Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Postfix + amavis + SpamAssassin. Messages are coming through just fine, and they're getting X-Spam-Score as I would expect, along with X-Spam-Status values, implying that SA is doing something with them. Unfortunately, amavis doesn't seem to want to actually mark them as spam, as all messages are coming through with X-Spam-Flag: NO.

An example message that I'm looking at right now has the following headers:

X-Virus-Scanned: Debian amavisd-new at magni
X-Spam-Flag: NO
X-Spam-Score: 11.733
X-Spam-Level: ***********
X-Spam-Status: No, score=11.733 tests=[BAYES_99=3.5, HTML_MESSAGE=0.001,
        MIME_HTML_ONLY=1.457, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905,
        RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033] autolearn=no

Here's my amavisd.conf file:

$mydomain = "";
$MYHOME = '/var/amavisd';
$TEMPBASE = "$MYHOME/tmp";

$inet_socket_port = 10024;
$forward_method = 'smtp:127.0.0.1:10025';
$notify_method = $forward_method;

# @local_domains_acl = qw( "." ); # you may want to use qw() to check all in and out
$sa_tag_level_deflt = -999; # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 5.0; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 999; # triggers spam evasive actions
$sa_debug = 1;

$final_virus_destiny = D_DISCARD; # (defaults to D_BOUNCE)
$final_banned_destiny = D_REJECT; # (defaults to D_BOUNCE)
$final_spam_destiny = D_PASS; # (defaults to D_REJECT but we're tagging and passing)

$spam_admin = "postmaster\@$mydomain";
$spam_lovers{lc("postmaster\@$mydomain")} = 1;
$virus_admin = "postmaster\@$mydomain";

$QUARANTINEDIR = undef;
$virus_quarantine_to = undef;
#$spam_quarantine_to = 'spam-quarantine';

$remove_existing_spam_headers = 0;
$sa_local_tests_only = 0; # (default: false)
$SYSLOG_LEVEL = 'mail.err';
$DO_SYSLOG = 1;
$log_level = 2;

$enable_dkim_verification = 0;

# @bypass_spam_checks_maps = (1);

@lookup_sql_dsn = ( 'DBI:mysql:database=postfix;host=127.0.0.1;port=3306', '', '' );
$sql_select_policy = 'SELECT "Y" as local FROM aliases WHERE source IN (%k) UNION SELECT "Y" as local FROM users WHERE address IN (%k)';

1;

Any ideas?

UPDATE: A message that I've been holding on to:

X-Spam-Flag: NO
X-Spam-Score: 14.085
X-Spam-Level: **************
X-Spam-Status: No, score=14.085 tests=[BAYES_99=3.5, NO_DNS_FOR_FROM=1.496,
        RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5,
        RAZOR2_CHECK=0.5, RCVD_IN_XBL=3.033, RDNS_NONE=0.1,
        URIBL_BLACK=1.955,
        URIBL_JP_SURBL=1.501] autolearn=no

has this entry in the mail logs:

mail.log.1:Sep  5 21:43:39 magni amavis[25486]: (25486-10) Passed CLEAN, [78.189.26.137] [88.206.193.68] <buk@78.189-6793.ttnet.net.tr> -> <gms8994>, Message-ID: <9168695667.JH8FPJK6165793@hsnmmapfch.eiygiquc.info>, mail_id: 4Moi5p2dOV-I, Hits: 14.085, size: 891, queued_as: AFF8C2C367, 1156 ms

As suggested by Dave Drager, I'm going to try stopping spamd, and see what happens.

UPDATE2: Stopped spamassassin, leaving amavis running, just got this message:

X-Spam-Flag: NO
X-Spam-Score: 17.712
X-Spam-Level: *****************
X-Spam-Status: No, score=17.712 tests=[BAYES_99=3.5, FH_FROMEML_NOTLD=2.696,
        RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5,
        RAZOR2_CHECK=0.5, RCVD_ILLEGAL_IP=1.908, RCVD_IN_SORBS_WEB=0.619,
        RCVD_IN_XBL=3.033, URIBL_BLACK=1.955, URIBL_JP_SURBL=1.501]
        autolearn=failed

with this in the logs:

mail.log:Sep  9 08:49:11 magni amavis[13604]: (13604-10) Passed CLEAN, [77.70.121.78] [77.70.121.78] <trfq@pc-2bb82028ef37> -> <gms8994@dp.cx>, Message-ID: <1517253501.OMHO2ISO759593@xxmodf.awlxrunvwnzdz.ru>, mail_id: Lg-rCSg9x0rr, Hits: 17.712, size: 844, queued_as: 8269D2BF6B, 2312 ms

per @cite, I looked at /etc/amavis/conf.d/50-user (I am actually running debian). It was empty. I moved the configuration from /etc/amavis/amavisd.conf to 50-user, and restarted, and messages are now being tagged with X-Spam-Flag: YES. Points to cite.

share|improve this question
    
It seems that your configuration is ok. No hints in the amavis logs? –  HD. Sep 8 '09 at 16:50

2 Answers 2

up vote 4 down vote accepted
+200

You need to provide more detailed logging output to solve that: Stop amavisd and restart it in debug mode (amavisd debug, on Debian/Ubuntu it's probably amavisd-new debug, but since you mention you configured amavisd with amavisd.conf and not /etc/amavis/conf.d/50-user, I guess you are not on Debian/Ubuntu). While you do that, you will probably want to disable the Postfix SMTP port 25 listeners on your mail servers external interfaces (you can always submit mail locally) or else you will probably get a little bit too much logging, so locate those in /etc/postfix/master.cf and uncomment the appropriate entries (don't forget postfix reload afterwards).

Also, to avoid cluttering your screen, remove the $sa_debug setting from your amavisd.conf temporarily - but reenable it if you can't figure out the cause of your problem (and also try to check why autolearning fails).

Two more comments on your configuration, which are not really related to your problem:

  1. Set $sa_kill_level_deflt to $sa_tag2_level_deflt - your final spam destiny is D_PASS anyways.
  2. Set $sa_tag_level_deflt to undef.

A comment directed at Dave: amavisd-new doesn't use spamd by default, so restarting spamd is rather pointless. Furthermore, there is no way you can modify the way amavisd-new treats a message of a given content category (here: CC_SPAM) from within Spamassassin's configuration.

share|improve this answer

Check Amavis logs. I've found that the values that Amavis sends to Spamassassin may not work if Spamassassin is already running (using a different config file, with a different set of variables). I think you'll find Spamassassin running, and Amavis is using that instead of spawning its own process for it. Try also killing Spamassassin and see if Amavis starts to use the variables mentioned above (since it will spawn its own process).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.