[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Spamassassin hanging/dieing



Hi folks.

I had a FC4 system running exim, clamd.exim and spamassassin. A over 
christmas/new year the server started hanging. 

I took the opportunity to move email to a separate server and built a new FC5 
system just for email.  I'm still using exim, clamd.exim and spamassassin, 
having installed everything from rpms, and copied over the exim.conf and 
local.cf from the old server.

It's still dieing on a regular basis. Looking at top, spamd processes seem to 
be hogging the machine, with clamd.exim processes coming a not very close 
second.

Both real and virtual memory look fine, but CPU usage goes to around 99.7%

I've not changed exim.conf in months, and haven't changed local.cf in a while.  
I've included it below.  All other files have not ben touched and as of the 
rpms.

(The auto_whitelist and auto_learn arn't working either, complainin about file 
permissions, but I don't think they're affecting performance - I could be 
wrong)
# These values can be overridden by editing ~/.spamassassin/user_prefs.cf 
# (see spamassassin(1) for details)

# These should be safe assumptions and allow for simple visual sifting
# without risking lost emails.

version_tag rgw_2.1.28
required_score 12
report_safe 1
rewrite_header Subject [SPAM]
whitelist_from * ford com unspam ringways co uk
trusted_networks 127.
trusted_networks 10.
lock_method flock

auto_whitelist_path	/var/spool/spamassassin/auto-whitelist
auto_whitelist_file_mode   0666
auto_whitelist_factor   0.5
bayes_path		/var/spool/spamassassin/bayes
bayes_file_mode		0666
bayes_auto_learn_threshold_nonspam      1
bayes_auto_learn_threshold_spam         9.0

#use_dcc			0
#use_razor2		0
#score RAZOR2_CHECK	0
#score DCC_CHECK		0
#score PYZOR_CHECK	0


ok_locales	en

# rescore standard tests
score EXCUSE_3           	1
score FORGED_OUTLOOK_TAGS	2
score DRUGS_ERECTILE_OBFU	2.5
score HTML_OBFUSCATE_05_10	2.0
score NIGERIAN_BODY2		2
score DRUGS_ERECTILE		2.5
score MISS_SPELLED_DRUGS        6

# local tests

header __YG_STEAM	Envelope-to =~ /steam\ stainburn com/
header __YG_LISTID	List-Id =~/yahoogroups.com/
meta YAHOOGROUP		(( __YG_STEAM + __YG_LISTID ) > 1)
describe YAHOOGROUP	A subscribed Yahoo Group
score YAHOOGROUP	-100

header PHARM		Subject =~ /ph*arm*ac*y/i
describe PHARM		Subject contains pharmacy
score PHARM		3

header NEWAC		Subject =~ /new account/i
describe NEWAC		Email looks to be a Phish
score NEWAC		2

header STOX		Subject =~ /(STOX|bad debt|got debt)/i
describe STOX		Subject contains the  bad keywords
score STOX		7

header GOOD_TLD		From=~/\.(com|co\.uk|org|org\.uk)[>, ]/
describe GOOD_TLD	TLD is a good one
score GOOD_TLD		0

header BAD_TLD		From=~/\.(tv|br|ru|ch|biz|info)[>, ]/
describe BAD_TLD	TLD not is a good one
score BAD_TLD		2

header LAKESIDE		Subject =~ /lakeside cafe/i
describe LAKESIDE	Email is from the Lakeside Cafe Thread
score LAKESIDE		9

header BADFROM		From=~/(michaelmoffet|emailfactory|247.info)/
describe BADFROM	From contains a known SPAMMER
score BADFROM		5

header STEVECUMMINGS	To=~/steve.cummings/i
describe STEVECUMMINGS	One of the targets is Steve Cummings
score STEVECUMMINGS	15

body  __LOTTERY_1	/\blottery\b/i
body  __LOTTERY_2	/\bticket\b/i
body  __LOTTERY_3	/\bdraw\b/i
body  __LOTTERY_4	/\bprize\b/i
body  __LOTTERY_5	/\bemail (address|id)\b/i
body  __LOTTERY_6	/\bballot\b/i
body  __LOTTERY_7	/\bwinning\b/i
body  __LOTTERY_8	/\bnotification\b/i
meta MYLOTTERY		((__LOTTERY_1 +__LOTTERY_2 +__LOTTERY_3 +__LOTTERY_4 
+__LOTTERY_5 +__LOTTERY_6 +__LOTTERY_7 +__LOTTERY_8 ) > 4)
describe MYLOTTERY	A possible Lottery scam
score MYLOTTERY		6

header MEDICA		Subject =~ /medica/i
describe MEDICA		Subject contains medical reference
score MEDICA		2

header	__TRADEMAIL_FROM From =~/TradeMail/
header	__TRADEMAIL_TO	To =~/TradeMail/
describe TRADEMAIL	SPAM email about available used cars
score TRADEMAIL		10 


# # Cheap software
# full __BODY_PHOTOSHOP	/\bphotoshop\b/i
# full __BODY_WINDOWS	/\bwindows\b/i
# full __BODY_OFFICE	/\b(microsoft|ms) office\b/i
# full __BODY_XP		/\bXP\b/i
# full __BODY_OFFICE	/\boffice\b/i
# full __BODY_OEM		/\boem\b/i
# full __BODY_CHEAP	/\bcheap\b/i
# full __BODY_OFFER	/\boffer\b/
# full __BODY_DOWNLOAD	/\bdownload\b/
# full __BODY_SOFT	/\bs[0o]ftware\b/
# full __BODY_LOW_PRICE	/\blow\s*(cost|price)\b/i
# full __BODY_VEND1	/\bmicrosoft\b/i
# full __BODY_VEND2	/\bnorton\b/i
# full __BODY_VEND3	/\bcorel\b/i
# full __BODY_VEND4	/\badobe\b/i
# full __BODY_VEND5	/\bmacromedia\b/i
# full __BODY_VEND6	/\bMS\b/i
# meta SOFTWARE_OFFER	
((__BODY_VEND1+__BODY_VEND2+__BODY_VEND3+__BODY_VEND4+__BODY_VEND5+__BODY_VEND6+__BODY_LOW_PRICE+__BODY_OEM 
+__BODY_CHEAP + __BODY_PHOTOSHOP + __BODY_WINDOWS +__BODY_OFFICE + __BODY_XP 
+ __BODY_OFFICE +__BODY_SOFT+ __BODY_DOWNLOAD +__BODY_OFFER) > 4)
# describe SOFTWARE_OFFER	email contains offer of cheap software
# score SOFTWARE_OFFER	12
# 
# bogus ebay
header __EBAY_FROM	From:addr=~/ebay.co/
header __EBAY_REC	Received=~/ebay.co/
meta   BOGUS_EBAY	(__EBAY_FROM && !__EBAY_REC)
describe BOGUS_EBAY	Bogus eBay message - Not from their server
score BOGUS_EBAY	8.0

# bogus paypal
header __PAYPAL_FROM	From=~/\ paypal com[> ]*$/
header __PAYPAL_REC	Received=~/paypal.com/
meta   BOGUS_PAYPAL	(__PAYPAL_FROM && !__PAYPAL_REC)
describe BOGUS_PAYPAL	Bogus Paypal message - Not from their server
score BOGUS_PAYPAL	8.0


# bugus investment

body __INVEST_BODY	/investment/i
header __INVEST_HEAD	Subject =~ /invest/i
meta __INVEST		(__INVEST_BODY || __INVEST_HEAD )
body __OPORT_BODY	/oportunity/i
header __OPORT_HEAD	Subject =~ /oportunity/i
meta __OPORT		(__OPORT_BODY || __OPORT_HEAD)
meta INVESTMENT		(__OPORT && __INVEST)
describe INVESTMENT	Possible investment invitation
score INVESTMENT	8

header __STOCK_HEAD	Subject =~ /\bhot\b.*\bst[0o]ck\b/i
body __STOCK_BODY	 /\bhot\b.*\bstock\b/i
meta __STOCK		( __STOCK_BODY || __STOCK_HEAD)
body __SYMBOL		/S{1,2}(my|ym)b{1,2}o{1,2}l{1,2}:/i
body __PRICE		/P{1,2}r{1,2}i{1,2}c{1,2}e{1,2}:/i
meta __STOCK_QUOTE	(__SYMBOL && __PRICE)
meta INVESTMENT_2	(__STOCK || __STOCK_QUOTE)
describe INVESTMENT_2	reference to stock exchange symbol and price
score INVESTMENT_2	12
 
# if listed on >2 RBLs, less likely to be false, so increase score
meta MULTI_BL_LISTS	((URIBL_WS_SURBL+URIBL_JP_SURBL 
+URIBL_AB_SURBL+URIBL_WS_SURBL+RCVD_IN_XBL+RCVD_IN_BL_SPAMCOP_NET+RCVD_IN_SORBS_DUL+DNS_FROM_RFC_POST+DNS_FROM_RFC_ABUSE+RCVD_IN_NJABL_DUL+RCVD_IN_DSBL) 
> 1)
describe MULTI_BL_LISTS increase the score if in multiple RBL
score MULTI_BL_LISTS	 5

# if erectile drugs and *instant* or enhance
body __DRUGS_ENHANCE	/(enhance|improve|longer|harder|stamina)/
meta DRUGS_BETTER	(DRUGS_ERECTILE && __DRUGS_ENHANCE)
describe DRUGS_BETTER	Contains reference to improved performance
score DRUGS_BETTER	7.0

# # miss-spelled drugs
# full MISS_SPELLED_DRUGS	/(probecia|v.{1,5}gra|paxpl|v.lium|ci.lis|Letitra|
sema|merixia|xasax|ambiei)/i
# describe MISS_SPELLED_DRUGS	Contained obfusticated drugs (spelling wrong)
# score MISS_SPELLED_DRUGS	10.0
# 
#Ttip Ttop etc
body TIP_TOP		/t{1,2}i{1,2}p{1,2} {1,2}t{1,2}o{1,2}p{1,2} 
{1,2}e{1,2}q{1,2}u{1,2}i{1,2}t{1,2}i{1,2}t{1,2}i{1,2}e{1,2}s{1,2}/i
describe TIP_TOP	SPAM stock broker emails
score TIP_TOP		5.0

#PHAR*MACY
header PHARMACY		subject=~ /re: pha.{1,5}macy/i
describe PHARMACY	Obfusticated pharmacy subject.
score PHARMACY		12.0

header __WROTE_SUBJECT	Subject =~ /\b\w+\b wrote:/i
body __WROTE_STOCK	/Stock:/i
body __WROTE_SYM	/Sym:/i
body __WROTE_PRICE	/Price:/i
body __WROTE_SHORT	/Short Term Target:/i
body __WROTE_LONG	/Long Term Target:/i
body __WROTE_COMPANY	/Company:/i
meta SOMEONE_WROTE	
((__WROTE_PRICE+__WROTE_STOCK+__WROTE_SYM+__WROTE_SHORT+__WROTE_LONG+__WROTE_SUBJECT) 
> 3)
describe SOMEONE_WROTE	A Stock dealing SPAM
score SOMEONE_WROTE	12.0

header EQSE	Subject =~ /EQSE/
describe EQSE	EQSE stock quote
score EQSE	12.0

header FAKE_PILLS	Subject =~ /(fake|enhancement) pills/i
describe FAKE_PILLS	Selling (non)Fake enlargement pills
score FAKE_PILLS	12.0

body __GROW_JOHNSON	/(pen[i1]s|johnson|sausage|member|weenie|woody|muscle)/
body __GROW_LARGER	/(enlarge|larger|bigger|growth|longer|boost)/
META GROW_PILLS		((__GROW_JOHNSON+__GROW_LARGER) > 1)
describe GROW_PILLS	Offers pills to improve mens physique
score GROW_PILLS	5.0


body __PRICE_VIAGRA	/\bv[\w\d_]*ra\b \$ \d, \d\d/i
body __PRICE_VALIUM	/\bv[\w\d_]*um\b \$ \d, \d\d/i
body __PRICE_CIALLIS	/\bc[\w\d_]*is\b \$ \d, \d\d/i
body __PRICE_AMBIEN	/\ba[\w\d_]*en\b \$ \d, \d\d/i
body __PRICE_XANNAX	/\bx[\w\d_]*ax\b \$ \d, \d\d/i
META DRUGS_PRICE	
((__PRICE_VIAGRA+__PRICE_VALIUM+__PRICE_CIALLIS+__PRICE_AMBIEN+__PRICE_XANNAX) 
> 3)
describe DRUGS_PRICE	Drugs offered with prices
score DRUGS_PRICE	12.0

header WINDOWS_VISTA	Subject =~ /^Windows Vista.*download/
describe WINDOWS_VISTA	Offer of cheap copy of MS Windows Vista
score WINDOWS_VISTA	12.0

header __RE_RE		Subject=~/\bre:\b *$/i
body __RE_BLANK		/Content-Type: text\/plain \nContent-Transfer-Encoding: 7bit 
*\n *\n-----/
META	BLANK_EMAIL	((__RE_RE+__RE_BLANK) > 1)
describe BLANK_EMAIL	Email contains (almost) blank subject and blank plain 
text
score BLANK_EMAIL	8.0


-- 
Gary Stainburn
 
This email does not contain private or confidential material as it
may be snooped on by interested government parties for unknown
and undisclosed purposes - Regulation of Investigatory Powers Act, 2000     


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]