The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Apache SpamAssassin - Negative Scores

Discussion in 'EasyApache' started by Norman, Feb 7, 2005.

  1. Norman

    Norman Well-Known Member

    Joined:
    Sep 20, 2004
    Messages:
    88
    Likes Received:
    0
    Trophy Points:
    6
    Hello Everyone,

    I was on a RHEL 3 server with cpanel and spam assassin installed and it worked VERY VERY well.. Well I moved servers (Doing transfer in cpanel) to a new CentOS server.. And now SpamAssasin, pretty much does not work.

    It's negative scoring everything.. I've ssen everywhere from -85 to -0 scores. However nothing has changed in my configs. I've checked all my config files, nothing is really whitelisted..

    The setup should be the same.. I did a search on here and didn't seem to really help me out much..

    I just wanted to know a few things.

    1) if anyone has had this before, is there an easy fix?
    2) If I can't get it fixed, how easy is it to remove SA and install MailScanner
    3) Can I run both MailScanner and SA together?

    Thanks for the help all
    Dave
     
  2. Norman

    Norman Well-Known Member

    Joined:
    Sep 20, 2004
    Messages:
    88
    Likes Received:
    0
    Trophy Points:
    6
    Here's some more info

    Seems autolearn is on and such:
    Code:
    X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on myhost.com
    X-Spam-Level: 
    X-Spam-Status: No, score=-2.1 required=5.0 tests=ALL_TRUSTED,BAYES_50,
    	DEAR_FRIEND,MISSING_HEADERS,SUBJ_ALL_CAPS,US_DOLLARS_3 autolearn=ham 
    	version=3.0.2
    And the funny thing is.. in teh SAME account this message shows autolearn turned off..

    What the hey?
    Code:
    X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on myhost.com
    X-Spam-Level: 
    X-Spam-Status: No, score=0.5 required=5.0 tests=BAYES_00,PERCENT_RANDOM 
    	autolearn=no version=3.0.2
     
  3. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Hi Dave,

    1. Might be OK. Negative scores indicate that SA thinks it is ham (non-spam) and not spam. You can check spamassassin reasonably well using the following and making sure you get no errors:

    spamassassin --lint

    2. MailScanner uses SpamAssassin, but in a different way to cPanel. cPanel connects to a spamd daemon that performs the email scanning, whereas MailScanner uses the Mail::SpamAssassin perl libraries that are what make up the bulk of SA

    3. See above. If you use my free installer it automatically enables SA through MailScanner:
    http://www.configserver.com/free/mailscanner.html

    If you get any errors with the spamassassin lint test, post them here.
     
  4. Norman

    Norman Well-Known Member

    Joined:
    Sep 20, 2004
    Messages:
    88
    Likes Received:
    0
    Trophy Points:
    6
    Thanks for your reply chirpy.. I looked at your site today and talked to one of your techs...

    Lint showed nada
    Code:
    root@morpheus [/etc/mail/spamassassin]# spamassassin --lint
    root@morpheus [/etc/mail/spamassassin]# 
    I may just need to change.. I cna't figure out what would have changed between teh two servers.. course they are different DC's too.. so who knows
     
  5. FriedEgg

    FriedEgg Active Member

    Joined:
    Sep 27, 2003
    Messages:
    40
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Washington, DC
    "autolearn=no" doesn't mean it's turned off, simply that it didn't learn from that message. "autolearn=unavailable" means that it's turned off.

    Based on those messages, the scores look reasonable for what SpamAssassin found. Something like "ALL_TRUSTED" will be a heavier negative weight towards marking it spam.

    If you have control of the server, you might want to install some combination of DCC , Pyzor, and Vipul's Razor. They'll potentially increase the score of spam. You can also enable all the plugins in /etc/mail/spamassassin/init.pre for a bit more testing.
     
  6. Norman

    Norman Well-Known Member

    Joined:
    Sep 20, 2004
    Messages:
    88
    Likes Received:
    0
    Trophy Points:
    6
    This is pretty much setup like our OTHER server.. configs are pretty much all the same..

    All the plugins are enabled.. as far as I can see
    Code:
    # URIDNSBL - look up URLs found in the message against several DNS
    # blocklists.
    #
    loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
    
    # Hashcash - perform hashcash verification.
    #
    loadplugin Mail::SpamAssassin::Plugin::Hashcash
    
    # SPF - perform SPF verification.
    #
    loadplugin Mail::SpamAssassin::Plugin::SPF
    
    Well the thing is.. sometimes it says autolearn is on .. and sometiems it doesn't.. I'm sure this is a config issue.. from when I moved the accounts over.. just not sure how to fix it..
     
  7. FriedEgg

    FriedEgg Active Member

    Joined:
    Sep 27, 2003
    Messages:
    40
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Washington, DC
    Well, like I said, autolearn=no doesn't mean it's "off" it just means it chose not to learn from that message. There are 4 states: ham, spam, no, and unavailable. Ham is learned good email, spam is of course learned bad email, no means it didn't make a decision to learn it either way, and unavailable means that feature is off. It is normal for some messages to be to autolearn=no, as SpamAssassin can disqualify messages for various reasons.
     
  8. ncrossland

    ncrossland Member

    Joined:
    Sep 23, 2003
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    1
    In cases where autolearn="no", is it possible to teach it manually? Could I forward mail which is autolearn="no" to a specific e-mail address (e.g. spam@mydomain.com) , and then use sa-learn on that mail folder? Or would it then learn that anything I have forwarded is spam? We're seeing a big increase is spam getting through so some training would be a good thing...
     
  9. FriedEgg

    FriedEgg Active Member

    Joined:
    Sep 27, 2003
    Messages:
    40
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Washington, DC
    sa-learn is exactaly what you want to use to teach it manually. It accepts --ham and --spam command line options that let you tell it which it is. I probably wouldn't forward the mail, but use a folder (via IMAP or webmail, rather than POP) and move the messages that are spam into that folder. Run sa-learn --spam on that folder, then delete/archive the messages you just had it learn.
     
Loading...

Share This Page