Local mail marked as spam

[sirio81]

Hi all, I'm working with ZSC 5 on centos 5 and have a domain called mail.local.
Local mails are marked as spam and sent to user's junk folder.

I tried to edit
/opt/zimbra/conf/spamassassin/local.cf

inserting
trusted_networks 192.168.0.

and reload the service
zmantispamctl reload

But it didn't help.

I also noticed that the autotraining was not writing any log since the end of 2009.
/opt/zimbra/log/spamtrain.log
...
20091129234511 Finished spam/ham cleanup


I try to run

zmtrainsa
20100503170034 Starting spam/ham extraction from system accounts.
[] WARN: Spam/notspam messages must have attachments (skipping /service/user/spam.qwksig9eca@mail.local/?id=1289)
[] INFO: Total messages processed: 10
[] INFO: Total messages processed: 1
20100503170041 Finished extracting spam/ham from system accounts.
20100503170041 Starting spamassassin training.
netset: cannot include 192.168.0.0/24 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 192.168.0.0/24 as it has already been included
Learned tokens from 0 message(s) (7 message(s) examined)
netset: cannot include 192.168.0.0/24 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 192.168.0.0/24 as it has already been included
Learned tokens from 1 message(s) (1 message(s) examined)
netset: cannot include 192.168.0.0/24 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 192.168.0.0/24 as it has already been included
bayes: synced databases from journal in 0 seconds: 485 unique entries (799 total entries)
20100503170044 Finished spamassassin training.


Could you please help me?
Wich other invormation can I report to clear the problem?

[owl700]

Please, copy and past here the spam email headers

[sirio81]

Return-Path: test1@mydomain.com
Received: from mail.local (LHLO mail.local) (127.0.0.1) by mail.local with
 LMTP; Tue, 4 May 2010 08:25:46 +0200 (CEST)
Received: from localhost (mail.local [127.0.0.1])
	by mail.local (Postfix) with ESMTP id 839A12A030A
	for <test2@mail.local>; Tue,  4 May 2010 08:25:46 +0200 (CEST)
X-Virus-Scanned: amavisd-new at mail.local
X-Spam-Flag: YES
X-Spam-Score: 9.305
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.305 tagged_above=-10 required=6
	tests=[ALL_TRUSTED=-1.8, BAYES_99=3.5, DNS_FROM_OPENWHOIS=1.13,
	FH_DATE_PAST_20XX=3.188, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=1.5]
Received: from mail.local ([127.0.0.1])
	by localhost (mail.local [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id gJOLQApRxAxG for <test2@mail.local>;
	Tue,  4 May 2010 08:25:46 +0200 (CEST)
Received: by mail.local (Postfix, from userid 101)
	id 0721E2A030D; Tue,  4 May 2010 08:25:46 +0200 (CEST)
Received: from mail.local (mail.local [127.0.0.1])
	by mail.local (Postfix) with ESMTP id CDE392A030A
	for <test2@mail.local>; Tue,  4 May 2010 08:25:45 +0200 (CEST)
Date: Tue, 4 May 2010 08:25:45 +0200 (CEST)
From: test1@mydomain.com
To: test2@mail.local
Message-ID: <364313864.71272954345804.JavaMail.root@mail.local>
Subject: prova
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Originating-IP: [192.168.0.101]
X-Mailer: Zimbra 5.0.16_GA_2921.RHEL5_64 (ZimbraWebClient - FF3.0 (Linux)/5.0.16_GA_2921.RHEL5_64)

[phoenix]

When you get a problem with spam you should check the headers and see what's causing it, when you've done that search the forum or the internet for any similar problems. Search these forums for 'FH_DATE_PAST_20XX' and you'll find the solution.

[uxbod]

You will also want to look at [SOLVED] spamassassin: false positives from openwhois.

[sirio81]

First of all, is there a way to white list mail.local? I need to fix that quickly so a workaround is ok.
I tried
Improving Anti-spam system - Zimbra :: Wiki
The easiest way to "tweak" your spamassassin filtering setup is to edit your /opt/zimbra/conf/salocal.cf.in file...

but it didn't work! Local mails are still marked as spam.

I searched on internet for FH_DATE_PAST_20XX and found
Rules/FH_DATE_PAST_20XX - Spamassassin Wiki
That means "The date is grossly in the future."
It might help to run "sa-update" but how to do it in zimbra? Is there CLI zimbra command?
Or another binary? I can't find a sa-update command:
locate sa-update
/opt/zimbra/conf/spamassassin/sa-update-pubkey.txt

[uxbod]

Searching the Zimbra forums you would have found the sticky :- [SOLVED] FH_DATE_PAST_20XX - Spamassassin bug - incorrect tagging from Jan 1, 2010 on

If you want the sa-update binary then you will need to upgrade to the latest version of Zimbra.

[yogesh2tech]

Hi sirio81

Just open the file /op/zimbra/spamassassin/50_scores.cf

search the line FH_DATE_PAST_20XX

there will be some number remove that nombers and place 0.0 after that line.

FH_DATE_PAST_20XX 0.0 like this

you can also put this in salocal.cf

most probably you will get rid off the problem.

[sirio81]

Hi yogesh2tech, thanks for the answer.

Is it ok like that

/opt/zimbra/conf/spamassassin/50_scores.cf
score FH_DATE_IS_19XX 1.947 1.970 2.512 2.199 # n=2
score FH_DATE_PAST_20XX 0.0  # n=2

or do I have to remove also the "# n=2" ?
Note that I reported also the line "FH_DATE_IS_19..." because it looks similar and I would not like it need to be changed/removed.

Wich services do I have ro reload to make the changes effective?

Searching the Zimbra forums you would have found the sticky :- http://www.zimbra.com/forums/adminis...-1-2010-a.html

I did, as you can see I also posted the link but it didn't help me for the reason below

If you want the sa-update binary then you will need to upgrade to the latest version of Zimbra.

PS:
what are the differences between
/opt/zimbra/conf/salocal.cf
/opt/zimbra/conf/salocal.cf.in
/opt/zimbra/conf/spamassassin/local.cf

They all start with the comment
# This is the right place to customize your installation of SpamAssassin.


Thank you all for the help.

[uxbod]

You should not need to touch the 50_scores.cf file at all. Setting the following in salocal.cf.in

score FH_DATE_PAST_20XX 0.0

and then restarting Amavis using

su - zimbra
zmamavisdctl stop ; zmamavisdctl start

I believe will re-write the salocal.cf and tell Amavis to use the new score.