Re: [SAtalk] spamd performance

2003-09-11 Thread Jim
On Thu, Sep 11, 2003 at 09:42:02PM -0400, Paul Farber wrote: > New machine... dual 1.2Ghz AMD CPU's, 1 Gb RAM, Ultra-SCSI-3 (160Mbps) drive: Single Duron 1.3GHz CPU, FreeBSD 4.8: some stats for Sept. 11, 2003: Total analyzed :827 Average analysis time :

Re: [SAtalk] What the F****??

2003-09-11 Thread Theo Van Dinter
On Thu, Sep 11, 2003 at 11:46:37PM -0500, Larry Rosenman wrote: > I.E. feed it back in? yes. -- Randomly Generated Tagline: Could this be the best day of my life? -- Homer Simpson Homer the Heretic pgp0.pgp Description: PGP signature

Re: [SAtalk] SA 2.60 was hit-and-miss for me

2003-09-11 Thread Creede Lambard
It's possible, but when I go to the place Gentoo specifies to pick up the build http://www.spamassassin.org/released/ there's a set of 2.60 files there -- but now that I look at the page, the dates on them are earlier than either rc3 or rc4. Don't know what's up with that, but as far as I can te

Re: [SAtalk] What the F****??

2003-09-11 Thread Matt Kettler
At 10:36 PM 9/11/03 -0500, Larry Rosenman wrote: a SPAM message being learned as HAM? X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 2.60-rc4 (1.203-2003-08-29-exp) on lerami.lerctr.org X-Spam-Level: * X-Spam-Status: Yes, hits=5.5 required=5.0 tests=BAYES_99,HTML_MESSAGE

[SAtalk] Wolfgang Fuertbauer: Ich bin außer Haus! / I'm out of the office

2003-09-11 Thread Wolfgang . Fuertbauer
Ich werde ab 12.09.2003 nicht im Büro sein. Ich kehre zurück am 13.09.2003. Ich werde Ihre Nachricht(en) nach meiner Rückkehr beantworten. mfg I will answer after returning to the office. Regards Wolfgang Fuertbauer --- This sf.net email i

Re: [SAtalk] What the F****??

2003-09-11 Thread Larry Rosenman
--On Friday, September 12, 2003 00:35:14 -0400 Theo Van Dinter <[EMAIL PROTECTED]> wrote: On Thu, Sep 11, 2003 at 10:36:51PM -0500, Larry Rosenman wrote: a SPAM message being learned as HAM? X-Spam-Status: Yes, hits=5.5 required=5.0 tests=BAYES_99,HTML_MESSAGE autolearn=ham version=2.60

Re: [SAtalk] What the F****??

2003-09-11 Thread Theo Van Dinter
On Thu, Sep 11, 2003 at 10:36:51PM -0500, Larry Rosenman wrote: > a SPAM message being learned as HAM? > X-Spam-Status: Yes, hits=5.5 required=5.0 tests=BAYES_99,HTML_MESSAGE > autolearn=ham version=2.60-rc4 BAYES_* doesn't affect autolearning (or else it would get into a feedback cycle). H

Re: [SAtalk] user_prefs

2003-09-11 Thread Matt Kettler
At 08:52 PM 9/11/03 -0600, Alan Fullmer wrote: So I have 2 files: /home/dick/.spamassassin/user_prefs and /home/jane/.spamassassin/user_prefs It does not even touch those user_prefs files (checked it with the -D option) Well, you've never told spamc to use jane or dick's userid.. so it's going

Re: [SAtalk] SA 2.60 was hit-and-miss for me

2003-09-11 Thread Daniel Quinlan
Creede Lambard <[EMAIL PROTECTED]> writes: > Hello all, new to the list, so apologies if this has already been covered. > > I upgraded my version of SpamAssassin from 2.55 to 2.6 this morning, turned 2.60 is not yet released. Perhaps it was one of the release candidates? Daniel -

[SAtalk] What the F****??

2003-09-11 Thread Larry Rosenman
a SPAM message being learned as HAM? X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 2.60-rc4 (1.203-2003-08-29-exp) on lerami.lerctr.org X-Spam-Level: * X-Spam-Status: Yes, hits=5.5 required=5.0 tests=BAYES_99,HTML_MESSAGE autolearn=ham version=2.60-rc4 MIME-Version: 1.0

[SAtalk] Need help with SpamAssassin ver. 2.6 and Kmail ver 1.5.3

2003-09-11 Thread Ralph F. De Witt
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello: I just subscribed to this and have not had the time to check the archives yet, so I hope you will forgiven. I have been using Spamassassin ver. 1.3x to the latest 2.6 with Kmail using two simple filter rules one to limit the size to 25 by

Re: [SAtalk] SpamAssassin 2.60 rc4 released

2003-09-11 Thread Benny Pedersen
Theo Van Dinter wrote: http://SpamAssassin.org/released/Mail-SpamAssassin-2.60-rc4.tar.gz http://SpamAssassin.org/released/Mail-SpamAssassin-2.60-rc4.zip rpmbuild -tb --target=athlon Mail-SpamAssassin-2.60-rc4.tar.gz is now not possible to do non rooted :/ rc2 worked :-) %install failed ---

Re: [SAtalk] Ham and Spam script

2003-09-11 Thread Peter Kiem
Hi James, > Has anyone written a script that run sa-learn through an IMAP folder? Yes. Try this one: $ cat trainbayes #!/bin/bash sa-learn --no-rebuild --ham --dir /home/mail/amavis/maildir/.ham/cur/ sa-learn --no-rebuild --spam --dir /home/mail/amavis/maildir/.spam/cur/ sa-learn --rebuild --

Re: [SAtalk] user_prefs

2003-09-11 Thread Alan Fullmer
I guess I should start from the top. Originally I installed SA through the spamassassin way, not through spamd (originally) I have changed to spamd because of the speed. I have a site-wide config in /etc/mail/spamassassin/local.cf I have it set to various things. The required_hits is 6.0. I

Re: [SAtalk] SpamAssassin 2.60 rc4 released

2003-09-11 Thread Theo Van Dinter
On Fri, Sep 12, 2003 at 05:17:24AM +0200, Benny Pedersen wrote: > rpmbuild -tb --target=athlon Mail-SpamAssassin-2.60-rc4.tar.gz > > is now not possible to do non rooted :/ building non-root works fine for me. in fact I just ran that command and it worked fine. what RPM version are you using, an

Re: [SAtalk] spamd performance

2003-09-11 Thread Matt Kettler
At 09:42 PM 9/11/03 -0400, Paul Farber wrote: New machine... dual 1.2Ghz AMD CPU's, 1 Gb RAM, Ultra-SCSI-3 (160Mbps) drive: 1) exactly what comands do you launch spamd with? 2) what exact command are you executing to process your messages in this test and time them? If spamc isn't part of the ans

Re: [SAtalk] spamd performance

2003-09-11 Thread Paul Farber
primary mail server running qmail has the following for local deliver instructions (other items related to qmail processing not shown): /usr/bin/spamc -u pop3 -d 65.161.2.8 -p 1783 this tosses the message to the dual AMD/spamd server set up with: #!/bin/sh exec \ /usr/bin/spamd -a -m 100 -u pop

[SAtalk] Wolfgang Fuertbauer: Ich bin außer Haus! / I'm out of the office

2003-09-11 Thread Wolfgang . Fuertbauer
Ich werde ab 12.09.2003 nicht im Büro sein. Ich kehre zurück am 13.09.2003. Ich werde Ihre Nachricht(en) nach meiner Rückkehr beantworten. mfg I will answer after returning to the office. Regards Wolfgang Fuertbauer --- This sf.net email i

Re: [SAtalk] user_prefs

2003-09-11 Thread Alan Fullmer
I launch it from the spamd, then postfix uses the spamc to filter. my options i have ./spamd -d -c the user_pref's file I am trying to get to work is in the ~username/.spamassassin/user_prefs the ~username is a username listed in passwd's home dir for that user. - Original Message -

[SAtalk] SpamAssassin 2.60 rc4 released

2003-09-11 Thread Theo Van Dinter
Pick it up from: http://SpamAssassin.org/released/Mail-SpamAssassin-2.60-rc4.tar.gz http://SpamAssassin.org/released/Mail-SpamAssassin-2.60-rc4.zip md5sums: 41e4e3f6a01e0fb104119c9b403cc7b4 Mail-SpamAssassin-2.60-rc4.tar.gz 8aaa1066d0819a9d88649c4e70bab63a Mail-SpamAssassin-2.60-rc4.zi

[SAtalk] SA 2.60 was hit-and-miss for me

2003-09-11 Thread Creede Lambard
Hello all, new to the list, so apologies if this has already been covered. I upgraded my version of SpamAssassin from 2.55 to 2.6 this morning, turned it on, and started watching the mail log when obvious spams started appearing in my mailbox. At first I thought it was only spam that was being for

Re: [SAtalk] user_prefs

2003-09-11 Thread Matt Kettler
At 08:03 PM 9/11/03 -0600, Alan Fullmer wrote: my options i have ./spamd -d -c No.. what entries are you trying to put into the user_prefs itself that aren't working? If it's a rule, well then read the manpage.. rules are ignored in user_prefs when using spamd for security reasons. If it's so

Re: [SAtalk] spamd performance

2003-09-11 Thread Paul Farber
New machine... dual 1.2Ghz AMD CPU's, 1 Gb RAM, Ultra-SCSI-3 (160Mbps) drive: first number time second number msg size 16.0 66395 2.7 5884 2.1 1456 6.8 1519 5.0 1307 4.5 1436 4.5 1436 7.6 1367 2.7 1367 1.5 3504 8.6 1374 3.5 1421 2.3 1319 7.5 1519 2.0 1485 8.5 1367 6.7 5319 4.0 2

Re: [SAtalk] spamd performance

2003-09-11 Thread Alan Fullmer
I am getting 1 sec with my single athlon 700. strange yours is so high. Sep 11 20:05:45 euphoria spamd[15378]: clean message (-0.5/5.0) for spamfilter:666 in 1.0 seconds, 3558 bytes. - Original Message - From: "Paul Farber" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday,

Re: [SAtalk] user_prefs

2003-09-11 Thread Matt Kettler
At 04:33 PM 9/11/03 -0600, Alan Fullmer wrote: I am having difficulty, and was wondering if anyone can shed some light on the subject. I can't get spam assassin to read any user_prefs file. it works with the local.cf just fine. What settings are you trying to put in user_prefs? How do you launch S

[SAtalk] Load throttling with Procmail/Sendmail. [Was: Getting slammed with virri and spam]

2003-09-11 Thread Simon Byrnand
At 23:31 9/09/2003 -0500, David B Funk wrote: On Wed, 10 Sep 2003, Jim wrote: > On Tue, Sep 09, 2003 at 12:18:10AM -0400, Debbie D wrote: > > 3 times today I noticed the server running very high loads of 4-6 and as > > high as 10, normally I run 1% or lower usually closer to .3-.6%. Three days >

Re: [SAtalk] Nigerian, er, Afghani scam

2003-09-11 Thread Bob Sully
Well, I got one of these today also (though it purportedly came from some boggart in the United Arab Emirates who has esophageal cancer (couldn't happen to a nicer spammer!))...anyway, it only scored a 4.0, and I'm running 2.55 with Bayes on (adequately trained). -- Bob -- On Thu, 11 Sep 200

RE: [SAtalk] Is no message-id header a good measure of spam?

2003-09-11 Thread Gilson, Larry
Hi James, > -Original Message- > From: James Herschel > What I'm asking is: > 1. Is the lack of a message-id header an accurate measure of spam? > 2. Is this a rule in SpamAssassin? I haven't seen it in any reports The Message-Id is an optional field. From what I have seen from posts ov

[SAtalk] regarding autolearning

2003-09-11 Thread Nick Patavalis
Consider the following spamassasin setup: auto_learn_threshold_nonspam 4.99 auto_learn_threshold_spam 5.0 (that is: auto-learn from *every* message) Messages identified as spam are saved (by procmail) in a "spam" mbox. All others go to the inbox. Whenever I see (in my inbox) a message that

[SAtalk] Ham and Spam script

2003-09-11 Thread James Gardiner
Has anyone written a script that run sa-learn through an IMAP folder? James --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mai

Re: [SAtalk] Site-wide spam traps

2003-09-11 Thread Regis Wilson
Matt Tencati writes: > We receive lots of SPAM that is addressed to several users at our site some of which > are > old and basically spam traps. I'd like for that message to be tagged as spam for all > users not just for the spamtrap delivered email. > > Does this make sense and if so is anyone

[SAtalk] Rule frequencies

2003-09-11 Thread Regis Wilson
I wrote a quick and dirty hack script to count the number of rules that match in a Spam or Ham file. There are probably better reporting tools. There are probably better ways to do this, as well. The output is comma-delimited, you can import into Excel or similar for sorting, further processing.

RE: [SAtalk] Rule for no reverse DNS

2003-09-11 Thread Larry Gilson
Hi Chris, > -Original Message- > From: Covington, Chris > This is what I'm now using w/Postfix (should work for any MTA): > > header NO_RDNS Received=~ /\(unknown[ ]\[/ > describe NO_RDNS Sending MTA has no reverse DNS > score NO_RDNS 2.5 > > header NO_RDNS2 Received=~ /\(\[.*\]\)/ > de

[SAtalk] user_prefs

2003-09-11 Thread Alan Fullmer
I am having difficulty, and was wondering if anyone can shed some light on the subject. I can't get spam assassin to read any user_prefs file. it works with the local.cf just fine. is there something i've missed? thanks in advance. --- Th

Re[2]: [SAtalk] No BAYES_* ?

2003-09-11 Thread Abigail Marshall
Hello Carlo, Thursday, September 11, 2003, 4:35:22 AM, you wrote: CW> Ok, I re-learned most of it :/ CW> Does anyone have an idea why it can happen that CW> this database loses its content? I don't know but I have the same problem. It seems to happen when my bayes_toks file reaches about 5k.

Re: [SAtalk] Nigerian, er, Afghani scam

2003-09-11 Thread Gerry Doris
On Thu, 11 Sep 2003, Steve Thomas wrote: > > This may not be new, but it's the first one I've seen... It only scored 2.513 on my > company's mail server which runs a CVS version of 2.60 from a couple months ago. The > only tests it hit are NIGERIAN_BODY1 and US_DOLLARS. We're not using bayes he

RE: [SAtalk] Rule for no reverse DNS

2003-09-11 Thread Covington, Chris
-Original Message- From: Tony Hoyle [mailto:[EMAIL PROTECTED] >Since there isn't a standard for received headers, no rule will work for >Everyone... >MS Exchange: >Received: from mail.magenta-netlogic.com ([192.168.1.2]) by ireland.local.mnl >with Microsoft SMTPSVC(5.0.2195.5329); >

Re: [SAtalk] Nigerian, er, Afghani scam

2003-09-11 Thread Christopher X. Candreva
On Thu, 11 Sep 2003, Steve Thomas wrote: > This may not be new, but it's the first one I've seen... It only scored > 2.513 on my company's mail server which runs a CVS version of 2.60 from a > couple months ago. The only tests it hit are NIGERIAN_BODY1 and > US_DOLLARS. We're not using bayes here

Re: [SAtalk] RCVD_IN_OSIRUSOFT_COM still in SpamAssassin version 2.60-rc3??

2003-09-11 Thread Christopher X. Candreva
On Thu, 11 Sep 2003, Ken Gordon wrote: > I just noticed the following in a spamassassin report. I thought 2.60 > (which I think I am running) didn't use this test. Am I wrong? Should I > be zeroing it in local.cf? grep -i OSIRU * in /usr/local/share/spamassassin returns no matches on my system, a

RE: [SAtalk] Nigerian, er, Afghani scam

2003-09-11 Thread Chris Santerre
I actually received something very similar in our fax machine last week. Hmm.Faxassassin! :-) --Chris "Not Howdy Doodey" Santerre > -Original Message- > From: Steve Thomas [mailto:[EMAIL PROTECTED] > Sent: Thursday, September 11, 2003 1:12 PM > To: [EMAIL PROTECTED] > Subject: [SAtal

Re: [SAtalk] spamd vs spamassassin from .forward files

2003-09-11 Thread Scott Lambert
On Wed, Sep 10, 2003 at 04:03:02PM -0700, John Schneider wrote: > Please forgive me if this is already answered in the list archives. But, if > it is, I didn't find it: cd ${WHEREYOUUNPACKEDTHESOURCE}; find . -name 'README*' -print; cat ${FILETHATLOOKSRELEVANT}; -- Scott Lambert

Re: [SAtalk] Getting slammed with virri and spam

2003-09-11 Thread Edward Muller
Another idea would be to block the mail servers at the IP level using iptables. At least for a few days. This is of course only useful if all the mail you are seeing is coming from a certain server or a certain group of servers. On Mon, 2003-09-08 at 23:18, Debbie D wrote: > 3 times today I notice

RE: [SAtalk] RCVD_IN_OSIRUSOFT_COM still in SpamAssassin version 2.60-rc3??

2003-09-11 Thread Brad Tarver
I would for sure set this one to zero since Osirusoft is defunct for the time being -Original Message- From: Ken Gordon [mailto:[EMAIL PROTECTED] Sent: Thursday, September 11, 2003 9:41 AM To: [EMAIL PROTECTED] Subject: [SAtalk] RCVD_IN_OSIRUSOFT_COM still in SpamAssassin version 2.60-rc3

[SAtalk] Nigerian, er, Afghani scam

2003-09-11 Thread Steve Thomas
This may not be new, but it's the first one I've seen... It only scored 2.513 on my company's mail server which runs a CVS version of 2.60 from a couple months ago. The only tests it hit are NIGERIAN_BODY1 and US_DOLLARS. We're not using bayes here. ---

[SAtalk] Editing scores

2003-09-11 Thread Alicia Forsythe
I just cought an FP where the SUBJ_HAS_SPACES rule gave 3.5 points. My local.cf has no reference to this rule, but I did find it in 50_scores.cf: SUBJ_HAS_SPACES 2.425 2.026 1.101 2.329. Where is the 3.5 coming from? I need to lower this score right away. X-Mail-Format-Warning: Bad RFC2822 head

Re: [SAtalk] RCVD_IN_OSIRUSOFT_COM still in SpamAssassin version 2.60-rc3??

2003-09-11 Thread Theo Van Dinter
On Thu, Sep 11, 2003 at 08:40:54AM -0600, Ken Gordon wrote: > I just noticed the following in a spamassassin report. I thought 2.60 > (which I think I am running) didn't use this test. Am I wrong? Should I > be zeroing it in local.cf? 2.60 was using it until osirusoft went belly-up. it's no lon

RE: [SAtalk] Rule for no reverse DNS

2003-09-11 Thread Covington, Chris
This is what I'm now using w/Postfix (should work for any MTA): header NO_RDNS Received=~ /\(unknown[ ]\[/ describe NO_RDNS Sending MTA has no reverse DNS score NO_RDNS 2.5 header NO_RDNS2 Received=~ /\(\[.*\]\)/ describe NO_RDNS2 Sending MTA has no reverse DNS score NO_RDNS2 2.5 --

[SAtalk] RCVD_IN_OSIRUSOFT_COM still in SpamAssassin version 2.60-rc3??

2003-09-11 Thread Ken Gordon
I just noticed the following in a spamassassin report. I thought 2.60 (which I think I am running) didn't use this test. Am I wrong? Should I be zeroing it in local.cf? RCVD_IN_OSIRUSOFT_COM (0.9 points) RBL: Received via a relay in relays.osirusoft.com [RBL check: found 31.

RE: [SAtalk] Rule for no reverse DNS

2003-09-11 Thread Covington, Chris
> -Original Message- > From: Tony Hoyle [mailto:[EMAIL PROTECTED] > > It's actually quite a good spam sign, but you I don't think > you can get that information From the MTA (I used to block on > it for a while, which had only a handful of FPs in over 6 > months... A way to assign poin

Re: [SAtalk] whitelist_from_rcvd

2003-09-11 Thread Cahya Wirawan
On Tue, Sep 09, 2003 at 12:28:48PM -0600, Alan Fullmer wrote: > > Am I doing something wrong? > > This is the statement I have in my list: > > whitelist_from_rcvd [EMAIL PROTECTED] xnote.com > > but it isn't working. do i have the syntax right? > > where [EMAIL PROTECTED] is my email address.

Re: [SAtalk] No BAYES_* ?

2003-09-11 Thread Carlo Wood
Ok, I re-learned most of it :/ Does anyone have an idea why it can happen that this database loses its content? When running the same mail again with debugging turned on, I see the following: debug: bayes token 'HX-Qmail-Scanner-1.16:header' => 0.970436474139029 debug: bayes token 'HX-Qmail-Scann

Re: [SAtalk] Header problem, intermittent, SpamAssassin 2.60 rc3

2003-09-11 Thread Alan Leghart
It would be nearly impossible for every message to take the same path, unless you close off your mail server to only itself. There is a possibility that someone's relay is also using SA _before_ outbound relaying. This could be an ISP or company/organization who is running outbound message th

[SAtalk] sa-learn (Can't locate Mail/SpamAssassin/CmdLearn.pm in @INC)

2003-09-11 Thread Gunter Harper
I'm running successfully SpamAssassin (spamd) on a freeBSD VPS. However when I try to train SpamAssassin with sa-learn I get the following error:Can't locate Mail/SpamAssassin/CmdLearn.pm in @INC I should also mention I had to patch spamd with the following instructions: http://www.perlcode.org/t

RE: [SAtalk] Rule for no reverse DNS

2003-09-11 Thread Tony Hoyle
> -Original Message- > From: Covington, Chris [mailto:[EMAIL PROTECTED] > Sent: 11 September 2003 02:22 > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] Rule for no reverse DNS > > > > -Original Message- > > I've noticed that Columbia University has an SA rule for no > > reverse D

[SAtalk] spamd failing

2003-09-11 Thread Richard I. Kirkcaldy
Hi, I'm using exiscan with spamd, and recently it's stopped working. I've been trying to get dcc working with spamassassin, but gave up - so I'm assuming that's what has caused it. Running spamd in debug mode I get: debug: all '*From' addrs: [EMAIL PROTECTED] debug: running head

Re: [SAtalk] Header problem, intermittent, SpamAssassin 2.60 rc3

2003-09-11 Thread Yoav Aner
I'm not sure I'm following you on this one... Mail does go through the same path - i.e. it's going to the same user account on the same server. And as for the other point, who else could be filtering for spam ? Definitely not the spammer, right ? and on the server, all mail do go through the same p

Re: [SAtalk] Install problem

2003-09-11 Thread David B Funk
On Wed, 10 Sep 2003, Alastair Battrick wrote: > I'm having a problem installing SA 2.55 > > The server is running Redhat 7.2 (I think) has 256Mb RAM and plenty of spare > disk space. > > When I go to cpan, I can get and make Mail::SpamAssassin no problems, but > when I 'make test' I get this: [sn

Re: [SAtalk] Can base64 encoded messages learnable by sa-learn?

2003-09-11 Thread Rob Chanter
On Thu, Sep 04, 2003 at 10:59:39AM -0500, Thomas Cameron wrote: > All - > > I have a client with a Red hat 9 + SA 2.55 + spamass-milter server in > front of a Lotus Notes server. The client has hired a Notes developer > to give their users an extra button in Notes to forward false negatives > to