I just logged into my webmail account and had a uce setting in my inbox. I opened it up to manually reported it and noticed this.



Here is a link to the report:
http://www.spamcop.net/sc?id=z1123505239z8...bf199693535521z

Then, I went into my held mail folder, and opened up the first message there, and the headers showed it was filtered with Spamassassin 3.1.1. I noticed the news said that the sysops added some more filtering servers, so I assume that an older version of Spamassassin was installed on these?

The first email says filter7, the other email says blade, which is what it what it usually says.


http://www.spamcop.net/sc?id=z1123509382z1...d4dcbf34c338c1z

I also see a message from filter7 that has Spamassassin 3.1.0, so I assume that is what the problem is, the new filters have older copies of the software installed.

Just thought I'd let you guys know.

If you 'just logged on' then you should have also seen the recent 'news' postings on that front page. I thought I'd be nive and also bring them to the Forum, posting them as Pinned items so that they'd be easy to see by most, having to scroll by them ....

However, I can see that the efforts to lets folks now what's going on somehow mised your eyes ... I can't explain how you'd have missed the 'news' posting ... but the Pinned items here .. that's pretty easy .. you posted this into the Reporting Gelp Forum section .. but the subject matter deals with the SpamCop E-mail System & Account stuff ... with this post, I'm moving this Topic to that 'matching' Forum section ....

I'm sorry, I don't understand your response.





So, the purpose of my posting was to notify the administrators of SpamCop that there is an older version of SpamAssassin installed on the new filter servers. Is this the wrong place to post this?

You posted into SpamCop Discussion > Discussions & Observations > SpamCop Reporting Help

I moved the Topic into SpamCop Discussion > Discussions & Observations > SpamCop Email System & Accounts

The "Administrators of Spamcop" ..????
Section 8 - SpamCop's System & Active Staff User Guide
SpamCop Staff
Not finding the Help you need?

Tried to point out in several places that there is just the one guy handling the e-mail side of the house. The new servers were just placed on-line .. the first 'test' is to ensure that they are working, integrated, etc.

The 'whole' of a SpamAssassin install also includes options of other 'filter packs' .. langiage packs .. on and on ... these can be added in as time goes on.

Your posting 'here' does give a heads-up to other users (ignoring that it wasn't placed into the Forum that those dedicated to only "e-mail account" issues would stumble across it) .. so thanks for that. However, as a means of direct, instant contact to JT .. no, this won't work in general ....

That said, I did kick out an e-mail to advise him of your 'discovered problem' ...

The servers with "blade" in their names all seem to be running 3.1.1 (since about March 20th 2006), but I can confirm that two of the new boxes, "filter7" and "filter8" are running 3.1.0. However, I looked at some items that got through to my inbox overnight and on almost identical spam items, the "filter" servers actually had given a higher score than blade1 did, which is a bit counter-intuitive.

So, I looked into my Held Mail and did a little more analysis. I have six similar "Investment Strategy" spams (all identical subjects and almost identical spam bodies, except for the URLs). Here are the receipt times, server names, and SA analyses from these items:



There does seem to be a bit of inconsistency, and the "blade" servers came out ahead, specifically because the "filter" servers didn't seem to know about the "URIBL_BLACK" test that the blade servers identified. The only other difference was the the last one, processed by "filter7" is missing the "SARE_CSNUMTAG" flag, but it's possible that there was something different about that item.

So, I'd say this small, but carefully selected sample, might indicate that there's some work to be done to make the filtering on all of the servers equal to one another, but I'm speaking as a person who has never installed or configured SpamAssassin. :-)

Wazoo....wanna kick this to JT also, or should I send him an email?

DT

I found a little more inconsistency, though not a major one. blade2 and blade3 both present the FQDN in the X-Spam-Checker-Version: line. All the others simply present the server name.

It just seems to further indicate that the servers are all not using the same configuration file. I have never setup and configured a spamassassin server, but I have done other parallel processing systems and one thing I always made sure of is that each system was using the same configuration.

Wazoo, I assume you directed JT to this thread. Otherwise I will bring the information to JT's attention directly.

Believe it or not, thats a whole lot more difficult that it would seem especially as the number of servers increase and there are differences in the hardware configueration of each. So one trys to match them as close as possible, but working on a problem of one server and fixing that, then going to another problem and fixing that, one quickly finds that the result is a bunch of servers that are all setup somewhat differently.
In the ideal world one would buy ALL new equipment and set them up all the same, but in the REAL world that most of us live in, that is usually not possible. You are happy if you can just keep them all working.

No offense, but I work in the REAL world. It sounds like you need better change management policies. The "fix" is not done until all servers are updated, especially for a software configuration file, which I am assuming SpamAssassin is using. Some systems, we keep the master file on a fileserver and the server itself checks there for updates. OSes are a bit more difficult, especially if they have different functions.

Except that they don't, and I have proof, so Wazoo, please remove the "Resolved" from this topic. Here's why...

After some of us complained about stale SpamAssassin installations on "filter7" and "filter8" (the new servers), and an intial denial of any problem, the new servers have now been "leapfrogged" to a newer release of SA than the one on all the servers named "blade#." The "blade" servers still have "SpamAssassin 3.1.1 (2006-03-10)" (from March 2006) while the "filter#" servers both now have "SpamAssassin 3.1.4 (2006-07-26)" (from July). I checked the various download mirror sites, and it looks like there have been subsequent releases in August and October, although I'm not sure if I was looking at the correct repository or not.

As for the spam scoring ramifications, here are the scoring details on identical spams:

X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-26) on filter8
X-Spam-Level: ******************
X-Spam-Status: hits=18.1 tests=SARE_RMML_Stock4,UNPARSEABLE_RELAY,
URIBL_AB_SURBL,URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL,
URIBL_SC_SURBL,URIBL_WS_SURBL version=3.1.4

X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on blade1
X-Spam-Level: *****************
X-Spam-Status: hits=17.7 tests=SARE_RMML_Stock4,UNPARSEABLE_RELAY,
URIBL_AB_SURBL,URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL,
URIBL_SC_SURBL,URIBL_WS_SURBL version=3.1.1

These are both from "Subject: Investment Strategy" spams that have been arriving in droves in my Held Mail, so I have multiple copies for header analysis. I could show you the others, but they were all scored the same way by the various "blades" and "filters," with the "filters" now producing (slightly) higher scores. That contradicts the most recent message you've posted here from JT, Wazoo.

I sent my previous detailed info to JT last week and he didn't respond to me at all, no acknowledgement whatsoever, so I guess that instead of wasting my time sending it to him, I'll ask you to get his attention back on this once again. Tell him I'd be happy to share my latest evidence with him, if he would deign to send me an email.

Over and out,
DT

ps - not logging in here much lately due to some unfortunate treatment, but I'll check back in a few days for any response.

Back to check on this, as promised, but there's been no change on what I've seen from the servers. They still appear to be running different SA versions, and as I mentioned, I've not had any luck dealing directly with JT on this. Wazoo, have you pinged him again about this? Please?

DT

I got in touch directly with JT on this and he responded today. He acknowledged that the new servers are currently running a more recent update of SpamAssassin and said that the original servers would be updated at "some point" but they have to proceed carefully with that due to the possibility of service interruptions.

So, for the time being, identical spam messages may receive slightly different scores, depending upon which server happens to "answer the phone," but it's not a major problem, and is at least acknowledged, which is always nice. Being ignored isn't.

DT

Good to hear. Thanks for taking the time to help resolve the issue for us.

Seconded .... I can't conjure up replies whan I don't get answers either ....

Sorry if this is the wrong section, I wasn't sure if this should be under reporting or email, but since it seems to be an error in one of the receiving servers, I thought this was the appropriate place.

Today I have received 2 spam emails in my inbox that passed through filter8.cesmail.net and SpamAssassin isn't mentioned anywhere in the headers.


http://www.spamcop.net/sc?id=z1156864402z1...;action=display


http://www.spamcop.net/sc?id=z1156881419z3...;action=display

I haven't noticed this on another blade server, so it appears from what I've seen, to be isolated to this server. Don't know if it's been resolved or any other servers are affected, but hopefully can someone can forward this off to one of the deputies or server admins and check into this.

The last filter8 message I found was from yesterday and it did pass through SA at that time: http://www.spamcop.net/sc?id=z1155761790ze...1cf400786e27c0z

It looks like (if I am reading the timestamps correctly) that my messages were received after yours. I'll keep watching my inbox and heldmail folders and see if the issue comes up again. I did notice one email in my heldmail folder that passed through filter8, but was blocked by the SpamCop BL. It didn't have any SA markings though.

It is possible that SA is not working on that server. I will send a quick message to JT about it.

Thanks for that.

Here are two more examples on spams I just received. One was blocked by an external BL, the other went straight to my inbox. As you can see, both are on filter8. All other servers seem to be working fine.



http://www.spamcop.net/sc?id=z1157144227zb...;action=display



http://www.spamcop.net/sc?id=z1157158272z0...;action=display

I sent the email, no reply (yet, as expected).

And I got one a small bit ago, also missing the SA parts: http://www.spamcop.net/sc?id=z1157230039za...9c47ddb8588d6ez

P.S. TrackingURL's are sufficient as those interested can look up the info you are posting in addition.

Just received the following reply:

Since he is asking for more input, I am posting it here.

Hint: 2 lines of text and pointing him here for full explaination gets a faster response

As of sometime today, some of my incoming mail is no longer being filtered by SpamAssassin. I have verified that SA is still checked in my filter list, but the headers show no SA check is being done. Other messages coming in are SA-filtered.

Looking at the headers, if a message passed through blade4.cesmail.net, it gets filtered, but filter7.cesmail.net does not.

I can confirm this is happening again since at least yesterday. There was a time within the last month??? where this was happening. Sending an email off to JT to check things out.

http://www.spamcop.net/sc?id=z1182216992z6...0685baceac194az

PM sent to advise of the merging of this 'new' Topic into an existing one that addresses the same issue/solution ...

Yes, I was just coming here to report I noticed the same thing on filter7.

http://www.spamcop.net/sc?id=z1182611997z9...;action=display

It's been a number of days now
http://www.spamcop.net/sc?id=z1183038094z5...;action=display
http://www.spamcop.net/sc?id=z118303729...;action=display

Day before with SpamAssasin on example
http://www.spamcop.net/sc?id=z1183034019z2...;action=display

[Moderator edit - one mailsc converted to www - Farelf]

Hi!
...Since I am not a SpamCop e-mail subscriber, I won't be able to be of much help. However, I can tell you that you are the only user who is able to see the web pages whose URLs you posted, so please come up with another way to convey the information. Perhaps if you convert the reportid to a Tracking URL? There's a SpamCop FAQ entry that tells how to do that.
...Good luck!

Thanks fixed

This is being moved to the current thread on the same subject. No answer yet from JT.

Date: Tue, 02 Jan 2007 23:11:38 -0500

Arrgh! Yes, thanks, it's going again.

Jeff

Yes, things are back to normal. I had noticed the same thing, so I'm glad that you folks took care of it.

DT

Bad news! Now it seems that the SpamAssassin on "filter8.cesmail.net" isn't active. Some spams have been delivered straight to my inbox and they're missing these header lines:

X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-26) on filter8
X-Spam-Level:
X-Spam-Status:

The failure seems to have happened between "4 Jan 2007 15:03:00 -0000" and "4 Jan 2007 17:50:48 -0000"

Someone with a more direct line to JT should get his attention on this ASAP.

DT

Could someone PM the email address of the deputies and/or this individual JT, if possible? I wouldn't mind forwarding issues I come up with during SC usage to them, if they accept it from regular SC mail subscribers.

(@Wazoo: Sorry, I did check the FAQ but only saw a contact form for ISPs emailing the deputies)

Hi, jongrose!
...If you navigate to the "SpamCop Forum" click the link labeled "How can I contact a SpamCop representative?" you go to a page with a long list of links, including a section entitled "Other reasons for contact."
...JT's e-mail address is in Jeff G's first reply in SpamCop Forum thread "Unable to renew subscription."
...Good luck and thank you for volunteering!

I would love to get the specifics on this ....

Just which FAQ was looked at specifically?

The issue on this specific data item is now just so overdone (in my head at least)

the SpamCop FAQ "here"
in the Announcements section
in the Red-Lettered link to the 'Latest' stuff
in the Wiki
on the Portal
in the half-dozen other FAQ attempts that have been installed, removed, quit working, etc.
the countless postings which contain just that data

This is another one of those spots where I'm asking just how it could not be found .. remembering that some folks complain about too much Pinned data, FAQ has too much data, too many places tagged as "read first" .. on and on and on ...

and for the love of Gawd and all that's holy, I am not calling you stupid .... which seems to be the typical response to me asking this question .... it's just that this data exists in so many places, under several 'titles' .. it is just hard for me to come up with how it is not something that is easily found ..

ignoring the scenario in which when someone says "I checked 'the' FAQ" . they are talking about the Original/Official one that caused all these others to be created in the first place ....

Wazoo, relax, I was just joking with you. You always seem to be so serious and angry with everyone for not reading the FAQ.

So, just relax, you work to hard on these boards. I know how aggravating it can be to be a moderator. So, have a break once and a while.



Anyway, sorry if I pissed you off.

You have not pissed him off, but you also did NOT answer the question asked?

Exactly WHERE did you look for the email address before posting?

Hellooooooo! Anyone home???? Can we please get back to the issue at hand? The server I identified is still NOT doing any SA analysis on the mail it's handling. I sent an email yesterday to the "support" address and haven't heard back. That's why I asked for others to contact JT also, but nobody has mentioned doing so.

None of the messages that "filter8" has processed on my behalf since yesterday have been subjected to SA analysis....and that's supposed to be the current issue.

DT

David, Please clam down. Sometimes JT takes 2-3 days (or more) to get back to people. I have sent several messages to him and just sent another.

In my emails, I simply state what is wrong in the subject: Filter8-SpamAssassin not working?

And send a link to this conversation and thank him. Short and sweet.

Sorry, I've never cared much for clams, so I think I'll pass. ;-)


*If* he responds. I've had important messages go unanswered, but YMMV.


I did all that. I posted here to get others to do likewise, and didn't see any confirmation...until now...that anyone had done so. Instead, I saw more of the usual prattle about the multitude of FAQ and "read this" links....but I'm calm. :-)

DT

SpamAssasin still not checking some email
http://www.spamcop.net/sc?id=z1185280394z3...7ebdfd43f19ea3z

...One of the nice things about web-based forums like this (also newsgroups, although the ones I've used seem less prone to it) is that if one wishes, one can go off on little side tangents and someone else can come along and pull the conversation back to the main point! <g>

On January 3 when that message you replied to was posted, it (filter7 which we were talking about there) was working again because JT had just fixed it. It is still working as far as I can see. filter8 was also working at least an hour after that post was made (Jan 3 2007, 01:10 PM EST).

SpamAssassin has been up and down on filter7 and 8 sporadically since the new year. Currently, filter8 appears to be off and that is the message I last sent to JT:

These are all EST
filter8 with spamassassin
14:00 1/3/2007
18:02 1/2/2007
13:34 1/2/2007

filter8 without spamassassin
22:14 1/4/2007

filter7 with spamassassin
08:42 1/5/2007
09:21 1/4/2007
04:06 1/4/2007
20:01 1/3/2007
10:19 1/3/2007
08:32 1/3/2007
23:11 1/2/2007
16:59 1/1/2007

filter7 without spamassassin
20:04 1/2/2007
07:39 1/2/2007

Not any longer. Many hours ago, I posted this response in the other topic about this:

http://forum.spamcop.net/forums/index.php?...ost&p=52976

SA was restored on "filter8" a few hours after petzl's message, and I never heard back from JT. My two paid email accounts are up for renewal, and this kind of thing (the lack of response) makes me consider whether I should bother to renew them or not.

DT

Seems the spam leakage has stopped (knock wood) I think it was a combination of SCBL not being updated and SpamAssasin (SA) missing a beat (I have SA set at 5)

Actually, I can't find now where it was. I did a search on all the forum sections for "deputies" and I believe I came to an sticky/faq post that had a link to contact the deputies through an online web form, which said it was for ISPs to contact the deputies - which I didn't notice until after I had sent the email.

Anyway, sorry for going O/T.

SA is kaput on filter7 (?)


http://www.spamcop.net/sc?id=z1197519570z6...35b98613eb9ba0z

Yes, confirmed. It seems to have died this morning, sometime between 9:30 and 10:00 am PST. I'll try to send a message to JT, but others (Steven U and Wazoo, maybe more) seem to have their messages opened by JT right away. Let's all send a message to support at cesmail.net and see who gets his attention first....the shotgun approach. :-)

DT

blade4 is also not running SA.