Re: latest spam-milter

[Mike Tancsa]

OK, running with debugging on, I am seeing the following in my mail logs 
before the milter dies on a signal 6 at 20:46:28



Nov 25 20:46:22 ns4 spamd[138]: connection from localhost [127.0.0.1] at 
port 4327
Nov 25 20:46:22 ns4 spamass-milter[47719]: ::input enter
Nov 25 20:46:22 ns4 spamass-milter[47719]: ::empty_and_close_pipe enter
Nov 25 20:46:22 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:22 ns4 spamd[50319]: Still running as root: user not 
specified, not found, or set to root.  Fall back to nobody.
Nov 25 20:46:22 ns4 spamd[50319]: processing message 
<address@hidden> for root:65534, expecting
 5042 bytes.
Nov 25 20:46:23 ns4 spamd[50318]: clean message (4.0/5.0) for root:65534 in 
1.2 seconds, 5042 bytes.
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::empty_and_close_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::input exit
Nov 25 20:46:23 ns4 sm-mta[50309]: gAQ1kJ8H050309: Milter add: header: 
X-Spam-Status: No, hits=4.0 required=5.0\n\ttests=BIG_FONT,CL
ICK_BELOW,CTYPE_JUST_HTML,EXCUSE_1,HTML_50_70,\n\t 
HTML_FONT_COLOR_RED,HTML_FONT_FACE_ODD,MAILTO_TO_SPAM_ADDR,\n\t      SPAM_PH
RASE_03_05,WEB_BUGS\n\tversion=2.43
Nov 25 20:46:23 ns4 sm-mta[50309]: gAQ1kJ8H050309: Milter add: header: 
X-Spam-Level: ****
Nov 25 20:46:23 ns4 spamass-milter[47719]: mlfi_eom: exit
Nov 25 20:46:23 ns4 sm-mta[50321]: ruleset=try_tls, arg1=ns3.recycle.net, 
relay=ns3.recycle.net, reject=550 5.7.1 <address@hidden
d.com>... do not try TLS with ns3.recycle.net [207.245.212.98]
Nov 25 20:46:23 ns4 sm-mta[50321]: gAQ1kJ8H050309: 
to=<address@hidden>, delay=00:00:02, xdelay=00:00:00, mailer=smtp, 
pri=30
478, relay=ns3.recycle.net. [207.245.212.98], dsn=2.0.0, stat=Sent 
(gAQ1kNsm029850 Message accepted for delivery)
Nov 25 20:46:23 ns4 spamd[50319]: clean message (4.0/5.0) for root:65534 in 
1.3 seconds, 5042 bytes.
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::empty_and_close_pipe exit
Nov 25 20:46:23 ns4 spamass-milter[47719]: ::input exit
Nov 25 20:46:23 ns4 sm-mta[50316]: gAQ1kL8G050316: Milter add: header: 
X-Spam-Status: No, hits=4.0 required=5.0\n\ttests=BIG_FONT,CL
ICK_BELOW,CTYPE_JUST_HTML,EXCUSE_1,HTML_50_70,\n\t 
HTML_FONT_COLOR_RED,HTML_FONT_FACE_ODD,MAILTO_TO_SPAM_ADDR,\n\t      SPAM_PH
RASE_03_05,WEB_BUGS\n\tversion=2.43
Nov 25 20:46:23 ns4 sm-mta[50316]: gAQ1kL8G050316: Milter add: header: 
X-Spam-Level: ****
Nov 25 20:46:23 ns4 spamass-milter[47719]: mlfi_eom: exit
Nov 25 20:46:23 ns4 sm-mta[50323]: ruleset=try_tls, arg1=ns3.recycle.net, 
relay=ns3.recycle.net, reject=550 5.7.1 <address@hidden
d.com>... do not try TLS with ns3.recycle.net [207.245.212.98]
Nov 25 20:46:23 ns4 spamass-milter[47719]: mlfi_close
Nov 25 20:46:23 ns4 spamass-milter[47719]: mlfi_close
Nov 25 20:46:23 ns4 sm-mta[50323]: gAQ1kL8G050316: 
to=<address@hidden>, delay=00:00:01, xdelay=00:00:00, mailer=smtp, 
pri=30
478, relay=ns3.recycle.net. [207.245.212.98], dsn=2.0.0, stat=Sent 
(gAQ1kNsm029865 Message accepted for delivery)
Nov 25 20:46:24 ns4 spamass-milter[47719]: mlfi_envfrom: enter
Nov 25 20:46:24 ns4 spamass-milter[47719]: mlfi_envfrom: exit
Nov 25 20:46:26 ns4 sm-mta[50312]: gAQ1kK8G050312: from=<address@hidden>, 
size=357, class=0, nrcpts=1, msgid=<6f77my10ya0vx.1a8c2mip
address@hidden>, proto=SMTP, daemon=MTA, 
relay=lsanca1-ar2-015-190.lsanca1.dsl-verizon.net [4.33.15.190]
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_header: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_eoh: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::output exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_eoh: exit
Nov 25 20:46:26 ns4 spamass-milter[47719]: mlfi_eom: enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::input enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::empty_and_close_pipe enter
Nov 25 20:46:26 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:26 ns4 spamd[138]: connection from localhost [127.0.0.1] at 
port 4340
Nov 25 20:46:26 ns4 spamd[50326]: Still running as root: user not 
specified, not found, or set to root.  Fall back to nobody.
Nov 25 20:46:26 ns4 spamd[50326]: processing message 
<address@hidden> for root:65534, expecting 368 b
ytes.
Nov 25 20:46:28 ns4 spamd[50326]: identified spam (5.0/5.0) for root:65534 
in 1.1 seconds, 368 bytes.
Nov 25 20:46:28 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:28 ns4 spamass-milter[47719]: ::read_pipe enter
Nov 25 20:46:28 ns4 spamass-milter[47719]: ::read_pipe exit
Nov 25 20:46:28 ns4 spamass-milter[47719]: ::empty_and_close_pipe exit
Nov 25 20:46:28 ns4 spamass-milter[47719]: ::input exit
Nov 25 20:46:28 ns4 sm-mta[50312]: gAQ1kK8G050312: Milter add: header: 
X-Spam-Status: Yes, hits=5.0 required=5.0\n\ttests=CTYPE_JUST
_HTML,NO_REAL_NAME,RATWARE_SCREWUP_1,\n\t 
SPAM_PHRASE_00_01\n\tversion=2.43
Nov 25 20:46:28 ns4 sm-mta[50312]: gAQ1kK8G050312: Milter add: header: 
X-Spam-Flag: YES
Nov 25 20:46:28 ns4 sm-mta[50312]: gAQ1kK8G050312: Milter add: header: 
X-Spam-Report:   5.00 hits, 5 required;\n  *  2.5 -- Bulk ema
il software fingerprint (screwup 1) found in headers\n  *  1.3 -- From: 
does not include a real name\n  *  0.8 -- BODY: Spam phrases
 score is 00 to 01 (low)\n  *  0.4 -- HTML-only mail, with no text version
Nov 25 20:46:28 ns4 sm-mta[50312]: gAQ1kK8G050312: Milter add: header: 
X-Spam-Level: *****
Nov 25 20:46:28 ns4 sm-mta[50312]: gAQ1kK8G050312: Milter add: header: 
X-Spam-Checker-Version: SpamAssassin 2.43 (1.115.2.20-2002-10
-15-exp)
Nov 25 20:46:28 ns4 sm-mta[50312]: gAQ1kK8G050312: Milter delete: 
header  Content-Type: text/html;\n\t charset=us-ascii
Nov 25 20:46:28 ns4 sm-mta[50312]: gAQ1kK8G050312: 
milter_read(spamassassin): cmd read returned 0, expecting 5
Nov 25 20:46:28 ns4 sm-mta[50312]: gAQ1kK8G050312: Milter (spamassassin): 
to error state
Nov 25 20:46:28 ns4 sm-mta[50328]: ruleset=try_tls, arg1=ns3.recycle.net, 
relay=ns3.recycle.net, reject=550 5.7.1 <address@hidden>
... do not try TLS with ns3.recycle.net [207.245.212.98]
Nov 25 20:46:28 ns4 sm-mta[50328]: gAQ1kK8G050312: to=<address@hidden>, 
delay=00:00:03, xdelay=00:00:00, mailer=smtp, pri=30357, r
elay=ns3.recycle.net. [207.245.212.98], dsn=2.0.0, stat=Sent 
(gAQ1kSsm029956 Message accepted for delivery)
Nov 25 20:46:34 ns4 sm-mta[50330]: gAQ1kY8G050330: Milter (spamassassin): 
error connecting to filter: Connection refused by /var/run
/spamass-milter.sock
Nov 25 20:46:34 ns4 sm-mta[50330]: gAQ1kY8G050330: Milter (spamassassin): 
to error state
Nov 25 20:46:36 ns4 sm-mta[50330]: gAQ1kY8G050330: 
from=<address@hidden>, size=1217, class=0, nrcpts=1, 
msgid=<1021125182110.fa
address@hidden>, 
proto=SMTP, daemon=MTA, relay=adsl-64-217-194-27.texas
industrialfloors.com [64.217.194.27] (may be forged)
Nov 25 20:46:36 ns4 sm-mta[50332]: ruleset=try_tls, arg1=ns3.recycle.net, 
relay=ns3.recycle.net, reject=550 5.7.1 <address@hidden>
... do not try TLS with ns3.recycle.net [207.245.212.98]


The two spam messages that the system was processing dont look too strange, 
but I have appeneded them below to see if they can spot anything odd with them.


--------------------------------------

From address@hidden Mon Nov 25 20:46:28 2002
Return-Path: <address@hidden>
Received: from ns4.recycle.net (ns4.recycle.net [64.7.141.12])
        by ns.recycle.net (8.12.6/8.12.6) with ESMTP id gAQ1kSsm029956
        for <address@hidden>; Mon, 25 Nov 2002 20:46:28 -0500 (EST)
        (envelope-from address@hidden)
Received: from maila.microsoft.com 
(lsanca1-ar2-015-190.lsanca1.dsl-verizon.net [4.33.15.190])
        by ns4.recycle.net (8.12.6/8.12.6) with SMTP id gAQ1kK8G050312
        for <address@hidden>; Mon, 25 Nov 2002 20:46:25 -0500 (EST)
        (envelope-from address@hidden)
Content-Transfer-Encoding: 7BIT
Message-Id: <address@hidden>
Date: Mon, 25 Nov 2002 20:46:28 -0500
X-Mailer: X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Reply-To: address@hidden
To: address@hidden
From: address@hidden
Subject: .
X-Spam-Status: Yes, hits=5.0 required=5.0
        tests=CTYPE_JUST_HTML,NO_REAL_NAME,RATWARE_SCREWUP_1,
              SPAM_PHRASE_00_01
        version=2.43
X-Spam-Flag: YES
X-Spam-Report:   5.00 hits, 5 required;
  *  2.5 -- Bulk email software fingerprint (screwup 1) found in headers
  *  1.3 -- From: does not include a real name
  *  0.8 -- BODY: Spam phrases score is 00 to 01 (low)
  *  0.4 -- HTML-only mail, with no text version
X-Spam-Level: *****
X-Spam-Checker-Version: SpamAssassin 2.43 (1.115.2.20-2002-10-15-exp)


From address@hidden Mon Nov 25 20:46:37 2002
Return-Path: <address@hidden>
Received: from ns4.recycle.net (ns4.recycle.net [64.7.141.12])
        by ns.recycle.net (8.12.6/8.12.6) with ESMTP id gAQ1kasm030212
        for <address@hidden>; Mon, 25 Nov 2002 20:46:37 -0500 (EST)
        (envelope-from address@hidden)
Received: from adsl-64-217-194-27.texasindustrialfloors.com 
(adsl-64-217-194-27.texasindustrialfloors.com [64.217.194.27] (may be f
orged))
        by ns4.recycle.net (8.12.6/8.12.6) with SMTP id gAQ1kY8G050330
        for <address@hidden>; Mon, 25 Nov 2002 20:46:36 -0500 (EST)
        (envelope-from address@hidden)
Received: from cagf9722.com ([200.47.176.240]) by 
adsl-64-217-194-27.texasindustrialfloors.com (AppleShare IP Mail Server 
6.3.1) id
 800159 via TCP with SMTP; Mon, 25 Nov 2002 18:21:10 -0600
Message-id: 
<address@hidden>
From: "Sandra Jensen" <address@hidden>
Reply-To: address@hidden
To: address@hidden, address@hidden
CC: address@hidden, address@hidden, address@hidden, address@hidden,
   address@hidden, address@hidden
Date: Mon, 25 Nov 2002 18:53:56 -0500
Subject: Come Play With MYSELF And MY Friends.
MIME-Version: 1.0
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<HTML>

*** Come Check Out Me and My Happy Friends ****
Live webmcams, one on one chat and lots more.
Click here for our pics: <a 
href="http://ssvideos.com/teencam.html"; >http://ssvideos.com/teencam.html</a>
No one under 18 allowed to view this material!
 if you would like to be removed please click
here: <a 
href="http://ssvideos.com/remove.html";>http://ssvideos.com/remove.html</a>


</body></html>


-----------------------------------------------
--------------------------------------------------------------------
Mike Tancsa,                                      tel +1 519 651 3400
Sentex Communications,                            address@hidden
Providing Internet since 1994                    www.sentex.net
Cambridge, Ontario Canada                         www.sentex.net/mike