I'm in debian9/postfix, spamassassin is installed and running and detects GTUBE ok.

The documentation said that sa-update and the first install should install a good default rule set but mails with viagra in the subject pass through just fine. I am confused about multiple things.

-why are there two identical folder /etc/mail/spamassassin/local.cf and /etc/spamassassin/local.cf, which is the one I should change to put in my own rules? They are not linked.

-65_debian.cf is the only ruleset I see here, are there supposed to be other rulesets here? I read that the default ruleset should catch viagra in the subject. Are there rulesets I can just download and install that are worthwhile?

-where is spamassassin logging? there is a /var/log/spamassassin/.spamassassin folder but no logs in it. Where is logging turned on and the location specified?

I have ddg'd around on this stuff and ran in circles, can someone shed light or links im not finding?

Hi,

I'm not using debian, but according to the documentation, it should be /etc/spamassassin/local.cf


The default spamassassin rules should be in /usr/share/spamassassin.
If you send yourself an email with subject "viagra", don't expect SA to flag it as spam, because it takes into consideration many other factors, before giving a score.
Since you said that it can identify GTUBE, I guess SA is working properly.
You can check an email, running the following to see what rules are used to get a score:

spamassassin is logging in the file /var/log/maillog.
The /var/log/spamassassin could be the homedir of the spamd user. Check /etc/passwd to verify.

Regards

1 members found this post helpful.

This is not an answer to your specific question but have you considered replacing SpamAssassin with rspamd? It's more performant, uses less CPU and in my experience bettwr at getting the job done. There is, I believe, a build of rspamd for Debian, if you're interested: https://thomas-leister.de/en/mailserver-debian-stretch/

I've implemented this on a Zimbra Collaboration Server (postfix, spamassassin etc.....) and it was relatively trivial to get working, it's also been in use for the for almost two years now with no problems.

1 members found this post helpful.

Thank you this is helpful.

spamassassin -D is cool, this shows me that actually the rules are in /var/lib/spamassassin/3.0/updates../ and not in the home folder with local.cf as the docs lead me to believe.

Yeah I did just send myself a viagra subject email and it went through, but now I can use spam -D to confirm what is being checked and look into scoring with detail, thats def something i can use here.

rspamd is good to know about, thanks for the tip.

why i have two /etc/spamassassin/local.cf and /etc/mail/spamassassin/local.cf is kindof a mystery but whatever. Home in passwd is /etc/spam... though.

In mail.log I just dont see any spamd entries, is there anyplace else this might be logging? If I wanted to turn verbose/debug logging on for spamd where would that be? Aha, I found it, you have to modify the spamd executable itself to activate it, it doesnt log automatically.

Thanks guys, closing this one.