Re: Mail gateway server with amavis on CentOS 8

On 28/12/2020 3:35 μ.μ., Matus UHLAR - fantomas wrote:

> ...however I see /var/spool/amavisd/.spamassassin and 
> /var/spool/amavisd/var/.spamassassin
> and those are two directories.
>

You are right.

The former is unused:

    # ls -la /var/spool/amavisd/.spamassassin/
    total 8
    drwx------. 2 amavis amavis 4096 Dec 21 15:09 .
    drwxr-x---. 9 amavis amavis 4096 Dec 21 15:22 ..

If I remember right, I had created it experimentally at some point.

> what is the homedir of "amavis" user? 

# cat /etc/passwd | grep amavis
amavis:x:988:983:User for amavis:/var/spool/amavisd:/bin/sh

/var/spool/amavisd is the standard home on CentOS packages.

Any ideas will be welcome!

Some debug info from amavisd.log regarding bayes:

When starting:

Dec 28 16:30:07 mailgw1 amavis[258129]: SpamAssassin debug facilities: bayes
Dec 28 16:30:08 mailgw1 amavis[258129]: SA dbg: bayes: learner_new 
self=Mail::SpamAssassin::Plugin::Bayes=HASH(0x560a59d2ff70), 
bayes_store_module=Mail::SpamAssassin::BayesStore::DBM
Dec 28 16:30:08 mailgw1 amavis[258129]: SA dbg: bayes: learner_new: got 
store=Mail::SpamAssassin::BayesStore::DBM=HASH(0x560a5a4919e8)
Dec 28 16:30:08 mailgw1 amavis[258129]: SA dbg: bayes: tie-ing to DB 
file R/O /var/spool/amavisd/var/.spamassassin/bayes_toks
Dec 28 16:30:08 mailgw1 amavis[258129]: SA dbg: bayes: tie-ing to DB 
file R/O /var/spool/amavisd/var/.spamassassin/bayes_seen
Dec 28 16:30:08 mailgw1 amavis[258129]: SA dbg: bayes: found bayes db 
version 3
Dec 28 16:30:08 mailgw1 amavis[258129]: SA dbg: bayes: DB journal sync: 
last sync: 1609127225
Dec 28 16:30:09 mailgw1 amavis[258129]: SA dbg: bayes: untie-ing

When examimining an email:

Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) CALLING SA check (0)
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
tie-ing to DB file R/O /var/spool/amavisd/var/.spamassassin/bayes_toks
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
tie-ing to DB file R/O /var/spool/amavisd/var/.spamassassin/bayes_seen
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: found 
bayes db version 3
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: DB 
journal sync: last sync: 1609127225
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
corpus size: nspam = 2982, nham = 2308
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
tokenized body: 1528 tokens
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
tokenized uri: 420 tokens
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
tokenized invisible: 0 tokens
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for *p = "U*imaptest D*example.com D*com"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for X-Amavis-PolicyBank = ""
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for X-Amavis-MessageSize = "183729"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for *f = "<[email protected]>"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for To = "U*recipient D*example.com D*com"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for *F = "U*imaptest D*example.com D*com"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for X-Forwarded-Message-Id = 
"<[email protected]>"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for *M = " b7d1e507 fc7a fd5f d3e4 604a1b508af0 example com "
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for *u = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; 
rv:78.0) Gecko/20100101 Thunderbird/78.6.0"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for MIME-Version = ""
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for *i = "<[email protected]>"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for *ct = "multipart/mixed; ------------ 
HHHHHHHHHHHHHHHHHHHHHHHH"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for Content-Language = "en-US"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for x-spam-relays-external = " [ ip=***.***.***.*** 
rdns=admin4.example.com helo=!***.***.***.***! by=mailgw1.example.com 
ident= envfrom= intl=0 id=4D4Kjs4H7LzLlXv auth= msa=0 ]"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for x-spam-relays-internal = " "
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for *RT = " "
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for *RU = " [ ip=***.***.***.xxx rdns=admin4.example.com 
helo=!***.***.***.***! by=mailgw1.example.com ident= envfrom= intl=0 
id=4D4Kjs4H7LzLlXv auth= msa=0 ]"
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
header tokens for *r = " [***.***.*** ip****.***.***.xxx ] 
(admin4.example.com [***.***.*** ip****.***.***.*** ]) by 
mailgw1.example.com (XXX Mail Srv) <[email protected]>; "
Dec 28 16:31:32 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: 
tokenized header: 84 tokens
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Hx-spam-relays-external:auth' => 1.80127897503432e-05
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Hx-spam-relays-external:ident' => 1.80127897503432e-05
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Hx-spam-relays-external:mailgw1.example.com' => 1.80127897503432e-05
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Hx-spam-relays-external:helo' => 1.80127897503432e-05
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Hx-spam-relays-external:rdns' => 1.80127897503432e-05
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Hx-spam-relays-external:msa' => 1.80127897503432e-05
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Hx-spam-relays-external:intl' => 1.80127897503432e-05
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Hx-spam-relays-external:envfrom' => 1.80127897503432e-05
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*r:***.***.***' => 0.000105469515781219
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*u:10.0' => 0.000132262558387282
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Forwarded' => 0.000358427714856762
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*r:sk:admin4.' => 0.00107385229540918
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*r:ip****.***.***.***' => 0.0011503920171062
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'[email protected]' => 0.00134164588528678
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'egeexample.com' => 0.00134164588528678
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'U*egera' => 0.00134164588528678
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'sk:martin' => 0.99861814556331
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'sk:martin.' => 0.99861814556331
...
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'archivio' => 0.998028449502134
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'975' => 0.00200996264009963
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'U*akaza' => 0.00229587482219061
...
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'THANKS' => 0.997701492537313
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Portfolio' => 0.996560794044665
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*p:D*example.com' => 0.0038691094021318
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Pilot' => 0.995425742574258
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'again!' => 0.993172413793104
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'PSI' => 0.993172413793104
...
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*u:20100101' => 0.0117280933454805
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'sri' => 0.986543689320388
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Still' => 0.986543689320388
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'OK' => 0.986543689320388
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'thanks!' => 0.0330610845076257
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*u:Windows' => 0.0361758023213184
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'forwarded' => 0.0387378669727604
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*UA:10.0' => 0.0423035480713656
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'EXAMPLE' => 0.0476483462574561
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*UA:20100101' => 0.0486626841109365
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*UA:Thunderbird' => 0.0509786578675443
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*u:Thunderbird' => 0.0509786578675443
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'again' => 0.0518634083926762
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'hours' => 0.0519881776820482
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*u:Mozilla' => 0.0522048764912657
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*u:Gecko' => 0.0522048764912657
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'example' => 0.0543063485876463
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*u:5.0' => 0.05572079000307
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Kostas' => 0.0759937556972057
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'tomorrow' => 0.0793126351528278
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'auth' => 0.0805598590217134
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*r:mailgw1.example.com' => 0.910903426065397
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'2020' => 0.0926080608304338
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'kostas' => 0.100107369239404
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'missing' => 0.106691116776113
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*UA:Win64' => 0.884635170069726
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*UA:x64' => 0.884635170069726
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*UA:Mozilla' => 0.119342261050237
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*UA:Gecko' => 0.119342261050237
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*M:example' => 0.128342656685796
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'fwd' => 0.132735674527173
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'H*UA:5.0' => 0.139860356881026
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'Message' => 0.140983424392774
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'reminder' => 0.141600743125293
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'UD:example.com' => 0.144970890148895
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: token 
'D*example.net' => 0.153281181261131
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: score 
= 0.00494515373509247
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: DB 
expiry: tokens in DB: 142147, Expiry max size: 300000, Oldest atime: 
1597503752, Newest atime: 1609147617, Last expire: 1608557188, Current 
time: 1609165893
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: DB 
journal sync: last sync: 1609127225
Dec 28 16:31:33 mailgw1 amavis[258130]: (258130-01) SA dbg: bayes: untie-ing

Cheers,
Nick