DSPAM issue - Doesn't work.

[blusowiec]

Hello,

I have problem with DSPAM, but without any reasons... :(

X-DSPAM-Result: Spam
X-DSPAM-Class: Spam
X-DSPAM-Confidence: 0.59
X-DSPAM-Probability: 0.9955
X-DSPAM-Signature: N/A
X-Virus-Scanned: amavisd-new at zeus.******.com
X-Spam-Flag: YES
X-Spam-Score: 9.112
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.112 tagged_above=-10 required=5
tests=[BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, DKIM_SIGNED=0.1,
FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, NML_ADSP_CUSTOM_MED=0.9,
NO_RECEIVED=-0.001, NO_RELAYS=-0.001, RFC_ABUSE_POST=0.001,
T_DKIM_INVALID=0.01, DSPAM:Spam=10.000] autolearn=no


Few days ago I made dist-upgrade, and restart was required.
After restart I have issue with DSPAM. All of my emails going to SPAM.

Zimbra: Release 7.1.1_GA_3196.UBUNTU10_64 UBUNTU10_64 FOSS edition.

Does anybody have any idea whats the problem all about??
What can I do to fix this?

Thanks for help
Blusowiec

[blusowiec]

Some additional logs:

X-DSPAM-Result: Spam
X-DSPAM-Class: Spam
X-DSPAM-Confidence: 0.99
X-DSPAM-Probability: 1.0000
X-DSPAM-Signature: N/A
X-Virus-Scanned: amavisd-new at zeus.ultimatravel.com
X-Spam-Flag: NO
X-Spam-Score: 5.182
X-Spam-Level: *****
X-Spam-Status: No, score=5.182 tagged_above=-10 required=6.6
tests=[BAYES_00=-1.9, DEAR_SOMETHING=1.973, DKIM_SIGNED=0.1,
HTML_MESSAGE=0.001, NO_RECEIVED=-0.001, NO_RELAYS=-0.001,
T_OBFU_DOC_ATTACH=0.01, DSPAM:Spam=5.000] autolearn=no

$ zimbra.log

Dec 10 09:08:58 zeus amavis[25496]: (25496-03) TIMING [total 3435 ms] - SMTP greeting: 1 (0%)0, SMTP EHLO: 1 (0%)0, SMTP pre-MAIL: 1 (0%)0, lookup_ldap: 8 (0%)0, SMTP pre-DATA-flush: 1 (0%)0, SMTP DATA: 51 (1%)2, check_init: 0 (0%)2, digest_hdr: 2 (0%)2, digest_body_dkim: 971 (28%)30, gen_mail_id: 2 (0%)30, mime_decode: 43 (1%)31, get-file-type10: 15 (0%)32, decompose_part: 2 (0%)32, parts_decode: 1 (0%)32, check_header: 2 (0%)32, AV-scan-1: 119 (3%)35, spam-wb-list: 1 (0%)36, SA parse: 15 (0%)36, SA check: 2057 (60%)96, DSPAM: 41 (1%)97, update_cache: 1 (0%)97, decide_mail_destiny: 1 (0%)97, fwd-connect: 7 (0%)97, fwd-mail-pip: 6 (0%)97, fwd-rcpt-pip: 0 (0%)97, fwd-data-chkpnt: 0 (0%)97, write-header: 1 (0%)97, fwd-data-contents: 20 (1%)98, fwd-end-chkpnt: 56 (2%)100, prepare-dsn: 1 (0%)100, main_log_entry: 7 (0%)100, SMTP pre-response: 0 (0%)100, SMTP response: 0 (0%)100, unlink-10-files: 1 (0%)100, rundown: 1 (0%)100

$ dspam_stats
TP True Positives: 593
TN True Negatives: 0
FP False Positives: 0
FN False Negatives: 0
SC Spam Corpusfed: 0
NC Nonspam Corpusfed: 0
TL Training Left: 2492
SHR Spam Hit Rate 100.00%
HSR Ham Strike Rate: 100.00%
PPV Positive predictive value: 100.00%
OCA Overall Accuracy: 100.00%

Any ideas?
Blusowiec

[blusowiec]

I did some looking around and found that the /opt/zimbra/data/dspam/z/i/zimbra/zimbra.sig dir is huge - > 160MB.

[bofh]

Hello,

ife got the same problem - i guess i damaged my database and im going to reset hole dspam

maybe your dspam database courroped cause youved used 2 differend dspam modes - bevore and after teh upgrade - so i recommed backup dspam data and dspam conf bevore upgrade and restore it after

the sig dir should be big

please dig into dspam more to find out which settings are best for your setup

dspam is a very complicated thing it would blow up this thread to go more specific

so refer to dspam manual about filtering method try what you think its best for you delete all files everything within data/dspam but not the directorys

maybe restart zimbra but as far as i know this isnt nessesary cause dspam in the nondaemon mode initialises with the next mail new

[bofh]

WAIT a second


Allright i got the answer
Problem is zimbra hasnt compiled in latest dspam - they using an very old "stable" release -
problem with dpsam is they not doing much releases so its really nessesary to use the latest git snapshop to have it useable
- i think a fault from both sides


thing is zimbra also dindt add any cleaning tools to the crontab which are nessesary so after a while dpsam stop working at all
but you cant use those tools anyway because they got a bug so you need to recompile the latest version yourself

dspam_clean locking up

heres another thread about it and very usefull as i think
this should be the solution


i know its a lot of effort but believe me its worth it
im running dspam on regular mailserver for years (but i use mysql instead of hash)



of course theres another way too:
you could reconfig dspam to use mysql - those cleauptools will work properly
but theres a downside - you gonna need a lot more resources
because dspam is not running in daemonmode - so it will make a dbconnect each time you analyse a mail
it eats up also a bit more diskspace and performance is slower

advantage is you can do a cleanup by using a mysqlscript and do not recompile dspam yourself to get proper cleanuptools

[bofh]

allright i made a short howto
DSPAM and zcs 7.x HowTo

after this i recommend to delete the data/dspam/data/z/i/zimbra directory and start from scratch