On Debian based systems, set "CRON=1" in /etc/default/spamassassin - this is not the default so no sa-update is happening if it isn't enabled. It would be great to have it enabled by default when someone is installing the server for first time.