Updating rules with old version of spamassassin
Good day, I am running a pretty old Debian box with spamassassin 3.0 here. It seems to have some problems with rulesdujour and hence I am wondering if I shouldn't upgrade to the current version. Pro: Current version has up to date docs and features Cons: The machine is very important (proxy) and blowing it up for just an hour means running the gauntlet when I leave the office tonight :) So my questions are (I couldn't find answers elsewhere, sorry): - Does rulesdujour still work to keep my rulesets current? - Is there another way to keep my rulesets up to date? - If I have to upgrade, what's the easiest way? Thanks for your help in advance Patrick -- View this message in context: http://www.nabble.com/Updating-rules-with-old-version-of-spamassassin-tp19160511p19160511.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
RE: Updating rules with old version of spamassassin
Hi Martin, thank you for the info. So what I can see, Spamassassin is merely a perl module used by amavisd, right? If I install the new version, it will just replace the old module and add some little gadgets like sa-update? Or could I use the sa-update script from a new version with my old spamassassin installation? P. Martin.Hepworth wrote: > > Patrick > > Yes RDJ will still work, but only for the ones you've enabled. There's > been very liitle update on the standard RDJ ruleset for months now. So > don't expect to see much updating. > > Sa-update is the way to go for more modern versiosn, this will also keep > the core rules updated too. > > -- View this message in context: http://www.nabble.com/Updating-rules-with-old-version-of-spamassassin-tp19160511p19189904.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
SA does not apply content-filter rules
Good morning, I have setup a test-installation of SA, fetching emails from my imap server and parsing it through SA. It works so far, yet I have noticed it does only scan for things like invalid headers, RBL MX, invalid return adress and so on. But when I send myself a test message with content far beyond all good manners, it just goes through with a score of 0? I have attached two logfiles, one from the test email txt-file parsed through spamassassin on the cli, the other one is the logfile of starting amavisd. Can I provide anything else, to debug this problem? TIA Patrick http://www.nabble.com/file/p19253738/testlauf.cli.txt testlauf.cli.txt http://www.nabble.com/file/p19253738/testlauf.cli3.txt testlauf.cli3.txt -- View this message in context: http://www.nabble.com/SA-does-not-apply-content-filter-rules-tp19253738p19253738.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: SA does not apply content-filter rules
PS: I have made some other tests and it seems, the body is indeed scanned, as it catched the testphrase just fine, but why not the porn stuff? -- View this message in context: http://www.nabble.com/SA-does-not-apply-content-filter-rules-tp19253738p19254301.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: SA does not apply content-filter rules
Well mouss, how could I attach a message like this? Let me say, it contained numerous descriptions of things done when making love, reproductions organs and ways to increase size of those, is that precise enough, or can you provide me a not-spam-filtered email i should send it to? :) Meanwhile I have found the mistake, the init.pre contained some 5 entries of modules, while spamassassin from the cli loaded around 20. Added those modules to init.pre and now everything is scanned. mouss-2 wrote: > > patrickbaer wrote: >> PS: I have made some other tests and it seems, the body is indeed >> scanned, as >> it catched the testphrase just fine, but why not the porn stuff? > > which porn stuff? your first URL is a gtube test and the second doesn't > contain any message that we can look at. > > -- View this message in context: http://www.nabble.com/SA-does-not-apply-content-filter-rules-tp19253738p19267390.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
How can I see all rules applied?
Hi all, I now have SA installed at the live machine and it seems to be running ok, at least no bigger issues besides an error loadeding RSA.pm, which I have no idea what it is for? Anyway, it still let's a load of spam through. For testing, I took one of those spams out of an inbox and applied spamassassin -D. Result: The live-machine did not recognize it as spam, while the test-machine did! So my question: spamassassin -D only gives me the rules which hit, but omits those which fail. Is there a way to further debug? Machines have different OS (Linux and OpenBSD) and I am not sure if I can just copy over (which I'd love to do) :) What puzzles me: [9045] dbg: learn: auto-learn: currently using scoreset 1 [9045] dbg: learn: auto-learn: message score: -0.001, computed score for autolearn: 0.001 [9045] dbg: learn: auto-learn? ham=0.1, spam=12, body-points=0.001, head-points=0.001, learned-points=0 [9045] dbg: learn: auto-learn? yes, ham (0.001 < 0.1) ^^^ [9045] dbg: learn: initializing learner [9045] dbg: learn: learning ham [9045] dbg: plugin: Mail::SpamAssassin::Plugin::WLBLEval=HASH(0x9628d2c) implements 'check_wb_list', priority 0 [9045] dbg: eval: all '*From' addrs: [EMAIL PROTECTED] [9045] dbg: eval: all '*To' addrs: [EMAIL PROTECTED] [9045] dbg: locker: safe_lock: created /root/.spamassassin/bayes.lock.proxy1.tvwerk.de.9045 [9045] dbg: locker: safe_lock: trying to get lock on /root/.spamassassin/bayes with 0 retries [9045] dbg: locker: safe_lock: link to /root/.spamassassin/bayes.lock: link ok [9045] dbg: bayes: tie-ing to DB file R/W /root/.spamassassin/bayes_toks [9045] dbg: bayes: tie-ing to DB file R/W /root/.spamassassin/bayes_seen [9045] dbg: bayes: found bayes db version 3 [9045] dbg: bayes: learned '[EMAIL PROTECTED]', atime: 1220534086 [9045] dbg: bayes: untie-ing [9045] dbg: bayes: files locked, now unlocking lock [9045] dbg: locker: safe_unlock: unlink /root/.spamassassin/bayes.lock [9045] dbg: learn: initializing learner [9045] dbg: check: is spam? score=-0.001 required=5 [9045] dbg: check: tests=HTML_MESSAGE,NO_RECEIVED,NO_RELAYS [9045] dbg: check: subtests=__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__DOS_HAS_ANY_URI,__EXCLAIM_SUBJ,__FH_HAS_XMSMAIL,__FH_HAS_XPRIORITY,__FRAUD_DBI,__HAS_ANY_URI,__HAS_MIMEOLE,__HAS_MSGID,__HAS_MSMAIL_PRI,__HAS_SUBJECT,__HAS_X_MAILER,__HTML_LENGTH__1024,__JM_REACTOR_XMOLE,__MIMEOLE_MS,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MISSING_REF,__MSGID_DOLLARS_MAYBE,__MSGID_DOLLARS_OK,__MSGID_OK_HEX,__MSGID_OK_HOST,__MSGID_RANDY,__NONEMPTY_BODY,__OE_MSGID_2,__SANE_MSGID,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TOCC_EXISTS,__TVD_BODY,__TVD_MIME_ATT_TP,__UNUSABLE_MSGID,__XM_MS_IN_GENERAL X-Spam-ASN: X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on proxy1.tvwerk.de X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=HTML_MESSAGE,NO_RECEIVED, NO_RELAYS shortcircuit=no autolearn=ham version=3.2.5 From: "Ayomide Acton" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: The best offer! Does that mean, it is considered ham? Patrick -- View this message in context: http://www.nabble.com/How-can-I-see-all-rules-applied--tp19312076p19312076.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: How can I see all rules applied?
mouss-2 wrote: > > the question is why is it a NO_RECEIVED, NO_RELAYS mail? how do you pass > the message to SA? can you show the message? > As I wrote, I usedproxy1:/tmp# spamassassin -D DNS available (set dns_available to override) [10406] dbg: dns: name server: 172.24.250.2, LocalAddr: 0.0.0.0 [10406] dbg: dns: resolver socket rx buffer size is 107520 bytes [10406] dbg: dns: trying (3) msn.com... [10406] dbg: dns: looking up NS for 'msn.com' [10406] dbg: dns: NS lookup of msn.com using 172.24.250.2 succeeded => DNS available (set dns_available to override) [10406] dbg: dns: name server: 172.24.250.2, LocalAddr: 0.0.0.0 [10406] dbg: dns: resolver socket rx buffer size is 107520 bytes [10406] dbg: dns: NS list: 212.121.128.10, 172.24.250.2 [10406] dbg: dns: name server: 212.121.128.10, LocalAddr: 0.0.0.0 [10406] dbg: dns: resolver socket rx buffer size is 107520 bytes [10406] dbg: dns: is DNS available? 1 [10406] dbg: asn: could not parse IP from first external relay, skipping ASN check [10406] dbg: uridnsbl: domains to query: dupedangryred.com [10406] dbg: async: starting: URI-DNSBL, DNSBL:multi.uribl.com.:dupedangryred.com (timeout 15.0s, min 3.0s) [10406] dbg: dns: URIBL_RED lookup start [10406] dbg: dns: URIBL_GREY lookup start [10406] dbg: async: starting: URI-DNSBL, DNSBL:bl.open-whois.org.:dupedangryred.com (timeout 15.0s, min 3.0s) [10406] dbg: dns: WHOIS_SECUREWHOIS lookup start [10406] dbg: dns: WHOIS_MYPRIVREG lookup start [10406] dbg: dns: WHOIS_NETSOLPR lookup start [10406] dbg: dns: WHOIS_AITPRIV lookup start [10406] dbg: async: starting: URI-DNSBL, DNSBL:multi.surbl.org.:dupedangryred.com (timeout 15.0s, min 3.0s) [10406] dbg: dns: URIBL_SC_SURBL lookup start [10406] dbg: dns: URIBL_AB_SURBL lookup start [10406] dbg: dns: WHOIS_CONTACTPRIV lookup start [10406] dbg: dns: WHOIS_NAMEKING lookup start [10406] dbg: dns: WHOIS_PRIVPROT lookup start [10406] dbg: dns: WHOIS_WHOISGUARD lookup start [10406] dbg: dns: URIBL_PH_SURBL lookup start [10406] dbg: dns: URIBL_BLACK lookup start [10406] dbg: dns: WHOIS_PRIVACYPOST lookup start [10406] dbg: async: starting: URI-DNSBL, DNSBL:dob.sibl.support-intelligence.net:dupedangryred.com (timeout 15.0s, min 3.0s) [10406] dbg: dns: URIBL_RHS_DOB lookup start [10406] dbg: dns: URIBL_JP_SURBL lookup start [10406] dbg: dns: URIBL_WS_SURBL lookup start [10406] dbg: dns: URIBL_OB_SURBL lookup start [10406] dbg: dns: WHOIS_DMNBYPROXY lookup start [10406] dbg: dns: WHOIS_REGISTERFLY lookup start [10406] dbg: dns: WHOIS_UNLISTED lookup start [10406] dbg: dns: WHOIS_MONIKER_PRIV lookup start [10406] dbg: async: starting: URI-NS, NS:dupedangryred.com (timeout 15.0s, min 3.0s) [10406] dbg: dns: URIBL_SBL lookup start [10406] dbg: dns: checking RBL sa-other.bondedsender.org., set bsp-untrusted [10406] dbg: dns: checking RBL plus.bondedsender.org., set ssc-firsttrusted [10406] dbg: dns: checking RBL combined.njabl.org., set njabl [10406] dbg: dns: checking RBL bl.spamcop.net., set spamcop [10406] dbg: dns: checking RBL dob.sibl.support-intelligence.net., set dob [10406] dbg: dns: checking RBL zen.spamhaus.org., set zen-lastexternal [10406] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs-lastexternal [10406] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs [10406] dbg: dns: checking RBL zen.spamhaus.org., set zen-lastexternal [10406] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted [10406] dbg: dns: checking RBL sa-accredit.habeas.com., set habeas-firsttrusted [10406] dbg: dns: checking RBL list.dsbl.org., set dsbl-lastexternal [10406] dbg: dns: checking RBL sa-trusted.bondedsender.org., set bsp-firsttrusted [10406] dbg: dns: checking RBL zen.spamhaus.org., set zen [10406] dbg: dns: checking RBL iadb.isipp.com., set iadb-firsttrusted [10406] dbg: plugin: Mail::SpamAssassin::Plugin::Shortcircuit=HASH(0x924d418) implements 'have_shortcircuited', priority 0 [10406] dbg: check: running tests for priority: -1000 [10406] dbg: async: select found no responses ready (t.o.=0.0) [10406] dbg: async: queries completed: 0, started: 0 [10406] dbg: async: queries active: URI-DNSBL=4 URI-NS=1 at Thu Sep 4 20:59:22 2008 [10406] dbg: plugin: Mail::SpamAssassin::Plugin::OneLineBodyRuleType=HASH(0x8b3ce0c) implements 'check_rules_at_priority', priority 0 [10406] dbg: plugin: Mail::SpamAssassin::Plugin::Rule2XSBody=HASH(0x920af10) implements 'check_rules_at_priority', priority 0 [10406] dbg: rules: running one_line_body tests; score so far=0 [10406] dbg: rules: compiled one_line_body tests [10406] dbg: plugin: Mail::SpamAssassin::Plugin::Rule2XSBody=HASH(0x920af10) implements 'run_body_fast_scan', priority 0 [10406] dbg: rules: running one_line_body tests; score so far=0 [10406] dbg: rules: running head tests; score so far=0 [10406] dbg: rules: compiled head tests [10406] dbg: eval: all '*From' addrs: [EMAIL PROTECTED] [10406] dbg: eval: all '*To' addrs: [EMAIL PROTECTED] [10406] dbg: rules: running body tests; score so far=0 [10406] dbg: rules: compiled body tests
Results from test machine, was: Re: How can I see all rules applied?
And this is the output from the very same command, ran on the test box: [26243] dbg: config: read file /etc/mail/spamassassin/init.pre [26243] dbg: config: read file /etc/mail/spamassassin/v310.pre [26243] dbg: config: read file /etc/mail/spamassassin/v312.pre [26243] dbg: config: read file /etc/mail/spamassassin/v320.pre [26243] dbg: config: using "/var/lib/spamassassin/3.002005" for sys rules pre files [26243] dbg: config: using "/var/lib/spamassassin/3.002005" for default rules dir [26243] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org.cf [26243] dbg: config: using "/etc/mail/spamassassin" for site rules dir [26243] dbg: config: read file /etc/mail/spamassassin/local.cf [26243] dbg: config: using "/root/.spamassassin" for user state dir [26243] dbg: config: using "/root/.spamassassin/user_prefs" for user prefs file [26243] dbg: config: read file /root/.spamassassin/user_prefs [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::ASN from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::AWL from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::AccessDB from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::AntiVirus from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::AutoLearnThreshold from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::Bayes from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::BodyEval from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::BodyRuleBaseExtractor from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::Check from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::DCC from @INC [26243] dbg: dcc: network tests on, registering DCC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::DKIM from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::DNSEval from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::DomainKeys from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::HTMLEval from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::HTTPSMismatch from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::HeaderEval from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::ImageInfo from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEEval from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEHeader from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::OneLineBodyRuleType from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor from @INC [26243] dbg: pyzor: network tests on, attempting Pyzor [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::Razor2 from @INC [26243] dbg: razor2: razor2 is available, version 2.84 [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::RelayCountry from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::RelayEval from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::ReplaceTags from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::Rule2XSBody from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::Shortcircuit from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::SpamCop from @INC [26243] dbg: reporter: network tests on, attempting SpamCop [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::Test from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::TextCat from @INC [26243] dbg: textcat: loading languages file... [26243] dbg: textcat: loaded 73 language models [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDetail from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIEval from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::VBounce from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::WLBLEval from @INC [26243] dbg: plugin: loading Mail::SpamAssassin::Plugin::WhiteListSubject from @INC [26243] dbg: config: using "/var/lib/spamassassin/3.002005/updates_spamassassin_org/10_default_prefs.cf" for included file [26243] dbg: config: read file /var/lib/spamassassin/3.002005/updates_spamassassin_org/10_default_prefs.cf [26243] dbg: rules: __XM_OL_22B61 merged duplicates: __XM_OL_A842E [26243] dbg: rules: __MO_OL_07794 merged duplicates: __MO_OL_8627E __MO_OL_F3B05 [26243] dbg: rules: __JM_REACTOR_DATE merged duplicates: __RATWARE_0_TZ_DATE [26243] dbg: rules: __XM_OL_07794 merged duplicates: __XM_OL_25340 __XM_OL_3857F __XM_OL_4F240 __XM_OL_58CB5 __XM_OL_6554A __XM_OL_812FF __XM_OL_C65FA __XM_OL_CF0C0 __XM_OL_F475E __XM_OL_F6D01 [26243] dbg: rules: FH_MSGID_01C67 merged duplicates: __MSGID_VGA [26243] dbg: rules: FS_NEW_SOFT_UPLOAD merged duplicates: HS_SUBJ_NEW_SOFTWARE [26243] dbg: rules: __FH_HAS_XMSMAIL merged dup
Re: How can I see all rules applied?
I have now came down to a problem with the auto whitelist: See the test machine: [4998] dbg: auto-whitelist: tie-ing to DB file of type DB_File R/W in /root/.spamassassin/auto-whitelist [4998] dbg: auto-whitelist: db-based [EMAIL PROTECTED]|ip=190.173 scores 5/61.821 [4998] dbg: auto-whitelist: AWL active, pre-score: 2.602, autolearn score: 2.602, mean: 12.3642, IP: 190.173.128.77 [4998] dbg: auto-whitelist: add_score: new count: 6, new totscore: 64.423 [4998] dbg: auto-whitelist: DB addr list: untie-ing and unlocking [4998] dbg: auto-whitelist: DB addr list: file locked, breaking lock [4998] dbg: locker: safe_unlock: unlink /root/.spamassassin/auto-whitelist.lock [4998] dbg: auto-whitelist: post auto-whitelist score: 7.4831 Compared to the live-system: [18824] dbg: auto-whitelist: tie-ing to DB file of type DB_File R/W in /root/.spamassassin/auto-whi telist [18824] dbg: auto-whitelist: db-based [EMAIL PROTECTED]|ip=190.173 scores 6/13.112 [18824] dbg: auto-whitelist: AWL active, pre-score: 2.602, autolearn score: 2.602, mean: 2.1853 33, IP: 190.173.128.77 [18824] dbg: auto-whitelist: add_score: new count: 7, new totscore: 15.714 [18824] dbg: auto-whitelist: DB addr list: untie-ing and unlocking [18824] dbg: auto-whitelist: DB addr list: file locked, breaking lock [18824] dbg: locker: safe_unlock: unlink /root/.spamassassin/auto-whitelist.lock [18824] dbg: auto-whitelist: post auto-whitelist score: 2.393667 -- View this message in context: http://www.nabble.com/How-can-I-see-all-rules-applied--tp19312076p19329022.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: How can I see all rules applied?
Hi Anthony, I agree. But how can I delete this auto-whitelist? I found two of them in /root/.spamassassin/auto-whitelist and /var/amavis/.spamassassin/auto-whitelist. I even disabled it in /etc/mail/spamassassin/v310.pre No avail. :( Anthony Peacock wrote: > > Hi, > > I am not sure what you think the problem is. If you are refering to the > different scores then that is to be expected as the two systems are > using different auto-whitelist databases and will probably have > different data in them. > > patrickbaer wrote: >> I have now came down to a problem with the auto whitelist: >> >> See the test machine: >> >> [4998] dbg: auto-whitelist: tie-ing to DB file of type DB_File R/W in >> /root/.spamassassin/auto-whitelist >> [4998] dbg: auto-whitelist: db-based [EMAIL PROTECTED]|ip=190.173 >> scores 5/61.821 >> [4998] dbg: auto-whitelist: AWL active, pre-score: 2.602, autolearn >> score: >> 2.602, mean: 12.3642, IP: 190.173.128.77 >> [4998] dbg: auto-whitelist: add_score: new count: 6, new totscore: 64.423 >> [4998] dbg: auto-whitelist: DB addr list: untie-ing and unlocking >> [4998] dbg: auto-whitelist: DB addr list: file locked, breaking lock >> [4998] dbg: locker: safe_unlock: unlink >> /root/.spamassassin/auto-whitelist.lock >> [4998] dbg: auto-whitelist: post auto-whitelist score: 7.4831 >> >> Compared to the live-system: >> >> [18824] dbg: auto-whitelist: tie-ing to DB file of type DB_File R/W in >> /root/.spamassassin/auto-whi >> telist >> [18824] dbg: auto-whitelist: db-based [EMAIL PROTECTED]|ip=190.173 >> scores 6/13.112 >> [18824] dbg: auto-whitelist: AWL active, pre-score: 2.602, autolearn >> score: >> 2.602, mean: 2.1853 >> 33, IP: 190.173.128.77 >> [18824] dbg: auto-whitelist: add_score: new count: 7, new totscore: >> 15.714 >> [18824] dbg: auto-whitelist: DB addr list: untie-ing and unlocking >> [18824] dbg: auto-whitelist: DB addr list: file locked, breaking lock >> [18824] dbg: locker: safe_unlock: unlink >> /root/.spamassassin/auto-whitelist.lock >> [18824] dbg: auto-whitelist: post auto-whitelist score: 2.393667 >> > > > -- > Anthony Peacock > CHIME, Royal Free & University College Medical School > WWW:http://www.chime.ucl.ac.uk/~rmhiajp/ > Study Health Informatics - Modular Postgraduate Degree > http://www.chime.ucl.ac.uk/study-health-informatics/ > > -- View this message in context: http://www.nabble.com/How-can-I-see-all-rules-applied--tp19312076p19329287.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: How can I see all rules applied?
Dear Lord, I am going nuts! I promised my colleagues a new filter three days ago. Now they are drowning in spam and I have no idea about what's going on! I have this test-machine with a fresh installation of postfix, spamassassin and amavisd and it works like a charme. I have a catch rate of no less than 99.6% on this machine and not a single false negative! Now on the crappy live box, absolutely NOTHING works as it should. I just tried, in my despair, to apply a custom rule, but no way it will accept them! Added it to local.cf, no work. Added a new file to /var/lib/spamassassin.../20_test.cf, no work. Spamassassin parses the rule, yes, but it doesn't apply the score! Please, what the hell is going on there and how can I find out how to solve it? I have no idea where to go from here any more... -- View this message in context: http://www.nabble.com/How-can-I-see-all-rules-applied--tp19312076p19331058.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: How can I see all rules applied?
McDonald, Dan wrote: > > On Fri, 2008-09-05 at 06:18 -0700, patrickbaer wrote: > >> Now on the crappy live box, absolutely NOTHING works as it should. I just >> tried, in my despair, to apply a custom rule, but no way it will accept >> them! Added it to local.cf, no work. Added a new file to >> /var/lib/spamassassin.../20_test.cf, no work. Spamassassin parses the >> rule, >> yes, but it doesn't apply the score! > >>Did you run sa-compile? then you will need to run sa-compile each time >>you change a body rule. > > I just tried, just to make sure. But it failed with an error with e2c (?) > > >>Are you re-starting amavisd when you make the changes? Amavisd-new >>daemonizes the spamassassin libraries. Only when it is restarted will >>it load any new rules. > > Yes, but it also fails when I sent the email from the command line (see > above) > > > And finally, have you checked that the amavisd user is able to read the > files you are modifying? > > Of course :) > > As I am now pi for various reasons, I'll put my desktop machine (the > testbox) in the DMZ and enable it in the other mailserver, then report > back. > > I'll just add it to the current config: localhost:25 => localhost:10024 => > external:10024 => localhost:10025 > > > -- > Daniel J McDonald, CCIE #2495, CISSP #78281, CNX > Austin Energy > http://www.austinenergy.com > > > > -- View this message in context: http://www.nabble.com/How-can-I-see-all-rules-applied--tp19312076p19331798.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
How to search the whole body
Hi all,
relaxing from my hassle with the new machine :)
I'd like to set up a rule catching multiple dollar-signs in a message, I
don't see any other way to catch those heavily "encrypted" pill-emails like
this:
C A aN A DvAN P c cH A RM A oCY
VzA zG _RA - $1.48
C 9a A L u S - $2.24
S0 O M A - $0.65
My idea was to ring the bell, when the dollar-sign appears more than four
times in a single email. As a bayes_00 rule marks it with a -2.5 score I am
clueless what else to do about them. /\${3,}/ oviously won't work :(
TIA
P.
--
View this message in context:
http://www.nabble.com/How-to-search-the-whole-body-tp19392593p19392593.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Searching for a list of strings
Hi all, I'm looking for some regex to find a list of strings in the body, independent where they are and so on. Example: i am Nice Girl good looking girl who is looking to chat with you. email me back at [EMAIL PROTECTED] i will reply back with some really nice pics or skype realtime videos. The most common phrases are: nice girl, good looking, chat with you, nice pics, videos So if at least three of them hit, the rule should match. Sorry for bothering again. -- View this message in context: http://www.nabble.com/Searching-for-a-list-of-strings-tp19455236p19455236.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Searching for a list of strings
This is the email that went through. Nothing about razor though?
Return-Path: <[EMAIL PROTECTED]>
Received: from medusa.tvwerk.de ([unix socket])
by medusa2 (Cyrus v2.2.13-Debian-2.2.13-10.cb1.1) with LMTPA;
Fri, 12 Sep 2008 14:33:23 +0200
X-Sieve: CMU Sieve 2.2
Received: from proxy.tvwerk.de (proxy1 [10.10.10.2])
by medusa.tvwerk.de (Postfix) with ESMTP id 0B6D51BD7F23
for <[EMAIL PROTECTED]>; Fri, 12 Sep 2008 14:33:23 +0200 (CEST)
Received: from localhost (unknown [10.10.10.66])
by proxy.tvwerk.de (Postfix) with ESMTP id 0313F304012
for <[EMAIL PROTECTED]>; Fri, 12 Sep 2008 14:33:23 +0200 (CEST)
X-Virus-Scanned: amavisd-new at animoto.intern
X-Spam-Flag: NO
X-Spam-Score: 4.427
X-Spam-Level:
X-Spam-Status: No, score=4.427 tagged_above=-999 required=5
tests=[BAYES_50=0.001, HTML_MESSAGE=0.001, RCVD_FORGED_WROTE2=4.325,
RDNS_NONE=0.1]
Received: from proxy.tvwerk.de ([10.10.10.2])
by localhost (voodoo.animoto.intern [10.10.10.66]) (amavisd-new, port
10024)
with ESMTP id ZBT1zGMIqj33 for <[EMAIL PROTECTED]>;
Fri, 12 Sep 2008 14:33:04 +0200 (MEST)
Received: from furtmair.com (unknown [79.165.217.243])
by proxy.tvwerk.de (Postfix) with SMTP id 04966304031
for <[EMAIL PROTECTED]>; Fri, 12 Sep 2008 14:32:11 +0200 (CEST)
Received: from 212.203.9.120 (HELO mail3.servernation.nl)
by tvwerk.de with esmtp ({nChar[8-12]} {nChar[4-6]})
id 8secZp-Vw7spY-Ee
for [EMAIL PROTECTED]; Fri, 12 Sep 2008 16:32:12 +0400
Message-ID: <[EMAIL PROTECTED]>
From: "Rowena Hyatt" <[EMAIL PROTECTED]>
To: "Cherry Zapata" <[EMAIL PROTECTED]>
Subject: i need you
Date: Fri, 12 Sep 2008 16:32:12 +0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_17862_4630_01C914F5.1BF90F20"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
This is a multi-part message in MIME format.
--=_NextPart_17862_4630_01C914F5.1BF90F20
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
i am Nice Girl good looking girl who is looking to chat with you=2E=20
email me back at [EMAIL PROTECTED]
i will reply back with some really nice pics or skype realtime videos=2E
--=_NextPart_17862_4630_01C914F5.1BF90F20
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
i am Nice Girl good looking girl who is looking to chat with you=2E=
email me back at 3D"mailto:[EMAIL PROTECTED]" [EMAIL PROTECTED]
ciallam=2Ecom
i will reply back with some really nice pics or skype realtime videos=2E<=
/b>
--=_NextPart_17862_4630_01C914F5.1BF90F20--
Robert Schetterer wrote:
>
> patrickbaer schrieb:
>> Hi all,
>>
>> I'm looking for some regex to find a list of strings in the body,
>> independent where they are and so on.
>>
>> Example:
>>
>> i am Nice Girl good looking girl who is looking to chat with you.
>> email me back at [EMAIL PROTECTED]
>>
>> i will reply back with some really nice pics or skype realtime videos.
>>
>> The most common phrases are: nice girl, good looking, chat with you, nice
>> pics, videos
>>
>> So if at least three of them hit, the rule should match.
>>
>> Sorry for bothering again.
>
> on my side
> this nice girl stuff is mostly matched
> by pyzor, razor, dcc, ixhash, freemail plugins etc
> so phrase matches arent that much important
> there arent so much mails of such kind which bypass
> rbls and clamav-milter at smtp level
>
> --
> Best Regards
>
> MfG Robert Schetterer
>
> Germany/Munich/Bavaria
>
>
--
View this message in context:
http://www.nabble.com/Searching-for-a-list-of-strings-tp19455236p19455515.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Searching for a line-pattern
Dear Guennadi Liakhovetski, In message <[EMAIL PROTECTED]> you wrote: > > Was this patch correct then? > > http://lists.denx.de/pipermail/u-boot/2008-July/037375.html > > So, we jules are no longer listed and (b) the score will be 2.0 if buth > subrules match and zero otherwise. > > > Martin > > > > -- View this message in context: http://www.nabble.com/Searching-for-a-line-pattern-tp19488817p19490704.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Searching for a line-pattern
It's ugly, but it actually seems to work: rawbody PBA_TEST /Content.*\n\n.*\n.*http.*\n\n-/ Any comments before I activate it? patrickbaer wrote: > > Sorry for not posting a whole email, I tried but the message got blocked > :) > > My problem are those two-liners: One line of text, second line a link > only. Just like: > > New versions of pills for you > www.gmx.net > > So the pattern should be /two lines only, second one link/ > > Sorry for not saying anything more, but I have no idea how to describe > this or what to do .( > -- View this message in context: http://www.nabble.com/Searching-for-a-line-pattern-tp19488817p19527787.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
