Mailing List Archive

Two different machines running same versoin of SA giving different scores for scores that are commented out
I'm running the same version of SA on the same email on two different
machines and getting different scores in for some rules in the report:

Machine A gives: 0.0 FSL_BULK_SIG Bulk signature with no
Unsubscribe
Machine B gives: 1.0 FSL_BULK_SIG Bulk signature with no
Unsubscribe

On both machines, /usr/share/spasmassassin/72_active.cf has this rule
which is commented out:

#score FSL_BULK_SIG 3.000 # limit

Similarly, for another rule that's commented out, I'm getting:

Machine A: 0.3 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to
be ASCII
Machine B: 1.0 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to
be ASCII

That rule has this line in the 72_active.cf file:

# score PP_MIME_FAKE_ASCII_TEXT 1.0


It appears Machine A is somehow caching the old scores for rules that
have been commented out. Restarting spamassassin daemon doesn't help.
The command I'm running to generate the report is:

spamc -R <
/spam/Maildir/.Spam/cur/1619286920.M132164P23787.email.dondley.com\,S\=5093\,W\=5214\:2\,S
Re: Two different machines running same versoin of SA giving different scores for scores that are commented out [ In reply to ]
On Sun, 25 Apr 2021, Steve Dondley wrote:

> I'm running the same version of SA on the same email on two different
> machines and getting different scores in for some rules in the report:
>
> Machine A gives: 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
> Machine B gives: 1.0 FSL_BULK_SIG Bulk signature with no Unsubscribe
>
> On both machines, /usr/share/spasmassassin/72_active.cf has this rule which
> is commented out:

...

> Machine A: 0.3 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII
> Machine B: 1.0 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII
>
> That rule has this line in the 72_active.cf file:

Look in 72_scores.cf and compare the modification dates on that file.

Their scores as of today (saturday):

72_scores.cf:score FSL_BULK_SIG 0.001 0.001 0.001 0.001
72_scores.cf:score PP_MIME_FAKE_ASCII_TEXT 0.999 0.837 0.999 0.837


--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
329 days since the first private commercial manned orbital mission (SpaceX)
Re: Two different machines running same versoin of SA giving different scores for scores that are commented out [ In reply to ]
On 2021-04-25 01:00 AM, John Hardin wrote:
> On Sun, 25 Apr 2021, Steve Dondley wrote:
>
>> I'm running the same version of SA on the same email on two different
>> machines and getting different scores in for some rules in the report:
>>
>> Machine A gives: 0.0 FSL_BULK_SIG Bulk signature with no
>> Unsubscribe
>> Machine B gives: 1.0 FSL_BULK_SIG Bulk signature with no
>> Unsubscribe
>>
>> On both machines, /usr/share/spasmassassin/72_active.cf has this rule
>> which is commented out:
>
> ...
>
>> Machine A: 0.3 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to
>> be ASCII
>> Machine B: 1.0 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to
>> be ASCII
>>
>> That rule has this line in the 72_active.cf file:
>
> Look in 72_scores.cf and compare the modification dates on that file.
>
> Their scores as of today (saturday):
>
> 72_scores.cf:score FSL_BULK_SIG 0.001 0.001
> 0.001 0.001
> 72_scores.cf:score PP_MIME_FAKE_ASCII_TEXT 0.999 0.837
> 0.999 0.837

The date is Jan 30, 2020. I'm running SA 3.4.4 (the version supplied by
backports on my debian machine).
Re: Two different machines running same versoin of SA giving different scores for scores that are commented out [ In reply to ]
On Sun, 25 Apr 2021 00:40:59 -0400
Steve Dondley wrote:


>
> On both machines, /usr/share/spasmassassin/72_active.cf has this rule
> which is commented out:
>

This is the legacy rule directory from before sa-update existed.

Have you not got another directory populated by sa-update?
Re: Two different machines running same versoin of SA giving different scores for scores that are commented out [ In reply to ]
On 2021-04-25 05:57 AM, Reindl Harald wrote:
> Am 25.04.21 um 07:09 schrieb Steve Dondley:
>>>> That rule has this line in the 72_active.cf file:
>>>
>>> Look in 72_scores.cf and compare the modification dates on that file.
>>>
>>> Their scores as of today (saturday):
>>>
>>> 72_scores.cf:score FSL_BULK_SIG                          0.001 0.001
>>> 0.001 0.001
>>> 72_scores.cf:score PP_MIME_FAKE_ASCII_TEXT               0.999 0.837
>>> 0.999 0.837
>>
>> The date is Jan 30, 2020. I'm running SA 3.4.4 (the version supplied
>> by backports on my debian machine).
> it's time to learn about basics like sa-update and where the stuff is
> located

OK, heh. I had totally forgotten about SA updates and what they do.
After figuring out sa-update and getting it working properly on both
machines, the scores are the same now. Thanks.
Re: Two different machines running same versoin of SA giving different scores for scores that are commented out [ In reply to ]
On 2021-04-25 10:19 AM, RW wrote:
> On Sun, 25 Apr 2021 00:40:59 -0400
> Steve Dondley wrote:
>
>
>>
>> On both machines, /usr/share/spasmassassin/72_active.cf has this rule
>> which is commented out:
>>
>
> This is the legacy rule directory from before sa-update existed.
>
> Have you not got another directory populated by sa-update?

Yeah, I got it working after Rendi gave me a clue. Thanks.
Re: Two different machines running same versoin of SA giving different scores for scores that are commented out [ In reply to ]
On Sun, 25 Apr 2021, Steve Dondley wrote:

> On 2021-04-25 01:00 AM, John Hardin wrote:
>> On Sun, 25 Apr 2021, Steve Dondley wrote:
>>
>>> That rule has this line in the 72_active.cf file:
>>
>> Look in 72_scores.cf and compare the modification dates on that file.
>
> The date is Jan 30, 2020. I'm running SA 3.4.4 (the version supplied by
> backports on my debian machine).

Then sa-update is not running. Those scores are more than a year old. Fix
that first.

The installs might be giving different scores for the same rule due to
configuration differences - for example, one might have Bayes enabled and
the other doesn't, or one might have network checks enabled and the other
does not.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...to announce there must be no criticism of the President or to
stand by the President right or wrong is not only unpatriotic and
servile, but is morally treasonous to the American public.
-- Theodore Roosevelt, 1918
-----------------------------------------------------------------------
330 days since the first private commercial manned orbital mission (SpaceX)
Re: Two different machines running same versoin of SA giving different scores for scores that are commented out [ In reply to ]
On Sun, 25 Apr 2021, John Hardin wrote:

> On Sun, 25 Apr 2021, Steve Dondley wrote:
>
>> On 2021-04-25 01:00 AM, John Hardin wrote:
>>> On Sun, 25 Apr 2021, Steve Dondley wrote:
>>>
>>>> That rule has this line in the 72_active.cf file:
>>>
>>> Look in 72_scores.cf and compare the modification dates on that file.
>>
>> The date is Jan 30, 2020. I'm running SA 3.4.4 (the version supplied by
>> backports on my debian machine).
>
> Then sa-update is not running. Those scores are more than a year old. Fix
> that first.

...which you did. Ah, the hazards of answering as you read...

> The installs might be giving different scores for the same rule due to
> configuration differences - for example, one might have Bayes enabled and the
> other doesn't, or one might have network checks enabled and the other does
> not.

It sounds like this isn't the case as your scores are now the same.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...to announce there must be no criticism of the President or to
stand by the President right or wrong is not only unpatriotic and
servile, but is morally treasonous to the American public.
-- Theodore Roosevelt, 1918
-----------------------------------------------------------------------
330 days since the first private commercial manned orbital mission (SpaceX)