Spam getting through SpamAssassin, lots of it: Spam Firewall, Email, SpamAssassin

by: robocatPosted on 2009-10-20 at 00:38:45ID: 25611725

A great way to enhance a SA setup for the type of SPAM you describe, is to use ClamAV + Sanesecurity.

ClamAV is an anti-virus toolkit you can install to process mail *before* it goes through SA. Sanesecurity is a set of signatures for ClamAV that protects against all kinds of marketing SPAM.

http://sanesecurity.co.uk/clamav/index.htm

We catch about 90% of our SPAM using sanesecurity, only 10% is left to be dealt with by SA.

by: grbladesPosted on 2009-10-20 at 00:55:06ID: 25611788

CalmAV + Sanesecurity is very good. I dont find that it cataches the amount of spam that the previous poster sais that his does but it is good at catching the spam which has a tendancy to make it past spamassassin so it is a very worthwhile addition.

For fixing your spamassassin problem there are a few things you can check.

1) Check your spamassassin startup script to see what parameters are being used to start spamassassin. In particular make sure it is not being run in local only mode which disables DNS checks.

2) Make sure that you can resolve DNS queries on your box.

3) Check the logs and make sure the bayes files are being updated. Its a very common problem to have permission issues with these files which can cause them not to be used.

4) Run 'spamassassin --lint -D' and paste the output here. This will list the ddebug output and show which modules are being loaded.

by: ShylokPosted on 2009-10-20 at 05:58:49ID: 25613536

Hey guys thanks for heads up on SaneSecurity. I'll take a look at putting that in. I've got ClamAV running, it seems to be working as I do see mails getting caught with viruses.

1) Are we talking about the /etc/init.d/amavisd file?

2) can resolve dns

3) I'm done a sa-update as root? should i be doing it as amavis and also have done the load-sa-rules.pl which is part of Maia Mailguard which is the front end to this SA/Clam/pyzor/razor solution.
Sa-update doesn't seem to do anything after I run it. no confirmation or anything.

4) is there a way to run this to a fIle? Since it's way too much info to copy from putty. ie i can't scroll that high.

** I also can't restart amavisd it fails with

root@maia:/usr/local/bin# service amavisd restart
Restarting Amavis Mail Filter Daemon: No amavisd found running; none killed.
Pid_file already exists for running process (2307)... aborting
amavisd.

even though

root@maia:/usr/local/bin# ps aux | grep amavi
amavis 2307 0.0 8.3 180452 84160 ? Ss Oct19 0:01 amavisd (master)
amavis 4793 0.0 8.5 182968 86252 ? S Oct19 0:01 amavisd (ch5-avail)
amavis 4853 0.0 8.3 181652 84860 ? S Oct19 0:00 amavisd (ch1-avail)
root 13434 0.0 0.0 7524 892 pts/1 R+ 08:51 0:00 grep amavi

root@maia:/usr/local/bin# more /etc/init.d/amavisd
#! /bin/sh
 
# amavis init script
# February 26, 2006
# David Sims
 
# Based on SpamAssassin script
 
PATH=/sbin:/bin:/usr/sbin:/usr/bin
DAEMON=/usr/sbin/amavisd
NAME=amavisd
SNAME=amavisd
DESC="Amavis Mail Filter Daemon"
PIDFILE="/var/run/$NAME.pid"
PNAME="amavisd"
 
export TMPDIR=/tmp
# Apparently people have trouble if this isn't explicitly set...
 
# Defaults - don't touch, edit /etc/default/amavisd
ENABLED=1
OPTIONS=""
NICE=
 
test -f /etc/default/amavisd && . /etc/default/amavisd
 
#if [ "$ENABLED" = "0" ]; then
#    echo "$DESC: disabled, see /etc/default/amavisd"
#    exit 0
#fi
 
test -f $DAEMON || exit 0
 
set -e
 
case "$1" in
  start)
        echo -n "Starting $DESC: "
        start-stop-daemon --start --pidfile $PIDFILE --name $PNAME \
            $NICE --oknodo --startas $DAEMON -- $OPTIONS $DOPTIONS
        echo "$NAME."
        ;;
 
  stop)
        echo -n "Stopping $DESC: "
        start-stop-daemon --stop --pidfile $PIDFILE --name $PNAME --oknodo
        rm $PIDFILE
        echo "$NAME."
        ;;
 
  reload|force-reload)
        echo -n "Reloading $DESC: "
        start-stop-daemon --stop --pidfile $PIDFILE --signal HUP --name $PNAME
        echo "$NAME."
        ;;
 
  restart)
        echo -n "Restarting $DESC: "
        start-stop-daemon --stop --pidfile $PIDFILE --name $PNAME \
            --retry 5 --oknodo
        start-stop-daemon --start --pidfile $PIDFILE --name $PNAME \
            $NICE --oknodo --startas $DAEMON -- $OPTIONS $DOPTIONS
 
        echo "$NAME."
        ;;
 
  *)
        N=/etc/init.d/$SNAME
        echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2
        exit 1
        ;;
esac
 
exit 0

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:

Select all Open in new window

by: grbladesPosted on 2009-10-20 at 06:31:47ID: 25613878

1) It depends. It can call spamassassin directly or it cal use 'spamd'. If its using spamd then it will have its own startup parameters.
Have a look in /etc/init.d/ to see if there is an entry there for spamassassin or spamd.
Also have a look in /etc/sysconfig or /etc/default to see if there is a file there.

3) Thats normal. Updates are very uncommon.

4) Yes just append "&> file.to.write.to" to the end of the command and the standard and error output will be written to the file.

I cant see why the amavisd wont restart. Are you running the command while logged in as root?

by: ShylokPosted on 2009-10-20 at 06:56:47ID: 25614147

root@maia:/etc/default# more amavisd
ENABLED=1
PIDFILE="/var/run/amavisd.pid"

Last post had the code from the /etc/init.d/amavisd which appears to be the file which is calling SA? unless i'm wrong. there is no spamd.

Yes running as root.

Re: spamassassin --lint

In the local.cf i had to comment out the following or id get an error for dccifd, should I fixing it instead of commenting it out? /var/dcc/libexec/dccifd actually exists.. so not sure why i get the error.

# Distributed Checksum Clearinghouse (DCC) options.
use_dcc 1
dcc_timeout 10
dcc_body_max 999999
dcc_fuz1_max 999999
dcc_fuz2_max 999999
dcc_home /var/dcc
#dcc_dccifd_path /var/dcc/libexec/dccifd
dcc_path /usr/local/bin/dccproc

Spamassassin --lint -D below in code.

I notice -lint shows the following. Do i need to install these?
[3491] dbg: diag: module not installed: Mail::SPF ('require' failed)
[3491] dbg: diag: module not installed: IP::Country::Fast ('require' failed)
[3491] dbg: diag: module not installed: Net::Ident ('require' failed)
[3491] dbg: diag: module not installed: IO::Socket::INET6 ('require' failed)
[3491] dbg: diag: module not installed: IO::Socket::SSL ('require' f
[3491] dbg: diag: module not installed: Mail::DomainKeys ('require' failed)
[3491] dbg: diag: module not installed: Mail::DKIM ('require' failed)
[3491] dbg: diag: module not installed: Encode::Detect ('require' failed)

[3491] dbg: logger: adding facilities: all
[3491] dbg: logger: logging level is DBG
[3491] dbg: generic: SpamAssassin version 3.2.5
[3491] dbg: config: score set 0 chosen.
[3491] dbg: util: running in taint mode? yes
[3491] dbg: util: taint mode: deleting unsafe environment variables, resetting PATH
[3491] dbg: util: PATH included '/usr/local/sbin', keeping
[3491] dbg: util: PATH included '/usr/local/bin', keeping
[3491] dbg: util: PATH included '/usr/sbin', keeping
[3491] dbg: util: PATH included '/usr/bin', keeping
[3491] dbg: util: PATH included '/sbin', keeping
[3491] dbg: util: PATH included '/bin', keeping
[3491] dbg: util: PATH included '/usr/games', keeping
[3491] dbg: util: final PATH set to: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
[3491] dbg: dns: no ipv6
[3491] dbg: dns: is Net::DNS::Resolver available? yes
[3491] dbg: dns: Net::DNS version: 0.63
[3491] dbg: diag: perl platform: 5.010000 linux
[3491] dbg: diag: module installed: Digest::SHA1, version 2.11
[3491] dbg: diag: module installed: HTML::Parser, version 3.59
[3491] dbg: diag: module installed: Net::DNS, version 0.63
[3491] dbg: diag: module installed: MIME::Base64, version 3.07_01
[3491] dbg: diag: module installed: DB_File, version 1.816_1
[3491] dbg: diag: module installed: Net::SMTP, version 2.31
[3491] dbg: diag: module not installed: Mail::SPF ('require' failed)
[3491] dbg: diag: module installed: Mail::SPF::Query, version 1.999001
[3491] dbg: diag: module not installed: IP::Country::Fast ('require' failed)
[3491] dbg: diag: module installed: Razor2::Client::Agent, version 2.84
[3491] dbg: diag: module not installed: Net::Ident ('require' failed)
[3491] dbg: diag: module not installed: IO::Socket::INET6 ('require' failed)
[3491] dbg: diag: module not installed: IO::Socket::SSL ('require' failed)
[3491] dbg: diag: module installed: Compress::Zlib, version 2.015
[3491] dbg: diag: module installed: Time::HiRes, version 1.9711
[3491] dbg: diag: module not installed: Mail::DomainKeys ('require' failed)
[3491] dbg: diag: module not installed: Mail::DKIM ('require' failed)
[3491] dbg: diag: module installed: DBI, version 1.607
[3491] dbg: diag: module installed: Getopt::Long, version 2.37
[3491] dbg: diag: module installed: LWP::UserAgent, version 5.819
[3491] dbg: diag: module installed: HTTP::Date, version 5.810
[3491] dbg: diag: module installed: Archive::Tar, version 1.38
[3491] dbg: diag: module installed: IO::Zlib, version 1.09
[3491] dbg: diag: module not installed: Encode::Detect ('require' failed)
[3491] dbg: ignore: using a test message to lint rules
[3491] dbg: config: using "/etc/mail/spamassassin" for site rules pre files
[3491] dbg: config: read file /etc/mail/spamassassin/init.pre
[3491] dbg: config: read file /etc/mail/spamassassin/v310.pre
[3491] dbg: config: read file /etc/mail/spamassassin/v312.pre
[3491] dbg: config: read file /etc/mail/spamassassin/v320.pre
[3491] dbg: config: using "/var/lib/spamassassin/3.002005" for sys rules pre files
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com.pre
[3491] dbg: config: using "/var/lib/spamassassin/3.002005" for default rules dir
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com.cf
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org.cf
[3491] dbg: config: using "/etc/mail/spamassassin" for site rules dir
[3491] dbg: config: read file /etc/mail/spamassassin/local.cf
[3491] dbg: config: read file /etc/mail/spamassassin/oldlocal.cf
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::DCC from @INC
[3491] dbg: dcc: local tests only, disabling DCC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor from @INC
[3491] dbg: pyzor: local tests only, disabling Pyzor
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::Razor2 from @INC
[3491] dbg: razor2: local tests only, skipping Razor
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::SpamCop from @INC
[3491] dbg: reporter: local tests only, disabling SpamCop
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::AWL from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::AutoLearnThreshold from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::WhiteListSubject from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEHeader from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::ReplaceTags from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::Check from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::HTTPSMismatch from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDetail from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::Bayes from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::BodyEval from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::DNSEval from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::HTMLEval from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::HeaderEval from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEEval from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::RelayEval from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIEval from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::WLBLEval from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::VBounce from @INC
[3491] dbg: plugin: loading Mail::SpamAssassin::Plugin::ImageInfo from @INC
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/loadplugins.pre
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/loadplugins.pre" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/loadplugins.pre
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_adult.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_adult.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_adult.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_bayes_poison_nxm.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_bayes_poison_nxm.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_bayes_poison_nxm.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_evilnum0.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_evilnum0.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_evilnum0.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_evilnum1.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_evilnum1.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_evilnum1.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj0.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj0.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj0.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj1.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj1.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj1.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj2.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj2.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj2.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj_eng.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj_eng.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_genlsubj_eng.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_header0.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_header0.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_header0.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_header1.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_header1.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_header1.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_highrisk.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_highrisk.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_highrisk.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_html0.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_html0.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_html0.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_html1.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_html1.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_html1.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_obfu0.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_obfu0.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_obfu0.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_obfu1.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_obfu1.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_obfu1.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_oem.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_oem.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_oem.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_random.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_random.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_random.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_specific.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_specific.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_specific.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_spoof.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_spoof.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_spoof.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_stocks.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_stocks.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_stocks.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_unsub.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_unsub.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_unsub.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_uri0.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_uri0.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_uri0.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_uri1.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_uri1.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_uri1.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_uri_eng.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_uri_eng.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_uri_eng.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_whitelist.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_whitelist.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_whitelist.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_whitelist_rcvd.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_whitelist_rcvd.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_whitelist_rcvd.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_whitelist_spf.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_whitelist_spf.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sare_whitelist_spf.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sc_top200.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sc_top200.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/70_sc_top200.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/72_sare_bml_post25x.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/72_sare_bml_post25x.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/72_sare_bml_post25x.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/72_sare_redirect_post3.0.0.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/72_sare_redirect_post3.0.0.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/72_sare_redirect_post3.0.0.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/saupdates_openprotect_com/99_sare_fraud_post25x.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/saupdates_openprotect_com/99_sare_fraud_post25x.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/saupdates_openprotect_com/99_sare_fraud_post25x.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/10_default_prefs.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/10_default_prefs.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/10_default_prefs.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_advance_fee.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_advance_fee.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_advance_fee.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_body_tests.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_body_tests.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_body_tests.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_compensate.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_compensate.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_compensate.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dnsbl_tests.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dnsbl_tests.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dnsbl_tests.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_drugs.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_drugs.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_drugs.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dynrdns.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dynrdns.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dynrdns.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_fake_helo_tests.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_fake_helo_tests.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_fake_helo_tests.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_head_tests.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_head_tests.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_head_tests.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_html_tests.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_html_tests.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_html_tests.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_imageinfo.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_imageinfo.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_imageinfo.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_meta_tests.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_meta_tests.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_meta_tests.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_net_tests.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_net_tests.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_net_tests.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_phrases.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_phrases.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_phrases.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_porn.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_porn.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_porn.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_ratware.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_ratware.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_ratware.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_uri_tests.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_uri_tests.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_uri_tests.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_vbounce.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_vbounce.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/20_vbounce.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/23_bayes.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/23_bayes.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/23_bayes.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_accessdb.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_accessdb.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_accessdb.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_antivirus.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_antivirus.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_antivirus.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_asn.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_asn.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_asn.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dcc.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dcc.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dcc.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dkim.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dkim.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dkim.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_domainkeys.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_domainkeys.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_domainkeys.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_hashcash.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_hashcash.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_hashcash.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_pyzor.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_pyzor.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_pyzor.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_razor2.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_razor2.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_razor2.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_replace.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_replace.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_replace.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_spf.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_spf.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_spf.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_textcat.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_textcat.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_textcat.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_uribl.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_uribl.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_uribl.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_de.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_de.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_de.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_fr.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_fr.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_fr.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_it.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_it.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_it.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_nl.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_nl.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_nl.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pl.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pl.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pl.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pt_br.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pt_br.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pt_br.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_awl.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_awl.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_awl.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_shortcircuit.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_shortcircuit.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_shortcircuit.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dk.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dk.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dk.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dkim.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dkim.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dkim.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_spf.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_spf.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_spf.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_subject.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_subject.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_subject.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/72_removed.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_removed.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/72_removed.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/72_scores.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_scores.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/72_scores.cf
[3491] dbg: config: fixed relative path: /var/lib/spamassassin/3.002005/updates_spamassassin_org/80_additional.cf
[3491] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/80_additional.cf" for included file
[3491] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/80_additional.cf
[3491] warn: netset: cannot include 127.0.0.1/32 as it has already been included
[3491] warn: config: failed to parse, now a plugin, skipping, in "/etc/mail/spamassassin/local.cf": ok_languages en fr
[3491] dbg: rules: __XM_OL_22B61 merged duplicates: __XM_OL_A842E
[3491] dbg: rules: PREVENT_NONDELIVERY merged duplicates: SARE_HEAD_HDR_PREVNDR
[3491] dbg: rules: __SARE_HEAD_HDR_IDKEY merged duplicates: SARE_HEAD_HDR_XIDKEY
[3491] dbg: rules: __JM_REACTOR_DATE merged duplicates: __RATWARE_0_TZ_DATE
[3491] dbg: rules: __SARE_BODY_BLANKS_5_100 merged duplicates: __SARE_BODY_BLNK_5_100
[3491] dbg: rules: __XM_OL_07794 merged duplicates: __XM_OL_25340 __XM_OL_3857F __XM_OL_4F240 __XM_OL_58CB5 __XM_OL_6554A __XM_OL_812FF __XM_OL_C65FA __XM_OL_CF0C0 __XM_OL_F475E __XM_OL_F6D01
[3491] dbg: rules: __HTML_IMG_ONLY merged duplicates: __IMG_ONLY
[3491] dbg: rules: FU_UKGEOCITIES merged duplicates: __SARE_SPEC_XX2GEOCIT
[3491] dbg: rules: FB_FAKE_NUMBERS merged duplicates: SARE_OBFU_NUMBERS
[3491] dbg: rules: FH_MSGID_01C67 merged duplicates: __MSGID_VGA
[3491] dbg: rules: FS_NEW_SOFT_UPLOAD merged duplicates: HS_SUBJ_NEW_SOFTWARE
[3491] dbg: rules: __MO_OL_22B61 merged duplicates: __MO_OL_4F240 __MO_OL_ADFF7
[3491] dbg: rules: SARE_SUB_2UNDERSCORES merged duplicates: SARE_SUB_6_FIG_INC SARE_SUB_ACCENT_CHAR SARE_SUB_ACCT_UPD SARE_SUB_ACTION_OB SARE_SUB_ADV_DB SARE_SUB_ADV_SEARCH SARE_SUB_AGING SARE_SUB_ALL_LEAD SARE_SUB_AM_MED_DICT SARE_SUB_ASSIST SARE_SUB_AS_LOW_AS SARE_SUB_BETTER_DEAL SARE_SUB_BETTER_OB2 SARE_SUB_BIGGER SARE_SUB_BIGGER_OB SARE_SUB_BOOST SARE_SUB_BOOST_OB SARE_SUB_BREAKTHRU SARE_SUB_BREAKTHRU_OB SARE_SUB_BULK_EMAIL SARE_SUB_BUY_CHEAP SARE_SUB_BUY_OB SARE_SUB_BUY_OB1 SARE_SUB_CALL_NOW SARE_SUB_CARD_BILLED SARE_SUB_CARTRIDGE_OB SARE_SUB_CAR_INSURANCE SARE_SUB_CASINO_OB SARE_SUB_CHANGE_LIFE SARE_SUB_CHARGE_OB SARE_SUB_CHEAP_OB SARE_SUB_COMM_MAILERS SARE_SUB_CONFIDENTIAL SARE_SUB_CONFID_OB SARE_SUB_CONSULTATION SARE_SUB_CONSULTN_OB SARE_SUB_CURRENT_NEWS SARE_SUB_DBL_MEDICTN SARE_SUB_DBL_PHARM SARE_SUB_DEBT SARE_SUB_DEBTS_COURT SARE_SUB_DOLLARS SARE_SUB_DOWNLOAD_OB SARE_SUB_EBAY_OB SARE_SUB_EXCL_OB SARE_SUB_EXPIRED SARE_SUB_FORECLOSURE SARE_SUB_FOREVER SARE_SUB_FOR_WOMEN SARE_SUB_FREE_SAMPLE SARE_SUB_GAPPY_3 SARE_SUB_GAPPY_4 SARE_SUB_GAPPY_5 SARE_SUB_GAPPY_6 SARE_SUB_GAPPY_7 SARE_SUB_GAPPY_8 SARE_SUB_GROW_BUSINESS SARE_SUB_HARD_OB SARE_SUB_HOMEOWNER_OB SARE_SUB_INCHES SARE_SUB_INC_ONLINE SARE_SUB_INEXPEN SARE_SUB_INKJET SARE_SUB_INKJET_OB SARE_SUB_INVESTMENTS SARE_SUB_INVESTORS SARE_SUB_JOB SARE_SUB_LEAD_PUNCT SARE_SUB_LINES_CREDIT SARE_SUB_LONG_SUBJ_140 SARE_SUB_LONG_SUBJ_170 SARE_SUB_LOSE_OB SARE_SUB_LOTS_PUNC_21 SARE_SUB_LOTS_PUNC_26 SARE_SUB_MED_USE SARE_SUB_MENS_HEALTH SARE_SUB_MINUTES SARE_SUB_MISC_1 SARE_SUB_MORTGAGE SARE_SUB_MORTGAGE_OB SARE_SUB_MOVE_OB SARE_SUB_MSGSUB SARE_SUB_NEXT_DOOR SARE_SUB_NOW_TIME SARE_SUB_OBFU_V SARE_SUB_ODDWORD_G SARE_SUB_ODDWORD_I SARE_SUB_ODDWORD_P SARE_SUB_ODDWORD_Q SARE_SUB_ODDWORD_U SARE_SUB_ONLINE_OB SARE_SUB_ORIG_SOFT_OB SARE_SUB_PAREN_NUM2 SARE_SUB_PASSION_OB SARE_SUB_PENIS_OB SARE_SUB_PERFECTLY SARE_SUB_PHOTOS_OB SARE_SUB_PHYSICIAN SARE_SUB_PHYSICIAN_OB SARE_SUB_PLEASE_OB SARE_SUB_PORN_WORD10 SARE_SUB_PRINTER_OB SARE_SUB_PROVEN_OB SARE_SUB_RAND_LETTRS5 SARE_SUB_RAND_UC SARE_SUB_REAL_OB SARE_SUB_SEXY SARE_SUB_SION_OB SARE_SUB_STRETCH_MARK SARE_SUB_STRONG SARE_SUB_STRONG_OB SARE_SUB_TAXES SARE_SUB_TION_OB SARE_SUB_TONER SARE_SUB_TONER_OB SARE_SUB_VIDEO_OB SARE_SUB_VIRUSQ SARE_SUB_WEBMASTER2 SARE_SUB_WINNER SARE_SUB_YOUNGER SARE_SUB_YOUNGER_OB
[3491] dbg: rules: __MO_OL_812FF merged duplicates: __MO_OL_BC7E6
[3491] dbg: rules: __SARE_HEAD_FALSE merged duplicates: __SARE_SUB_FALSE
[3491] dbg: rules: SARE_SUBJ_SLUT merged duplicates: __FPS_SLUT
[3491] dbg: rules: __FVGT_RAPE merged duplicates: __WORD_RAPED
[3491] dbg: rules: SARE_USERAG_BAT merged duplicates: __SARE_HEAD_MAIL_BAT2
[3491] dbg: rules: __XM_OL_C9068 merged duplicates: __XM_OL_EF20B
[3491] dbg: rules: __FH_RCV_53 merged duplicates: __RCVD_53
[3491] dbg: rules: __MO_OL_72641 merged duplicates: __MO_OL_A842E
[3491] dbg: rules: SARE_OBFU_AFFORD merged duplicates: SARE_OBFU_AMP SARE_OBFU_BETTER_SUB SARE_OBFU_CARTRDGE_SUB SARE_OBFU_CIALIS SARE_OBFU_OBLIGATION SARE_OBFU_SEX_SPL SARE_OBFU_TBL_05 SARE_URI_AFF_DIG SARE_URI_CAMPAIGNID SARE_URI_CASINO SARE_URI_DIET SARE_URI_DIG_LET_PIC SARE_URI_DOM_ENDU SARE_URI_H0 SARE_URI_HARRYDAV SARE_URI_HOUSE SARE_URI_IPPORT3333 SARE_URI_MIXED_CASE SARE_URI_MRTG SARE_URI_OC SARE_URI_OPTOUT SARE_URI_P8 SARE_URI_PORTD4 SARE_URI_REFID2 SARE_URI_REFID3 SARE_URI_SHARE_DIG SARE_URI_SIXCAPS SARE_URI_SQUARE SARE_URI_SUCCEZZ
[3491] dbg: rules: __MO_OL_4BF4C merged duplicates: __MO_OL_F6D01
[3491] dbg: rules: __MO_OL_07794 merged duplicates: __MO_OL_8627E __MO_OL_F3B05
[3491] dbg: rules: SARE_SPOOF_COM2OTH merged duplicates: SPOOF_COM2COM
[3491] dbg: rules: __MO_OL_9B90B merged duplicates: __MO_OL_C65FA
[3491] dbg: rules: __FH_FRM_53 merged duplicates: __FROM_53
[3491] dbg: rules: SARE_HEAD_HDR_XRMDTXT merged duplicates: __SARE_HEAD_HDR_RMDB
[3491] dbg: rules: FH_HELO_GMAILSMTP merged duplicates: SARE_HELO_GMAILSMTP
[3491] dbg: rules: __FH_HAS_XMSMAIL merged duplicates: __HAS_MSMAIL_PRI
[3491] dbg: rules: KAM_STOCKOTC merged duplicates: KAM_STOCKTIP15 KAM_STOCKTIP20 KAM_STOCKTIP21 KAM_STOCKTIP4 KAM_STOCKTIP6
[3491] dbg: rules: __MO_OL_91287 merged duplicates: __MO_OL_B30D1 __MO_OL_CF0C0
[3491] dbg: rules: __XM_OL_015D5 merged duplicates: __XM_OL_4BF4C __XM_OL_4EEDB __XM_OL_5B79A __XM_OL_9B90B __XM_OL_ADFF7 __XM_OL_B30D1 __XM_OL_B4B40 __XM_OL_BC7E6 __XM_OL_F3B05 __XM_OL_FF5C8
[3491] dbg: rules: __MO_OL_015D5 merged duplicates: __MO_OL_6554A
[3491] dbg: rules: __MO_OL_25340 merged duplicates: __MO_OL_4EEDB __MO_OL_7533E
[3491] dbg: rules: __MO_OL_58CB5 merged duplicates: __MO_OL_B4B40
[3491] dbg: rules: __DOS_HAS_ANY_URI merged duplicates: __HAS_ANY_URI __SARE_URI_ANY
[3491] dbg: rules: SARE_BOUNDARY_02 merged duplicates: SARE_BOUNDARY_ANYDIG SARE_BOUNDARY_D11 SARE_BOUNDARY_D8 SARE_BOUNDARY_MULTB SARE_CONTENT_BITBITNUM SARE_FREE_WEBM_CZSEZNA SARE_FREE_WEBM_USACOPS SARE_FROM_AMERICA SARE_FROM_DEBT SARE_FROM_DVDCOPY SARE_FROM_MULTI_DASH SARE_FROM_NUM_9DIG SARE_FROM_PRINTER SARE_FROM_QUOTE SARE_FROM_SPACE2 SARE_FROM_SPAM_CHAR0 SARE_FROM_SPAM_DOMN0 SARE_FROM_SPAM_NAME2 SARE_FROM_SPAM_WORD0 SARE_FROM_SUPPORT_DIG SARE_FROM_UK2NET2 SARE_FROM_VIRUS1 SARE_FROM_WSJ SARE_HEAD_8BIT_NOSPM SARE_HEAD_8BIT_SPAM SARE_HEAD_BDY_BOUNCES SARE_HEAD_DATE18 SARE_HEAD_DATE_5L SARE_HEAD_DATE_RNDDATE SARE_HEAD_HDR_ALTREC SARE_HEAD_HDR_AUTSUBD SARE_HEAD_HDR_CONVER SARE_HEAD_HDR_JLH SARE_HEAD_HDR_MSGTYPE SARE_HEAD_HDR_NLETRID SARE_HEAD_HDR_PID SARE_HEAD_HDR_RTNPATH SARE_HEAD_HDR_X400RCV SARE_HEAD_HDR_XACWGHT SARE_HEAD_HDR_XAR SARE_HEAD_HDR_XAUTOGN SARE_HEAD_HDR_XBBOUNC SARE_HEAD_HDR_XBNCETR SARE_HEAD_HDR_XCCDIAG SARE_HEAD_HDR_XCNDINF SARE_HEAD_HDR_XCONTAC SARE_HEAD_HDR_XEMGBMS SARE_HEAD_HDR_XENVID SARE_HEAD_HDR_XGMAILA SARE_HEAD_HDR_XIDSRVR SARE_HEAD_HDR_XLEGAL2 SARE_HEAD_HDR_XLEGAL4 SARE_HEAD_HDR_XLISTAD SARE_HEAD_HDR_XMAILTH SARE_HEAD_HDR_XMCAVTP SARE_HEAD_HDR_XMEBDOM SARE_HEAD_HDR_XMLFILT SARE_HEAD_HDR_XNOSPAM SARE_HEAD_HDR_XRIPE SARE_HEAD_HDR_XSAFMMI SARE_HEAD_HDR_XSMTPSV SARE_HEAD_HDR_XUMAIL SARE_HEAD_HDR_XUNOLOOK SARE_HEAD_HDR_XWTID SARE_HEAD_HDR_XWTVERS SARE_HEAD_MSMPR_RNDSTR SARE_HEAD_ORIG_RECIP SARE_HEAD_THRD_ALNUM SARE_HEAD_XCANIT1 SARE_HEAD_XCANIT2 SARE_HEAD_XCOM_RFCMIN SARE_HEAD_XM4 SARE_HEAD_XMF_AUTHSNDR SARE_HEAD_XWORD SARE_HELO_MAIL SARE_HELO_MAILUSER SARE_HELO_SERVER SARE_HTML_ALT_WAIT1 SARE_HTML_ALT_WAIT2 SARE_HTML_A_NULL SARE_HTML_BADOPEN SARE_HTML_BAD_FG_CLR SARE_HTML_BR_MANY SARE_HTML_COLOR_B SARE_HTML_COLOR_NWHT3 SARE_HTML_EHTML_OBFU SARE_HTML_FONT_INVIS2 SARE_HTML_FSIZE_1ALL SARE_HTML_GIF_DIM SARE_HTML_H2_CLK SARE_HTML_HEAD_AFFIL SARE_HTML_HTML_AFTER SARE_HTML_HTML_DBL SARE_HTML_INV_TAGA SARE_HTML_JSCRIPT_ENC SARE_HTML_JVS_HREF SARE_HTML_LEAKTHRU1 SARE_HTML_LEAKTHRU2 SARE_HTML_MANY_BR10 SARE_HTML_NO_BODY SARE_HTML_NO_HTML1 SARE_HTML_ONE_LINE2 SARE_HTML_ONE_LINE3 SARE_HTML_POB1200 SARE_HTML_P_JUSTIFY SARE_HTML_TITLE_MNY SARE_HTML_URI_2SLASH SARE_HTML_URI_AXEL SARE_HTML_URI_BADQRY SARE_HTML_URI_BUG SARE_HTML_URI_DEFASP SARE_HTML_URI_FORMPHP SARE_HTML_URI_HIDADD SARE_HTML_URI_HREF SARE_HTML_URI_LOGOGEN SARE_HTML_URI_MANYP2 SARE_HTML_URI_MANYP3 SARE_HTML_URI_NUMPHP3 SARE_HTML_URI_OBFU4 SARE_HTML_URI_OBFU4a SARE_HTML_URI_OC SARE_HTML_URI_OFF SARE_HTML_URI_REFID SARE_HTML_URI_RID SARE_HTML_URI_RM SARE_HTML_USL_B7 SARE_HTML_USL_B9 SARE_HTML_USL_MULT SARE_MSGID_06D6 SARE_MSGID_2KDD SARE_MSGID_DBL_AT SARE_MSGID_EMPTY SARE_MSGID_HEX30 SARE_MSGID_LONG SARE_MSGID_LONG35 SARE_MSGID_LONG40 SARE_MSGID_LONG55 SARE_MSGID_LONG65 SARE_MSGID_LONG75 SARE_MSGID_SPAM_DOMN0 SARE_MSGID_SUSP2 SARE_MULT_RATW_02 SARE_MULT_RATW_03 SARE_MULT_SEXCLUB SARE_MULT_SUBJ SARE_MULT_VIA_FWCATS SARE_PHISH_HTML_01 SARE_RECV_CHAR_CARAT SARE_RECV_FREESERVE SARE_RECV_IP_004078 SARE_RECV_IP_038112147 SARE_RECV_IP_062023 SARE_RECV_IP_063106130 SARE_RECV_IP_064034 SARE_RECV_IP_064069032 SARE_RECV_IP_064080 SARE_RECV_IP_064192082 SARE_RECV_IP_064192191 SARE_RECV_IP_065205157 SARE_RECV_IP_066063 SARE_RECV_IP_066111 SARE_RECV_IP_066114a SARE_RECV_IP_066114b SARE_RECV_IP_066159017 SARE_RECV_IP_066248154 SARE_RECV_IP_069060122 SARE_RECV_IP_070096177 SARE_RECV_IP_071004246 SARE_RECV_IP_080178 SARE_RECV_IP_081019 SARE_RECV_IP_195229 SARE_RECV_IP_206248152 SARE_RECV_IP_207182 SARE_RECV_IP_208048182 SARE_RECV_IP_209190 SARE_RECV_IP_211049 SARE_RECV_IP_212164 SARE_RECV_IP_216055133 SARE_RECV_IP_222126 SARE_RECV_ISWEST SARE_RECV_LOCALHOST SARE_RECV_RANDOM SARE_RECV_RND_DATE SARE_RECV_RND_NUMBER SARE_RECV_SPAM_DOMN3 SARE_RECV_SPAM_DOMN81 SARE_RECV_SPAM_NAME0 SARE_RECV_SUSP_2 SARE_RECV_SUSP_3 SARE_RECV_TRADVALUES SARE_RECV_VIPLIST SARE_RECV_XACTRIX SARE_REPLY_SPAMWORD0 SARE_REPLY_XACTRIX SARE_TOCC_BCC_MANY SARE_TOCC_COMBO1 SARE_USERAG_Dig SARE_XMAIL_DIRUNIV SARE_XMAIL_GDI SARE_XMAIL_GOMAIL SARE_XMAIL_INTERMED SARE_XMAIL_LEO SARE_XMAIL_PHPBulkEmai SARE_XMAIL_SUSP3 SARE_XMAIL_TOLMAIL SARE_XMAIL_XMAIL
[3491] dbg: rules: AXB_RCVD_ZOOBSEND merged duplicates: BROKEN_RATWARE_BOM CTYPE_001C_A DEAR_HOMEOWNER DIV_CENTER_A_HREF DRUG_RA_PRICE FM_DDDD_TIMES_2 FM_SEX_HOSTDDDD HG_HORMONE HS_PHARMA_1 HS_UPLOADED_SOFTWARE OEBOUND RCVD_IN_DSBL STOX_RCVD_N_NN_N URIBL_RHS_ABUSE URIBL_RHS_BOGUSMX URIBL_RHS_DSN URIBL_RHS_POST URIBL_RHS_TLD_WHOIS URIBL_RHS_WHOIS URIBL_XS_SURBL URI_L_PHP XMAILER_MIMEOLE_OL_5E7ED XMAILER_MIMEOLE_OL_C7C33 XMAILER_MIMEOLE_OL_D03AB X_LIBRARY YOUR_CRD_RATING
[3491] dbg: rules: __MO_OL_F475E merged duplicates: __MO_OL_FF5C8
[3491] dbg: conf: finish parsing
[3491] dbg: plugin: Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x4334230) implements 'finish_parsing_end', priority 0
[3491] dbg: replacetags: replacing tags
[3491] dbg: replacetags: done replacing tags
[3491] dbg: bayes: using username: amavis
[3491] dbg: bayes: database connection established
[3491] dbg: bayes: found bayes db version 3
[3491] dbg: bayes: Using userid: 1
[3491] dbg: bayes: not available for scanning, only 10 spam(s) in bayes DB < 200
[3491] dbg: config: score set 0 chosen.
[3491] dbg: message: main message type: text/plain
[3491] dbg: message: ---- MIME PARSER START ----
[3491] dbg: message: parsing normal part
[3491] dbg: message: ---- MIME PARSER END ----
[3491] dbg: plugin: Mail::SpamAssassin::Plugin::DNSEval=HASH(0x4426a50) implements 'check_start', priority 0
[3491] dbg: bayes: database connection established
[3491] dbg: bayes: found bayes db version 3
[3491] dbg: bayes: Using userid: 1
[3491] dbg: bayes: not available for scanning, only 10 spam(s) in bayes DB < 200
[3491] dbg: plugin: Mail::SpamAssassin::Plugin::Check=HASH(0x43aa2a8) implements 'check_main', priority 0
[3491] dbg: conf: internal_networks not configured, using trusted_networks configuration for internal_networks; if you really want internal_networks to only contain the required 127/8 add 'internal_networks !0/0' to your configuration
[3491] dbg: metadata: X-Spam-Relays-Trusted:
[3491] dbg: metadata: X-Spam-Relays-Untrusted:
[3491] dbg: metadata: X-Spam-Relays-Internal:
[3491] dbg: metadata: X-Spam-Relays-External:
[3491] dbg: message: no encoding detected
[3491] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x410d800) implements 'parsed_metadata', priority 0
[3491] dbg: dns: is DNS available? 0
[3491] dbg: rules: local tests only, ignoring RBL eval
[3491] dbg: check: running tests for priority: -1000
[3491] dbg: rules: running head tests; score so far=0
[3491] dbg: rules: compiled head tests
[3491] dbg: eval: all '*From' addrs: ignore@compiling.spamassassin.taint.org
[3491] dbg: eval: all '*To' addrs:
[3491] dbg: rules: running body tests; score so far=0
[3491] dbg: rules: compiled body tests
[3491] dbg: rules: running uri tests; score so far=0
[3491] dbg: rules: compiled uri tests
[3491] dbg: rules: running rawbody tests; score so far=0
[3491] dbg: rules: compiled rawbody tests
[3491] dbg: rules: running full tests; score so far=0
[3491] dbg: rules: compiled full tests
[3491] dbg: rules: running meta tests; score so far=0
[3491] dbg: rules: compiled meta tests
[3491] dbg: check: running tests for priority: -950
[3491] dbg: rules: running head tests; score so far=0
[3491] dbg: rules: compiled head tests
[3491] dbg: rules: running body tests; score so far=0
[3491] dbg: rules: compiled body tests
[3491] dbg: rules: running uri tests; score so far=0
[3491] dbg: rules: compiled uri tests
[3491] dbg: rules: running rawbody tests; score so far=0
[3491] dbg: rules: compiled rawbody tests
[3491] dbg: rules: running full tests; score so far=0
[3491] dbg: rules: compiled full tests
[3491] dbg: rules: running meta tests; score so far=0
[3491] dbg: rules: compiled meta tests
[3491] dbg: check: running tests for priority: -900
[3491] dbg: rules: running head tests; score so far=0
[3491] dbg: rules: compiled head tests
[3491] dbg: rules: running body tests; score so far=0
[3491] dbg: rules: compiled body tests
[3491] dbg: rules: running uri tests; score so far=0
[3491] dbg: rules: compiled uri tests
[3491] dbg: rules: running rawbody tests; score so far=0
[3491] dbg: rules: compiled rawbody tests
[3491] dbg: rules: running full tests; score so far=0
[3491] dbg: rules: compiled full tests
[3491] dbg: rules: running meta tests; score so far=0
[3491] dbg: rules: compiled meta tests
[3491] dbg: check: running tests for priority: -400
[3491] dbg: rules: running head tests; score so far=0
[3491] dbg: rules: compiled head tests
[3491] dbg: rules: running body tests; score so far=0
[3491] dbg: rules: compiled body tests
[3491] dbg: rules: running uri tests; score so far=0
[3491] dbg: rules: compiled uri tests
[3491] dbg: rules: running rawbody tests; score so far=0
[3491] dbg: rules: compiled rawbody tests
[3491] dbg: rules: running full tests; score so far=0
[3491] dbg: rules: compiled full tests
[3491] dbg: rules: running meta tests; score so far=0
[3491] dbg: rules: compiled meta tests
[3491] dbg: check: running tests for priority: 0
[3491] dbg: rules: running head tests; score so far=0
[3491] dbg: rules: compiled head tests
[3491] dbg: rules: ran header rule __MISSING_REF ======> got hit: "UNSET"
[3491] dbg: rules: ran header rule __MSOE_MID_WRONG_CASE ======> got hit: "
[3491] dbg: rules: Message-Id: "
[3491] dbg: rules: ran header rule MISSING_DATE ======> got hit: "UNSET"
[3491] dbg: rules: ran header rule __SARE_WHITELIST_FLAG ======> got hit: "i"
[3491] dbg: rules: ran header rule __MSGID_OK_HOST ======> got hit: "@lint_rules>"
[3491] dbg: rules: ran header rule __MSGID_OK_DIGITS ======> got hit: "1256045701"
[3491] dbg: rules: ran header rule __HAS_MSGID ======> got hit: "<"
[3491] dbg: rules: ran header rule __SANE_MSGID ======> got hit: "<1256045701@lint_rules>
[3491] dbg: rules: "
[3491] dbg: spf: checking to see if the message has a Received-SPF header that we can use
[3491] dbg: spf: already checked for Received-SPF headers, proceeding with DNS based checks
[3491] dbg: spf: already checked for Received-SPF headers, proceeding with DNS based checks
[3491] dbg: rules: ran eval rule NO_RELAYS ======> got hit (1)
[3491] dbg: spf: already checked for Received-SPF headers, proceeding with DNS based checks
[3491] dbg: spf: already checked for Received-SPF headers, proceeding with DNS based checks
[3491] dbg: spf: cannot get Envelope-From, cannot use SPF
[3491] dbg: spf: def_spf_whitelist_from: could not find useable envelope sender
[3491] dbg: spf: already checked for Received-SPF headers, proceeding with DNS based checks
[3491] dbg: spf: already checked for Received-SPF headers, proceeding with DNS based checks
[3491] dbg: spf: already checked for Received-SPF headers, proceeding with DNS based checks
[3491] dbg: rules: ran eval rule __UNUSABLE_MSGID ======> got hit (1)
[3491] dbg: spf: spf_whitelist_from: could not find useable envelope sender
[3491] dbg: rules: ran eval rule MISSING_HEADERS ======> got hit (1)
[3491] dbg: rules: running body tests; score so far=1.899
[3491] dbg: rules: compiled body tests
[3491] dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "I"
[3491] dbg: rules: running uri tests; score so far=1.899
[3491] dbg: rules: compiled uri tests
[3491] dbg: eval: stock info total: 0
[3491] dbg: rules: ran eval rule __HAVE_BOUNCE_RELAYS ======> got hit (1)
[3491] dbg: rules: running rawbody tests; score so far=1.899
[3491] dbg: rules: compiled rawbody tests
[3491] dbg: rules: ran rawbody rule __TVD_BODY ======> got hit: "need"
[3491] dbg: rules: running full tests; score so far=1.899
[3491] dbg: rules: compiled full tests
[3491] dbg: rules: running meta tests; score so far=1.899
[3491] dbg: rules: compiled meta tests
[3491] dbg: check: running tests for priority: 500
[3491] dbg: dns: harvest_dnsbl_queries
[3491] dbg: rules: running head tests; score so far=1.899
[3491] dbg: rules: compiled head tests
[3491] dbg: rules: running body tests; score so far=1.899
[3491] dbg: rules: compiled body tests
[3491] dbg: rules: running uri tests; score so far=1.899
[3491] dbg: rules: compiled uri tests
[3491] dbg: rules: running rawbody tests; score so far=1.899
[3491] dbg: rules: compiled rawbody tests
[3491] dbg: rules: running full tests; score so far=1.899
[3491] dbg: rules: compiled full tests
[3491] dbg: rules: running meta tests; score so far=1.899
[3491] dbg: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_XMAIL_SUSP2'
[3491] dbg: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_HEAD_XAUTH_WARN'
[3491] dbg: rules: meta test SARE_HEAD_SUBJ_RAND has undefined dependency 'X_AUTH_WARN_FAKED'
[3491] dbg: rules: meta test SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_MKSHRT'
[3491] dbg: rules: meta test SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_GT'
[3491] dbg: rules: meta test SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_TINY'
[3491] dbg: rules: compiled meta tests
[3491] dbg: check: running tests for priority: 1000
[3491] dbg: rules: running head tests; score so far=4.205
[3491] dbg: rules: compiled head tests
[3491] dbg: rules: running body tests; score so far=4.205
[3491] dbg: rules: compiled body tests
[3491] dbg: rules: running uri tests; score so far=4.205
[3491] dbg: rules: compiled uri tests
[3491] dbg: rules: running rawbody tests; score so far=4.205
[3491] dbg: rules: compiled rawbody tests
[3491] dbg: rules: running full tests; score so far=4.205
[3491] dbg: rules: compiled full tests
[3491] dbg: rules: running meta tests; score so far=4.205
[3491] dbg: rules: compiled meta tests
[3491] dbg: check: is spam? score=4.205 required=5
[3491] dbg: check: tests=MISSING_DATE,MISSING_HEADERS,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS
[3491] dbg: check: subtests=__HAS_MSGID,__HAVE_BOUNCE_RELAYS,__MISSING_REF,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__MSOE_MID_WRONG_CASE,__NONEMPTY_BODY,__SANE_MSGID,__SARE_WHITELIST_FLAG,__TVD_BODY,__UNUSABLE_MSGID

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
256:
257:
258:
259:
260:
261:
262:
263:
264:
265:
266:
267:
268:
269:
270:
271:
272:
273:
274:
275:
276:
277:
278:
279:
280:
281:
282:
283:
284:
285:
286:
287:
288:
289:
290:
291:
292:
293:
294:
295:
296:
297:
298:
299:
300:
301:
302:
303:
304:
305:
306:
307:
308:
309:
310:
311:
312:
313:
314:
315:
316:
317:
318:
319:
320:
321:
322:
323:
324:
325:
326:
327:
328:
329:
330:
331:
332:
333:
334:
335:
336:
337:
338:
339:
340:
341:
342:
343:
344:
345:
346:
347:
348:
349:
350:
351:
352:
353:
354:
355:
356:
357:
358:
359:
360:
361:
362:
363:
364:
365:
366:
367:
368:
369:
370:
371:
372:
373:
374:
375:
376:
377:
378:
379:
380:
381:
382:
383:
384:
385:
386:
387:
388:
389:
390:
391:
392:
393:
394:
395:
396:
397:
398:
399:
400:
401:
402:
403:
404:
405:
406:
407:
408:
409:
410:
411:
412:
413:
414:
415:
416:
417:
418:
419:
420:
421:
422:
423:
424:
425:
426:
427:
428:
429:
430:
431:
432:
433:
434:
435:
436:
437:
438:
439:
440:
441:
442:
443:
444:
445:
446:
447:
448:
449:
450:
451:
452:
453:
454:
455:
456:
457:
458:
459:
460:
461:
462:
463:
464:
465:
466:
467:
468:
469:
470:
471:
472:
473:
474:
475:
476:
477:
478:
479:
480:
481:
482:
483:
484:
485:
486:
487:
488:
489:
490:
491:
492:
493:
494:
495:
496:
497:
498:
499:
500:
501:
502:
503:
504:
505:
506:
507:
508:
509:
510:
511:
512:
513:
514:
515:
516:
517:
518:
519:
520:
521:
522:
523:
524:
525:
526:
527:
528:
529:
530:
531:
532:
533:
534:

Select all Open in new window

by: grbladesPosted on 2009-10-20 at 07:15:43ID: 25614348

No need to worry about dcc at this point. It helps to detect mails which have been sent to multiple recipients (which could be a mailing list and not necessarily spam) so needs a lot of configuration to whitelist common senders. Many people dont use it for this reason.

I cant see any real problems with the debug output.
It did report that there are only 10 spams in the database which seems low. Normally I believe spams detected with a score over 20 are automatically learnt as spam.
Does this sound correct?
If not then perhaps there is a permissions issue. Check the last modified time on the files to check that they are being updated.

I would suggest making sure razor and pyzor are configured correctly. They do require minimal inital configuration and I find they help a lot.
http://sourceforge.net/apps/trac/pyzor/
http://razor.sourceforge.net/

Do you have amavis configured to automatically include a report for detected spams. It shows the rules which matched and this can often be usefull to see which rules are not triggering which can point to whats not working.

by: ShylokPosted on 2009-10-20 at 07:28:58ID: 25614517

I've only run it live for 4-5hrs or so thus far. I can't bring it online completely due to a firewall issue. It's going live shortly but quite frankly I'd like to get it solid now so all those watch/degree spams aren't getting through.

I'll attempt to figure out if pyzor/raxor are working. This is my first time with them so any quick test suggestion would be helpful.

The last question I'm frankly not sure if this is the case.

re: DCC I did see in the spam and not spam folder mails that were to multiple recipients. I also saw it catch what appeared to be legit stuff from mailing lists like our local municipal govt.

Any suggestions on SARE rules??

I installed sanesecurity as per both your suggestions. Won't be able to tell if its work until later tonight when I do another test again. With Maia the spam gets classified as viruses unless I install the new branch.. which I'm not sure how to do yet.

by: robocatPosted on 2009-10-20 at 07:43:38ID: 25614676

>Any suggestions on SARE rules??

The SARE rules are no longer being updated, so don't expect too much from these.

As far as Sanesecurity and virus classification goes, we've never seen a false positive coming from sane. So you can safely quarantine or delete the entire message and not bother with how the mails are classified.

>bayes: not available for scanning, only 10 spam(s) in bayes DB < 200

As far as Bayes goes, you need to do some initial *manual* training by feeding it SPAM and HAM. Only then will it start autolearning. Bayes can be a valuable aid, so take some time to train it with at least 200 SPAMs and 200 HAMs

by: grbladesPosted on 2009-10-20 at 07:49:30ID: 25614740

Here is a list of the additional rules I have defined.

My website has a more detailed list of the setup that I am running.
http://www.gbnetwork.co.uk/mailscanner/

70_sare_adult.cf
70_sare_bayes_poison_nxm.cf
70_sare_evilnum0.cf
70_sare_genlsubj0.cf
70_sare_genlsubj1.cf
70_sare_header0.cf
70_sare_header1.cf
70_sare_html0.cf
70_sare_html1.cf
70_sare_obfu.cf
70_sare_oem.cf
70_sare_random.cf
70_sare_specific.cf
70_sare_spoof.cf
70_sare_stocks.cf
70_sare_unsub.cf
70_sare_uri0.cf
70_sare_uri1.cf
70_sare_whitelist_rcvd.cf
70_sare_whitelist_spf.cf
72_sare_bml_post25x.cf
72_sare_redirect_post3.0.0.cf
88_FVGT_body.cf
88_FVGT_headers.cf
88_FVGT_rawbody.cf
88_FVGT_subject.cf
99_FVGT_meta.cf
99_sare_fraud_post25x.cf
backhair.cf
Botnet.cf
chickenpox.cf
imageinfoextras.cf
KAM.cf
mangled.cf
tripwire.cf
weeds_2.cf

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:

Select all Open in new window

by: ShylokPosted on 2009-10-24 at 15:14:36ID: 25654608

Ok guys. It looks like the issue was that I had not opened the ports for razor2 2703, dcc 6277, DNS 53 allowed outbound from the Maia server. Once the ports were opened the RBL were being referenced and spam started to get caught and scored properly. So it appears port 53 outbound rule on firewall is fairly important.

I also installed sanesecurity, and sare rules from openprotect and sa-update. Using the amavis user. I had to do a chown -R amavis:amavis on the SA directories that were buggered when i ran sa-update as root.

Things are working like a top now. I ran it overnight and out of 2500mails 27legit. 2400~spam 100virus and 1 spam having made it through into non-spam. Bayes isn't trained yet since I haven't seen 200ham. But thanks again.

by: ShylokPosted on 2009-10-24 at 15:16:25ID: 31643217

Restart issue was also resolved. Issue was dameon was reference conf which had a differnet location for pid.

Question

Spam getting through SpamAssassin, lots of it

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Spam Firewall

Email

SpamAssassin

Spam Assassin

Postfix

Simple Mail Transfer Protocol (SMTP)

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press