mark message as spam doesn't work

Report bugs and workarounds
Post Reply
froman
Posts: 21
Joined: 29 Aug 2017 03:41

mark message as spam doesn't work

Post by froman » 02 Mar 2018 13:29

Hello my friends.
I trying to use the link in the signature in each scanned mail to mark some of them as spam, when I click on the link there is no problem the EFA shows the message:

"We are committed to delivering the best protection possible against undesirable email content including spam and viruses. The simple action of reporting this message as spam helps us achieve this by treating similar messages with greater suspicion in future.

Please continue to report any messages which you believe to be spam in this way.

Although you will not receive any further update about this spam message, the anti-spam system has already been automatically updated to treat similar messages with more suspicion in future. This will reduce the likelihood of you or others receiving them again.

Reporting this message will not automatically block all messages from this sender - if you want to do this you should add the sender to your blacklist.
If the message you just reported is from a mailing list you subscribed to, please unsubscribe from the mailing list rather than report the messages as spam (reporting mailing list messages as spam will have a negative effect on people who want to receive these messages).
Please see the user guide or contact your email administrator for further instructions."

but the spam keep comming and I can't find any changes on the EFA after mark an email as spam, the only thing I found is in the apache log

==> httpd/ssl_error_log <==
[Fri Mar 02 10:18:34 2018] [error] [client 10.8.0.42] [Fri Mar 2 10:18:34 2018] learn-msg.cgi: illegal netmask: 255.255.255.0
[Fri Mar 02 10:18:34 2018] [error] [client 10.8.0.42] [Fri Mar 2 10:18:34 2018] learn-msg.cgi: at /var/www/cgi-bin/learn-msg.cgi line 67

I tried with several netmasks, the error is always the same.

the trusted networks are correct and the domains too.

any idea why is this not working?
thank you very much.

froman
Posts: 21
Joined: 29 Aug 2017 03:41

Re: mark message as spam doesn't work

Post by froman » 04 Mar 2018 02:40

I erased the trusted networks file and create it again and now there is no error.

I found this script to check this and the network match without problem, but it still doesn't mark the mails as spam

Code: Select all

#!/usr/bin/perl                                                                                                                                                         
                                                                                                                                                                        
use CGI::Carp qw(fatalsToBrowser);                                                                                                                                      
use CGI qw(:standard);                                                                                                                                                  
use Net::Netmask;                                                                                                                                                       
print "Content-type: text/html \n\n";                                                                                                                                   
                                                                                                                                                                        
open(FILE, '/etc/sysconfig/EFA_trusted_networks') or die ("Trusted Networks File Missing");                                                                             
@trustednetworks = <FILE>;                                                                                                                                              
close (FILE);                                                                                                                                                           

if(@trustednetworks) {
  foreach (@trustednetworks) {
    @items = split(/ /);
    $ip = @items[0];
    print "$ip ";
    $mask = @items[1];
    print "$mask <br/>";
    $block = new Net::Netmask($ip,$mask);
    print "$ENV{REMOTE_ADDR} <br/>";
    if ($block->match($ENV{REMOTE_ADDR})) {
      print "IP MATCHES SUBNET <br/>";
    } else {
      print "IP DOES NOT MATCH SUBNET <br/>";
    }
 }
} else {
    print "No Trusted Networks found";
}
also, where can I check which mails are marked as spam on the e.f.a web admin?

User avatar
pdwalker
Posts: 1137
Joined: 18 Mar 2015 09:16

Re: mark message as spam doesn't work

Post by pdwalker » 05 Mar 2018 03:39

under https://<your efa hostname>/mailscanner/status.php
Screen-Shot.png
Screen-Shot.png (61.85 KiB) Viewed 2525 times
Green? Whitelisted and ignored by the system Spamassassin score irrelevant (SA Score)

Grey? Not spam. SA Score < 4

Pink/Salmon? Possibly Spam, 4 <= SA Score <= 7

Red? Almost certainly spam. SA SCore > 7.

User avatar
pdwalker
Posts: 1137
Joined: 18 Mar 2015 09:16

Re: mark message as spam doesn't work

Post by pdwalker » 05 Mar 2018 03:49

so, if your messages are not getting marked as spam, you have to find out why.

Open a message that you think is spam (click on the blue circle with the i inside), and look at the spam report.
Screen Shot 2018-03-05 at 11.47 1.png
Screen Shot 2018-03-05 at 11.47 1.png (108.12 KiB) Viewed 2525 times
Here I can see why this message is considered spam (or not for the non spam messages). That helps you determine why or why not a message is considered spam. Once you know that, you (or someone helpful in the forums) can then work out what needs fixing or correcting in your system.

froman
Posts: 21
Joined: 29 Aug 2017 03:41

Re: mark message as spam doesn't work

Post by froman » 05 Mar 2018 13:36

that is not the problem I posted in this thread.

I don't care if the message is spam or not, the link in the footer to mark the message as spam with sa-learn doesn't work. that's the problem.


thanks.

User avatar
pdwalker
Posts: 1137
Joined: 18 Mar 2015 09:16

Re: mark message as spam doesn't work

Post by pdwalker » 05 Mar 2018 16:24

that was not clear from your original message.

so, what is the exact link in the message? when you click on the link, what happens exactly? does it go to efa? does the link time out?

without information, your problem is very hard to diagnose.

froman
Posts: 21
Joined: 29 Aug 2017 03:41

Re: mark message as spam doesn't work

Post by froman » 05 Mar 2018 17:03

my original message clearly says the EFA shows no problem, this means it open the webpage of the efa and show the default message when you report a message as spam.

as update I added in the second message, that I manage to edit the trusted networks file and now is working, there is no more error on the httpd log.

but I can't see any difference between before and after mark a message as spam using the link on the footer, so I assume it's not working.

when I mark a message in the E.F.A web as spam, it shows a flag in the right side of the message "learned as spam", this not happen when I mark a message as spam using the link on the footer of the emails, there is no log of this action and no change on the E.F.A , there is no change in the E.F.A actions either.

I sended the same mail to several accounts to test this, all the accounts used the link in the footer to mark it as spam but nothing happen, the mail keep coming with the same spam score as always.

there is a way to see wich emails are marked as spam using the link on the footer or the web admin?

thanks.

User avatar
pdwalker
Posts: 1137
Joined: 18 Mar 2015 09:16

Re: mark message as spam doesn't work

Post by pdwalker » 06 Mar 2018 09:11

pdwalker wrote:
05 Mar 2018 16:24
so, what is the exact link in the message? when you click on the link, what happens exactly? does it go to efa? does the link time out?

froman
Posts: 21
Joined: 29 Aug 2017 03:41

Re: mark message as spam doesn't work

Post by froman » 06 Mar 2018 13:49

pdwalker wrote:
06 Mar 2018 09:11
pdwalker wrote:
05 Mar 2018 16:24
so, what is the exact link in the message? when you click on the link, what happens exactly? does it go to efa? does the link time out?
really my friend? I know my english is very "basic" but is that bad? did you read the first message?

- what's on the link: the url to my efa plus the sa-learn.cgi script, plus the token to the quarentine folder
- when you click on the link, what happens exactly?: it open the efa web page, and says the spam has been reported (I copied the entire message in the first post)
there is no time out, there is no error, also, if you click on the link again, the E.F.A says it's already marked as spam.


But (a big but), there is no log of this action on any file on the E.F.A, there is no change at all, there is no acknowledgement of this action on the web interface, there is no change in the spam score on the same messages that arrives after I marked the exactly same messages with this method, there is no list of messages marked as spam (or I don't know how to check it, and I'll be very happy if you tell me how to check it out)

I'll change the question to narrow this down.
- Do you know how to list all the messages marked as "learn as spam" on the E.F.A?

thanks again.

User avatar
pdwalker
Posts: 1137
Joined: 18 Mar 2015 09:16

Re: mark message as spam doesn't work

Post by pdwalker » 06 Mar 2018 14:32

I can’t help you if you insist on not answering the questions I ask.

As you seem to know better than I what information is important and what is not important, you should be able to solve the problem yourself.

Good luck.

froman
Posts: 21
Joined: 29 Aug 2017 03:41

Re: mark message as spam doesn't work

Post by froman » 06 Mar 2018 14:35

pdwalker wrote:
06 Mar 2018 14:32
I can’t help you if you insist on not answering the questions I ask.

As you seem to know better than I what information is important and what is not important, you should be able to solve the problem yourself.

Good luck.
is this a joke? all you asked is in my posts, did you read them?

budy
Posts: 74
Joined: 10 Sep 2017 07:33

Re: mark message as spam doesn't work

Post by budy » 06 Mar 2018 21:47

Well… afaiks, pdwalker is correct. He asked for the specific text of the link in the footer of your messages. E.g, this is what such a link in the messages, which I get from my eFa, looks like:

Code: Select all

This message has been scanned for viruses and dangerous content by 
E.F.A. Project, and is believed to be clean.

Click here to report this message as spam.
http://efa.foo.bar/cgi-bin/learn-msg.cgi?id=EF19040936.A4B8F&token=62728992582a83b94f36dde2b142340a
I don't see anything like this in your posts.

froman
Posts: 21
Joined: 29 Aug 2017 03:41

Re: mark message as spam doesn't work

Post by froman » 07 Mar 2018 01:31

(is in spanish, nothing relevant but the link)

____________________________________________________________________________

Este mensaje ha sido analizado en busca de virus y otros contenidos
peligrosos y se considera que esta limpio.

Si usted considera que este mensaje es SPAM haga click en el siguiente link:

http://efa.mydomain.com/cgi-bin/learn-m ... 0423ef654f
_____________________________________________________________________________


thanks.

henk
Posts: 355
Joined: 14 Dec 2015 22:16
Location: Netherlands
Contact:

Re: mark message as spam doesn't work

Post by henk » 07 Mar 2018 12:33

Froman: The language is not the problem here.....
'll change the question to narrow this down.
- Do you know how to list all the messages marked as "learn as spam" on the E.F.A?

Clear Answer: No

To narrow down the list you could use some filters in de Gui.
Reports1.png
Reports1.png (4.31 KiB) Viewed 2494 times
Add filters as needed to minimize the list.
report2.png
report2.png (9.62 KiB) Viewed 2494 times
Using SQL is another option. Just play around with the conditions.

MariaDB [mailscanner]>

Code: Select all

 select maillog_id,subject,salearn,ishighspam,issaspam,isfp,isfn,quarantined,sascore from maillog where salearn = 2 and spamblacklisted = 0 and quarantined = 1;
+------------+------------------------------------------------------+---------+------------+----------+------+------+-------------+---------+
| maillog_id | subject | salearn | ishighspam | issaspam | isfp | isfn | quarantined | sascore |
+------------+------------------------------------------------------+---------+------------+----------+------+------+-------------+---------+
| 9755 | Silence The Ringing In 3 Simple Steps Report#3171329 | 2 | 1 | 1 | 0 | 0 | 1 | 14.06 |
| 9830 | RE: Claimen uw nieuwe E-Bike | 2 | 1 | 1 | 0 | 0 | 1 | 9.48 |
+------------+------------------------------------------------------+---------+------------+----------+------+------+-------------+---------+
2 rows in set (0.00 sec)

The best option is to find the cause of this is to find the difference between the

learn-msg.cgi and sa-learn -p xx

froman
Posts: 21
Joined: 29 Aug 2017 03:41

Re: mark message as spam doesn't work

Post by froman » 07 Mar 2018 19:17

wow, this is just great! thank you!

with the query you gave me I can see all the messages marked as "learn as spam", and there is only the messages marked through the E.F.A web admin, and non of the messages marked using the link in the footage.

this is the query to use in a script to report that.

Code: Select all

#mysql -u root -p<password> mailscanner -e "select maillog_id,subject,salearn,ishighspam,issaspam,isfp,isfn,quarantined,sascore from maillog where salearn = 2 and spamblacklisted = 0 and quarantined = 1"
so I went back to the logs, sadly I can't see any error or details of this actions, just the call on the web files (because there is no error, I know that now)

this is when I click on this link one the footer of one message I sent:

this is the link:

Code: Select all

http://efa.jhg.cl/cgi-bin/learn-msg.cgi?id=15D3D21181.AAC9B&token=aa3a1ddb2cb15895d0a0a1c4b6fb432a
and this is on the httpd_access.log

Code: Select all

192.168.0.42 - - [07/Mar/2018:13:13:14 -0300] "GET /cgi-bin/learn-msg.cgi?id=15D3D21181.AAC9B&token=aa3a1ddb2cb15895d0a0a1c4b6fb432a HTTP/1.1" 302 287 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36"
no error, no log, and no database modification.

I checked all the lines on the cgi.bin and recreate them in the shell and all of them is working correctly.

so to double check I marked a message as spam in the console using sa-learn and save it to a file to analize the log.

this is the code (-D debug and the exit to a file)

Code: Select all

#sa-learn -D --spam /var/spool/MailScanner/quarantine/20180307/nonspam/4EC054050F.A41B2 &> /tmp/trololo.log
so let's see what's happened

Code: Select all

#cat /tmp/trololo.log|grep -i "correct\|learning\|fail"
it shows:

Code: Select all

dbg: learn: learning spam
TxRep: learning a message
the first time it shows all correctly, but if I mark as spam the same message and I check out the log and it shows: "already learnt correctly, not learning twice"

so I marked one message with the footer signature and I marked it again on the console, and the log shows "already learnt correctly, not learning twice" , so it's working, but is not adding the entry to the database, so the web interface don't show it as marked.

I don't know if is the spamassassin who adds the marked messages as spam to the database or the web interface does it (I think is the second), if is the second, it would be very nice that the learn-msg.cgi script could add the info to the database, so the web interface can show what messages where marked as spam.

PS: I f****ing love log files.

thank you all!.

Post Reply