Spamassassin guidance needed!

[annathepiper]

solarbird showed me tonight, folks, something of a system log from lodestone (she gets mailed these things) from just before the attack. In this, there is unusual activity tagged from spamd, the daemon that runs spamassassin on a system-wide basis. What was shown in the log was a bunch of spamd doing setuid's over to various users and processing their mail, and either finding spam or not. This by itself is not unusual--this is what spamd is supposed to do. However, Dara tells me that having this activity show up in the logs AT ALL is the part that isn't normal.

So. What I need to find out is how spamd's behavior might have been modified such that suddenly it's showing up as unusual activity in the system logs. I haven't done a damned thing with spamd since I installed it other than stopping or starting it.

Since Dara and I have to pack and get ready to move, if I can summon an army of monkeys to go find what I need to know on this, that would be incredibly helpful. How about it, folks? Can anybody find me information on what the heck might have happened to spamd, if anything?

Comments

[cdybedahl.livejournal.com]

My spamd does that logging by default. And it goes via syslog anyway, so it's far more likely that something's happened to syslogd and its setup than to SpamAssassin, I'd say.

[solarbird]

It shows up in the core logs. It does _not_ normally show up in the log summary reports, because I didn't care about seeing it.

I'm mostly concerned that it wants to upgrade libc6 to the unstable tree in order to install it.

[annathepiper]

Another person has agreed with you on this--but thank you kindly for checking in! Sorry about my slowness in reply; we've been tearing our hair out over trying to fix this.

[hippybngstockng.livejournal.com]

Hi Anna, it's Sah.

I've asked to add Dara, and I'd like to add you as well so I can keep up with the whole murkworks.net rebuild thang...

I'd love to have my box again, but it can totally wait for whenever things are up and running again.

And I wish I could offer help or knowledge, but I am sadly clueless as always..

Hope you're feeling well, and I'm so sorry you have to move at the same time as you're having surgery :P What a drag!

[annathepiper]

I'd be delighted to be on your Friends list! Glad to see you--and yeah, moving AND server rebuild AND surgery is a drag. ;P :)