SpamAssassin behaves differently in manual run vs Virtualmin (using spamc)

Usermin
1
SYSTEM INFORMATION
OS type and version Debian Linux 13
Webmin version 2.621
Usermin version 2.521
Virtualmin version 8.0.1 GPL
Theme version 26.22
Apache version 2.4.66
Package updates All installed packages are up to date

Hello,
We are facing an issue with SpamAssassin and Virtualmin. When emails are processed through Virtualmin (default setting using spamc/spamd client), many of them are flagged as CLEAN with scores below 5. However, when the same emails are checked manually using spamassassin -e, their scores are higher and they are correctly flagged as SPAM.

This shows that SpamAssassin behaves differently in two execution environments, even though the threshold is set to 5. It seems that in spamc/spamd mode some rules or external sources (like DNSBL/URIBL) are disabled or inaccessible, resulting in lower scores. In standalone mode (spamassassin), all rules are active and the results are more accurate.

We have not yet tested the spamd (standalone spamassassin) option, only spamc, but the difference between spamc and manual execution is significant.

Manual test script
We used the following script to test:

#!/bin/bash
SRC="/home/vs-name/homes/info/Maildir/cur"
REPORT="./spam_report.txt"
BADMAILS=()

> "$REPORT"

for mail in "$SRC"/*; do
    if spamassassin -e < "$mail" > /dev/null; then
        echo "$mail : SPAM" >> "$REPORT"
        BADMAILS+=("$mail")
    else
        echo "$mail : CLEAN" >> "$REPORT"
    fi
done

echo "Report generated: $REPORT"
echo "Number of spam mails: ${#BADMAILS[@]}"
printf '%s\n' "${BADMAILS[@]}"

Could you please check why Virtualmin with spamc/spamd client seems to run with different rules or limited access to external sources, and confirm if switching to spamassassin (standalone) would be a better option to achieve consistent behavior with manual execution? Our goal is to ensure that spam scoring in delivery matches the manual test results, so spam emails are properly flagged as YES and moved to the spam folder.

2

If this is a production server be careful trying this. If I recall correctly, this opens a separate instance of spamassassin for each test and will eat up memory and cpu.

But, interesting that they are different.
I haven’t finished my morning coffee yet. However when doing a quick search the Built In Scrupple AI offered up this. I’ll include the search string so others can search it and the output. Seems reasonable but I don’t have time to check it myself at the moment. IF it is wrong, let me know so I can delete it as not to pollute the forum. Though, if you look at the very end it appears the AI is quoting this forum. (Well looks like a Virtualmin forum summary and doesn’t paste cleanly . Interestingly enough if you ask for ‘deep dive’ it says NO instead of Yes. :rofl:)

does spamc use different rules than manual mode

The only way I can retain the formatting so it doesn’t get ugly is with a screen shot.

image
image619×689 89.3 KB

1 Like
3

Interestingly, there were about 2000 emails in the sample directory, of which about 80% were actually spam but had entered the inbox. However, almost all of them were identified using a manual script, but we want this behavior to be standard at the server level.

4

Check #2 Bullet Point about enabling user rules. It should be easy enough to verify. That’s why I posted it. I STILL haven’t finished my morning coffee and started breakfast. :wink: