Amavis and FuzzyOcr

I 'm using amavis-new 2.4 with p0f and SA 3.1 with FuzzyOcr
on FreeBSD 
6.1. with postfix. 

When I feed to SA by hand, the scores are 2 -3 times higher
than what 
Amavis gives it.  In amavis' debug output, I can see
FuzzyOcr being 
loaded but it never scores anything.  SA is configured to
use FuzzyOcr 
and it works fine.  What do I need to do to make it work?
Sorry if this 
has been answered elsewhere. I'm not finding it.

As an aside, p0f seems to be working well on my low-volume
site (2000 
messages a day). I bumped up the XP score and that one alone
is catching 
a lot of spam.

------------------------------------------------------------
-------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the
chance to share your
opinions on IT & business topics through brief surveys -
and earn cash
http://www.techsay.com/default.
php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Jeff wrote:

> I 'm using amavis-new 2.4 with p0f and SA 3.1 with
FuzzyOcr on FreeBSD 
> 6.1. with postfix. 

> When I feed to SA by hand, the scores are 2 -3 times
higher than what 
> Amavis gives it.  In amavis' debug output, I can see
FuzzyOcr being 
> loaded but it never scores anything.  SA is configured
to use FuzzyOcr 
> and it works fine.  What do I need to do to make it
work? Sorry if this 
> has been answered elsewhere. I'm not finding it.

> As an aside, p0f seems to be working well on my
low-volume site (2000 
> messages a day). I bumped up the XP score and that one
alone is catching 
> a lot of spam.

It is my understanding that when you feed a message to
FuzzyOcr
using SA debug mode 'spamassassin -tD < message' FuzzyOcr
sets
focr_autodisable_score to 1000. Are the messages is
question
scoring over the focr_autodisable_score you have set in
FuzzyOcr.cf? If so, you will not get any scoring from
FuzzyOcr
(and you should not).

Also, see: http://w
ww.ijs.si/software/amavisd/#faq-spam
"SpamAssassin returns different score"

It's a good idea to ensure amavisd-new is using the same
configuration
that the command line SA is using. As the FAQ states, run SA
as the
amavisd-new user. Also, compare the configurations.
Amavisd-new
could be using a completely different set of rules and
configuration.
In order to see where amavisd-new is looking for SA files,
with version
2.4.4 or newer you can narrow debug-sa output to various SA
channels; e.g.:
amavisd -d config debug-sa

Gary V


------------------------------------------------------------
-------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the
chance to share your
opinions on IT & business topics through brief surveys -
and earn cash
http://www.techsay.com/default.
php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Gary V wrote:
> Jeff wrote:
>
>   
>> I 'm using amavis-new 2.4 with p0f and SA 3.1 with
FuzzyOcr on FreeBSD 
>> 6.1. with postfix. 
>>     
>
>   
>> When I feed to SA by hand, the scores are 2 -3
times higher than what 
>> Amavis gives it.  In amavis' debug output, I can
see FuzzyOcr being 
>> loaded but it never scores anything.  SA is
configured to use FuzzyOcr 
>> and it works fine.  What do I need to do to make it
work? Sorry if this 
>> has been answered elsewhere. I'm not finding it.
>>     
>
> It is my understanding that when you feed a message to
FuzzyOcr
> using SA debug mode 'spamassassin -tD < message'
FuzzyOcr sets
> focr_autodisable_score to 1000. Are the messages is
question
> scoring over the focr_autodisable_score you have set
in
> FuzzyOcr.cf? If so, you will not get any scoring from
FuzzyOcr
> (and you should not).
  'spamassassin -tD < message' returns a score that
includes FuzzyOcr. 
> Also, see: http://w
ww.ijs.si/software/amavisd/#faq-spam
> "SpamAssassin returns different score"
>
> It's a good idea to ensure amavisd-new is using the
same configuration
> that the command line SA is using. As the FAQ states,
run SA as the
> amavisd-new user. Also, compare the configurations.
Amavisd-new
> could be using a completely different set of rules and
configuration.
> In order to see where amavisd-new is looking for SA
files, with version
> 2.4.4 or newer you can narrow debug-sa output to
various SA channels; e.g.:
> amavisd -d config debug-sa
>
> Gary V
>
>
>   
I ran 'amavisd -d config debug-sa',  and amavisd appears to
be reading 
the reading the correct local config files, including
FuzzyOcr:

config: read file
/usr/local/etc/mail/spamassassin/FuzzyOcr.cf

However, when I do a simple 'spamassassin < message' as
vscan (the user 
that amavis uses here), FuzzyOcr does not get used. I assume
that this 
is a clue to the problem. Did I misconfigure the user?

I know that this is something simple I've missed, but it
doesn't quite 
make sense to me. The daemon seems to be reading all the
correct config 
files. Why would the user get different results? Thanks for
your help.


------------------------------------------------------------
-------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the
chance to share your
opinions on IT & business topics through brief surveys -
and earn cash
http://www.techsay.com/default.
php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Jeff wrote:

> Gary V wrote:
>> Jeff wrote:
>>
>>   
>>> I 'm using amavis-new 2.4 with p0f and SA 3.1
with FuzzyOcr on FreeBSD 
>>> 6.1. with postfix. 
>>>     
>>
>>   
>>> When I feed to SA by hand, the scores are 2 -3
times higher than what 
>>> Amavis gives it.  In amavis' debug output, I
can see FuzzyOcr being 
>>> loaded but it never scores anything.  SA is
configured to use FuzzyOcr 
>>> and it works fine.  What do I need to do to
make it work? Sorry if this 
>>> has been answered elsewhere. I'm not finding
it.
>>>     
>>
>> It is my understanding that when you feed a message
to FuzzyOcr
>> using SA debug mode 'spamassassin -tD < message'
FuzzyOcr sets
>> focr_autodisable_score to 1000. Are the messages is
question
>> scoring over the focr_autodisable_score you have
set in
>> FuzzyOcr.cf? If so, you will not get any scoring
from FuzzyOcr
>> (and you should not).
>   'spamassassin -tD < message' returns a score that
includes FuzzyOcr. 
>> Also, see: http://w
ww.ijs.si/software/amavisd/#faq-spam
>> "SpamAssassin returns different score"
>>
>> It's a good idea to ensure amavisd-new is using the
same configuration
>> that the command line SA is using. As the FAQ
states, run SA as the
>> amavisd-new user. Also, compare the configurations.
Amavisd-new
>> could be using a completely different set of rules
and configuration.
>> In order to see where amavisd-new is looking for SA
files, with version
>> 2.4.4 or newer you can narrow debug-sa output to
various SA channels; e.g.:
>> amavisd -d config debug-sa
>>
>> Gary V
>>
>>
>>   
> I ran 'amavisd -d config debug-sa',  and amavisd
appears to be reading 
> the reading the correct local config files, including
FuzzyOcr:

> config: read file
/usr/local/etc/mail/spamassassin/FuzzyOcr.cf

> However, when I do a simple 'spamassassin < message'
as vscan (the user 
> that amavis uses here), FuzzyOcr does not get used. I
assume that this 
> is a clue to the problem. Did I misconfigure the user?

> I know that this is something simple I've missed, but
it doesn't quite 
> make sense to me. The daemon seems to be reading all
the correct config 
> files. Why would the user get different results? Thanks
for your help.

Try spamassassin -tD < message (as vscan)

The question is, what to you have focr_autodisable_score set
to and
does the message you are testing score higher than that?

I would not use 'spamassassin < message'.
Running 'spamassassin -t < message' is not in SA debug
mode so
focr_autodisable_score is honored whereas running
'spamassassin -tD <message' would set
focr_autodisable_score to 1000.
Try running 'spamassassin -tD <message' as vscan.

Gary V


------------------------------------------------------------
-------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the
chance to share your
opinions on IT & business topics through brief surveys -
and earn cash
http://www.techsay.com/default.
php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Gary wrote:

> Jeff wrote:

>> Gary V wrote:
>>> Jeff wrote:
>>>
>>>   
>>>> I 'm using amavis-new 2.4 with p0f and SA
3.1 with FuzzyOcr on FreeBSD 
>>>> 6.1. with postfix. 
>>>>     
>>>
>>>   
>>>> When I feed to SA by hand, the scores are 2
-3 times higher than what 
>>>> Amavis gives it.  In amavis' debug output,
I can see FuzzyOcr being 
>>>> loaded but it never scores anything.  SA is
configured to use FuzzyOcr 
>>>> and it works fine.  What do I need to do to
make it work? Sorry if this 
>>>> has been answered elsewhere. I'm not
finding it.
>>>>     
>>>
>>> It is my understanding that when you feed a
message to FuzzyOcr
>>> using SA debug mode 'spamassassin -tD <
message' FuzzyOcr sets
>>> focr_autodisable_score to 1000. Are the
messages is question
>>> scoring over the focr_autodisable_score you
have set in
>>> FuzzyOcr.cf? If so, you will not get any
scoring from FuzzyOcr
>>> (and you should not).
>>   'spamassassin -tD < message' returns a score
that includes FuzzyOcr. 
>>> Also, see: http://w
ww.ijs.si/software/amavisd/#faq-spam
>>> "SpamAssassin returns different
score"
>>>
>>> It's a good idea to ensure amavisd-new is using
the same configuration
>>> that the command line SA is using. As the FAQ
states, run SA as the
>>> amavisd-new user. Also, compare the
configurations. Amavisd-new
>>> could be using a completely different set of
rules and configuration.
>>> In order to see where amavisd-new is looking
for SA files, with version
>>> 2.4.4 or newer you can narrow debug-sa output
to various SA channels; e.g.:
>>> amavisd -d config debug-sa
>>>
>>> Gary V
>>>
>>>
>>>   
>> I ran 'amavisd -d config debug-sa',  and amavisd
appears to be reading 
>> the reading the correct local config files,
including FuzzyOcr:

>> config: read file
/usr/local/etc/mail/spamassassin/FuzzyOcr.cf

>> However, when I do a simple 'spamassassin <
message' as vscan (the user 
>> that amavis uses here), FuzzyOcr does not get used.
I assume that this 
>> is a clue to the problem. Did I misconfigure the
user?

>> I know that this is something simple I've missed,
but it doesn't quite 
>> make sense to me. The daemon seems to be reading
all the correct config 
>> files. Why would the user get different results?
Thanks for your help.

> Try spamassassin -tD < message (as vscan)

> The question is, what to you have
focr_autodisable_score set to and
> does the message you are testing score higher than
that?

> I would not use 'spamassassin < message'.
> Running 'spamassassin -t < message' is not in SA
debug mode so
> focr_autodisable_score is honored whereas running
> 'spamassassin -tD <message' would set
focr_autodisable_score to 1000.
> Try running 'spamassassin -tD <message' as vscan.

Actually, 3.5.x will set focr_autodisable_score to 1000 but
I don't
think older versions will. For older versions one would have
to
temporarily set focr_autodisable_score to a high value (and
reload
amavisd-new). Hopefully you are not using an unpatched
3.5.0-rc1 as
this is known to not work with amavisd-new.

Gary V


------------------------------------------------------------
-------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the
chance to share your
opinions on IT & business topics through brief surveys -
and earn cash
http://www.techsay.com/default.
php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Jeff,

> Done, and this did produce more output. FuzzyOcr is
being called by the
> vscan user, and produces exactly the same log output as
other users,
> with no errors.
> Still no scores from it in the headers for the vscan
user.
> Does that give a clue?

Is this the FuzzyOcr 2.3b from ports (mail/p5-FuzzyOcr),
or 3.4.2 from (mail/p5-FuzzyOcr-devel) or the 3.5.1 ?

  Mark

------------------------------------------------------------
-------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the
chance to share your
opinions on IT & business topics through brief surveys -
and earn cash
http://www.techsay.com/default.
php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/