Re: Could not extract score from <>

[Chris Crowley]

> Line wrapping fixed.  When you paste logfiles, it's much easier to read them
> if you leave them as one line per log entry:

Just a tip, if you use a client that always wraps lines, you could 
attach the log entries in a .txt file that you make with a text editor 
like notepad.  (People don't generally like attachments on lists, YMMV.)

>  
>
> > Aug  1 11:04:50 gate spamass-milter[5349]: Could not extract score from <>

> > I am wondering whether spammers are now attempting to exploit a problem
> > with the software that causes this error to occur and allow their spam

> spamass-milter can't find the X-Spam-Status: header.  It could be caused by
> a parsing bug.
>  

I see this error message in my logs, too.  But it usually correlates to 
times when spamd has failed.  Has there been a marked increase in e-mail 
traffic?

Are you experiencing timeouts on remote checks?  When you see the "Could 
not extract score..." error message occurring, you could try restarting 
your spamd with "-L" so that you only do local checking.  I found at one 
time that our DNS/pyzor/razor/... queries were delayed because of a 
congested uplink.  Running spamd with "-L" for the short term was the 
best solution in that case because spamd would respond very quickly with 
the remote checks disabled.  This decreases spamd's accuracy, but it 
would be more likely to catch spam than if it provides no response at all!

One last item worth considering is timing your response from spamd.  I 
use a simple netcat script to check if spamd is answering.  You might do 
something with time/timex to check the response timing to see if you are 
timing out for spamd when this problem is occurring:

"echo quit | nc -w 45 localhost 783"

You could record / graph the response time, and correlate that with 
error messages in your logs to see if this is the problem.

There may in fact be a parsing bug, but I wanted to add anecdotal 
experience I've had with that same error message in the log -- it 
usually is related to a failure or slowdown in spamd's response.


--
Christopher Crowley
address@hidden
(504) 314-2535
Network Administrator
Technology Services

ccrowley.vcf
Description: Vcard