hi,

I just ran sa-update to fix the FH_DATE_PAST_20XX bug,however when it runs none of the timestamps on the files in /usr/local/share/spamassassin

but new files do show up in /var/lib/spamassassin/3.002004/updates_spamassassin_org

Do I just copy these over? Shouldn't sa-update do this for me?

[mattmattt]

Hi,

I just ran sa-update to fix the FH_DATE_PAST_20XX bug,however when it runs none of the timestamps on the files in /usr/local/share/spamassassin

but new files do show up in /var/lib/spamassassin/3.002004/updates_spamassassin_org

Do I just copy these over? Shouldn't sa-update do this for me?

I am also curious about this question.
When I ran sa-update on my freebsd cpanel boxes it stuck everything into the
/var/lib area and left /usr/local/share/spamassassin untouched.

So back in the day I edited it by hand to fix the issue. But now I do really want
those sa-updates for better filtering...

Based on the spamassassin man page it should be looking in /var/lib first but
somehow I do not think that is the case because sa-update failed to fix this
bug and I had to edit the file by hand.

Do I just copy them over like the OP was thinking? I really hate having stuff
in two different places.... Would I be better editing an /etc/mail/spammassassin/ config file?

Any comments would be appreciated.

[bignose]

my best advice is ditch FreeBSD and use CentOS. Cpanel only pretend to work well on FreeBSD and its actually a red headed stepchild.

I wanted to stay true to FreeBSD, but CentOS really is what cPanel is meant for.

[AndyReed]

Do I just copy these over? Shouldn't sa-update do this for me?

This FAQ might help regarding SA RuleUpdates:

RuleUpdates - Spamassassin Wiki

[JamieW]

Okay I was getting this too. I just noticed getting some false positives. But I chalked it up to being a new source that SA hadn't learned yet. But then some from a site I had received just fine before were caught as spam. Looking at them I had the FH_DATE_PAST_20XX tag, even though the date looked fine. I found this and other info and did the sa-update also, which still didn't fix it as the OP and others mentioned. I then read the FAQ AndyReed pointed to. There's a lot to wade through, but the important part is:

"NOTE: Once the /var/lib/spamassassin/<spamassassin version> directory exists, spamassassin expects to find all rules underneath that directory".

So sa-update fixed those files, why is it still incorrectly flagging it? You need to restart SA! And to do that you need to restart exim. Then it will start looking for it in the new folder.

So it breaks down real easy. If you're getting the FH_DATE_PAST_20XX bug then just do:

1. sa-update
2. Restart exim (via WHM or service exim restart)

Real easy. I hope that helps someone else! That's a bug likely to make a lot of false positives at 3.2 points each!

Oh, and I'm guessing we will need to set up a crontab or something to periodically run sa-update after that, to keep it up to date.

[gkgcpanel]

Okay I was getting this too. I just noticed getting some false positives. But I chalked it up to being a new source that SA hadn't learned yet. But then some from a site I had received just fine before were caught as spam. Looking at them I had the FH_DATE_PAST_20XX tag, even though the date looked fine. I found this and other info and did the sa-update also, which still didn't fix it as the OP and others mentioned. I then read the FAQ AndyReed pointed to. There's a lot to wade through, but the important part is:

So sa-update fixed those files, why is it still incorrectly flagging it? You need to restart SA! And to do that you need to restart exim. Then it will start looking for it in the new folder.

So it breaks down real easy. If you're getting the FH_DATE_PAST_20XX bug then just do:

1. sa-update
2. Restart exim (via WHM or service exim restart)

Real easy. I hope that helps someone else! That's a bug likely to make a lot of false positives at 3.2 points each!

Oh, and I'm guessing we will need to set up a crontab or something to periodically run sa-update after that, to keep it up to date.

Tried your suggestion. Ran sa-update then restarted exim (service restart exim) and still the files in the /var/lib/spamassassin/3.002004/updates_spamassassin_org directory are dated Jan 2, 2010.

SpamAssassin is running, but we are seeing tons of spam coming through which is putting a huge load on the server.

Can't figure out why this isn't working...