Page 1 of 1

New Year's Mail marked as spam

PostPosted: Fri Jan 01, 2010 6:20 pm
by borni
due to a rule in spamassassin's default rules a lot of mails are tagged as spam as false positive.
Solution :

The error is caused by rule FH_DATE_PAST_20XX in 72_active.cf as it will hit any mail with a date later than 12-31-2009.
you can eiter disable the rule by adding to local.cf :

Code: Select all
score FH_DATE_PAST_20XX 0.0


or by changing the rule in 72_active.cf (can exist multiple times on your system) :

Code: Select all
##{ FH_DATE_PAST_20XX
header   FH_DATE_PAST_20XX      Date =~ /20[1-9][1-9]/ [if-unset: 2006]


but : be aware that in the latter case the same issue will re-appear next year!

In the spamassassin list there is a discussion if this rule is still necessary and if it should be removed from the default rulesets.

Re: New Year's Mail marked as spam

PostPosted: Fri Jan 01, 2010 6:45 pm
by mybulk
For Dummys like me , I would like to add that the score files are stored in

/usr/share/spamassassin/


and the local.cf is stored at

/etc/mail/spamassassin

Re: New Year's Mail marked as spam

PostPosted: Sat Jan 02, 2010 2:19 am
by borni
according to the spamassassin list the solution should be active in the updates :

Code: Select all
/20[1-9][0-9]/   --> /20[2-9][0-9]/


so if you perform a sa-update the new rule should be in place.
As far as I could see someone forgot to backport this issue as it had been fixed for brand new spamassassin 3.3.

For MailScanner they recommended to clear the spamassassin cache after update:

Code: Select all
service MailScanner stop
rm -fr /var/spool/MailScanner/incoming/SpamAssassin*
service MailScanner start

Re: New Year's Mail marked as spam

PostPosted: Sat Jan 02, 2010 6:25 am
by Timotheus
I ran sa-update and cleared the cache as borni suggested. Upon restarting MailScanner I got the error message:

Code: Select all
[root@mail ~]# service MailScanner start
Starting MailScanner daemons:
         incoming postfix:                                 [  OK  ]
         outgoing postfix:                                 [  OK  ]
         MailScanner:       File::Temp version 0.18 required--this is only version 0.16 at /usr/lib/perl5/site_perl/5.8.8/MIME/Tools.pm line 14.
BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/MIME/Tools.pm line 14.
Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/MIME/Parser.pm line 142.
BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/MIME/Parser.pm line 142.
Compilation failed in require at /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 41.
BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 41.
Compilation failed in require at /usr/sbin/MailScanner line 107.
BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 107.
                                                           [  OK  ]
[root@mail ~]# service MailScanner status
Checking MailScanner daemons:
         MailScanner:                                      [FAILED]


Having very little experience with Perl modules I hesitate to try upgrading modules without advice.

Is anybody else seeing this error?

How have you fixed it?

Re: New Year's Mail marked as spam

PostPosted: Sat Jan 02, 2010 8:48 am
by Timotheus
Discovered this bug listed at http://www.global-domination.org/forum/viewtopic.php?f=14&t=1933

Made a snapshot and updated to 2060. The error persisted.

Reverted and installed from RPM:

Code: Select all
cd /usr/src/redhat/RPMS/noarch/

[root@mail noarch]# rpm -ivh perl-File-Temp-0.20-4.noarch.rpm                 
Preparing...                ########################################### [100%]
   1:perl-File-Temp         ########################################### [100%]
[root@mail noarch]# service MailScanner start                                 
Starting MailScanner daemons:                                                 
         incoming postfix:                                 [  OK  ]           
         outgoing postfix:                                 [  OK  ]           
         MailScanner:                                                         

                                                           [  OK  ]


Life seems to be good again.