Page 1 of 2 12 LastLast
Results 1 to 10 of 13

Thread: [SOLVED] Spam headers missing after upgrading to Zimbra CS 7

  1. #1
    Join Date
    Mar 2011
    Posts
    9
    Rep Power
    4

    Default [SOLVED] Spam headers missing after upgrading to Zimbra CS 7

    I have recently upgraded Zimbra-6.0.10(OSS) to Zimbra-7 (GA). Everything went smoothly except SPAM filters. The zimbra.log shows all the services are working perfectly. However, the spam filters doesn't seem to work properly and the *show original* doesn't display any of the SPAM headers.

    I tried by sending the GTUBE and it is also directly delivered in inbox without any spam headers.

    How can I troubleshoot this issue?

    thanks in advance.

  2. #2
    Join Date
    Jun 2008
    Location
    Berkeley, CA
    Posts
    1,474
    Rep Power
    9

    Default

    What do you get with zmcontrol status?

    zimbra.log should actually show the entire path of incoming mail, not only SMTP reception from remote host, but also internal SMTP relay to amavis and then back for final delivery into mailboxes. It might help to post a log excerpt showing delivery.

  3. #3
    Join Date
    Mar 2011
    Posts
    9
    Rep Power
    4

    Default

    Code:
    [zimbra@indigo ~]$ zmcontrol status
    Host abc.xyz.com
    	antispam                Running
    	antivirus               Running
    	ldap                    Running
    	logger                  Running
    	mailbox                 Running
    	mta                     Running
    	snmp                    Running
    	spell                   Running
    	stats                   Running
    	zmconfigd               Running
    Here is the log when I tried to send a mail from my gmail account to our domain(I have changed the actual domain name to prevent spammers)

    Code:
    2011-03-15T08:41:59.940703-04:00 indigo postfix/smtpd[24220]: E5A2728079: client=mail-ww0-f43.google.com[74.125.82.43]
    2011-03-15T08:42:00.131201-04:00 indigo postfix/cleanup[30467]: E5A2728079: message-id=<AANLkTim60ks6rpyimh_GDfSKgzwzTMWgLAoVNX84OV_M@mail.gmail.com>
    2011-03-15T08:42:00.193191-04:00 indigo postfix/qmgr[25208]: E5A2728079: from=<sender@gmail.com>, size=1841, nrcpt=1 (queue active)
    2011-03-15T08:42:00.223728-04:00 indigo amavis[26076]: (26076-02) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20110315T081002-26076: <sender@gmail.com> -> <receiver@abc.com> SIZE=1841 Received: from xyz.abc.com ([127.0.0.1]) by localhost (xyz.abc.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <receiver@abc.com>; Tue, 15 Mar 2011 08:42:00 -0400 (EDT)
    2011-03-15T08:42:08.095623-04:00 indigo zmmailboxdmgr[30834]: status requested
    2011-03-15T08:42:08.095713-04:00 indigo zmmailboxdmgr[30834]: status OK
    2011-03-15T08:42:20.268268-04:00 indigo amavis[26076]: (26076-02) Checking: 72ClEiJ8diC7 [74.125.82.43] <sender@gmail.com> -> <receiver@abc.com>
    2011-03-15T08:42:20.345481-04:00 indigo postfix/smtpd[31013]: connect from localhost.localdomain[127.0.0.1]
    2011-03-15T08:42:20.349703-04:00 indigo postfix/smtpd[31013]: 555A32807A: client=localhost.localdomain[127.0.0.1]
    2011-03-15T08:42:20.350935-04:00 indigo postfix/cleanup[30467]: 555A32807A: message-id=<AANLkTim60ks6rpyimh_GDfSKgzwzTMWgLAoVNX84OV_M@mail.gmail.com>
    2011-03-15T08:42:20.405912-04:00 indigo postfix/qmgr[25208]: 555A32807A: from=<sender@gmail.com>, size=2619, nrcpt=1 (queue active)
    2011-03-15T08:42:20.405960-04:00 indigo postfix/smtpd[31013]: disconnect from localhost.localdomain[127.0.0.1]
    2011-03-15T08:42:20.406780-04:00 indigo amavis[26076]: (26076-02) FWD via SMTP: <sender@gmail.com> -> <receiver@abc.com>,BODY=7BIT 250 2.0.0 Ok, id=26076-02, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 555A32807A
    2011-03-15T08:42:20.413484-04:00 indigo amavis[26076]: (26076-02) Passed CLEAN, [74.125.82.43] [74.125.82.43] <sender@gmail.com> -> <receiver@abc.com>, Message-ID: <AANLkTim60ks6rpyimh_GDfSKgzwzTMWgLAoVNX84OV_M@mail.gmail.com>, mail_id: 72ClEiJ8diC7, Hits: -, size: 1841, queued_as: 555A32807A, dkim_id=sender@gmail.com, 20197 ms
    2011-03-15T08:42:20.415107-04:00 indigo postfix/smtp[30472]: E5A2728079: to=<receiver@abc.com>, orig_to=<receiver1@abc.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=86, delays=66/0.02/0/20, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=26076-02, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 555A32807A)
    2011-03-15T08:42:20.429638-04:00 indigo postfix/qmgr[25208]: E5A2728079: removed
    2011-03-15T08:42:20.533271-04:00 indigo postfix/lmtp[31014]: 555A32807A: to=<receiver@abc.com>, relay=xyz.abc.com[nn.nnn.nnn.nnn]:7025, delay=0.18, delays=0.06/0.03/0/0.1, dsn=2.1.5, status=sent (250 2.1.5 Delivery OK)
    2011-03-15T08:42:20.533507-04:00 indigo postfix/qmgr[25208]: 555A32807A: removed
    2011-03-15T08:42:25.755427-04:00 indigo postfix/smtpd[30445]: connect from xyz.abc.com[nn.nnn.nnn.nnn]
    2011-03-15T08:42:25.755519-04:00 indigo postfix/smtpd[30445]: disconnect from xyz.abc.com[nn.nnn.nnn.nnn]
    2011-03-15T08:42:30.278952-04:00 indigo postfix/smtpd[24220]: disconnect from mail-ww0-f43.google.com[74.125.82.43]

  4. #4
    Join Date
    Jun 2008
    Location
    Berkeley, CA
    Posts
    1,474
    Rep Power
    9

    Default

    Well, it is being passed through amavis, but amavis isn't showing any hits at all. This is probably why no spam headers are added.

    You might want to examine your /opt/zimbra/conf/amavisd.conf -- or post it here. Also post output of ls -l /opt/zimbra/conf/spamassassin to make sure all the files are there.

  5. #5
    Join Date
    Feb 2011
    Posts
    82
    Rep Power
    4

    Default

    Try:
    Code:
    grep content_filter /opt/zimbra/postfix/conf/main.cf

  6. #6
    Join Date
    Mar 2011
    Posts
    9
    Rep Power
    4

    Default

    @ewilen
    Here is the output of ls -l /opt/zimbra/conf/spamassassin:
    Code:
    # ls -l /opt/zimbra/conf/spamassassin/
    total 1264
    -r--r--r-- 1 zimbra zimbra   8318 Mar  5 00:16 10_default_prefs.cf
    -r--r--r-- 1 zimbra zimbra   7612 Mar  5 00:16 20_advance_fee.cf
    -r--r--r-- 1 zimbra zimbra   7986 Mar  5 00:16 20_aux_tlds.cf
    -r--r--r-- 1 zimbra zimbra   7005 Mar  5 00:16 20_body_tests.cf
    -r--r--r-- 1 zimbra zimbra   1894 Mar  5 00:16 20_compensate.cf
    -r--r--r-- 1 zimbra zimbra  11832 Mar  5 00:16 20_dnsbl_tests.cf
    -r--r--r-- 1 zimbra zimbra  14998 Mar  5 00:16 20_drugs.cf
    -r--r--r-- 1 zimbra zimbra  11492 Mar  5 00:16 20_dynrdns.cf
    -r--r--r-- 1 zimbra zimbra   8117 Mar  5 00:16 20_fake_helo_tests.cf
    -r--r--r-- 1 zimbra zimbra   3159 Mar  5 00:16 20_freemail.cf
    -r--r--r-- 1 zimbra zimbra  36137 Mar  5 00:16 20_freemail_domains.cf
    -r--r--r-- 1 zimbra zimbra  25738 Mar  5 00:16 20_head_tests.cf
    -r--r--r-- 1 zimbra zimbra  10504 Mar  5 00:16 20_html_tests.cf
    -r--r--r-- 1 zimbra zimbra   5287 Mar  5 00:16 20_imageinfo.cf
    -r--r--r-- 1 zimbra zimbra   3330 Mar  5 00:16 20_meta_tests.cf
    -r--r--r-- 1 zimbra zimbra   1880 Mar  5 00:16 20_net_tests.cf
    -r--r--r-- 1 zimbra zimbra   8069 Mar  5 00:16 20_phrases.cf
    -r--r--r-- 1 zimbra zimbra   2062 Mar  5 00:16 20_****.cf
    -r--r--r-- 1 zimbra zimbra  15856 Mar  5 00:16 20_ratware.cf
    -r--r--r-- 1 zimbra zimbra   5535 Mar  5 00:16 20_uri_tests.cf
    -r--r--r-- 1 zimbra zimbra  19305 Mar  5 00:16 20_vbounce.cf
    -r--r--r-- 1 zimbra zimbra   2549 Mar  5 00:16 23_bayes.cf
    -r--r--r-- 1 zimbra zimbra   1544 Mar  5 00:16 25_accessdb.cf
    -r--r--r-- 1 zimbra zimbra   1536 Mar  5 00:16 25_antivirus.cf
    -r--r--r-- 1 zimbra zimbra   1544 Mar  5 00:16 25_asn.cf
    -r--r--r-- 1 zimbra zimbra   2331 Mar  5 00:16 25_dcc.cf
    -r--r--r-- 1 zimbra zimbra   4407 Mar  5 00:16 25_dkim.cf
    -r--r--r-- 1 zimbra zimbra   2929 Mar  5 00:16 25_hashcash.cf
    -r--r--r-- 1 zimbra zimbra   1310 Mar  5 00:16 25_pyzor.cf
    -r--r--r-- 1 zimbra zimbra   3389 Mar  5 00:16 25_razor2.cf
    -r--r--r-- 1 zimbra zimbra   7672 Mar  5 00:16 25_replace.cf
    -r--r--r-- 1 zimbra zimbra   3100 Mar  5 00:16 25_spf.cf
    -r--r--r-- 1 zimbra zimbra   1768 Mar  5 00:16 25_textcat.cf
    -r--r--r-- 1 zimbra zimbra   8618 Mar  5 00:16 25_uribl.cf
    -r--r--r-- 1 zimbra zimbra  28494 Mar  5 00:16 30_text_de.cf
    -r--r--r-- 1 zimbra zimbra  20805 Mar  5 00:16 30_text_fr.cf
    -r--r--r-- 1 zimbra zimbra   1858 Mar  5 00:16 30_text_it.cf
    -r--r--r-- 1 zimbra zimbra  22043 Mar  5 00:16 30_text_nl.cf
    -r--r--r-- 1 zimbra zimbra  18189 Mar  5 00:16 30_text_pl.cf
    -r--r--r-- 1 zimbra zimbra   3331 Mar  5 00:16 30_text_pt_br.cf
    -r--r--r-- 1 zimbra zimbra  49608 Mar  5 00:16 50_scores.cf
    -r--r--r-- 1 zimbra zimbra   9288 Mar  5 00:16 60_adsp_override_dkim.cf
    -r--r--r-- 1 zimbra zimbra   1304 Mar  5 00:16 60_awl.cf
    -r--r--r-- 1 zimbra zimbra   2178 Mar  5 00:16 60_shortcircuit.cf
    -r--r--r-- 1 zimbra zimbra   4984 Mar  5 00:16 60_whitelist.cf
    -r--r--r-- 1 zimbra zimbra   6148 Mar  5 00:16 60_whitelist_dkim.cf
    -r--r--r-- 1 zimbra zimbra   3584 Mar  5 00:16 60_whitelist_spf.cf
    -r--r--r-- 1 zimbra zimbra   1914 Mar  5 00:16 60_whitelist_subject.cf
    -r--r--r-- 1 zimbra zimbra 266322 Mar  5 00:16 72_active.cf
    -r--r--r-- 1 zimbra zimbra   5236 Mar  5 00:16 72_scores.cf
    -r--r--r-- 1 zimbra zimbra   2123 Mar  5 00:16 73_sandbox_manual_scores.cf
    -rw-r--r-- 1 zimbra zimbra    896 Sep  1  2010 FromNotReturnPath.pm
    -r--r--r-- 1 zimbra zimbra   1495 Mar  5 00:16 STATISTICS-set0-72_scores.cf.txt
    -r--r--r-- 1 zimbra zimbra  61569 Mar  5 00:16 STATISTICS-set0.txt
    -r--r--r-- 1 zimbra zimbra   1494 Mar  5 00:16 STATISTICS-set1-72_scores.cf.txt
    -r--r--r-- 1 zimbra zimbra  69230 Mar  5 00:16 STATISTICS-set1.txt
    -r--r--r-- 1 zimbra zimbra      0 Mar  5 00:16 STATISTICS-set2-72_scores.cf.txt
    -r--r--r-- 1 zimbra zimbra  61568 Mar  5 00:16 STATISTICS-set2.txt
    -r--r--r-- 1 zimbra zimbra      0 Mar  5 00:16 STATISTICS-set3-72_scores.cf.txt
    -r--r--r-- 1 zimbra zimbra  69236 Mar  5 00:16 STATISTICS-set3.txt
    -r--r--r-- 1 zimbra zimbra   9238 Mar  5 00:16 active.list
    -rw-r----- 1 zimbra zimbra   9418 Sep  6  2010 header_check.cf
    -r--r--r-- 1 zimbra zimbra   1299 Mar  5 00:16 init.pre
    -r--r--r-- 1 zimbra zimbra 101479 Mar  5 00:16 languages
    -r--r--r-- 1 zimbra zimbra   2214 Mar  5 00:16 local.cf
    -rw-r----- 1 zimbra zimbra   7709 Sep  6  2010 malware_list.cf
    -r--r--r-- 1 zimbra zimbra   2762 Mar  5 00:16 regression_tests.cf
    drwx------ 2 zimbra zimbra   4096 Feb 23 10:18 sa-update-keys
    -r--r--r-- 1 zimbra zimbra   4777 Mar  5 00:16 sa-update-pubkey.txt
    -r--r--r-- 1 zimbra zimbra   1869 Mar  5 00:16 user_prefs.template
    -r--r--r-- 1 zimbra zimbra   2524 Mar  5 00:16 v310.pre
    -r--r--r-- 1 zimbra zimbra   1194 Mar  5 00:16 v312.pre
    -r--r--r-- 1 zimbra zimbra   2416 Mar  5 00:16 v320.pre
    -r--r--r-- 1 zimbra zimbra   1237 Mar  5 00:16 v330.pre
    Please find the attached amavisd.conf.

    Thanks
    Attached Files Attached Files

  7. #7
    Join Date
    Mar 2011
    Posts
    9
    Rep Power
    4

    Default

    @John Siu
    [zimbra@indigo ~]$ grep content_filter /opt/zimbra/postfix/conf/main.cf
    content_filter = smtp-amavis:[127.0.0.1]:10024

  8. #8
    Join Date
    Jun 2008
    Location
    Berkeley, CA
    Posts
    1,474
    Rep Power
    9

    Default

    The content_filter setting looks good, or at least it matches my system.

    Your spamassassin directory looks like it has all the necessary files although I didn't examine the listing in detail.

    Your amavisd.conf differs quite a bit from mine. Not sure if that's because you have ZCS 7 and I'm still on 6.

    One thing that caught my eye is the query_filter value in amavisd.conf. You have
    Code:
    query_filter  => '(&(objectClass=amavisAccount)(|(mail=%m)(zimbraDomainName=%m)))',
    while I have
    Code:
    query_filter  => '(&(objectClass=amavisAccount)(mail=%m))',
    So you might try changing that line (in amavisd.conf.in actually) and then restarting zimbra. (Or if you prefer, restart just amavis; zmamavisdctl restart should do the trick.)

  9. #9
    Join Date
    Feb 2011
    Posts
    82
    Rep Power
    4

    Default

    Quote Originally Posted by ewilen View Post
    ...

    One thing that caught my eye is the query_filter value in amavisd.conf. You have
    Code:
    query_filter  => '(&(objectClass=amavisAccount)(|(mail=%m)(zimbraDomainName=%m)))',
    ...
    That line is the same with my 7.0.1 testing box. And I get the x-spam header even I do a self email in that box.

  10. #10
    Join Date
    Mar 2011
    Posts
    9
    Rep Power
    4

    Default

    @ewilen, @John Siu
    I tried changing the query_filter in amavisd.conf and now the spam headers appear in the mail. But when I tried a sending GTUBE, the mail got discarded instead of dropping it to *Junk* folder. Any hint?

Similar Threads

  1. Zimbra 6 on Ubuntu 8.04 x64 reverting to IPv6
    By nimble7 in forum Installation
    Replies: 1
    Last Post: 11-29-2010, 11:03 PM
  2. Old Backup stay in TO_DELETE status and no clearing..
    By bartounet in forum Administrators
    Replies: 0
    Last Post: 10-05-2010, 07:40 AM
  3. Major Issue - 5.0RC2 NE to 5.0GA NE failed
    By DougWare in forum Installation
    Replies: 7
    Last Post: 01-06-2008, 08:56 PM
  4. Replies: 16
    Last Post: 09-07-2006, 06:39 AM
  5. Mail logs
    By Rick Baker in forum Installation
    Replies: 8
    Last Post: 01-17-2006, 03:33 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •