bogofilter failure - missing X-Bogosity line

[David Relson]

Greetings,

 From time to time, I've seen a spam message that has no spam header 
(X-Bogosity )line on it.  Earlier this evening it happened yet again.  I 
decided to learn what I can about what happened.

First thing is that two copies of the same spam arrived in one smtp 
connection.  Message id 33ED227F80 was addressed to Linda and message id 
5917B280E1 was addressed to Mark.  Looking at /var/log/mail/info I see that 
this happened between 20:50:02 and 20:50:11.

Remember that I also log each message's X-Bogosity line (to 
/var/log/mail/info).  The log shows only 1 X-Bogosity line.  Looking in the 
headers for messages 33ED... and 5917..., I see that 33ED has the logged 
header line and that 5917 doesn't have a header line.  Further comparison 
of the headers shows that 5917 has an X-IMAPbase line that 33ED does't have.

Here is the logged header line:

Nov 29 20:50:11 nic bogofilter[17261]: X-Bogosity: Yes, spamicity=0.736148, 
version=0.9.0.3, \
                 register-s, 392 words, 1 messages

The two part message ( "spamicity=..." and "register...words...messages") 
are normal when running with options "-r -p -u -l -e -v" as I usually do.

I've attached file no-bogo.1129.tgz.  It has three files which give the 
relevant portion of /var/log/mail/info and, for each of the two messages, 
the corresponding lines from /var/log/syslog (same as /var/log/mail/info) 
and the message's headers.

These files _prove_ that bogofilter _has_ a problem.  Under certain 
circumstances bogofilter _fails_ to process a message - as in read it, 
classify it, log the spamicity info, and insert the spam header line.

Many of you know more about email, smtp, linux, etc that do I.  Let's put 
our heads together to see if we can determine what is happening here.

What ideas and theories do you all have?

What can we do with bogofilter that will provide more information so that 
we can determine the point of failure?

Thanks.

David
-------------- next part --------------
A non-text attachment was scrubbed...
Name: no-bogo.1129.tgz
Type: application/x-compressed
Size: 1277 bytes
Desc: not available
URL: <http://www.bogofilter.org/pipermail/bogofilter/attachments/20021129/b79c09c9/attachment.bin>