Web Hosting Forum | Lunarpages
News: July 14, 2008 - New Contest! - Submit Your WordPress Theme Designs, Win BIG!
August 5, 2008 - Time to Submit Your Links for the August 08 Site of the Month Award!
 
*
Welcome, Guest. Please login or register.
Did you miss your activation email?
August 21, 2008, 01:59:08 AM


Login with username, password and session length


Pages: [1] 2   Go Down
  Print  
Author Topic: Recent change to SpamAssassin?  (Read 1445 times)
gadgetfan
Intergalactic Cowboy
*****
Offline Offline

Posts: 52


« on: October 15, 2007, 01:22:49 PM »

After getting 20-50 junkmail messages a day for many months now, suddenly on Oct. 13 something seems to have changed, and then more change today.  I have SpamAssassin enabled, using Ian Douglas's training script.  Up until the 13th, spam was automatically routed to a spam folder for each user, with the Spam Assassin explanation of the spam score showing up and the original message attached as an .eml file.

As of sometime between 4:30am and 10:30am (Pacific time) on the 13th, all of my subject lines started to be rewritten with "***SPAM***" and the Spam Assassin score information was no longer attached.  Then today I seem to have stopped receiving spam altogether.  (I know, maybe I should just count my blessings).

In looking more carefully at the messages that DO have the subject line rewritten, it seems that all of the SpamAssassin information that used to be in the message body is ending up in the X-Spam-Report header, which is now quite long.  At least, it was for the period when I was receiving the rewritten subject messages.

I've gone into cpanel, disabled SpamAssassin, disabled the Spam box in SA, re-enabled both, and replaced my SpamAssassin user prefs file with the one recommended by Ian in his SA training thread.  Maybe it's too early to see if that's put things back the way they used to be, but I'm just curious if LP has made any SpamAssassin changes lately that could be responsible for what I'm seeing.  What most concerns me is that while SA was doing a good job, there was the occasional false positive, and I'm worried that now everything SA thinks is junk is just being discarded.

Has anyone experienced anything similar or obtained further information?  I'm on Jupiter, if it makes a difference.
Logged
Mitch
Lunarpages Traffic Cop
Senior Moderator
Berserker Poster
*****
Offline Offline

Posts: 7271



WWW
« Reply #1 on: October 15, 2007, 01:28:02 PM »

I don't think there have been any big changes that might have caused this to happen lately.  You might give it a little more time and see how it reacts.  Also are you having any issues getting regular non-spam message into your inbox?  Might send yourself a few test messages, or ask your friends to so you can make sure your not losing any important e-mails.
Logged

gadgetfan
Intergalactic Cowboy
*****
Offline Offline

Posts: 52


« Reply #2 on: October 15, 2007, 01:32:56 PM »

As far as I can tell, I've been receiving non-spam email normally today.  I've definitely received a few messages, and there aren't any others that I've been expecting that are conspicuously absent.  A test message I just sent from outside LP arrived almost immediately.  If I'd had a complete email outage, trust me, that would have been clear in my initial post  Smile
Logged
JimBrown
Knowing enough to be dangerous!
Jabba the Hutt
*****
Offline Offline

Posts: 746



WWW
« Reply #3 on: October 16, 2007, 08:08:43 AM »

Interesting.

At about the same time (late afternoon, October 13th) spam messages suddenly stopped arriving in my inbox. Since then, I have only been getting 2 or 3 per day. I used to get 50 to 100.

I have never configured SpamAssasin on my account, it has always been disabled. I have always preferred to filter spam with my email client at home after downloading them. I do this so that I can review the spam for any false positives.

Like gadgetfan, I am concerned that I may not be receiving all email that I should. To date, I have not noticed any missing email, other than the lack of spam.

I have a ticket open with support asking if any changes were made to email processing. So far, the response has been to try enabling then disabling SpamAssasin to see if that does anything. After a couple of days monitoring, I was about to reply to the ticket advising that there has been no change. I am still only receiving 2 or 3 spam messages per day.

I too would like to know if Lunarpages has made any changes to their email systems.

Regards,
...jim

PS. I have just updated my ticket, and included a link to this thread.
« Last Edit: October 16, 2007, 08:16:38 AM by JimBrown » Logged

JimBrown
Knowing enough to be dangerous!
Jabba the Hutt
*****
Offline Offline

Posts: 746



WWW
« Reply #4 on: October 21, 2007, 10:45:24 AM »

Update:

After providing Lunarpages support with a temporary password to my email account, they advise that they were able to send test spam messages which arrived in my inbox.

I then asked point blank if any changes had been made to the way Lunarpages handles incoming email, including the addition of any filtering (other than SpamAssasin if enable by the client.) Their response was "No changes have been made."

Apparently, our email addresses somehow have been dropped from spam lists. Not that I'm complaining about that! But, it does make one worry for a bit wondering if one is missing any legitimate email. So far, I am not missing anything (other than spam. Heh.)

Since then, I have started to receive spam again, but at a very low rate.

I guess I'll enjoy it while it lasts.

Regards,
...jim
Logged

wektech
Jabba the Hutt
*****
Offline Offline

Posts: 686


WWW
« Reply #5 on: October 21, 2007, 11:01:15 AM »

I too have noticed a significant reduction in the amout of spam mail I am getting for the last week or so.
Logged

favcat
Space Explorer
***
Offline Offline

Posts: 9


« Reply #6 on: October 25, 2007, 02:32:32 PM »

They definitely changed something.  And I am missing email.  They are from mailing lists that could easily be viewed as spam but they are not.  But they aren't being delivered to me so I'm not able to filter them myself - they are just missing. 

And I'm most annoyed because one is from my favorite restaurant - where the heck are my coupons and specials??? They have no idea the Thai food withdrawal pains I'm suffering.  Lunarpages definitely owes me a curry.

We are missing email - something changed.  I want my spam back!

I was told that the way spam assassin is integrated into cpanel did change - so they are full of it when they say it didn't. It did.  Question is what is the change and how do we get our email back?
Logged
wektech
Jabba the Hutt
*****
Offline Offline

Posts: 686


WWW
« Reply #7 on: October 25, 2007, 02:50:26 PM »

I have totally turned off spam assassin and I still am receiving almost no spam or other mail either. Every test I have tried from other mail accounts is getting through, but without confirmation from LP of some other mechanism being in place, I still wonder if legit mail is being bounced that I do not know about. It is just too strange that somehow the account dropped from 20 or more spam messages a day to almost nothing.
Logged

favcat
Space Explorer
***
Offline Offline

Posts: 9


« Reply #8 on: October 25, 2007, 03:12:41 PM »

Support did tell me in email that changes were made to cpanel and spamassassin - maybe they configured it incorrectly on some of the servers.

What server are people on that are having this problem?  I'm on dewi.
Logged
AdrianAvadani
zombie
SysAdmin
Space Explorer
*****
Offline Offline

Posts: 9


WWW
« Reply #9 on: October 28, 2007, 03:54:53 AM »

Hello everyone,

None of our servers are having an "abnormal" configuration, as we usually try to run similar, tested versions across all our servers. That being said, the newest CPanel versions (+11) have quite a different way of handling spam, mostly because of the new version of SA thats been implemented. Also, the new exim configurations (which, again, are quite similar across every shared server) are making more use of the RBL kind of lists, regardless of the Spam Assassin settings. As a result, even if the sender tries to reach his friend with a legit email, if he is doing it from a "well known, spamming IP", then the message will (likely) be bounced back with a message concerning the block.

This is of a great help since:
a) it helps us keeping your mailboxes cleaner, which, in turn
b) has a good effect on the server load (and performance) and
c) ensures that no emails are actually lost, because of the bounceback (the sender WILL known that he couldn't reach his receipt).

However, if you do notice any loss of emails, please contact us immediately so we can check the logs and ensure that everything is actually functioning as planned.


Thank you Smile
Logged

Adrian Avadani
System Administrator Team

Telephone: 1-714-521-8150
Fax: 1-714-521-8195
Debbie
Spacescooter Operator
*****
Offline Offline

Posts: 36


Some people just wake up to be offended!


WWW
« Reply #10 on: October 30, 2007, 01:33:53 PM »

 Bouncin for Joy I noticed a decrease in spam also (about 100 - 200 a day to practically nil). I don't care what happened to it! I'm not noticing that I'm missing anything at all. So, why mess with success.

Maybe someone shut down a spam server somewhere? (It could happen!)   Rofl

Debbie
Logged

"Sooner or later, you are going to learn, just as I did, that there is  a difference between KNOWING the path and WALKING the path."  ~Morpheus, from The Matrix~
MrPhil
Quantum Encyclopedia Writer
*****
Offline Offline

Posts: 3201



« Reply #11 on: October 31, 2007, 09:15:50 AM »

LP does run SpamAssassin regardless of whether you have it enabled or not. I have never explicitly enabled SA (on Mizar), yet once in a while I get a message marked "SpamAssassin thinks this is spam" or something to that effect. I'm receiving email on Thunderbird on my PC (not Webmail), and don't have SA installed there, so where else could it be?
Logged

wektech
Jabba the Hutt
*****
Offline Offline

Posts: 686


WWW
« Reply #12 on: October 31, 2007, 10:36:00 AM »

I have noticed that a certain "powerful" webhost runs their outbound traffic sent via webmail through spamassasin, I am not sure why. It is also interesting to note that smtp traffic on the same account is not processed through SA.

I was seeing SA headers even though I had SA disabled on my LP account and noticed that they all came from the same host. As I manage several sites on that host, I tried a little experimenting to find the source of the mystery headers. I had no luck recreating the odd headers until I used their webmail interface to send a message.
Logged

gadgetfan
Intergalactic Cowboy
*****
Offline Offline

Posts: 52


« Reply #13 on: November 01, 2007, 03:43:13 PM »

While overall, I think LP provides decent value for the price, it's cases like this where the lack of communication and consistency from LP staff gets frustrating.  Here's a condensed history of my interactions with LP on this issue, with text highlighted in red to indicate conflicting explanations.  I know comments can be misinterpreted out of context, so I'm doing my best to preserve the flow of the "conversation" without pasting the whole thing, but I'll happily provide the full ticket text to anyone who's interested.

On Oct. 15, I posted the initial message at the top of this thread (which, I concede, is not an official support ticket request), asking what, if any, changes had been made over the past few days

In less than 10 minutes, Mitch advises that he's unaware of any relevant changes

On Oct. 17, I open a support ticket asking essentially the same questions.  Specifically,
Quote
Can you please advise on what, if any, changes were made over the weekend? If no changes were made, can you explain the sudden SpamAssassin changes and reduced spam volume?

10 minutes later, I receive a response from JohnnyStaggs saying that there have been no changes on LP's end, but the question of what could cause the change in SA behavior is not addressed

After a couple more rounds of back-and-forth the same day, I ask again
Quote
Is there any explanation for why my spam volume would have suddenly decreased over the weekend, at the same time that Spam Assassin changed its behavior without intervention from me?

After a one-week lapse, LP informs me that
Quote from: Suzanne Turner
The header rewrite change was due to the change in cpanel that came with the upgrade to your server

I request confirmation that there HAS been a recent cPanel upgrade, and am told
Quote from: StevenPriest
The Jupiter server was actually migrated to new hardware at the end of July and a cPanel upgrade accompanied that migration. There have been no updates to server software, or any reported issues with Jupiter since the migration occurred

On Oct. 28, After complying with an LP request for a test account on my domain, I'm told (by Adrian, who has commented above in this thread)
Quote from: AdrianAvadani
Since we have switched to CPanel 11, the exim configuration has been slightly modified as we are now using RBL lists in order to prevent the incoming spam messages.
His response is very similar to what he posted in this thread.  I'm not sure why it took so long for someone to just state that LP has started using RBL lists...that would have explained a lot.

This is followed by a couple more rounds of me asking for greater detail on what changes were implemented when, since so far, everything has said or implied that the changes took place in July, which wouldn't explain a mid-October behavior change.

Today, Nov. 1, Adrian informs me that
Quote from: AdrianAvadani
From what i can see, what happened in July was a server migration due to a hardware error. Scripts have been updated then as well, however the changes are due to the latest CPanel updates, done on around 13th october (unfortunately im not sure of the exact date when this has occurred).

So it took over two weeks to get what still amounts to conflicting information (or a lack of information among at least some of the LP staff).  I'm trying to give LP the benefit of the doubt here...there are a lot of servers, and I'm sure a lot of support staff, but shouldn't there be some sort of reasonably accessible master list (at least to the support staff, if not the subscribers) of changes made on each server?  I would think that it should have been relatively simple for someone, upon seeing my initial ticket, to look up that information and say, "Yes, there was a cPanel update around Oct. 13."  Even if that particular tech didn't know that it caused both changes to SpamAssassin behavior and implemented RBL list checks, at least we would have known that something had changed.  The first few LP staff to address my questions seemed to not know at all that anything had changed in mid-October.

With respect to at least the complaints I've personally had about LP service and support, the consistent theme is a failure of communication, either by lack of correct/consistent information, or simply an overall lack of communication.  I'm still here, which must say something about the fact that nothing has yet pushed to me leave LP, but it's still an area in which I think LP has significant room for improvement.
« Last Edit: November 02, 2007, 02:26:03 PM by gadgetfan » Logged
herbda2
Intergalactic Cowboy
*****
Offline Offline

Posts: 56


« Reply #14 on: November 02, 2007, 01:19:37 AM »

Yeah I got same problems as well .. and I keep on getting internal errors from Squirrel Mail .. I know that I am losing mail I have sent test messages that never arrive.   Confused
Logged
Pages: [1] 2   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.3 | SMF © 2006-2007, Simple Machines LLC
Seo4Smf v0.2 © Webmaster's Talks


Valid XHTML 1.0! Valid CSS! Dilber MC Theme by HarzeM