ConfigServer Community Forum

Hi,

What does the foll. info mean? Last Journal Sync showing 31 Dec 1969. Is this normal?
-------------------------------------------
Bayes Database Information Number of Spam Messages: 0
Number of Ham Messages: 3,296
Number of Tokens: 177,320
Oldest Token: Fri, 04 Mar 2011 01:47:50 -0500
Newest Token: Sat, 19 Mar 2011 01:19:45 -0400
Last Journal Sync: Wed, 31 Dec 1969 19:00:00 -0500
Last Expiry: Fri, 04 Mar 2011 01:49:44 -0500
Last Expiry Reduction Count: 0 tokens
-------------------------------------------

Thank you.

Usually that means a journal sync has never been done, or bayes is not working.

However, it is very odd that there are NO spam messages in your bayes database, it seems that your bayes is not working at all. Did we install MailScanner for you?

Regards,
Sarah

Yes Sarah, you set it up for us, but that was a while ago. One change with referece to cPanel is that we changed from release tree to stable tree recently.

We tried the steps given at: http://www.configserver.com/techfaq/faq ... =77&page=7
but still the same issue. What other settings do you want us to check?

Thank you.

Is this a live server? Have *any* messages been scored as spam by SpamAssassin since you cleared the bayes database?

If you run these commands:

cd /etc/mail/spamassassin/
grep bayes *

What is the output of the second command?

What is the ownership and permissions on this directory: /var/spool/mqueue/.spamassassin

What's the output of this command?

ls -la /var/spool/mqueue/.spamassassin

Sarah wrote:Is this a live server? Have *any* messages been scored as spam by SpamAssassin since you cleared the bayes database?

Yes. No. Same problem happened few weeks ago, and after doing the steps in that faq page, it was resolved soon after.

Sarah wrote: cd /etc/mail/spamassassin/
grep bayes *

What is the output of the second command?

70_sare_bayes_poison_nxm.cf:# SARE "70_sare_bayes_poison_nxm.cf" Ruleset for SpamAssassin
70_sare_bayes_poison_nxm.cf:# Current Home: http://www.rulesemporium.com/rules/70_s ... son_nxm.cf
mailscanner.cf:# use_bayes 0
mailscanner.cf:# will be created as /var/spool/spamassassin/bayes_msgcount, etc.mailscanner.cf:# bayes_path should NOT be directory!
mailscanner.cf:# In this example, the trailing "bayes" will be the "bayes*" +
mailscanner.cf:# files in the directory "/etc/MailScanner/bayes/"
mailscanner.cf:bayes_path /var/spool/mqueue/.spamassassin/bayes
mailscanner.cf:# bayes_file_mode 0770
mailscanner.cf:# To disable bayes autolearn
mailscanner.cf:# bayes_auto_learn 0
mailscanner.cf:bayes_ignore_header X-YOURDOMAIN-COM-MailScanner
mailscanner.cf:bayes_ignore_header X-YOURDOMAIN-COM-MailScanner-SpamCheck
mailscanner.cf:bayes_ignore_header X-YOURDOMAIN-COM-MailScanner-SpamScore
mailscanner.cf:bayes_ignore_header X-YOURDOMAIN-COM-MailScanner-Information
mailscanner.cf:# You will just end up with # MailScanner: big bayes_toks.new files
mailscanner.cf:#bayes_auto_expire 0
v320.pre:# and create a header containing ASN data for bayes tokenization.

Sarah wrote: What is the ownership and permissions on this directory: /var/spool/mqueue/.spamassassin

drwx------ 2 mailnull mail 2048 Mar 4 01:47 /var/spool/mqueue/.spamassassin

Sarah wrote: What's the output of this command?

ls -la /var/spool/mqueue/.spamassassin

total 4420
drwx------ 2 mailnull mail 2048 Mar 4 01:47 .
drwxr-x--- 4 mailnull mail 2048 Mar 4 01:47 ..
-rw------- 1 mailnull mail 10 Mar 21 00:31 bayes.mutex
-rw------- 1 mailnull mail 323584 Mar 21 00:31 bayes_seen
-rw------- 1 mailnull mail 5238784 Mar 21 00:31 bayes_toks


Thank you.

tuxg wrote:

Sarah wrote:Is this a live server? Have *any* messages been scored as spam by SpamAssassin since you cleared the bayes database?

Yes. No. Same problem happened few weeks ago, and after doing the steps in that faq page, it was resolved soon after.

In this case it is SpamAssassin that is not working, bayes itself may be fine. (Everything else looked OK.)

Try updating the spamassassin rules:
Also make sure there are no DNS issues on the server by doing a dig on some random domain (a domain that exists) to see if it succeeds and is quick.

dig lookups are quick, no issues there.

Running sa-update hasn't changed anything.

Then, tried the following:
# sa-learn --force-expire
# rm -Rvf /var/spool/mqueue/.spamassassin/
# sa-learn
# sa-update
and now the "Last Expiry" also is showing as 1969! Does that give us any clue?:

Bayes Database Information Number of Spam Messages: 6
Number of Ham Messages: 123
Number of Tokens: 15,185
Oldest Token: Mon, 21 Mar 2011 07:26:24 -0400
Newest Token: Tue, 22 Mar 2011 01:29:27 -0400
Last Journal Sync: Wed, 31 Dec 1969 19:00:00 -0500
Last Expiry: Wed, 31 Dec 1969 19:00:00 -0500
Last Expiry Reduction Count: 0 tokens

We are not getting lot of spam messages in, and the RBL check is being done by Exim. What are we still missing?

Thank you.

I don't think sa-learn by itself does anything. Since you've removed the bayes database you will need to wait for it to be built back up again. At least there were some spam messages at the last check, so spamassassin *is* working. I think the dates are now showing as 1969 because there isn't any database there. Wait a few days and then check it again.