Page MenuHomePhabricator

In mail routed to OTRS, Spamassassin BAYES_xx scores no longer applied
Closed, ResolvedPublic

Description

It appears, based on a sample of "junk" emails I've looked at, that Spamassassin's Bayes_xx rules do not currently appear to be applied, causing too much spam to show up in regular queues. (If indeed the case, I note that this has been an issue in the past, several times caused by problems with the Bayes database.)

Event Timeline

Confirmed. Up to now, I also agree with the diagnosis, it is indeed something that has occured before, it's documented here https://wikitech.wikimedia.org/wiki/OTRS#SpamAssassin_stops_reporting_Bayes_results

After some lengthy export process and a bit of debugging, it was exactly the same issue as in the link pasted above. Fixed once more. The first time the database was aborted was on Dec 21 01:05:06

Dec 21 01:05:06 mendelevium spamd[28401]: bayes: bayes db version 0 is not able to be used, aborting! at /usr/share/perl5/Mail/SpamAssassin/BayesStore/DBM.pm line 208, <GEN804> line 2.

Funnily enough, this time around the databases would not fail the verification process but would not have enough ham+spam messages in them to trigger a classification

I 'll resolve this for now, but if it occurs again in a short timeframe, we might want to debugging more to figure out the cause.

akosiaris claimed this task.
MarcoAurelio subscribed.

I've been approached recently that some queues are getting flooded of spam emails again. Could you please have a look again? Thanks.

Logs indicate that the bayes database is working fine and scoring emails just fine. In fact since fixing this more than 60% of incoming messages have been flagged as spam. Could it be that these reports are a bit delayed, just reporting now the issue we had a few hours ago ?

Only ops will be able to give you a server-side assessment, but looking at the most recent tickets in Junk, Bayes scores seem to get added as expected. Are you sure the reports are referring to mail received after the issue was reported as fixed? (The fix described above would only affect new mail, not re-classify existing tickets.) The amount of new tickets from the past 5 hours that were manually marked as spam/moved to Junk also looks unsuspicious to me.

@Shanmugamp7 reported that new spam emails were received at the time of my
reopening, but as of now I don't see more of those (I moved a bunch from
info-es manually, though). Regards.

OK thanks. I 'll re-resolve then, feel free to reopen.