SpamAssasin : problems with some emails...

**dexus** · 06-09-2008 03:54 AM

I noticed that SpamAssasin after last cPanel Release upgrade have problems with some emails... When SpamAssasin can't parse some email following error is loged in exim_paniclog and exim_mainlog...

Code:

2008-06-08 16:32:08 1K5Lwd-0001Vn-A8 spam acl condition: cannot parse spamd output

For example this email can not be properly parsed...

Code:

Subject: MSG ID:62304 Make her wet
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="0E7BEC25F499B23"
X-Spam-Status: No, score=
X-Spam-Score: 
X-Spam-Bar: 
X-Spam-Flag: NO

--0E7BEC25F499B23
Content-Type: text/plain;
 charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

There’s nothing more impressive than a man with confidence. =
Confidence with the Ladies and inner confidence comes with impressive =
physical attributes.
Here is the solution to pleasuring the ladies and upsizing your manhood:
MAXGAIN+ , The world’s breakthrough Mens Formula
- Manufactured in FDA approved laboratories
- Proven, MASSIVE gains of more than three inches
   - Increase the duration of your erection
- No more becoming flaccid during intercourse
- Double your volume of ejaculate
Available for a very limited period only – grasp the chance to =
become a real Man today.
Visit www.xxxxxxxx
     
--0E7BEC25F499B23
Content-Type: text/html;
 charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<STYLE></STYLE>
</HEAD>
<BODY>
<html>
<p>There’s nothing more impressive than a man with confidence. =
Confidence with the Ladies and inner confidence comes with impressive =
physical attributes.</p>

<p>Here is the solution to pleasuring the ladies and upsizing your =
manhood:</p>

<p>MAXGAIN+ , The world’s breakthrough Mens Formula</p>

<p>- Manufactured in FDA approved laboratories</p>
<p>- Proven, MASSIVE gains of more than three inches</p>  =20
<p>- Increase the duration of your erection</p>
<p>- No more becoming flaccid during intercourse</p>
<p>- Double your volume of ejaculate</p>

<p>Available for a very limited period only – grasp the chance to =
become a real Man today.</p>

<p>Visit <a href=3D"http://xxxxxxxx">www.xxxxxxxx</a></p>     =20
</html></BODY></HTML>
--0E7BEC25F499B23--

**blaster701** · 06-25-2008 03:04 PM

I cannot figure out what's wrong in spamd conf, sockets or perl module Mail::SpamAssassin, but "spam acl error" occurs at least once per hour, letting obvious spam mails to go through filter with No-Score.

spamd -D --lint gave no errors, maybe acl is malformed, so those particular mails break the process.

At the same time of error SpamAssassin writes a file in /tmp, which is new for us.

If anyone can bring light here it will be very appreciated.

Thanks in advance for your time,

BTW
Perl Version is 5.8.8, SpamAssassin 3.2.4, Mail::SpamAssassin 3.002004 (holdback)

**mtindor** · 06-25-2008 05:28 PM

I see the same messages. I don't consider it real ipmortant (for me) - Over the past five days I've seen that exactly five times (at various times on various days) and we have hundreds of thousands of messages go through over the course of that time. So it's pretty rare.

Unfortunately I don't have the source messages to check them out at this time.

Mike

**blaster701** · 06-29-2008 04:50 PM

our problem was quickly solved by cpanel support tech staff. SpamAssassin was not configurated properly at

Code:

/etc/cpspamd.conf

As occasionally mail load processing was high, spamd childs refused to work, giving that "acl spam condition" error.
Try to increase connections per child and/or number of childs accordingly to your server performance (check SpamAssassin documentation)

**Babysittah** · 06-30-2008 02:02 AM

I'm sure it was not properly created, I have noticed it too.

**rclemings** · 07-03-2008 11:49 PM

Was this problem (from 6/9/08) ever solved? I did a manual upgrade last night to cPanel 11.23.3-S25971 (stable). Ever since then, I've been getting these errors -- about one per minute at their peak.

I've got spamd's maximum children set at 25 now, and maximum processes per child at 35, so I don't think that could be the problem.

It's got to be something that's changed between v11.18 and v11.23. But what?

rac

Originally Posted by dexus

I noticed that SpamAssasin after last cPanel Release upgrade have problems with some emails... When SpamAssasin can't parse some email following error is loged in exim_paniclog and exim_mainlog...

Code:

2008-06-08 16:32:08 1K5Lwd-0001Vn-A8 spam acl condition: cannot parse spamd output

(snip)

**sehh** · 07-11-2008 01:33 AM

Same problem here...

**cPanelDavidG** · 07-11-2008 09:36 AM

Originally Posted by sehh

Same problem here...

I recommend having our technical analysts take a look at this for you: http://tickets.cpanel.net/submit

**sehh** · 07-11-2008 09:54 AM

i can't at the moment, i am not allowed to open access to 3rd parties unless its a catastrophic situation.

is there something that can help me debug the problem by myself?

**sehh** · 07-14-2008 08:29 AM

Anyone solved this problem please?

**mtindor** · 07-14-2008 08:59 AM

Originally Posted by sehh

i can't at the moment, i am not allowed to open access to 3rd parties unless its a catastrophic situation.

is there something that can help me debug the problem by myself?

I must laugh at that. At the same time, I feel bad for you. I undestand things beyond your control because maybe you do not control the policy in your company. It's ashame though that they would state that things couldn't be opened up to the people who you pay to provide you with support. yikes.

Of course I've been down similar roads before so I can sympathize with you.

Mike

**mtindor** · 07-14-2008 09:26 AM

I don't see this happen very often, but I do see that it happened with an inbound message on a server I manage this morning. So I opened a ticket iwth Cpanel to see if they could take a look at it - just to help those of you out who can't open a ticket iwth Cpanel.

Not sure what they will find out though.

Info in exim_mainlog shows:
2008-07-14 01:08:44 1KIGI4-00007j-M7 spam acl condition: cannot parse spamd output
2008-07-14 01:08:44 1KIGI4-00007j-M7 H=nf-out-0910.google.com [64.233.182.189] Warning: ACL "warn" statement skipped: condition test deferred
2008-07-14 01:08:44 1KIGI4-00007j-M7 H=nf-out-0910.google.com [64.233.182.189] Warning: "SpamAssassin as gemoon detected message as NOT spam ()"
2008-07-14 01:08:49 1KIGI4-00007j-M7 <= some_email_address@gmail.com H=nf-out-0910.google.com [64.233.182.189] P=esmtp S=10910940 id=4548bc380807132207y647d7f79u385445c46e63147@mail.gmail.com T="some subject"
2008-07-14 01:08:49 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1KIGI4-00007j-M7
2008-07-14 01:08:50 1KIGI4-00007j-M7 => someuser <someaddress@somedomain.com> R=virtual_user T=virtual_userdelivery
2008-07-14 01:08:50 1KIGI4-00007j-M7 Completed

mike

**sehh** · 07-14-2008 09:41 AM

As you stated, its beyond my control

So far, my tests show that with a recent spamassassin update, the return status from spamd is not recognized by Exim's ACL, thus the no score () in the error message.

Probably the ACL is outdated and doesn't cover all the different return codes from spamd.

**rclemings** · 07-14-2008 12:24 PM

It's been mostly resolved in my case. My ISP filed a ticket with CPanel and the result, after a few days of trying other things, was a perl reinstall, I am told.

I'm still seeing an occasional spamd failure (one in the past 24 hours) but nothing like before, when it was several times per hour.

**sehh** · 07-15-2008 01:06 AM

Then we have the same problem since these errors aren't very frequent here either.

The problem is that /tmp is fill up with spamassassin temporary files and the logs are filling up by the end of the week.

LinkBack

Thread Tools

SpamAssasin : problems with some emails...

same here

Emails problems

I have problems receiving emails

Problems with sending emails

spamassasin problems

spamassasin problems