Apache SpamAssassin v3.20 throwing errors

[aegis]

Is anyone else getting lots of errors in /var/maillog from SpamAssassin v3.20 ?

I'm getting a lot of ...

spamd[16962]: Malformed UTF-8 character (unexpected non-continuation byte 0x00, immediately after start byte 0xc5) in pattern match (m//) at /etc/mail/spamassassin/70_sare_adult.cf, rule SARE_OBFUTEENS, line 1.

...and similar. All in the 70_sare_adult.cf rule.

It started after the update to v3.20.

 

[chirpy]

I'd suggest that you use sa-update to keep the SARE rules up to date rather than downloading and installing them manually:

/usr/bin/sa-update --nogpg --channel saupdates.openprotect.com

Run that in a cronjob on a daily basis and remove the rules that you have in /etc/mail/spamassassin/. The recommended rules will then be kept up to date in the directory tree /var/lib/spamassassin/

 

[aegis]

I don't download them manually. I've got a cron job that runs rules_du_jour daily.

Would I be better off with your sa-update command ?

I've been using "SARE_SPECIFIC SARE_ADULT SARE_FRAUD SARE_RANDOM SARE_OEM SARE_REDIRECT_POST300 SARE_HTML0
SARE_HEADER0 SARE_uri0 SARE_STOCKS" up till now and they've been pretty good.

The ADULT rule doesn't seem to have been updated in years though so maybe it's now broken in v3.20

 

[chirpy]

As you say, it's most likely incompatible.

The rules_du_jour script was deprecated some time ago in favour of the inbuild sa-update procedure that SpamAssassin introduced with v3.

 

[aegis]

switching to sa-update's cured the problem.

Thanks

 

[JamesCTotalWeb]

Well I am not sure what I did wrong but I am still getting this error?

spamd[28695]: Malformed UTF-8 character (unexpected non-continuation byte 0x00, immediately after start byte 0xce) in pattern match (m//) at /var/lib/spamassassin/3.002000/saupdates_openprotect_com/70_sare_obfu1.cf, rule __SARE_OBFU_VISIT1, line 1, <GEN12> line 149.

I deleted the rules as suggested should I delete everything in the /etc/mail/spamassassin/ directory?

 

[jamesbond]

I switched to the openprotect updates, but now spamd keeps failing. I removed the sare rules from /etc/mail/spamassassin.

spamassassin -D --lint shows these errors:

[8924] dbg: rules: meta test __SARE_HEAD_FALSE has undefined dependency '__FROM_AOL_COM'
[8924] dbg: rules: meta test __SARE_HEAD_FALSE has undefined dependency '__FROM_AOL_COM'
[8924] dbg: rules: meta test SARE_BOUNDARY_D12 has undefined dependency 'MIME_BOUND_DIGITS_15'
[8924] dbg: rules: meta test SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_MKSHRT'
[8924] dbg: rules: meta test SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_GT'
[8924] dbg: rules: meta test SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_TINY'
[8924] dbg: rules: meta test SARE_CIT_BLOCKER has undefined dependency 'USER_IN_WHITELIST'
[8924] dbg: rules: meta test SARE_SUN_BLOCKER has undefined dependency 'USER_IN_WHITELIST'
[8924] dbg: rules: meta test SARE_SUB_INET_PHARM has undefined dependency 'ONLINE_PHARMACY'
[8924] dbg: rules: meta test SARE_FPP_BLOCKER has undefined dependency 'USER_IN_WHITELIST'
[8924] dbg: rules: meta test SARE_FEB_BLOCKER has undefined dependency 'USER_IN_WHITELIST'
[8924] dbg: rules: meta test SARE_OBFU_CIALIS has undefined dependency 'SARE_OBFU_CIALIS2'
[8924] dbg: rules: meta test LW_STOCK_SPAM4 has undefined dependency 'MIME_BASE64_TEXT'
[8924] dbg: rules: meta test __IMG_ONLY has undefined dependency 'HTML_IMAGE_ONLY_04'
[8924] dbg: rules: meta test __IMG_ONLY has undefined dependency 'HTML_IMAGE_ONLY_08'
[8924] dbg: rules: meta test __IMG_ONLY has undefined dependency 'HTML_IMAGE_ONLY_12'
[8924] dbg: rules: meta test __IMG_ONLY has undefined dependency 'HTML_IMAGE_ONLY_16'
[8924] dbg: rules: meta test __IMG_ONLY has undefined dependency 'HTML_IMAGE_ONLY_20'
[8924] dbg: rules: meta test __IMG_ONLY has undefined dependency 'HTML_IMAGE_ONLY_24'
[8924] dbg: rules: meta test __IMG_ONLY has undefined dependency 'HTML_IMAGE_ONLY_28'
[8924] dbg: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_XMAIL_SUSP2'
[8924] dbg: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_HEAD_XAUTH_WARN'
[8924] dbg: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'X_AUTH_WARN_FAKED'

How to fix this? i reinstalled spamassassin, didn't help.

 

[jamesbond]

I had to disable spamassassin because spamd children were increasing the load.

What is the best way to completely uninstall and do a fresh install of spamassassin? Can I just remove the whole /etc/mail/spamassassin directory? Any other directories I should remove before running: /scripts/perlinstaller --force Mail::SpamAssassin ?

 

[JC]

I'm having the same problem on multiple servers.
Exactly the same error.
Has anyone found a solution he can share?

Thanks
Jose

 

[aegis]

All I did was delete my RulesDuJour rules from /etc/mail/spamassassin leaving ...

./  ../  init.pre  local.cf  sa-update-keys/  v310.pre  v312.pre  v320.pre

Delete the cron task I had in /etc/cron.daily for updating the rules

Run sa-update as per Chirpy's post and add a cron.daily job for it.

Remember to stop and restart spamd.

 

[sparek-3]

It looks like running sa-update is also causing some problems. I am having issues with my /var/log/maillog file growing too large due to errors such as:

Malformed UTF-8 character (unexpected non-continuation byte 0x00, immediately after start byte 0xd0) in pattern match (m//) at /var/lib/spamassassin/3.002000/saupdates_openprotect_com/

filling up the log. Is anybody else that is using sa-update also experiencing this problem?

 

[JamesCTotalWeb]

Yes we are too ...... Spamassassain seems not to be working at all ... its running but no spam is being caught.

 

[JC]

It seems to be a problem in version 3.002000 (previous was 3.001008)

The UTF8 error comes up on some rules like:

72_sare_bml_post25x.cf
70_sare_adult.cf

and another one I can't recall now.

Problem is how do we get around this.
Other posts on this thread didn't solve it for me.

 

[JC]

Can someone poiunt me in the right direction to set spamassassin to use the previus rules (3.001008) instead of te new ones.
The older ones were working well.

What file / setting should de editted?

Thanks

 

[sparek-3]

It seems to be a problem in version 3.002000 (previous was 3.001008)

The UTF8 error comes up on some rules like:

72_sare_bml_post25x.cf
70_sare_adult.cf

and another one I can't recall now.

This is the conclusion that I cam to as well. There were some changes made in the SpamAssassin 3.2.0 code and the SARE rules are not yet updated to account for this. You can see the changelog for SpamAssassin 3.2.0 at:

http://www.nabble.com/forum/ViewPost.jtp?post=10285287&framed=y

I removed the SARE rules downloaded from saupdates.openprotect.com to fix this. I'm not sure if this is recommended, but I have tried it on a few server and it seems to help. This would only work if you are updating your rulesets with:

/usr/bin/sa-update --nogpg --channel saupdates.openprotect.com

rm -rf /var/lib/spamassassin/3.002000/saupdates_openprotect_com
rm -f /var/lib/spamassassin/3.002000/saupdates_openprotect_com.cf
rm -f /var/lib/spamassassin/3.002000/saupdates_openprotect_com.pre

Again, use do this at your own risk. Perhaps someone with a little more knowledge of the situation will chime in with more information.

 

[JamesCTotalWeb]

We removed the .cf files that were causing the errors which seemed to help.

cPanel is sending emails saying spamd has failed but we see it running it is just not stopping much spam.

Sooooo I just sent a request to chirpy to install his Mailscanner package (been wanting to do this anyways) hopefully this will get rid of the spam and stop the errors.

When in doubt hire a professional .......

 

[nightfall_sg]

Chirpy,

On running the string of command, I encountered this

IO::Zlib version 1.04 required--this is only version 1.01 at /usr/bin/sa-update line 82.
BEGIN failed--compilation aborted at /usr/bin/sa-update line 82.

How do I update the zlib?

Thanks

I'd suggest that you use sa-update to keep the SARE rules up to date rather than downloading and installing them manually:

/usr/bin/sa-update --nogpg --channel saupdates.openprotect.com

Run that in a cronjob on a daily basis and remove the rules that you have in /etc/mail/spamassassin/. The recommended rules will then be kept up to date in the directory tree /var/lib/spamassassin/

 

[sparek-3]

IO::Zlib version 1.04 required--this is only version 1.01 at /usr/bin/sa-update line 82.
BEGIN failed--compilation aborted at /usr/bin/sa-update line 82.

How do I update the zlib?

Thanks

Just run:

/scripts/realperlinstaller IO::Zlib

That should update IO::Zlib.

 

[nightfall_sg]

Thanks. I will give it a go.

 

[glansing]

Hey everyone,

I was using sa-update using the server SARE recommends -- switched to this one and am still getting the error:

May  6 12:15:37 tamarin spamd[24283]: Malformed UTF-8 character (unexpected non-continuation byte 0x00, immediately after start byte 0xc4) in pattern match (m//) at /var/lib/spamassassin/3.002000/saupdates_openprotect_com/70_sare_adult.cf, rule SARE_OBFUGIRLS, line 1, <GEN5> line 216.

No other rules installed, reinstalled SpamAssassin... same thing. Any thoughts?