[SAtalk] spam stats

2003-06-22 Thread Marek Dohojda
Hello everyone I am looking for a good spam stat program that will work with spamassassin and qmail. I don't care if it's graphical or not, as long as it works. Thank you!! Marek --- This SF.Net email is sponsored by: INetU Attention Web

Re: [SAtalk] Spam got score -80.6 - Spamassassin 2.55

2003-06-22 Thread Matt Kettler
At 03:14 PM 6/23/03 +1200, Simon Byrnand wrote: I've suggested before on the list that predefined whitelists for places like amazon.com should be much less than -100, just -10, or perhaps even -5. Enough to offset any "spamminess" that might otherwise bump them over over the threshold, but not s

Re: [SAtalk] Spam got score -80.6 - Spamassassin 2.55

2003-06-22 Thread Simon Byrnand
At 21:41 22/06/03 -0400, Matt Kettler wrote: At 12:15 PM 6/23/03 +1200, Simon Byrnand wrote: At 00:41 23/06/03 +0200, Bernd Kuhls wrote: Hi, got this nice baby: Greetings, Bernd [snip] Just wondering, how exactly does posting a copy of that message to this list help anyone ? a) There is no ind

[SAtalk] CPU Death: body tests (Delta: 7.000s)

2003-06-22 Thread zeek
Greetings, I'm running RH9, perl v5.8.0, and Theo's latest rpms spamassassin-2.55-1 and the scans are killing my machine. I read about the LANG issue and set LANG=en_US and I also had set: # :0fw: spamassassin.lock # * < 256000 # | /usr/bin/spamc -f It may be the bayes db --does this require pr

Re: [SAtalk] Max children

2003-06-22 Thread Simon Byrnand
At 18:36 22/06/03 -0700, Justin Mason wrote: Simon Byrnand said: > > So quickly that it makes me suspicious as to what was REALLY > >wrong. Maybe something more than just load, or RBL problems. Maybe a > >locking problem. > > Nope, this is a problem with stock installs of sendmail/procmail and/o

Re: [SAtalk] Spam got score -80.6 - Spamassassin 2.55

2003-06-22 Thread Matt Kettler
At 12:15 PM 6/23/03 +1200, Simon Byrnand wrote: At 00:41 23/06/03 +0200, Bernd Kuhls wrote: Hi, got this nice baby: Greetings, Bernd [snip] Just wondering, how exactly does posting a copy of that message to this list help anyone ? a) There is no indication of what version of SpamAssassin proce

Re: [SAtalk] Max children

2003-06-22 Thread Justin Mason
Simon Byrnand said: > > So quickly that it makes me suspicious as to what was REALLY > >wrong. Maybe something more than just load, or RBL problems. Maybe a > >locking problem. > > Nope, this is a problem with stock installs of sendmail/procmail and/or a > lack of memory. How much memory does

RE: [SAtalk] Spam got score -80.6 - Spamassassin 2.55

2003-06-22 Thread Bingham, Ryan
Check the first two lines of the header: Return-path: <[EMAIL PROTECTED]> Received: from router ([192.168.1.8]) It looks like it was able to spoof amazon.com, which would explain why it got whitelisted. If I'm reading this correctly, the first hop was to an internal router (probably with its own

Re: [SAtalk] Max children

2003-06-22 Thread Jack Gostl
On Mon, 23 Jun 2003, Simon Byrnand wrote: > At 20:54 22/06/03 -0400, Jack Gostl wrote: > > > >On Mon, 23 Jun 2003, Simon Byrnand wrote: > > > > > At 08:38 18/06/03 -0400, Jack Gostl wrote: > > > > > > >I've seen this two or three times now, and I'm not sure what to make of > > > >it. > > > > > >

Re: [SAtalk] Max children

2003-06-22 Thread Simon Byrnand
At 20:54 22/06/03 -0400, Jack Gostl wrote: On Mon, 23 Jun 2003, Simon Byrnand wrote: > At 08:38 18/06/03 -0400, Jack Gostl wrote: > > >I've seen this two or three times now, and I'm not sure what to make of > >it. > > > >Outward appearance is that we get hit with a ton of spam, or perhaps that >

Re: [SAtalk] Spam got score -80.6 - Spamassassin 2.55

2003-06-22 Thread Simon Byrnand
At 00:41 23/06/03 +0200, Bernd Kuhls wrote: Hi, got this nice baby: Greetings, Bernd [snip] Just wondering, how exactly does posting a copy of that message to this list help anyone ? a) There is no indication of what version of SpamAssassin processed the message, its not even obvious that it

Fwd: Re: [SAtalk] Max children

2003-06-22 Thread Simon Byrnand
#!/bin/sh loadavg=`sed 's/\..*//g' /proc/loadavg` if [ "$loadavg" -gt 14 ]; then /usr/bin/logger -i -p mail.warn -t `basename $0` WARNING: Returning temporary failure due to load average of $loadavg exit 75 fi procmail=`ps -Af | grep procmail | grep -v grep | wc -l` if [ "$procm

Re: [SAtalk] Max children

2003-06-22 Thread Simon Byrnand
At 08:38 18/06/03 -0400, Jack Gostl wrote: I've seen this two or three times now, and I'm not sure what to make of it. Outward appearance is that we get hit with a ton of spam, or perhaps that an RBL goes out. I wind up with many copies of spamd running, many more than the -m parameter should allo

Re: [SAtalk] autolearn/autowhitelist misguided

2003-06-22 Thread Justin Mason
Simon Byrnand said: > > - for spam, must have 3 head hits and 3 body hits > > Why ? This seems a bit arbitrary to me. Either we trust the scoring or we > don't :) What is magic about 3 in particular ? Yeah, not sure myself. if I recall correctly it gave a stronger statistical basis to ensur

Re: [SAtalk] OT- "greylisting" - opinions from the SA community?

2003-06-22 Thread Bob Apthorpe
Hi, On 21 Jun 2003 19:21:12 +0100 Yorkshire Dave <[EMAIL PROTECTED]> wrote: > On Sat, 2003-06-21 at 08:58, Alan Leghart wrote: > > > This method proposes to delay EVERY SINGLE MESSAGE until a database match > > is found for sending IP, FROM, and TO. > > > > So...we punish everyone in the world

RE: [SAtalk] Public folders, IMAP

2003-06-22 Thread Bingham, Ryan
Mark, This sounds great; thanks for posting the script. One question: does this method preserve the message headers? I've had a lot of problems keeping the headers intact with Exchange 2000/Public Folders/IMAP. Ryan -Original Message- From: Mark Motley [mailto:[EMAIL PROTECTED] Sent:

Re: [SAtalk] autolearn/autowhitelist misguided

2003-06-22 Thread Simon Byrnand
At 15:20 22/06/03 -0700, Justin Mason wrote: Matt Kettler said: > As for disabling the network checks for auto-learning, that makes sense to > me as well, since the bayes code learns from text tokens, not IPs. Actually, not quite right, if you're scanning with network tests, it'll do the auto-lea

Re: [SAtalk] Server Load Average Increasing in Redhad 7.3

2003-06-22 Thread Michael P. Carel
> > I've installed spamassassin 2.54 in redhat 7.3 with a machine specs > > of Intel PII 350MHz 128MB, there are times that my server loads > > abnormally increases when spamassassin daemon scanning emails. I used > > to restart the daemon process and the server load back to normal > > again. > >

[SAtalk] Spam got score -80.6 - Spamassassin 2.55

2003-06-22 Thread Bernd Kuhls
Hi, got this nice baby: Greetings, Bernd --cut Return-path: <[EMAIL PROTECTED]> Received: from router ([192.168.1.8]) by router with esmtp (Exim 4.12) id 19UD83-0006oj-00 for [EMAIL PROTECTED]; Mon, 23 Jun 2003 00:16:07 +0200 Received: from localhost by local

Re: [SAtalk] autolearn/autowhitelist misguided

2003-06-22 Thread Simon Byrnand
At 10:08 22/06/03 -0400, Matt Kettler wrote: At 08:30 PM 6/21/03 -0400, Gordon Cormack wrote: Auto-learn and auto-whitelist use different scoring criteria from those used in spamassassin's spam filtering. The bayes auto-learning does not use "it's own" scoring mechanism, it uses scoreset 0. This i

Re: [SAtalk] autolearn/autowhitelist misguided

2003-06-22 Thread Justin Mason
Matt Kettler said: > As for disabling the network checks for auto-learning, that makes sense to > me as well, since the bayes code learns from text tokens, not IPs. Actually, not quite right, if you're scanning with network tests, it'll do the auto-learn score test with network tests as well.

Re: [SAtalk] autolearn/autowhitelist misguided

2003-06-22 Thread Justin Mason
Gordon Cormack said: > In supervised mode, positive feedback is exactly what you want. > > For the reasons that I've mentioned before, the lack of feedback in the > current setup causes the system to 'learn' progressively less accurate > information. BTW supervised mode is pretty trivial to set

Re: [SAtalk] To the SA developers

2003-06-22 Thread Simon Byrnand
At 08:19 22/06/03 +0200, guenther wrote: > I think what might eventually happen is that ISP's start blocking egress > on port 25 from all but their own mailserver(s) which forces all the > customers within their ip range to relay through their server. That way > they can run something like spamass

Re: [SAtalk] resolution of rbls using specific local name servers?

2003-06-22 Thread Simon Byrnand
At 12:36 20/06/03 -0700, Daniel Quinlan wrote: Daniel Quinlan wrote: >> In 2.60, RBL lookups are going to be a *lot* faster. I should do some >> benchmarks vs. 2.55, but you should notice a very nice improvement. Simon Byrnand <[EMAIL PROTECTED]> writes: > I'm curious, what kind of changes are r

Re: [SAtalk] rules not working

2003-06-22 Thread Tony Earnshaw
Test, James wrote: Using spamassassin 2.54 + red hat 8.0 + exim 4.20. I have made some custom rules, and sometimes incoming mail seems to totally bypass my custom rules. I had a piece of spam come in that did not seem to be analyzed by my local.cf file. I can then take that same mail and forwar

Re: [SAtalk] Re: rule to catch obsfucated html ?

2003-06-22 Thread Daniel Quinlan
Tomoyuki Sakurai wrote: >> Hopefully SA2.60 would solve it. Gordon Cormack <[EMAIL PROTECTED]> writes: > The version of 2.60 that I have sort of works in detecting obfuscated html. > > It *does* detect words split apart by html comments. > > It *does not* detect words split apart by bogus tags.

[SAtalk] SA 2.60 question? Should I delete my old learning database?

2003-06-22 Thread Bill
I understand that SA 2.60 has a revamped learning routine. When installing it should I delete the old data to prevent it from picking up any old bad habits? If yes, what file(s) should I delete? TIA, Bill --- This SF.Net email is sponsored by

[SAtalk] rules not working

2003-06-22 Thread Test, James
Using spamassassin 2.54 + red hat 8.0 + exim 4.20. I have made some custom rules, and sometimes incoming mail seems to totally bypass my custom rules. I had a piece of spam come in that did not seem to be analyzed by my local.cf file. I can then take that same mail and forward it to go throug

Re: [SAtalk] can't make install if personal

2003-06-22 Thread Gordon Cormack
On Sun, Jun 22, 2003 at 12:49:36PM +0800, Dan Jacobson wrote: > > please somebody tell me how to make install in $HOME!? > Dan, I, too, had a great deal of trouble installing spamassassin. In the end I did the following: 1. installed my own version of perl with the necessary packages

Re: [SAtalk] Re: rule to catch obsfucated html ?

2003-06-22 Thread Gordon Cormack
On Sun, Jun 22, 2003 at 11:18:05PM +0900, Tomoyuki Sakurai wrote: > Hopefully SA2.60 would solve it. The version of 2.60 that I have sort of works in detecting obfuscated html. It *does* detect words split apart by html comments. It *does not* detect words split apart by bogus tags. It *does n

Re: [SAtalk] autolearn/autowhitelist misguided

2003-06-22 Thread Gordon Cormack
On Sun, Jun 22, 2003 at 10:45:42AM -0400, Gordon Cormack wrote: > What I have observed is < 0.2% false > positives and < 1.0% false negatives. I miscomputed, using only the spam count in the denominator. The true numbers [false / (ham+spam)] are: false positives: < 0.05% (counted) false

Re: [SAtalk] autolearn/autowhitelist misguided

2003-06-22 Thread Gordon Cormack
On Sun, Jun 22, 2003 at 10:08:07AM -0400, Matt Kettler wrote: > At 08:30 PM 6/21/03 -0400, Gordon Cormack wrote: > >Auto-learn and auto-whitelist use different scoring criteria from those > >used in spamassassin's spam filtering. > > The bayes auto-learning does not use "it's own" scoring mechanis

Re: [SAtalk] can't make install if personal

2003-06-22 Thread Tim
Hi Dan, All I can say is, it works for me. I have SA in the following locations: /home/kc8hr/bin/sausr/bin/spamassassin /home/kc8hr/bin/sausr/share/spamassassin On Sun, 22 Jun 2003, Dan Jacobson wrote: > Non-root mentioned twice: These should be consolidated > $ egrep -in 'personal|non-root' /v

[SAtalk] Re: rule to catch obsfucated html ?

2003-06-22 Thread Tomoyuki Sakurai
| Do you have any good idea? I'dont. Nice guys do. Hopefully SA2.60 would solve it. See, http://sourceforge.net/mailarchive/message.php?msg_id=5013771 http://sourceforge.net/mailarchive/message.php?msg_id=523 Regards, -- Tomoyuki Sakurai - Tomi - [EMAIL PROTECTED] ---

Re: [SAtalk] autolearn/autowhitelist misguided

2003-06-22 Thread Matt Kettler
At 08:30 PM 6/21/03 -0400, Gordon Cormack wrote: Auto-learn and auto-whitelist use different scoring criteria from those used in spamassassin's spam filtering. The bayes auto-learning does not use "it's own" scoring mechanism, it uses scoreset 0. This is the score the email would get by the main S

Re: [SAtalk] Net::DNS tests skipped.

2003-06-22 Thread Matt Kettler
At 03:30 PM 6/21/03 +0100, Jim Ford wrote: Hi, A bit OT here - I've posted to the net-dns list, but I feel I'm more likely to get a response here! I'm trying to use Net::DNS with spamassassin without success so far. I've grabbed Net-DNS-0.38 and installed it, but when I run the test suite I get t

Re: [SAtalk] Spam profiting from auto_whitelist -- how to avoid?

2003-06-22 Thread Kai Schaetzl
Justin Mason wrote on Sat, 21 Jun 2003 12:12:01 -0700: > Not the case -- whitelist settings are ignored for auto-learning. So > if the mail is judged as spam without the WL score applied, it'll > be auto-learned as spam. I see, thanks. I looked at his stats and it looked like it was learned onl

[SAtalk] >>15.7 MILLION TARGETED EMAIL ADDRESSES....PLUS TONS OF FREE SOFTWARE!

2003-06-22 Thread kiasa
Hello, WOULD YOU LIKE TO HAVE YOUR MESSAGE SEEN BY OVER 15.7 MILLION OPT-IN, TARGETED PEOPLE DAILY? PLUS RECEIVE TONS OF FREE EMAIL MARKETING SOFTWARE! Below contains all the information you will ever need to market your product or service on the Internet. If you have a product, service, or

[SAtalk] No RBL checks - baffled!

2003-06-22 Thread Jim Ford
Hi, I'm using SA 2.55, with no previous installations. I've got Razor & DCC working fine, but as the last piece of the jigsaw I want to use RBLs. I've installed Net::DNS (0.38) and although some tests were skipped, the Net-DNS mailing list assures me my installation's OK. I've got 'dns_available y

[SAtalk] Razor packages for Red Hat

2003-06-22 Thread Warren Togami
The following are everything needed to easily install razor2 on Red Hat Linux 9. You need to rebuild these SRPMS, and it will tell you what additional perl packages that shipped with RH9 are needed when you install them. These packages are polished up and in the process of approval for publicatio

AW: [SAtalk] autolearn/autowhitelist misguided

2003-06-22 Thread Martin Bene
Hi Gordon > The rationale for spamassassin's behaviour is, I think, the fear that > in unsupervised mode it will go off track. Perhaps there should be a user > flag "supervised/unsupervised" that determines whether or not the same > criteria are used for filtering and learning. In "supervised" m

Re: [SAtalk] To the SA developers

2003-06-22 Thread guenther
> I think what might eventually happen is that ISP's start blocking egress > on port 25 from all but their own mailserver(s) which forces all the > customers within their ip range to relay through their server. That way > they can run something like spamassassin on *outgoing* messages and, for > e

Re: [SAtalk] To the SA developers

2003-06-22 Thread guenther
> So, gentlemen, hat(s) off and on in ever increasing tempo. Full ack! Although my results are not as good and a couple of SPAM still slips through... > I wonder what comes next. To my mind, attempts at legislation will prove > useless. Technology will prove the savior. Technology as the savi