No DSPAM headers

[carverrn]

I've gotten about a dozen or so messages today that are flagged as SPAM by SpamAssassin but are missing DSPAM headers. Is there a problem with DSPAM?

Oh ... I also found these messages in the headers:

8594: [1/11/2005 3:51:12] Too many connections
8594: [1/11/2005 3:51:12] process_message returned error -2. delivering message.

Regards,
Rich

[Geir]

The Dspam server (Laika) is starting to feel the pressure during peak hours or when we clean the Dspam database of old or irrelevant tokens.

We'll try to tweak the setup a bit and upgrade the server if it becomes necessary.

- Geir

[50ftQueenie]

Does the upgrading also involve fixing (see also: http://www.emaildiscussions.com/...ighlight=50ftq)
the DSPAM error 22 lines?

I accidentally received spam messages with these lines from December 19 until January 5.

On another note: should I treat spam messages with any error lines by DSPAM as spam or not?

Sorry if this has been already fixed, but I thought it was worth mentioning it.

Regards,
50ftQ.

[carverrn]

Jan already said they addressed that probem in the same thread:

We have installed a patched version of DSPAM on our servers today, so the problem should be fixed. Please tell me if you still get error messages.

I think the current problem is that their DSPAM setup can't handle the load during peek times. Which would explain the "Too many connections" error message in my headers.

Regards,
Rich

[50ftQueenie]

Hi Rich,

Thank you for posting your reaction.

Jan already said they addressed that probem in the same thread:

Well he posted that on December 8, but from December 19 on the problem seems to be back, but maybe only in my case. Judging from your reaction you didn't receive those error messages ever since December 8?

These are the headings of the last e-mail received on January 5:

From Beasley@indiatimes.com Wed Jan 05 17:33:44 2005
Return-path: <Beasley@indiatimes.com>
Received: from exim by fetch.runbox.com with spamfilter (Exim 4.34)
id 1CmE6Q-0008EI-Uy
for xxxxx@runbox.com; Wed, 05 Jan 2005 17:33:44 +0100
31642: [1/5/2005 17:33:43] received invalid result (! DSR_ISSPAM || DSR_INNOCENT || DSR_ISWHITELISTED): 22
31642: [1/5/2005 17:33:43] process_message returned error 22. delivering message.
Received: from [61.52.125.53] (helo=193.71.199.94)
by fetch.runbox.com with smtp (Exim 4.34)
id 1CmE6A-0007Ut-QX; Wed, 05 Jan 2005 17:33:33 +0100
Received: (from @61.52.125.53)
by .60.48.248.112 (.[2
X-DSPAM-Result: Innocent
X-DSPAM-Confidence: 0.0000
X-DSPAM-Probability: -1.0000
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on fetch.runbox.com
X-Spam-Status: No, score=3.9 required=5.0 tests=MISSING_DATE,MISSING_SUBJECT,
RCVD_DOUBLE_IP_LOOSE,RCVD_HELO_IP_MISMATCH,RCVD_IN_SORBS_DUL,
RCVD_NUMERIC_HELO autolearn=disabled version=3.0.1
X-Spam-Level: ***
Message-Id: <E1CmE6Q-0008EI-Uy@fetch.runbox.com>
From: Beasley@indiatimes.com
Date: Wed, 05 Jan 2005 17:33:44 +0100

So, actually when you break down the information in the message, it would indicate the following:
DSR_ISSPAM || (which is true)
DSR_INNOCENT || (ehm...)
DSR_ISWHITELISTED (not whitelisted by me; I could not find an entry or part in the above headers which were defined by myself in my filters that would make this e-mail delivered into my Inbox).

I think the current problem is that their DSPAM setup can't handle the load during peek times. Which would explain the "Too many connections" error message in my headers.

That makes perfectly sense of course, but I actually meant that I don't know what to do when I receive a message like the one I posted the headers from above.

Regards,
50ftQ.

[Geir]

Originally posted by carverrn
I think the current problem is that their DSPAM setup can't handle the load during peek times. Which would explain the "Too many connections" error message in my headers.

We believe it's mainly a configuration issue short term, and we're trying different things to find the right balance between speed and filter performance.

The "Error 22" header was debug information and is no longer output. The underlying problem will be fixed once a patch is available.

- Geir

[50ftQueenie]

Thank you for your quick response and explanation, Geir!

Kind regards,
50ftQ.

[carverrn]

So far 8 more today with these errors:

4120: [1/12/2005 18:1:46] Lost connection to MySQL server during query

6028: [1/12/2005 17:57:32] Too many connections


There were 18 yesterday.

Rich

[tore]

Originally posted by carverrn
So far 8 more today with these errors:

I belive I've fixed this permanently now (if DSPAM fails it should now retry later rather than deliver unscanned). Let me know it you notice a discrepancy between this claim and reality..

Tore

[carverrn]

Hi Tore,

Does "retry later" mean that it simply requeues the message for delivery or is there a fixed retry time?

Rich

[carverrn]

I received 2 more messages with no DSPAM header in them today. Both had SpamAssassin headers but no DSPAM headers.

One arrived "Sun Jan 16 21:14:36 2005" the other arrived "Sun Jan 16 21:23:12 2005".

Regards,
Rich

[carverrn]

Another one at Mon Jan 17 03:02:14 2005.

Rich

[50ftQueenie]

Originally posted by carverrn
I received 2 more messages with no DSPAM header in them today. Both had SpamAssassin headers but no DSPAM headers.

One arrived "Sun Jan 16 21:14:36 2005" the other arrived "Sun Jan 16 21:23:12 2005".

Yesterday I received 2 messages scanned by SpamAssassin, but lacking the DSPAM headers as well.

Checking the headers you can see the difference between the time the message was originally retrieved by the Runbox server with smtp and the time it was retrieved by the Runbox server with spamfilter.

Message 1:
Received: from exim by bolivar.runbox.com with spamfilter (Exim 4.34)
id 1CqGrP-0004ai-Hr
for xxx@runbox.com; Sun, 16 Jan 2005 21:19:01 +0100
Received: from [218.39.95.25] (helo=HH-8JM47TJ2T5SX)
by bolivar.runbox.com with smtp (Exim 4.34)
id 1Cpj1p-0002DZ-Fw; Sat, 15 Jan 2005 09:11:26 +0100

Message 2:
Received: from exim by lassie.runbox.com with spamfilter (Exim 4.34)
id 1CqGsi-00049m-Ri
for xxx@runbox.com; Sun, 16 Jan 2005 21:20:19 +0100
Received: from [83.166.192.145] (helo=FLAVIA)
by lassie.runbox.com with smtp (Exim 4.34)
id 1CqDkA-0002g5-PN; Sun, 16 Jan 2005 17:59:15 +0100

I just wonder: does this mean that when a message could not be scanned for some reason, it would not be retrieved (i.e. by your own e-mailclient) until it is scanned? And if so, does this also affect whitelisted e-mailadresses and could these be delayed for that same reason?

Regards,
50ftQ.

[carverrn]

I'm still getting a few messages checked by SpamAssassin but not by DSPAM. Should this still be happening?

Rich

[carverrn]

Ahh ... I've got a bunch of messages that weren't checked by SpamAssassin either.

Did you guys shut off the spam filters to let the message queue catch up?

Rich