[SAtalk] "required hits" option

I'm SA newbie. How can I use the "required hits" option? I don't know, how to use it. Can you give me and PRACTICAL example, what it is for? Thank you very much for help Maca -- Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/ ---

Re: [SAtalk] Ideas on dealing with Joe Job?

Dear Jim Ford, Date: Wed, 25 Jun 2003 17:13:32 +0100 From: Jim Ford <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Re: [SAtalk] Ideas on dealing with Joe Job? ... Any pointers as to how to trace email from the headers - they're pretty cryptic to a non IT professional like myself? If fact it wo

Re: [SAtalk] learning mailserver headers

Simon Byrnand writes: >0.0000280700 non-token data: nspam >0.0000448940 non-token data: nham >0.0000 1027800 non-token data: ntokens >0.0000143410 non-token data: oldest age >0.0000536210 non-tok

Re: [SAtalk] Intriguing header forgery

Martin Radford wrote: What's interesting is that the header at the bottom is clearly forged - 194.217.242.6 *is* punt-2.mail.demon.net, which is one of the two MX records for my domain zamenhof.demon.co.uk. The genuine Received header is the one above. Is this a new spammer trick - to forge a R

Fwd: Re: [SAtalk] learning mailserver headers

Nope, only one secondary, and it runs the same version of Sendmail. (Changed to 8.11.6p2 a while back, but slightly after the bayes database was already learning) Err, to be clearer, both primary and secondary were updated at the same time. Alternatively, what's the token counts for that token?

Re: [SAtalk] IMAP: Mark as read?

> > When spam is moved to the spam folder, I want it automatically > > marked as read. Is this possible? How? > > Yes. You could add a Status: header, or modify an existing one if > present, using 'formail' and the -a, -A, -i or -I option (man formail to Jim, that worked terrific. Thank you!

Re: [SAtalk] learning mailserver headers

At 21:55 30/06/03 -0700, Justin Mason wrote: Simon Byrnand writes: >Just browsing through my bayes database and I see > >debug: bayes token '8.11.6' => 0.0186046511627907 > >Presumably it has grabbed the 8.11.6 from our sendmail version which is in >all message headers processed by our server ? >

Re: [SAtalk] learning mailserver headers

Simon Byrnand writes: >Just browsing through my bayes database and I see > >debug: bayes token '8.11.6' => 0.0186046511627907 > >Presumably it has grabbed the 8.11.6 from our sendmail version which is in >all message headers processed by our server ? > >Which begs the question, why has bayes lear

Re: [SAtalk] IMAP: Mark as read?

Monday June 30 at 7:04pm, Brian Klug wrote: > Hi- > > I have SA working really well with procmail & IMAP (delivery via dmail). > > There is only one more thing I would like to do: When spam is moved to > the spam folder, I want it automatically marked as read. > > Is this possible? How? Yes. Y

Re: [SAtalk] best way for off-host users to submit to sa-learn?

On Monday, Jun 30, 2003, at 20:55 US/Mountain, Leo Huang wrote: I think it's not a good idea to use forwarded mails as a source for "learning". Somewhere in the SA's documentation indicates this issue. Yes, we are not forwarding, we are redirecting. But I realize that is not a good way. redire

[SAtalk] Am I screwing up my bayes database?

Hi all, I recently installed SA+amavis-new+postfix on my mail server. I have been feeding it spam and ham on a daily basis for about 2 weeks. It suddenly occurred to me that I may be screwing up the results. I have spam quarantine set to forward to me with procmail putting it in a separate spam box

Re: [SAtalk] best way for off-host users to submit to sa-learn?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Chad, Monday, June 30, 2003, 5:16:30 PM, you wrote: > Is there a good way to easily allow my virtual users to supply spam and > non-spam to the system for learning purposes that does not require a > log in to the machine and running sa-learn th

[SAtalk] ANNOUNCE: mass-checks starting for 2.60

So the mass-check runs for 2.60 are now starting. Here's the procedure you'll need to follow, if you wish to submit rescoring data for the GA run: First, send mail to <[EMAIL PROTECTED]>, and ask for a GA submission account if you haven't already got one. Turn off your nightly mass-checks, if y

Re: [SAtalk] Default Scores of 0.001

R.W. <[EMAIL PROTECTED]> writes: > It's purely idle curiosity, but why are there so many default score > entries of 0.001 ? Rules with scores of 0 are *not* run. Rules with non-zero scores such as 0.001 are run. The common reasons why a score of 0.001 or -0.001 would be used: - because we man

[SAtalk] re: SA installation problem

Greetings, I new to the list so I apologize if the following has already been covered. I recently install (attempted) SA-2.55-1 (rpms) on a RHL7.2 server. gateway:/etc/mail/spamassassin# rpm -qa | grep spamassassin spamassassin-2.55-1 spamassassin-tools-2.55-1 It also has installed perl-5.6.1-3

[SAtalk] learning mailserver headers

Just browsing through my bayes database and I see debug: bayes token '8.11.6' => 0.0186046511627907 Presumably it has grabbed the 8.11.6 from our sendmail version which is in all message headers processed by our server ? Which begs the question, why has bayes learnt that 8.11.6 is a ham indica

[SAtalk] Data Format Error

Hello, I made this file, ~/.procmailrc: :0 ! [EMAIL PROTECTED] I want to forward all mails to the address above, but Sendmail reports Data Format Error. As I set up the spamassassin rule in the /etc/procmailrc and I want my mails to be scanned before forwarding, I can't use ~/.forward. Jun 29

Re: [SAtalk] best way for off-host users to submit to sa-learn?

I think it's not a good idea to use forwarded mails as a source for "learning". Somewhere in the SA's documentation indicates this issue. Leo - Original Message - From: "Chad Leigh -- Shire.Net LLC" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Tuesday, July 01,

RE: [SAtalk] mrtg

Thanks Tim, I'll let you know what I come up with too. Regards, Pete -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Litwiller Sent: Monday, June 30, 2003 21:50 Cc: [EMAIL PROTECTED] Subject: Re: [SAtalk] mrtg http://mailhost.bccwebhosting.com/mrt

Re: [SAtalk] why not use SA on this SA list?

I run SA to this list and I have no problems. On Понедельник, 30 Июнь 2003 14:10, Dan Jacobson wrote: > Isn't this list the last place one expects to find spam? > > ScanMail Message: To Recipient virus found and action taken. > System Attendant: > Mail Adminstrator :Blocked File Attachment >

[SAtalk] Default Scores of 0.001

It's purely idle curiosity, but why are there so many default score entries of 0.001 ? --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today a

Re: [SAtalk] "Naughty" test names

Satya wrote: On Jun 30, 2003 at 19:41, Tony Earnshaw wrote: My own doubt would be: where does political correctness end? E.g., when is some Jewish or Muslim user going to object to ham being called ham and spam (non-ham) being called spam (non-ham)? Would their objection be valid, because an i

Re: [SAtalk] mrtg

http://mailhost.bccwebhosting.com/mrtg/ the mrtg part is some perl scripts parsing the spamassassin and amavis logs then since I was pasring thru those files anyways I decided to grab the users names and make make some more interesting items for the page. I'm still adjusting the scripts etc. i

RE: [SAtalk] mrtg

Ronny, I don't believe SA has an SNMP component. You'd have to find a way to feed SNMP with values from SA. Regards, Pete Peter P. Benac, CCNA Emacolet Networking Services, Inc Providing Systems and Network Consulting, Training, Web Hosting Services Phone: 919-847-1740 or 866-701-2345 Web

Re: [SAtalk] Creative spam, any ideas?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Ralf, Monday, June 30, 2003, 1:37:22 AM, you wrote: RG> The spam below slipped through SA 2.54. Note how they substitute RG> possible trigger terms with other characters, like a capital "I". Any RG> ideas what to do to catch stuff like this? Th

[SAtalk] Reloading SpamAssassin's Preferences?

I use SpamAssassin in a Perl program I wrote (a filter for CommuniGate Pro, called CGPSA); it's used in a way very similar to the way spamd uses it (the Mail::SpamAssassin object is loaded and the rules compiled at startup, and then user settings are loaded as necessary with "read_scoreonly_con

[SAtalk] best way for off-host users to submit to sa-learn?

Hi I have upgraded to 2.55 of SA and would like to allow my users to use sa-learn to submit spam and non-spam to the learner. All mail users are off-host virtual users. I run spamd/spamc using exim 4.1x mta and most users are POP users (so I cannot have a shared IMAP folder for example). I s

[SAtalk] mrtg

Hi, I was wondering if anyone has an idea/experience with spammassassin in combination with mrtg? If so, how did you do this, where your experiences ? Met vriendelijke groeten/With regards, Ronny Roethof -- Ronny Roethof WWW: http://www.roethof.net/ E-Mail: [EMAIL PROTECTED] --

[SAtalk] baeys config parameters?

Hi First to the SA author(s) -- thanks, great tool. I am using SA, now the 2.55 version with the exim MTA (4.1x) using the spamd/spamc stuff on exim.org. It is working fine. I want to have the system do autolearning. In the spamassassin FAQ at

Re: [SAtalk] HEADER: Delivered-To:

Thank you kindly for your help. Here's what I did (thanks to theo's advice,) in case anyone else needs/wants to make the same modifications (diff patch) --- /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.orig 2003-06-30 16:44:54.0 -0700 +++ /usr/lib/perl5/site_perl/5.8.0/M

Re: [SAtalk] "Naughty" test names

On Jun 30, 2003 at 19:41, Tony Earnshaw wrote: >My own doubt would be: where does political correctness end? E.g., when >is some Jewish or Muslim user going to object to ham being called ham >and spam (non-ham) being called spam (non-ham)? Would their objection be >valid, because an incompetent CE

[SAtalk] IMAP: Mark as read?

Hi- I have SA working really well with procmail & IMAP (delivery via dmail). There is only one more thing I would like to do: When spam is moved to the spam folder, I want it automatically marked as read. Is this possible? How? Brian -- Brian Klug [EMAIL PROTECTED] TYX.NET Webhosting $9.95/

[SAtalk] Error message in /var/log/maillog confusion

I have this postfix/spamassassin server running pretty well, except for the fact that it crashes (think core dump) every couple of days. I ran across this error message while looking at my logs for a clue (didn't find one :-) ) Spamd[8982]: Malformed UTF-8 Character ( Unexpected continuation byte

Re: [SAtalk] How do I know whether Bayes is working or not?

Chris Halverson wrote: > > The filter stores its files in $HOME/.spamassassin (unless otherwise set > > up), you can look for those files and see if the database grows. Check > > bayes_msgcount, it simply contains a period for each entry in the > > database. > > I've run into this issue too. I ha

Re: [SAtalk] why not use SA on this SA list?

On Mon, Jun 30, 2003 at 03:10:10PM +0800, Dan Jacobson is rumored to have said: > > Wait, I don't see any spamassassin headers on the articles in this > group. That's right - SF doesn't use it. > Idea: why don't you use the famed SpamAssassin spam defense system to > reduce spam on this list? B

Re: [SAtalk] Getting a full report on uncaught spam

On Mon, Jun 30, 2003 at 03:26:37PM -0600, Mike Mills wrote: > /usr/bin/spamassassin -D spam ^ Missing redirection operator < ? -- Spam poison - don't use! ---> [EMAIL PROTECTED] <--- --- This SF.Net email sponsored

Re: [SAtalk] why not use SA on this SA list?

> Wait, I don't see any spamassassin headers on the articles in this > group. Wait, I think this list is run on something called ``SourceForge.net'' and happens to be an ``open'' list. > Idea: why don't you use the famed SpamAssassin spam defense system to > reduce spam on this list? Bet nobody

Re: [SAtalk] HEADER: Delivered-To:

On Mon, Jun 30, 2003 at 03:27:34PM -0700, Demitrious S. Kelly wrote: > > I believe this is valid for 2.5x: > > > > report_safe_copy_headers Delivered-To In looking again, it seems this is only available in 2.60 and beyond. For 2.5x, you'd have to modify PerMsgStatus and have it copy that header as

Re: [SAtalk] Moving Bayes Database.

I just tried this and it doesn't work. No matter how I set the permissions on the bayes files, it won't read them. But if I teach it, it will work just fine. .spamassassin # /usr/bin/sa-learn --rebuild Failed to create default user preference file /root/.spamassassin/user_prefs Cannot open baye

Re: [SAtalk] HEADER: Delivered-To:

Ahh, must have been 2.54, or something then - my apologies I attempted to use "report_safe_copy_headers Delivered-To" in the ~/.spamassassin/user_prefs fille, and the /etc/mail/spamassassin/local.cf file, niether of which managed to do anything. I attempted to find the option on spamassassin's web

Re: [SAtalk] Conflicting scores in SA/MailScanner

On Mon, Jun 30, 2003 at 05:31:06PM -0400, Greg Cirino wrote: > | i.e., everything in that directory is processed, in lexicographical sort > | order. actually, it's any file ending in '.cf' that gets read. -- Randomly Generated Tagline: "...very few phenomena can pull someone out of Deep Hack Mod

Re: [SAtalk] Conflicting scores in SA/MailScanner

that's what I thought. sa has been working great for us Greg - Original Message - From: "Martin Radford" <[EMAIL PROTECTED]> To: "Greg Cirino" <[EMAIL PROTECTED]> Cc: "mikea" <[EMAIL PROTECTED]>; "Nix" <[EMAIL PROTECTED]>; "Spamassassin-List" <[EMAIL PROTECTED]> Sent: Monday, June 30,

Re: [SAtalk] why not use SA on this SA list?

--On Monday, June 30, 2003 3:10 PM +0800 Dan Jacobson <[EMAIL PROTECTED]> wrote: Isn't this list the last place one expects to find spam? Idea: why don't you use the famed SpamAssassin spam defense system to reduce spam on this list? Bet nobody ever thought about that. All you gots to do is cra

Re: [SAtalk] Conflicting scores in SA/MailScanner

At Mon Jun 30 22:31:06 2003, Greg Cirino wrote: > > | i.e., everything in that directory is processed, in lexicographical sort > | order. > > so this means > local.cf > user_prefs > copy1.c > copy2.x > all would get processed? Actually, it's just files ending in '.cf' Martin -- Martin

Re: [SAtalk] Getting a full report on uncaught spam

On Mon, Jun 30, 2003 at 03:26:37PM -0600, Mike Mills wrote: > info given in messages caught as spam. Am I invoking spamassassin > incorrectly? Is it just really slow? Yes, it's waiting for input on STDIN, it doesn't take a filename. ie: spamassassin -D < message -- Randomly Generated Taglin

Re: [SAtalk] why not use SA on this SA list?

At Mon Jun 30 08:10:10 2003, Dan Jacobson wrote: > Idea: why don't you use the famed SpamAssassin spam defense system to > reduce spam on this list? Bet nobody ever thought about that. > > All you gots to do is crank the threshold really low, like 2. Most of > us will still pass. And if we don'

Re: [SAtalk] Getting a full report on uncaught spam

At 03:26 PM 6/30/2003 -0600, Mike Mills wrote: I'm having trouble running spamassassin to find out why a spam was not caught. I've tried invoking as follows: /usr/bin/spamassassin -D spam or ~/sausr/bin/spamassassin -D spam where spam is the message exported to a file. In both cases the proces

[SAtalk] Intriguing header forgery

Hi all, Now I admit that I don't regularly read all the headers of spam that I receive, but this one intrigued me. Take a look at its Received headers: > Received: from tele-punt-22.mail.demon.net (tele-punt-22.mail.demon.net > [194.217.242.7]) > by zamenhof.demon.co.uk (8.9.3/8.9.3) wit

[SAtalk] Re: "Naughty" test names

>> I think Rick has a valid request... I run the mail server at an ISP, and >> customers do get upset over the most trivial things. When they do, _I_ Me too, my http://jidanni.org/comp/spam/spamdealer.html jazz at present still attempts as a regular non-root user to bounce spam to supposedly whe

[SAtalk] why not use SA on this SA list?

Isn't this list the last place one expects to find spam? ScanMail Message: To Recipient virus found and action taken. System Attendant: Mail Adminstrator :Blocked File Attachment OK, it's not exactly spam, but still polluting my measly modem. Wait, I don't see any spamassassin headers on t

[SAtalk] Getting a full report on uncaught spam

I'm having trouble running spamassassin to find out why a spam was not caught. I've tried invoking as follows: /usr/bin/spamassassin -D spam or ~/sausr/bin/spamassassin -D spam where spam is the message exported to a file. In both cases the process seems to get caught in an infinite loop,

Re: [SAtalk] HEADER: Delivered-To:

On Mon, Jun 30, 2003 at 01:58:53PM -0700, Demitrious S. Kelly wrote: > We were using report_safe at a value of 1, with spamassassin 2.(x<5), and > this setup had been working flawlessly for months. Now, after upgrading hmmm. report_safe didn't exist until 2.50. > to 2.55, spamassassin is not in

Re: [SAtalk] Conflicting scores in SA/MailScanner

| i.e., everything in that directory is processed, in lexicographical sort | order. so this means local.cf user_prefs copy1.c copy2.x all would get processed? Greg - Original Message - From: "Nix" <[EMAIL PROTECTED]> To: "mikea" <[EMAIL PROTECTED]> Cc: "Spamassassin-List" <[EMAI

[SAtalk] HEADER: Delivered-To:

I've got a kind of a complicated setup going here, so bare with me. ___ ___ | Internet | -mail---> |Linux| -mail---> |Groupwise 5.5| --- --- the linux system is as follows ___

Re: [SAtalk] Conflicting scores in SA/MailScanner

On Fri, 27 Jun 2003, [EMAIL PROTECTED] uttered the following: > The default location for SpamAssassin local rules on my FreeBSD boxes > appears to be /etc/mail/spamassassin/local.cf. It's /etc/mail/spamassassin/* i.e., everything in that directory is processed, in lexicographical sort order. l

Re: [SAtalk] A question or two...

On Mon, Jun 30, 2003 at 04:05:50PM -0400, Wendell Smith wrote: > The domains listed in "/usr/share/spamassassin/60_whitelist.cf", are > they included in the default whitelist or do I need to add these to my yes. that is the default whitelist. ;) > Are these statistics that relate to the directiv

Re: [SAtalk] Sitewide config

On Mon, Jun 30, 2003 at 03:07:01PM -0500, Richard Humphrey wrote: > Cannot open bayes_path /home/sharedspam/.spamassassin/bayes R/O: > Inappropriate ioctl for device > > Anyone know how to fix this? A while ago, someone said that that error was caused by upgraded DB libs. Did you recently upgrade

[SAtalk] Sitewide config

On a sitewide config, i am getting the following error when running spamassassin -D --lint. Cannot open bayes_path /home/sharedspam/.spamassassin/bayes R/O: Inappropriate ioctl for device Anyone know how to fix this? Richard Humphrey --- T

[SAtalk] A question or two...

The domains listed in "/usr/share/spamassassin/60_whitelist.cf", are they included in the default whitelist or do I need to add these to my system-wide conf file? I am using a system-wide configuration by the way... These three files I found in my install tarball: STATISTICS-set1.txt STATISTICS-s

Re: [SAtalk] "Naughty" test names

Matt Kettler wrote: A dsjenwine problem. A what? Is this supposed to be the dutch spelling of genuine, not present anywhere within the visibility of even goggle? Do you know, I never ever recall my mother once ever saying the word "penis?" Never once. I wonder why. Perhaps that altered my conce

Re: [SAtalk] Re: misc virus warnings...

> "YD" == Yorkshire Dave <[EMAIL PROTECTED]> writes: >> only report a found virus if the virus is not known to be one that >> forges the return address. YD> Almost, but not quite. The virus checking programs need to do the YD> opposite of that, only report a found virus which is known to be o

[SAtalk] Problem W / Postfix SpamAssassin transport

I am getting an error , I have postfix configured as a message router (between a mail mateway and the destination server) the error I am receiving is:   Jun 30 11:50:03 spamhat postfix/nqmgr[1789]: warning: connect to transport spamassassin: Connection refused   this is in the Maillog file.

Re: [SAtalk] "Naughty" test names

At 07:41 PM 6/30/2003 +0200, Tony Earnshaw wrote: A dsjenwine problem. A what? Is this supposed to be the dutch spelling of genuine, not present anywhere within the visibility of even google? :) --- This SF.Net email sponsored by: Free pre-b

Re: [SAtalk] why is this not caught?

At 09:29 AM 6/30/2003 +0200, Martin Maechler wrote: Look at the message I've saved in ftp://stat.ethz.ch/U/maechler/spam-mail/please 1) why there's no check on the obvious spam subject Subject: PLEASE READ! Important Support Information and FAQs 2) I give small positive scores to the LINES

Re: [SAtalk] How do I know whether Bayes is working or not?

Leo Huang wrote: [snip] > Failed to parse line in SpamAssassin configuration, skipping: > spamphrase_highest_score 38220 > Failed to parse line in SpamAssassin configuration, skipping: spamphrase > 38220 temple kiff [snip] These would be due to invalid-in-v2.5x configuration lines in one of your c

[SAtalk] Spamassassin and qmail-scanner

Joseph Young Involved.com System Admin I don't know who to ask for help. I am running qmail-scanner with spamassassin and email that should be clearing be spam is not marked. qmail-scanner runs spamc in verbose mode and I get this in the header. Received: from [EMAIL PROTECTED] by wezen.involved.

Re: [SAtalk] "full" test and attachments

At 03:18 PM 6/30/2003 +0200, [EMAIL PROTECTED] wrote: of which I thought it should match on mails which contain a file attachment like "test.zip": Content-Type: application/zip; name="test.zip"; But the test doesn't match. What could have went wrong? Is "full" the wrong test method? Based on th

Re: [SAtalk] How do I know whether Bayes is working or not?

Jim Ford writes: >On Mon, Jun 30, 2003 at 05:40:35PM +0200, Morten Kjeldgaard wrote: > >> The filter stores its files in $HOME/.spamassassin (unless otherwise set >> up), you can look for those files and see if the database grows. Check >> bayes_msgcount, it simply contains a period for each entry

Re: [SAtalk] How do I know whether Bayes is working or not?

At Mon Jun 30 17:59:21 2003, Patrick Morris wrote: > > The header will only appear if the message is near the low or high end > of Bayes scoring. Your average message, which will have no Bayes score, > also won't have a Bayes header. If you to get a bayes score regardless, just put the followi

Re: [SAtalk] "Naughty" test names

At Mon Jun 30 16:41:56 2003, Bob Apthorpe wrote: > IIRC, rule names are arbitrary[1] and apparently a global > search-and-replace fixes this problem for those sites that see it as a > problem. It should be easy but tedious to (eventually) change the code > to use optional less vivid rule names. Pr

Re: [SAtalk] where to install..

Céline REDON wrote: I would like to install Spam Assassin. But I read it has to be installed with procmail to filter mails and procmail had to be installed on the mail server. Definitely doesn't have to be installed with Procmail. Neither does SpamAssassin as such have to be installed on the mail

Re: [SAtalk] "Naughty" test names

Bob Apthorpe wrote: Insulting admins because we think little of the their users is counterproductive; chances are, they probably don't need a reminder of how unreasonable their user base is. Still, it's the population they're paid to serve and protect, so why not put the insults on hold if you can

Re: [SAtalk] How do I know whether Bayes is working or not?

On Mon, Jun 30, 2003 at 06:29:43PM +0100, Jim Ford wrote: > I'd noticed the periods in bayes_msgcount. Surely it's an odd way to keep > a counter - I wonder why it's done that way. that way the file size could be used as the message count (don't have to worry about concurrent updates to the file,

Re: [SAtalk] How do I know whether Bayes is working or not?

On Mon, Jun 30, 2003 at 05:40:35PM +0200, Morten Kjeldgaard wrote: > The filter stores its files in $HOME/.spamassassin (unless otherwise set > up), you can look for those files and see if the database grows. Check > bayes_msgcount, it simply contains a period for each entry in the > database. I'

Re: [SAtalk] How do I know whether Bayes is working or not?

Chris Halverson writes: >Morten Kjeldgaard <[EMAIL PROTECTED]> writes: > >> The filter stores its files in $HOME/.spamassassin (unless otherwise set >> up), you can look for those files and see if the database grows. Check >> bayes_msgcount, it simply contains a period for each entry in the >> dat

Re: [SAtalk] New (to me) spam technique

Robert Menschel writes: >I haven't seen this one before ... slipped through most filtering rules. > >The spam has two parts -- spam in HTML, all graphics to avoid any/all >text filtering, and then a text section that appears to be normal text, >quoted from some source, that has nothing to do with

[SAtalk] Wrapping spamassassin in a multi-threaded C program?

I have a multi-threaded C program that I would like to "hook-up" to spamassassin that I would like to use as a replacement for spamc/spamd. The problem is that I have little experience with Perl and I would like to "spawn" spamassassin (obviously a Perl module) and send a message to it from within

Re: [SAtalk] How do I know whether Bayes is working or not?

The header will only appear if the message is near the low or high end of Bayes scoring. Your average message, which will have no Bayes score, also won't have a Bayes header. Chris Halverson wrote: I've run into this issue too. I have a user who fed (via sa-learn) a few thousand messages to SA

[SAtalk] SA with sendmail

Hello folks, I'm using SA now successfully on out exim3-based systems using the dman-hack for the exim.conf. This is especially usefull for me as I invoke spamc with spamc -u "[EMAIL PROTECTED]" and have then a username, for user-configurable whitelists etc. out of a database as sa supports it.

[SAtalk] Re: Quick question

Well Ralf, I think this has been discussed before, about 4 months ago, and the most consensuated sollution was to do some sa-learn of that messages. The OBFUSCATING_COMMENT rule isn't working pretty well, so most of us are teaching Bayes to recognize this kind of messages. There's practically n

Re: [SAtalk] How do I know whether Bayes is working or not?

Morten Kjeldgaard <[EMAIL PROTECTED]> writes: > The filter stores its files in $HOME/.spamassassin (unless otherwise set > up), you can look for those files and see if the database grows. Check > bayes_msgcount, it simply contains a period for each entry in the > database. I've run into this issu

RE: [SAtalk] New (to me) spam technique

At 03:22 PM 6/30/2003 +0100, Darren Coleman wrote: It would be nice, although ultimately unworkable I guess, if SA could be engineered to ignore anything which isn't humanly-visible in an email. i.e. when spammers insert fake PGP signatures in tags to lower their score - SA should ignore it. The p

Re: [SAtalk] New (to me) spam technique

On Mon, Jun 30, 2003 at 03:22:39PM +0100, Darren Coleman wrote: > It would be nice, although ultimately unworkable I guess, if SA could be > engineered to ignore anything which isn't humanly-visible in an email. > i.e. when spammers insert fake PGP signatures in color="White"> tags to lower their

Re: [SAtalk] "Naughty" test names

Hi, On Mon, 30 Jun 2003 13:17:42 +0100 "Darren Coleman" <[EMAIL PROTECTED]> wrote: > > -Original Message- > > From: Chr. von Stuckrad [mailto:[EMAIL PROTECTED] > > Sent: 29 June 2003 11:37 > > To: SpamAssassin-talk > > Subject: Re: [SAtalk] "Naughty" test names > > > > > > On Sat, Jun

Re: [SAtalk] How do I know whether Bayes is working or not?

Leo Huang asked: > I installed spamassassin 2.55, and set use_bayes, file mode and bayes_path > in the local.cf. How can I konw the bayes filter is running or not? When the filter is just installed, it is in auto-learn mode, and will not kick in until it has learned from 200 messages. This can ta

Re: [SAtalk] How do I know whether Bayes is working or not?

> debug: bayes: 27911 tie-ing to DB file R/O > /var/spool/spamassassin/bayes_toks > debug: bayes: 27911 tie-ing to DB file R/O > /var/spool/spamassassin/bayes_seen > debug: debug: Only 108 spam(s) in Bayes DB < 200 > debug: bayes: 27911 untie-ing > debug: bayes: 27911 untie-ing db_toks > debug: bay

Re: [SAtalk] Solaris , Sendmail & SpamAssassin

Check this out, it has a LOT of info on SA, Spamass-Milter, Sendmail, and virtually how to install them on any *nix: http://www.peregrinehw.com/downloads/SpamAssassin/ It describes an installation from scratch Regards, Luis Hernán Otegui Administrador de Red

Re: [SAtalk] How do I know whether Bayes is working or not?

Leo Huang wrote on Mon, 30 Jun 2003 21:01:31 +1000: > How can I konw the bayes filter is running or not? > Use the spamassassin debuging option: spamassassin -D < mail Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com IE-Center: http:/

Re: [SAtalk] Need rule to filter out spying tags

Darren Coleman wrote on Mon, 30 Jun 2003 13:14:45 +0100: > I suppose the larger question is - how likely is it that an image in a > legitimate email would be generated dynamically? (i.e. include "?" in > the URI) > Unfortunately there are, a lot of the subscription newsletters from PC magazines

RE: [SAtalk] New (to me) spam technique

It would be nice, although ultimately unworkable I guess, if SA could be engineered to ignore anything which isn't humanly-visible in an email. i.e. when spammers insert fake PGP signatures in tags to lower their score - SA should ignore it. The problem with this, I guess, is that not only would

Re: [SAtalk] How do I know whether Bayes is working or not?

Thanks for looking at this, SqM. But I get heaps of errors, what's wrong? debug: Score set 0 chosen. debug: running in taint mode? no debug: ignore: using a test message to lint rules debug: using "/usr/share/spamassassin" for default rules dir debug: using "/etc/mail/spamassassin" for site rules

Re: [SAtalk] where to install..

Well, if you can send mail, MTA(Sendmail) is working; if you can receive mail, MTA and MDA(procmail) is working. SA can be called on both MTA and MDA, depends on how you implement it. Leo - Original Message - From: "Céline REDON" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: "Céline RED

[SAtalk] where to install..

Hi, I would like to install Spam Assassin. But I read it has to be installed with procmail to filter mails and procmail had to be installed on the mail server. As for me , the incomming mails are going first on a server in DMZ , through an anti virus before being send to the mail server, in th

[SAtalk] New (to me) spam technique

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I haven't seen this one before ... slipped through most filtering rules. The spam has two parts -- spam in HTML, all graphics to avoid any/all text filtering, and then a text section that appears to be normal text, quoted from some source, that has no

Re: [SAtalk] How do I know whether Bayes is working or not?

> Hello, > > I installed spamassassin 2.55, and set use_bayes, file mode and bayes_path > in the local.cf. How can I konw the bayes filter is running or not? Run the command "spamassassin -D --lint" You will se a bunch of lines including bayes stuff.. Beware that the bayesian rules does not star

[SAtalk] "full" test and attachments

I want to classify certain attachment names as Spam. So I tried to add a test full TEST_ATTACH /test/ of which I thought it should match on mails which contain a file attachment like "test.zip": Content-Type: application/zip; name="test.zip"; But the test doesn't match. What could have went

Re: [SAtalk] 2.60-cvs (20030627) rules

* Martin Radford <[EMAIL PROTECTED]> [20030630 10:20]: wrote: > At Mon Jun 30 07:14:27 2003, ODHIAMBO Washington wrote: > > > One of the rules for this version was against using a port other than > > the standard HTTP port. Well, since this is -CVS, I may as well keep >

RE: [SAtalk] "Naughty" test names

Agreed. At the end of the day, as others have mentioned, these people should be given the choice - they either put up with a word "PENIS" which is neither a swear word or a vulgarity (how can anyone be offended by it is beyond me) or they don't get their email filtered by SpamAssassin - simple.

RE: [SAtalk] Need rule to filter out spying tags

I wrote a small quasi-solution to this a while back, a rule which detected 1 pixel "invisible" images. Because generally speaking spammers tend to use invisible 1 pixel images for tracking purposes (but they dont want it to be visible on the email to dilute the spam) it seems to cover most instanc

Re: [SAtalk] BUGGY_CGI?

Mad Martian wrote on Sun, 29 Jun 2003 15:53:27 -0700: > Ok, I switched to NMS FormMail version 3.08c1 and I get the same > BUGGY_CGI result. Is there some configuration I need to tweak? Here are > my variables: > According to Martin: > It looks for "Below is the result of your feedback form" in

  1   2   >