[Rspamd-Users] strange behavior symbol BAYES_SPAM random

Mon May 13 13:11:00 UTC 2019

Thanks for reply.

here's what I get from log. Surprisingly, the difference is that rspamd detect one time language as fr and so no BAYES_SPAM symbol and so no lua_task_set_pre_result and the second time detect language as es and i got BAYES_SPAM symbol.

See below

# grep '<f4d939>' rspamd.log
rspamd[46859]: <f4d939>; csession; rspamd_controller_check_password: allow unauthorized connection from a trusted IP ::1
rspamd[46859]: <f4d939>; csession; rspamd_mime_part_detect_language: detected part language: fr
rspamd[46859]: <f4d939>; csession; rspamd_message_parse: loaded message; id: <1721819489.1223194.1557733787464.JavaMail.zimbra at u-bordeaux.fr>; queue-id: <undef>; size: 73408; checksum: <3dd7cb1a627435d878f08d9396a0e86e>
rspamd[46859]: <f4d939>; surbl; surbl_test_url: disable surbl multi.uribl.com as it is reported to be offline
rspamd[46859]: <f4d939>; lua; greylist.lua:255: Score too low - skip greylisting
rspamd[46859]: <f4d939>; lua; neural.lua:297: ann score: 0.918
rspamd[46859]: <f4d939>; csession; rspamd_task_write_log: id: <1721819489.1223194.1557733787464.JavaMail.zimbra at u-bordeaux.fr>, from: <anne.vialard at u-bordeaux.fr>, (default: F (no action): [-0.10/15.00] [MIME_GOOD(-0.10){multipart/alternative;text/plain;},ARC_NA(0.00){},DMARC_NA(0.00){u-bordeaux.fr;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},HAS_XOIP(0.00){},MID_RHS_MATCH_FROM(0.00){},NEURAL_SPAM(0.00){0.918;0;},PREVIOUSLY_DELIVERED(0.00){fabrice.grelaud at u-bordeaux.fr;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_SEVEN(0.00){9;},RCVD_NO_TLS_LAST(0.00){},R_DKIM_NA(0.00){},TO_DN_ALL(0.00){},TO_DOM_EQ_FROM_DOM(0.00){}]), len: 73408, time: 88.806ms real, 9.110ms virtual, dns req: 18, digest: <3dd7cb1a627435d878f08d9396a0e86e>, mime_rcpt: <fabrice.grelaud at u-bordeaux.fr>, file: spam-easyjet
rspamd[46859]: <f4d939>; csession; rspamd_protocol_http_reply: regexp statistics: 254 pcre regexps scanned, 4 regexps matched, 172 regexps total, 11 regexps cached, 320.36k bytes scanned using pcre, 320.36k bytes scanned total

# grep '<8bb33a>' rspamd.log
rspamd[46859]: <8bb33a>; csession; rspamd_controller_check_password: allow unauthorized connection from a trusted IP ::1
rspamd[46859]: <8bb33a>; csession; rspamd_mime_part_detect_language: detected part language: es
rspamd[46859]: <8bb33a>; csession; rspamd_message_parse: loaded message; id: <1721819489.1223194.1557733787464.JavaMail.zimbra at u-bordeaux.fr>; queue-id: <undef>; size: 73408; checksum: <3dd7cb1a627435d878f08d9396a0e86e>
rspamd[46859]: <8bb33a>; surbl; surbl_test_url: disable surbl multi.uribl.com as it is reported to be offline
rspamd[46859]: <8bb33a>; csession; lua_task_set_pre_result: <1721819489.1223194.1557733787464.JavaMail.zimbra at u-bordeaux.fr>: set pre-result to add header: 'Forced add header due to BAYES_SPAM probability'
rspamd[46859]: <8bb33a>; lua; neural.lua:297: ann score: 0.918
rspamd[46859]: <8bb33a>; csession; rspamd_task_write_log: id: <1721819489.1223194.1557733787464.JavaMail.zimbra at u-bordeaux.fr>, from: <anne.vialard at u-bordeaux.fr>, (default: F (add header): [7.00/15.00] [BAYES_SPAM(4.00){100.00%;},MIME_GOOD(-0.10){multipart/alternative;text/plain;},ARC_NA(0.00){},DMARC_NA(0.00){u-bordeaux.fr;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},HAS_XOIP(0.00){},MID_RHS_MATCH_FROM(0.00){},NEURAL_SPAM(0.00){0.918;0;},PREVIOUSLY_DELIVERED(0.00){fabrice.grelaud at u-bordeaux.fr;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_SEVEN(0.00){9;},RCVD_NO_TLS_LAST(0.00){},R_DKIM_NA(0.00){},TO_DN_ALL(0.00){},TO_DOM_EQ_FROM_DOM(0.00){}]), len: 73408, time: 230.409ms real, 12.716ms virtual, dns req: 18, digest: <3dd7cb1a627435d878f08d9396a0e86e>, mime_rcpt: <fabrice.grelaud at u-bordeaux.fr>, file: spam-easyjet
rspamd[46859]: <8bb33a>; csession; rspamd_protocol_http_reply: regexp statistics: 254 pcre regexps scanned, 4 regexps matched, 172 regexps total, 11 regexps cached, 320.36k bytes scanned using pcre, 320.36k bytes scanned total

Would it be a track ?

regards

----- Mail original -----
De: "users" <users at lists.rspamd.com>
À: "users" <users at lists.rspamd.com>
Cc: "Alexander Moisseev" <moiseev at mezonplus.ru>
Envoyé: Lundi 13 Mai 2019 14:15:10
Objet: Re: [Rspamd-Users] strange behavior symbol BAYES_SPAM random

On 13.05.2019 13:48, Fabrice Grelaud wrote:
> 
> Any idea, why such behavior ?
> 

I'd suggest to check other log messages related to id <a6f109>. Probably some components are configured as dual-stack but others (e.g Redis) IPv4 or IPv6 only.
-- 
Users mailing list
Users at lists.rspamd.com
https://lists.rspamd.com/mailman/listinfo/users
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2063 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.rspamd.com/pipermail/users/attachments/20190513/d87e669d/attachment.bin>