Zimbra offers Open Source email server software and shared calendar for Linux and the Mac
Go Back   Zimbra :: Forums > Zimbra Collaboration Suite > Administrators

Welcome to the Zimbra :: Forums!
Welcome, if you would like to post a comment please register. We also encourage you to explore all things Zimbra with our team and members of the community.

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #1 (permalink)  
Old 01-18-2007, 11:45 AM
Intermediate Member
 
Posts: 24
Unhappy upgraded to 4.5 (OS edition), now no dspam?

I upgraded from 4.0.3 to 4.5 last night, and found this morning that a _ton_ of spam was getting through. Comparing headers I noticed that the new spam doesn't have any of the X-DSPAM-* stuff, and then I found this in my zimbra.log:

Jan 17 20:00:57 zimbra amavis[12120]: No $dspam, not using it

Is this an intentional change? What should I be doing to catch spam now, since it seems the dspam was doing most of the heavy lifting before! I'm going to turn it back on and see if that helps make people's inboxes usable again, but I'd love to know if others have experienced this (the major increase in spam, and/or the dspam disabling).

Mike
Reply With Quote
  #2 (permalink)  
Old 01-18-2007, 12:43 PM
Zimbra Consultant & Moderator
 
Posts: 20,314
Default

I haven't noticed any extra spam but I've just checked through my logs and I've got the same message. That message is also in the RC version logs as well.
__________________
Regards


Bill
Reply With Quote
  #3 (permalink)  
Old 01-18-2007, 12:53 PM
Zimbra Consultant & Moderator
 
Posts: 20,314
Default

It seems to be disabled by default. If you want to enable it have a look in /opt/zimbra/conf/amavisd.conf.in for the line
Code:
#$dspam = '/opt/zimbra/dspam/bin/dspam';
and uncomment it and then
Code:
zmamavisdctl stop
zmamavisdctl start
to save you doing a restart.
__________________
Regards


Bill
Reply With Quote
  #4 (permalink)  
Old 01-18-2007, 01:44 PM
Zimbra Employee
 
Posts: 274
Default

We noticed that many people were running into dspam performance isssues.

See:

http://bugzilla.zimbra.com/show_bug.cgi?id=12185
__________________
Bugzilla - Wiki - Downloads - Before posting... Search!
Reply With Quote
  #5 (permalink)  
Old 01-19-2007, 09:39 AM
Intermediate Member
 
Posts: 24
Unhappy

Quote:
Originally Posted by phoenix View Post
It seems to be disabled by default. If you want to enable it have a look in /opt/zimbra/conf/amavisd.conf.in for the line
Code:
#$dspam = '/opt/zimbra/dspam/bin/dspam';
and uncomment it and then
Code:
zmamavisdctl stop
zmamavisdctl start
to save you doing a restart.
Yeah, I did that and I'm _still_ getting a ton more spam than I was with 4.0.3. I think I'm going to have to roll back, because it's basically unusable as it is, and I can't see what to change to have it start blocking usefully again.

Thanks for the help, though!

Mike
Reply With Quote
  #6 (permalink)  
Old 01-19-2007, 09:47 AM
Zimbra Consultant & Moderator
 
Posts: 20,314
Default

I'd suggest you investigate the problem with 4.5 rather than roll-back. What's in the headers of the spam you're seeing? Are you sure all the zimbra services are running?
__________________
Regards


Bill
Reply With Quote
  #7 (permalink)  
Old 01-19-2007, 09:59 AM
Intermediate Member
 
Posts: 24
Default

Quote:
Originally Posted by phoenix View Post
I'd suggest you investigate the problem with 4.5 rather than roll-back. What's in the headers of the spam you're seeing? Are you sure all the zimbra services are running?
All the services are shown as running, yeah.

Here's a strange case that a user reported to me, identical messages with 4.0.3 and 4.5:

4.0.3:
X-Spam-Flag: YES
X-Spam-Score: 4
X-Spam-Status: Yes, score=4 tagged_above=-10 required=4 tests=[BAYES_99=3.5, DSPAM_SPAM=0.5]

4.5:
X-Spam-Flag: YES
X-Spam-Score: 8.596
X-Spam-Status: Yes, score=8.596 tagged_above=-10 required=4 tests=[BAYES_50=0.001, DSPAM_SPAM=1.5, URIBL_JP_SURBL=4.087, URIBL_OB_SURBL=3.008]

In the 4.5 case it went into the user's inbox, and in the 4.0.3 case it didn't. After he closed the message and it reloaded the inbox, though, it was gone and is now in the Junk folder. Very strange.

Another header from 4.5 with a more obvious problem:
X-Spam-Status: No, score=3.915 tagged_above=-10 required=4 tests=[BAYES_50=0.001, DSPAM_SPAM=1.5, FORGED_RCVD_HELO=0.135, RCVD_IN_BL_SPAMCOP_NET=1.558, RCVD_IN_NJABL_PROXY=0.721]

Even with the dspam bump of 1.5, it's still below the threshold, and without that it wouldn't even be close. Where did the BAYES_99 stuff go, I wonder?

Is there a way to reprocess inboxes for spam post facto? Users are getting like 10x the spam they were before, and if I don't figure it out pretty soon I'm going to have to roll back until I have more time to investigate it.

Mike
Reply With Quote
  #8 (permalink)  
Old 01-19-2007, 10:48 AM
Zimbra Consultant & Moderator
 
Posts: 20,314
Default

Are you sure the spam training accounts are there? Have a look in the admin UI and see if they show up.
__________________
Regards


Bill
Reply With Quote
  #9 (permalink)  
Old 01-19-2007, 11:29 AM
Intermediate Member
 
Posts: 24
Default

Quote:
Originally Posted by phoenix View Post
Are you sure the spam training accounts are there? Have a look in the admin UI and see if they show up.
Yeah, they're there. But even if they weren't, wouldn't that only prevent it from adapting, and not make the _current_ filtering worse?

Mike
Reply With Quote
  #10 (permalink)  
Old 01-19-2007, 01:51 PM
Zimbra Employee
 
Posts: 274
Default

Looks like your Bayes database is not being used:

4.0.3: BAYES_99=3.5
4.5: BAYES_50=0.001

Did the upgrade for some reason lose your Bayes DB?

That would be a major bug.

Let me ask around here if anyone knows why this would happen.
__________________
Bugzilla - Wiki - Downloads - Before posting... Search!
Reply With Quote
Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


Similar Threads

Why Join?

Registering let's you ask questions, makes it easier to search, displays any files attached to posts, and notifies you about replies.

blog.zimbra.com




 

SEO by vBSEO ©2011, Crawlability, Inc.