Procmail/Spamassassin not working correctly ?

Submitted by steve@itgroup.net.au on Fri, 04/23/2010 - 18:41 Pro Licensee

Hi, I am having a very strange issue that has been going on for quite some time and I just can't work out what is going on. I have all my domains 'checked' to look for Viruses and Spam Filtering. Occasionally, some users complain that they are getting some mail, but not others. When I check their mail box, I can't see any mail there, and yet their quota shows 814K (or similiar) used, so it would appear that there is mail there, but nothing at all? I send test messages to them, sometimes they get them, sometimes they do not. So, I delete their mailbox, recreate it - and it appears to now work. But again, sometimes, mail is getting 'lost' somewhere. It is like the virus/spam checking it putting the mail somewhere but NOT in the users mailbox. Further, there is no 'junk mail' folder being created in the users mailbox - which I assume that their should be? Would you be able to SSH into the system and check it out for me please? It does not appear to be consistent to any one of my domains, but rather all of them. Some mail comes through, some does not - I would hope that ALL mail comes though, but spam is classified as such and filed in 'junk mail' for the user to sort out. regards steve

Status: 
Active

Comments

Submitted by andreychek on Fri, 04/23/2010 - 19:04

Howdy -- if you're seeing weird things in regards to email, the thing you'll want to do to figure out what's going on is review the logs that say where all the emails are going.

You can get an overview of what is coming and going by looking at the email log, in /var/log/maillog... that shows all the email activity, and would display any Postfix, SpamAssassin, and ClamAV errors that may occur.

Also, when an email is delivered, there's a lot of detail about that delivery in the procmail log, /var/log/procmail.log. You'll see who the email was from, the subject, the size, and what folder it was delivered to.

Feel free to post anything unusual you see into here, and we can take a look at that together to try and figure out what's going on.

Submitted by steve@itgroup.net.au on Fri, 04/23/2010 - 19:15 Pro Licensee

Thanks for the reply, yes - I have done that. However, there is nothing unusual there at all. I have sat there with tail -f /var/log/maillog and watched it for 1/2 hour and all seems well. I did find a post on here relating to virtualmin - email settings - allow users to create spam filters check box - would that make a difference? I have now checked this box too. I would have thought that when I have a check box for the Domain settings to 'check for viruses' ' check for spam' it would automatically start to create a 'junk mail' folder for each user on that domain when 'spam' was discovered. It does not appear to be doing this?

Submitted by andreychek on Sat, 04/24/2010 - 11:14

Yeah, it would create junk folders whenever it attempts to deliver spam into that folder.

If you look in /var/log/procmail.log, do you see any attempts to deliver junk mail into directories named ".spam"?

Also, in Virtualmin, if you look in Server Configuration -> Spam and Virus Delivery, what is "Destination for spam emails" set to?

Submitted by steve@itgroup.net.au on Sat, 04/24/2010 - 17:18 Pro Licensee

Hi, thank you for the reply. I can't find - Server Configuration -> Spam and Virus Delivery Do you mean under each Domain? Only thing I have is under Virtualmin is System Settings - Server Templates - Spam Options, but there is nothing in there?

here is a snipet of the procmail log:

From osyveu8788@virginmedia.com Sun Apr 25 04:07:14 2010 Subject: [SPAM] Hey webmaster, get 80 percent OFF Folder: /dev/null 8691 Time:1272132458 From:osyveu8788@virginmedia.com To:webmaster@lavande.com.au User:lavande Size:8691 Dest:/dev/null Mode:Spam From dc6b034540e7d4f0614a97528543633c.20100425aa@dealsdirect.net Sun Apr 25 04:09:19 2010 Subject: Winter Bedding Sale! 90% Down Feather Duvet Sets from $69.95 Folder: /home/itginternet/homes/vinniesfruitz/Maildir/new/1272132560 68010 Time:1272132560 From:newsletter@dealsdirect.com.au To:vinniesfruitz@itginternet.net.au User:vinniesfruitz-itginternet.net.au Size:68101 Dest:/home/itginternet/homes/vinniesfruitz/Maildir/new/1272132560.7902_0.hosting.itgroup.net.au Mode:None From f1239762n@ms21.hinet.net Sun Apr 25 04:13:05 2010 Subject: Re: worldwide delivery info Folder: /home/keithgillmotors/homes/all/Maildir/new/1272132785.8260_ 1928 Time:1272132785 From:f1239762n@ms21.hinet.net To:wgarcia@keithgillmotors.com.au User:all.keithgillmotors Size:1984 Dest:/home/keithgillmotors/homes/all/Maildir/new/1272132785.8260_0.hosting.itgroup.net.au Mode:None From durifyqac8325@mediaWays.net Sun Apr 25 04:15:35 2010 Subject: Friend ffe, enter our shop Ryw Folder: /home/keithgillmotors/homes/all/Maildir/new/1272132936.8615_ 7799 Time:1272132936 From:durifyqac8325@mediaWays.net To:ffe@keithgillmotors.com.au User:all.keithgillmotors Size:7859 Dest:/home/keithgillmotors/homes/all/Maildir/new/1272132936.8615_0.hosting.itgroup.net.au Mode:None From talbottheresa@droppatrol.de Sun Apr 25 04:15:48 2010 Subject: [SPAM] amidst dumfounding eyelash's Folder: /home/vistabond/homes/wbc/Maildir/.spam/new/1272132976.8624_ 11064 Time:1272132976 From:talbottheresa@droppatrol.de To:wbc@vistabond.com.au User:wbc.vistabond Size:11123 Dest:/home/vistabond/homes/wbc/Maildir/.spam/new/1272132976.8624_0.hosting.itgroup.net.au Mode:Spam