upgraded to 4.5 (OS edition), now no dspam?

[shaver]

I upgraded from 4.0.3 to 4.5 last night, and found this morning that a _ton_ of spam was getting through. Comparing headers I noticed that the new spam doesn't have any of the X-DSPAM-* stuff, and then I found this in my zimbra.log:

Jan 17 20:00:57 zimbra amavis[12120]: No $dspam, not using it

Is this an intentional change? What should I be doing to catch spam now, since it seems the dspam was doing most of the heavy lifting before! I'm going to turn it back on and see if that helps make people's inboxes usable again, but I'd love to know if others have experienced this (the major increase in spam, and/or the dspam disabling).

Mike

[phoenix]

I haven't noticed any extra spam but I've just checked through my logs and I've got the same message. That message is also in the RC version logs as well.

[phoenix]

It seems to be disabled by default. If you want to enable it have a look in /opt/zimbra/conf/amavisd.conf.in for the line

#$dspam = '/opt/zimbra/dspam/bin/dspam';

and uncomment it and then

zmamavisdctl stop
zmamavisdctl start

to save you doing a restart.

[anand]

We noticed that many people were running into dspam performance isssues.

See:

http://bugzilla.zimbra.com/show_bug.cgi?id=12185

[shaver]

Originally Posted by phoenix

It seems to be disabled by default. If you want to enable it have a look in /opt/zimbra/conf/amavisd.conf.in for the line

#$dspam = '/opt/zimbra/dspam/bin/dspam';

and uncomment it and then

zmamavisdctl stop
zmamavisdctl start

to save you doing a restart.

Yeah, I did that and I'm _still_ getting a ton more spam than I was with 4.0.3. I think I'm going to have to roll back, because it's basically unusable as it is, and I can't see what to change to have it start blocking usefully again.

Thanks for the help, though!

Mike

[phoenix]

I'd suggest you investigate the problem with 4.5 rather than roll-back. What's in the headers of the spam you're seeing? Are you sure all the zimbra services are running?

[shaver]

Originally Posted by phoenix

I'd suggest you investigate the problem with 4.5 rather than roll-back. What's in the headers of the spam you're seeing? Are you sure all the zimbra services are running?

All the services are shown as running, yeah.

Here's a strange case that a user reported to me, identical messages with 4.0.3 and 4.5:

4.0.3:
X-Spam-Flag: YES
X-Spam-Score: 4
X-Spam-Status: Yes, score=4 tagged_above=-10 required=4 tests=[BAYES_99=3.5, DSPAM_SPAM=0.5]

4.5:
X-Spam-Flag: YES
X-Spam-Score: 8.596
X-Spam-Status: Yes, score=8.596 tagged_above=-10 required=4 tests=[BAYES_50=0.001, DSPAM_SPAM=1.5, URIBL_JP_SURBL=4.087, URIBL_OB_SURBL=3.008]

In the 4.5 case it went into the user's inbox, and in the 4.0.3 case it didn't. After he closed the message and it reloaded the inbox, though, it was gone and is now in the Junk folder. Very strange.

Another header from 4.5 with a more obvious problem:
X-Spam-Status: No, score=3.915 tagged_above=-10 required=4 tests=[BAYES_50=0.001, DSPAM_SPAM=1.5, FORGED_RCVD_HELO=0.135, RCVD_IN_BL_SPAMCOP_NET=1.558, RCVD_IN_NJABL_PROXY=0.721]

Even with the dspam bump of 1.5, it's still below the threshold, and without that it wouldn't even be close. Where did the BAYES_99 stuff go, I wonder?

Is there a way to reprocess inboxes for spam post facto? Users are getting like 10x the spam they were before, and if I don't figure it out pretty soon I'm going to have to roll back until I have more time to investigate it.

Mike

[phoenix]

Are you sure the spam training accounts are there? Have a look in the admin UI and see if they show up.

[shaver]

Originally Posted by phoenix

Are you sure the spam training accounts are there? Have a look in the admin UI and see if they show up.

Yeah, they're there. But even if they weren't, wouldn't that only prevent it from adapting, and not make the _current_ filtering worse?

Mike

[anand]

Looks like your Bayes database is not being used:

4.0.3: BAYES_99=3.5
4.5: BAYES_50=0.001

Did the upgrade for some reason lose your Bayes DB?

That would be a major bug.

Let me ask around here if anyone knows why this would happen.