Home / Browse / DSPAM / Mail / Archive

DSPAM

Email Archive: dspam-user (read-only)

[Dspam-user] Dspam can't find signatures when retraining

From: Alban Hertroys <dalroi@so...> - 2010-07-25 16:50

Hello,

I posted a couple of days back about this issue already, but didn't get any replies - may have been because I wasn't subscribed yet.

In the meantime I switched to training via the Dovecot plugin (which requires the signature to be in the header). I'm using DSPAM 3.9.0 from ports (FreeBSD 7.3).

I'm seeing this in my logs:

Jul 25 18:36:52 solfertje dspam[72733]: Signature retrieval for '3,4c4c60f8286211026045283' failed
Jul 25 18:36:53 solfertje dspam[72733]: Unable to find a valid signature. Aborting.
Jul 25 18:36:53 solfertje dspam[72733]: process_message returned error -5. dropping message.

So it successfully extracts the signature from the mail, but can't find it in the database.
While the database (PostgreSQL 8.3) says:

dspam=> select uid, signature from dspam_signature_data where signature = '3,4c4
c60f8286211026045283';
uid | signature
-----+---------------------------
3 | 3,4c4c60f8286211026045283
(1 row)

So the signature is there! What's happening?!?

Formerly I forwarded my spam to a local address, but that was having the same issue (signature not found, message dropped - as outlined in my previous mail).

At the moment the only way I can retrain missed spam is to use the web-UI...

Regarding the Dovecot plugin; does anyone know if it'd be okay to create a symlink from my dspam mbox-file into my IMAP folder?
Currently I'm using a normal mbox file that I created there using my mail client, but that has the obvious drawback that I can't take false positives out of it - they're never in there in the first place. Replacing it by a symlink seems the solution for that, or is that wrong?

Alban Hertroys

--
If you can't see the forest for the trees,
cut the trees and you'll see there is no forest.

!DSPAM:1126,4c4c6b4e286211514247947!

Thread View

Thread	Author	Date
[Dspam-user] Dspam can't find signatures when retraining	Alban Hertroys <dalroi@so...>

Re: [Dspam-user] Dspam can't find signatures when retraining

From: Alban Hertroys <dalroi@so...> - 2010-07-26 09:58

On 25 Jul 2010, at 18:50, Alban Hertroys wrote:

> Hello,
> 
> I posted a couple of days back about this issue already, but didn't get any replies - may have been because I wasn't subscribed yet.
> 
> In the meantime I switched to training via the Dovecot plugin (which requires the signature to be in the header). I'm using DSPAM 3.9.0 from ports (FreeBSD 7.3).
> 
> I'm seeing this in my logs:
> 
> Jul 25 18:36:52 solfertje dspam[72733]: Signature retrieval for '3,4c4c60f8286211026045283' failed
> Jul 25 18:36:53 solfertje dspam[72733]: Unable to find a valid signature. Aborting.
> Jul 25 18:36:53 solfertje dspam[72733]: process_message returned error -5.  dropping message.
> 
> So it successfully extracts the signature from the mail, but can't find it in the database.
> While the database (PostgreSQL 8.3) says:
> 
> dspam=> select uid, signature from dspam_signature_data where signature = '3,4c4
> c60f8286211026045283';                                                          
> uid |         signature         
> -----+---------------------------
>   3 | 3,4c4c60f8286211026045283
> (1 row)
> 
> So the signature is there! What's happening?!?

I researched this some more by turning on more verbose query logging on my dspam database, and it turns out the signature lookup is failing to get results from a query in _pgsql_drv_getpwnam(), namely:

SELECT uid FROM dspam_virtual_uids WHERE username='user'

For some reason dspam is looking up a user as 'user', while the dspam_virtual_uids(username) column contains usernames á la 'user@...'.

My dspam.conf contains:

ParseToHeaders on
ChangeModeOnParse on
ChangeUserOnParse user

(Not all of these options are documented BTW, I had to look up the possible options in the source!)

So it should be using my system username ('user') all the way, shouldn't it? Instead it seems that it uses 'user@...' when invoked from Postfix, while it uses 'user' when invoked from Dovecot (or, probably, when I forward mail to 'spam@...').

Any idea what's causing this discrepancy and what I can do about it?

Alban Hertroys

--
If you can't see the forest for the trees,
cut the trees and you'll see there is no forest.

!DSPAM:1126,4c4d5c52286211783268853!

Re: [Dspam-user] Dspam can't find signatures when retraining

From: Alban Hertroys <dalroi@so...> - 2010-07-26 10:08

On 26 Jul 2010, at 11:58, Alban Hertroys wrote:

> So it should be using my system username ('user') all the way, shouldn't it? Instead it seems that it uses 'user@...' when invoked from Postfix, while it uses 'user' when invoked from Dovecot (or, probably, when I forward mail to 'spam@...').


Replying to my own post again.

I just realised I can't use system usernames - I have a few aliases pointing to this same e-mail address. It wouldn't be possible to resolve usernames for those aliases as they enter dspam, and I don't think Postfix is at the point that it can determine the final user account to send it to when the message enters dspam either. I would prefer to resolve those, it would save me a few quarantine boxes to check for false positives... Any trick on how to achieve such?

Or am I stuck with full virtual usernames?

Alban Hertroys

--
Screwing up is an excellent way to attach something to the ceiling.


!DSPAM:1126,4c4d5e98286211269111788!

Re: [Dspam-user] Dspam can't find signatures when retraining

From: Hugo Monteiro <hugo.monteiro@fc...> - 2010-07-26 11:58

On 07/26/2010 11:08 AM, Alban Hertroys wrote:
> On 26 Jul 2010, at 11:58, Alban Hertroys wrote:
>
>    
>> So it should be using my system username ('user') all the way, shouldn't it? Instead it seems that it uses 'user@...' when invoked from Postfix, while it uses 'user' when invoked from Dovecot (or, probably, when I forward mail to 'spam@...').
>>      
>
> Replying to my own post again.
>
> I just realised I can't use system usernames - I have a few aliases pointing to this same e-mail address. It wouldn't be possible to resolve usernames for those aliases as they enter dspam, and I don't think Postfix is at the point that it can determine the final user account to send it to when the message enters dspam either. I would prefer to resolve those, it would save me a few quarantine boxes to check for false positives... Any trick on how to achieve such?
>
> Or am I stuck with full virtual usernames?
>
> Alban Hertroys
>
>    


Hello Alban,

You should take a look at the DSPAM's external lookup feature. (search 
for ExtLookup* directives in dspam.conf).

Regards,

Hugo Monteiro.

-- 
fct.unl.pt:~# cat .signature

Hugo Monteiro
Email	 : hugo.monteiro@...
Telefone : +351 212948300 Ext.15307
Web      : http://hmonteiro.net

Divisão de Informática
Faculdade de Ciências e Tecnologia da
		   Universidade Nova de Lisboa
Quinta da Torre   2829-516 Caparica   Portugal
Telefone: +351 212948596   Fax: +351 212948548
 http://www.fct.unl.pt                apoio@...

fct.unl.pt:~# _

Re: [Dspam-user] Dspam can't find signatures when retraining

From: Paul Cockings <dspam@cy...> - 2010-07-26 14:14

Alban Hertroys wrote:
> My dspam.conf contains:
>
> ParseToHeaders on
> ChangeModeOnParse on
> ChangeUserOnParse user
>
> (Not all of these options are documented BTW, I had to look up the possible options in the source!)

Please send me some notes on how you would describe those features to 
work, or I can give you write access to the wiki.  I'm sure many others 
would benefit from your input to Dspam.