munin-node amavis spam stats

[Tim Kuijsten]

Binary package hint: munin

The amavis plugin of munin-node displays 0 for "probably spam" and "surely spam" statistics. This is because it does the wrong `grep` on the mail log file.

The included patch has 2 altered grep statements
sure spam is a grep for 'Blocked SPAM'
and probably spam is a grep for messages with a "Hits" score between 4 and 10

The default Ubuntu SpamAssassin configuration will tag messages with a score above 2.0 and mark messages as Blocked SPAM if it has a score above 6.31.

[Andres Rodriguez (andreserl)]

Hi there!

Thank you for reporting bugs and trying to make Ubuntu better.

Can you please specify which Ubuntu versions are affected by this and what version of the software in question?

For now, I'll be marking this bug as incomplete as the required information is obtained.

Thank you again!

[Tim Kuijsten (kuijsten)]

I'm using Ubuntu 10.04.1 and munin-node 1.4.4-1ubuntu1 from the default repositories without customizations.

as a side note. I think it would be more appropriate to change the line in the graph containing "surely spam" to "blocked as spam", see the attached patch.

[Daniel Hahler (blueyed)]

Marking as Triaged.
Please note that you can easily add required information to a bug using "apport-collect $BUGNR".

Apart from that, this should get submitted to the upstream bug tracker, if it still affects the current upstream release - which is the case apparently: http://munin-monitoring.org/browser/trunk/plugins/node.d/amavis.in

I wonder why this has not been reported against the munin project though.

Tim, do you feel like forwarding it to the upstream tracker at http://munin-monitoring.org/newticket (requires an account there), or should I do this for you?

[Daniel Hahler (blueyed)]

I have now looked at the log format/output.
Looking for "Blocked SPAM" is clearly a good idea when counting blocked spams, which the other pattern depends on the configuration.
Would it be possible to get the barrier for spam easily from the amavis conf, and then use this for the "maybe spam" pattern?

[Tim Kuijsten (kuijsten)]

> Tim, do you feel like forwarding it to the upstream tracker at http://munin-monitoring.org/newticket (requires an account there), or should I do this for you?

Daniel, the reason I didn't submit it there was idd because I had to register and didn't find any links to do so at the time. So launchpad was easier for me. Please submit it overthere if you have an account.

> Would it be possible to get the barrier for spam easily from the amavis conf, and then use this for the "maybe spam" pattern?

I'm not aware of any utilities to extract a config-item like this, but I'm pretty new to Debian/Ubuntu and can imagine they have tools for it..

[Tim Kuijsten (kuijsten)]

reported to munin-monitoring.org bug tracker: http://munin-monitoring.org/ticket/1104

[Tim Kuijsten (kuijsten)]

the previous attachment was a reverse patch, now it should apply.

[Simon Déziel (sdeziel)]

Tim, your patch in comment #1 is definitely an improvement but I think the definition of a probable spam ("SPAMMY") should be revised as that is configurable in Amavis. Would it be possible to grep for 'Passed SPAMMY' instead ?

"Passed SPAMMY" is used by Amavis for messages with hits between $sa_tag2_level_deflt and $sa_kill_level_deflt.

[Tim Kuijsten (kuijsten)]

Simon, I have never seen the string "Passed SPAMMY" in my logs, are you also using amavisd-new 1:2.6.4-1ubuntu5 shipped with 10.04 and are these strings appearing in your /var/log/mail.log?

[Kenyon Ralph (kralph)]

Is there any consensus on what needs to be done here? I'll gladly apply a patch upstream if there is agreement on what must be done.