ls /usr/bin /usr/sbin | grep -E "^(spam|sa-)" | sort -u

sa-awl
sa-check_spamd
sa-compile
sa-learn
sa-update
spamassassin
spamc
spamd

mkdir -p /var/mailtest
cat > /var/mailtest/gtube.eml <<'EOF'
From: Sender <sender@example.net>
To: Recipient <recipient@example.com>
Subject: Test spam mail (GTUBE)
Date: Thu, 09 Oct 2026 08:00:00 +0800
Message-ID: <GTUBE1@example.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii

This is the GTUBE, the
	Generic
	Test for
	Unsolicited
	Bulk
	Email

If your spam filter supports it, the GTUBE provides a test by which you
can verify that the filter is installed correctly and is detecting incoming
spam. You can send yourself a test mail containing the following string of
characters (in upper case and with no white spaces and line breaks):

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

You should send this test mail from an account outside of your network.
EOF
cat > /var/mailtest/ham.eml <<'EOF'
From: Alice Zhang <alice@example.com>
To: Bob Li <bob@example.com>
Subject: Weekly project meeting minutes
Date: Fri, 10 Oct 2026 10:20:00 +0800
Message-ID: <20261010102000@example.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8

Hi Bob,

Here are the minutes from this week project meeting:

1. The new feature branch was merged into main.
2. QA finished the regression pass, no blockers found.
3. Next milestone demo is scheduled for next Tuesday.

Please review and add anything I missed.

Best regards,
Alice
EOF

SpamAssassin version 3.4.6
  running on Perl version 5.34.0

For more information read the spamassassin man page.

Usage:
    spamassassin [options] [ < mailmessage | path ... ]

    spamassassin -d [ < mailmessage | path ... ]

    spamassassin -r [ < mailmessage | path ... ]

    spamassassin -k [ < mailmessage | path ... ]

    spamassassin -W|-R [ < mailmessage | path ... ]

    Options:

     -L, --local                       Local tests only (no online tests)
     -r, --report                      Report message as spam
     -k, --revoke                      Revoke message as spam
     -d, --remove-markup               Remove spam reports from a message
     -C path, --configpath=path, --config-file=path
                                       Path to standard configuration dir
     -p prefs, --prefspath=file, --prefs-file=file
                                       Set user preferences file
     --siteconfigpath=path             Path to site configs
                                       (def: /etc/spamassassin)
     --cf='config line'                Additional line of configuration
     -x, --nocreate-prefs              Don't create user preferences file

Oct 12 00:44:23.612 [4647] warn: config: created user preferences file: /root/.spamassassin/user_prefs

spamassassin -t /var/mailtest/gtube.eml

Received: from localhost by mail01.example.com
        with SpamAssassin (version 3.4.6);
        Mon, 12 Oct 2026 00:44:24 +0000
From: Sender <sender@example.net>
To: Recipient <recipient@example.com>
Subject: Test spam mail (GTUBE)
Date: Thu, 09 Oct 2026 08:00:00 +0800
Message-Id: <GTUBE1@example.net>
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mail01.example.com
X-Spam-Flag: YES
X-Spam-Level: **************************************************
X-Spam-Status: Yes, score=1000.0 required=5.0 tests=GTUBE,NO_RECEIVED,
        NO_RELAYS autolearn=no autolearn_force=no version=3.4.6

Content analysis details:   (1000.0 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
1000 GTUBE                  BODY: Generic Test for Unsolicited Bulk Email
-0.0 NO_RELAYS              Informational: message was not relayed via SMTP
-0.0 NO_RECEIVED            Informational: message has no Received headers

spamassassin -t /var/mailtest/ham.eml

X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mail01.example.com
X-Spam-Level:
X-Spam-Status: No, score=-0.0 required=5.0 tests=NO_RECEIVED,NO_RELAYS
        autolearn=unavailable autolearn_force=no version=3.4.6

spamassassin -t gtube.eml; echo $?

EXIT=0

spamassassin -e < /var/mailtest/gtube.eml >/dev/null 2>&1; echo SPAM_EXIT=$?
spamassassin -e < /var/mailtest/ham.eml   >/dev/null 2>&1; echo HAM_EXIT=$?
spamassassin -t -e < /var/mailtest/gtube.eml >/dev/null 2>&1; echo SA_E_EXIT=$?

SPAM_EXIT=5
HAM_EXIT=0
SA_E_EXIT=5

spamassassin --cf="required_score 2000" -t gtube.eml | grep X-Spam-Status
spamassassin --cf="rewrite_header Subject [CUSTOM-MARK]" -t gtube.eml | grep "^Subject"

X-Spam-Status: No, score=1000.8 required=2000.0 tests=BAYES_50,GTUBE,

Subject: [CUSTOM-MARK] Test spam mail (GTUBE)

spamc < /var/mailtest/gtube.eml > /tmp/marked.eml
spamassassin -d < /tmp/marked.eml | grep -E "^Subject|X-Spam-Flag"

Subject: Test spam mail (GTUBE)

SpamAssassin Client version 3.4.6
  compiled with SSL support (OpenSSL 3.0.2 15 Mar 2022)

Usage: spamc [options] [-e command [args]] < message

spamc -c < /var/mailtest/gtube.eml; echo $?
spamc -c < /var/mailtest/ham.eml; echo $?

1000.0/5.0
1

0.0/5.0
0

spamc -y < /var/mailtest/gtube.eml
spamc -y < /var/mailtest/ham.eml

GTUBE,NO_RECEIVED,NO_RELAYS

NO_RECEIVED,NO_RELAYS

spamc -R < /var/mailtest/gtube.eml

1000.0/5.0
Spam detection software, running on the system "mail01.example.com",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
@@CONTACT_ADDRESS@@ for details.

Content analysis details:   (1000.0 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
-0.0 NO_RELAYS              Informational: message was not relayed via SMTP
1000 GTUBE                  BODY: Generic Test for Unsolicited Bulk Email
-0.0 NO_RECEIVED            Informational: message has no Received headers

spamc -E < /var/mailtest/gtube.eml >/dev/null; echo $?
spamc -E < /var/mailtest/ham.eml   >/dev/null; echo $?

1
0

echo -n "" | spamc -K

SPAMD/1.5 0

spamc -d mail01.example.com -p 783 -c < /var/mailtest/gtube.eml; echo CROSS_EXIT=$?

1000.0/5.0
CROSS_EXIT=1

SpamAssassin Server version 3.4.6
  running on Perl 5.34.0
  with SSL support (IO::Socket::SSL 2.074)
  with zlib support (Compress::Zlib 2.102)

For more details, use "man spamd".

Usage:
    spamd [options]

    The --listen option (or -i) may be specified multiple times, its syntax
    is: [ ssl: ] [ host-name-or-IP-address ] [ : port ] or an absolute path
    (filename) of a Unix socket. If port is omitted it defaults to --port or
    to 783. Option --ssl implies a prefix 'ssl:'. An IPv6 address should be
    enclosed in square brackets, e.g. [::1]:783, an IPv4 address may be but
    need not be enclosed in square brackets. An asterisk '*' in place of a
    hostname implies an unspecified address, ('0.0.0.0' or '::'), i.e. it
    binds to all interfaces. An empty option value implies '*'. A default is
    '--listen localhost', which binds to a loopback interface only.

[Unit]
Description=Perl-based spam filter using text analysis
After=network.target

[Service]
Type=forking
PIDFile=/run/spamd.pid
EnvironmentFile=-/etc/default/spamassassin
ExecStart=/usr/sbin/spamd -d --pidfile=/run/spamd.pid $OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
StandardOutput=null
StandardError=null
Restart=always

[Install]
WantedBy=multi-user.target

OPTIONS="--create-prefs --max-children 5 --helper-home-dir"
PIDFILE="/var/run/spamd.pid"
CRON=0

systemctl status spamassassin --no-pager -l
netstat -lntp | grep 783

● spamassassin.service - Perl-based spam filter using text analysis
     Loaded: loaded (/lib/systemd/system/spamassassin.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-10-12 00:45:53 UTC; 3s ago
   Main PID: 4811 (spamd)
      Tasks: 3 (limit: 5753)
     Memory: 97.1M
     CGroup: /system.slice/spamassassin.service
             ├─4811 /usr/bin/perl "-T -w" /usr/sbin/spamd -d --pidfile=/run/spamd.pid --create-prefs --max-children 5 --helper-home-dir
             ├─4813 "spamd child"
             └─4814 "spamd child"

tcp        0      0 127.0.0.1:783           0.0.0.0:*               LISTEN      5635/perl

Oct 12 00:46:11 mail01.example.com spamd[4813]: spamd: connection from 127.0.0.1 [127.0.0.1]:42338 to port 783, fd 5
Oct 12 00:46:11 mail01.example.com spamd[4813]: spamd: processing message <GTUBE1@example.net> for root:65534
Oct 12 00:46:12 mail01.example.com spamd[4813]: spamd: identified spam (1000.0/5.0) for root:65534 in 0.7 seconds, 741 bytes.
Oct 12 00:46:12 mail01.example.com spamd[4813]: spamd: result: Y 999 - GTUBE,NO_RECEIVED,NO_RELAYS scantime=0.7,size=741,user=root,uid=65534,required_score=5.0,rhost=127.0.0.1,raddr=127.0.0.1,rport=42338,mid=<GTUBE1@example.net>,autolearn=no autolearn_force=no

cp /etc/default/spamassassin /etc/default/spamassassin.bak
sed -i "s|^OPTIONS=.*|OPTIONS=\"--create-prefs --max-children 5 --helper-home-dir --listen=0.0.0.0 --allowed-ips=127.0.0.0/8,192.168.1.0/24\"|" /etc/default/spamassassin
grep ^OPTIONS /etc/default/spamassassin
systemctl restart spamassassin && sleep 4 && netstat -lntp | grep 783

OPTIONS="--create-prefs --max-children 5 --helper-home-dir --listen=0.0.0.0 --allowed-ips=127.0.0.0/8,192.168.1.0/24"
tcp        0      0 0.0.0.0:783             0.0.0.0:*               LISTEN      10904/perl

journalctl -u spamassassin --no-pager -n 30 | grep "server started"

Oct 12 01:48:20 mail01.example.com spamd[10904]: spamd: server started on IO::Socket::IP [0.0.0.0]:783 (running version 3.4.6)

spamc -c < /var/mailtest/gtube.eml; echo C_EXIT=$?
sa-check_spamd -H 127.0.0.1 -v

1000.0/5.0
C_EXIT=1

loaded Mail::SpamAssassin::Timeout
connecting to spamd for ping
SPAMD OK: 0.002 second ping response time

mv /etc/default/spamassassin.bak /etc/default/spamassassin
systemctl restart spamassassin && sleep 4 && netstat -lntp | grep 783
systemctl is-active spamassassin

tcp        0      0 127.0.0.1:783           0.0.0.0:*               LISTEN      10934/perl
active

For more information read the manual page
Usage:
    sa-learn [options] [file]...

    sa-learn [options] --dump [ all | data | magic ]

    Options:

     --ham                 Learn messages as ham (non-spam)
     --spam                Learn messages as spam
     --forget              Forget a message
     --use-ignores         Use bayes_ignore_from and bayes_ignore_to
     --sync                Synchronize the database and the journal if needed
     --force-expire        Force a database sync and expiry run
     --dbpath <path>       Allows commandline override (in bayes_path form)
                           for where to read the Bayes DB from
     --dump [all|data|magic]  Display the contents of the Bayes database
                           Takes optional argument for what to display
      --regexp <re>        For dump only, specifies which tokens to
                           dump based on a regular expression.
     -f file, --folders=file  Read list of files/directories from file
     --dir                 Ignored; historical compatibility
     --file                Ignored; historical compatibility
     --mbox                Input sources are in mbox format
     --mbx                 Input sources are in mbx format
     --max-size <b>        Skip messages larger than b bytes;
                           defaults to 256 KB, 0 implies no limit
     --showdots            Show progress using dots
     --progress            Show progress using progress bar
     --no-sync             Skip synchronizing the database and journal

sa-learn --spam /var/mailtest/spam-corpus --progress
sa-learn --ham /var/mailtest/ham-corpus --progress

100% Completed 344.85 msgs/sec in 00m00s
Learned tokens from 5 message(s) (5 message(s) examined)

100% Completed 524.05 msgs/sec in 00m00s
Learned tokens from 5 message(s) (5 message(s) examined)

sa-learn --dump magic | grep -E "nspam|nham|ntokens|db version"

0.000          0          3          0  non-token data: bayes db version
0.000          0          5          0  non-token data: nspam
0.000          0          5          0  non-token data: nham
0.000          0        116          0  non-token data: ntokens

sa-learn --spam /var/mailtest/bayes-spam
sa-learn --ham /var/mailtest/bayes-ham
sa-learn --spam /var/mailtest/bayes-spam2
sa-learn --dump magic | grep -E "nspam|nham|ntokens"

Learned tokens from 1 message(s) (250 message(s) examined)

Learned tokens from 250 message(s) (250 message(s) examined)

Learned tokens from 210 message(s) (210 message(s) examined)

0.000          0        216          0  non-token data: nspam
0.000          0        255          0  non-token data: nham
0.000          0       1904          0  non-token data: ntokens

sa-learn --forget /var/mailtest/bayes-spam2/s1.eml
sa-learn --sync

Forgot tokens from 1 message(s) (1 message(s) examined)

sa-learn --backup > /root/bayes-backup.txt
wc -l /root/bayes-backup.txt
head -3 /root/bayes-backup.txt
sa-learn --dump magic | grep -E "nspam|nham"

2374 /root/bayes-backup.txt

v       3       db_version # this must be the first line!!!
v       215     num_spam
v       255     num_nonspam

0.000          0        215          0  non-token data: nspam
0.000          0        255          0  non-token data: nham

systemctl restart spamassassin
spamc -t < /var/mailtest/bayes-test.eml | grep -E "BAYES|X-Spam-Status"

X-Spam-Status: Yes, score=6.6 required=5.0 tests=BAYES_99,BAYES_999,

spamassassin -t /var/mailtest/bayes-test.eml | grep -E "pts rule|BAYES_9"

 0.2 BAYES_999              BODY: Bayes spam probability is 99.9 to 100%
 3.5 BAYES_99               BODY: Bayes spam probability is 99 to 100%

For more information read the sa-update man page.

Usage:
    sa-update [options]

    Options:

      --channel channel       Retrieve updates from this channel
                              Use multiple times for multiple channels
      --channelfile file      Retrieve updates from the channels in the file
      --checkonly             Check for update availability, do not install
      --install filename      Install updates directly from this file. Signature
                              verification will use "file.asc", "file.sha256",
                              and "file.sha512".
      --allowplugins          Allow updates to load plugin code (DANGEROUS)
      --gpgkey key            Trust the key id to sign releases
                              Use multiple times for multiple keys
      --gpgkeyfile file       Trust the key ids in the file to sign releases
      --gpghomedir path       Store the GPG keyring in this directory
      --gpg and --nogpg       Use (or do not use) GPG to verify updates
                              (--gpg is assumed by use of the above
                              --gpgkey and --gpgkeyfile options)
      --import file           Import GPG key(s) from file into sa-update's
                              keyring. Use multiple times for multiple files
      --updatedir path        Directory to place updates, defaults to the
                              SpamAssassin site rules directory
                              (default: /var/lib/spamassassin/3.004006)
      --refreshmirrors        Force the MIRRORED.BY file to be updated
      --httputil util         Force used download tool. By default first found
                              from these is used: curl, wget, fetch, lwp
      -D, --debug [area=n,...]  Print debugging messages
      -v, --verbose           Be verbose, like print updated channel names;
                              For more verbosity specify multiple times
      -V, --version           Print version
      -h, --help              Print usage message
      -4                      Force using the inet protocol (IPv4), not inet6
      -6                      Force using the inet6 protocol (IPv6), not inet

sa-update

EXIT=0

ls -la /var/lib/spamassassin/3.004006/
grep -E "^# UPDATE" /var/lib/spamassassin/3.004006/updates_spamassassin_org.cf
ls /var/lib/spamassassin/3.004006/updates_spamassassin_org/ | wc -l

total 16
drwxr-xr-x 3 root         root         4096 Oct 12 00:48 .
drwxr-xr-x 5 debian-spamd debian-spamd 4096 Oct 12 00:47 ..
drwxr-xr-x 2 root         root         4096 Oct 12 00:48 updates_spamassassin_org
-rw-r--r-- 1 root         root         3163 Oct 12 00:48 updates_spamassassin_org.cf

# UPDATE version 1938768

72

spamassassin --lint

LINT=0

sa-update --checkonly; echo $?

EXIT=1

sa-update --version

sa-update version 3.4.6 / svn1881784
  running on Perl version 5.34.0

apt-get install -y re2c
time sa-compile

Installing /var/lib/spamassassin/compiled/5.034/3.004006/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so
Installing /var/lib/spamassassin/compiled/5.034/3.004006/Mail/SpamAssassin/CompiledRegexps/body_0.pm
cp /tmp/.spamassassin4889VaQtUetmp/bases_body_0.pl /var/lib/spamassassin/compiled/5.034/3.004006/bases_body_0.pl

real    0m18.014s
user    0m13.716s
sys     0m4.349s

sa-awl

Cannot open file /root/.spamassassin/auto-whitelist: No such file or directory

sa-check_spamd version

For more details, use "perldoc sa-check_spamd".

Usage:
   sa-check_spamd [options]

    Options:

     -c secs, --critical=secs          Critical ping response threshold
     -h, -?, --help                    Print usage message
     -H hostname, --hostname=hostname  Hostname of spamd service to ping
     -p port, --port=port              Port of spamd service to ping
     --socketpath=path                 Connect to given UNIX domain socket
     -t secs, --timeout=secs           Max time to wait for a ping response
     -v, --verbose                     Verbose debug output
     -V, --version                     Output version info

sa-check_spamd -H 127.0.0.1 -v

loaded Mail::SpamAssassin::Timeout
connecting to spamd for ping
SPAMD OK: 0.002 second ping response time

Oct 12 00:53:05.935 [8] warn: spamd: unauthorized connection from 127.0.0.1 [127.0.0.1]:57020 to port 783, fd 5 at /usr/sbin/spamd line 1627.

Oct 12 00:45:52 mail01.example.com spamd[4811]: Can't locate Mail/SpamAssassin/CompiledRegexps/body_0.pm in @INC (you may need to install the Mail::SpamAssassin::CompiledRegexps::body_0 module) (@INC contains: /var/lib/spamassassin/compiled/5.034/3.004006 ...) at (eval 1897) line 1.