[SAtalk] score for messages with empty bodies?

2003-10-09 Thread Dan Jacobson
How can I add points for messages with empty bodies? Assume the Lines: header is unreliable. Please CC me if you reply. --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See

Re: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread Scott Kennedy
I use RBL checks along with a bunch of rules in sendmail.mc to reject mail. In addition to all of that, I also use a couple of services that automatically updates the access database (/etc/mail/access.db), plus I have a bunch of entries in /etc/mail/access that I've added myself. What I did w

RE: [SAtalk] [RD] Evil rules HUGE update!

2003-10-09 Thread Larry Gilson
Matt, Which directory is preferred in choosing a location for custom cf files, /etc/mail/spamassassin or /usr/share/spamassassin? I would like to understand the answer from both a technical and personal point-of-view. Thanks, Larry > -Original Message- > From: Matt Kettler > At 03:30

Re: [SAtalk] [RD] Evil rules HUGE update!

2003-10-09 Thread Matt Kettler
At 03:30 PM 10/9/03 -0700, Robert Leonard III wrote: Here is a newbie question.. how would I implement those rules? Can I put them in my /etc/mail/spamassassin directory, or put them someplace else? Do I have to reference them in some way, or by them being in the right place are they automatically

[SAtalk] Documentation about trusted_networks

2003-10-09 Thread Dominik Ruf
Hi, Just before upgrading to the new 2.60 Release, I read through to documentation to see what has changed. But some things are not clear to me. Maybe someone's able to bring some light to me? http://eu.spamassassin.org/doc/Mail_SpamAssassin_Conf.html#network%20test%20opti ons | trusted_networks

[SAtalk] spamd and user configuration files

2003-10-09 Thread Ross Boylan
I'm using spamassassin 2.60-1 packaged for Debian. Various pieces of the documentation seem contradictory on the use of user preferences by spamd. README says - $USER_HOME/.spamassassin/user_prefs: User preferences file. If it does not exist, one of the default prefs file from above w

RE: [SAtalk] Popcorn, Backhair, and Weeds

2003-10-09 Thread Larry Gilson
Hi Jennifer, I have rules to match character sets also but my format is a bit different and thought I would share them. Character set DEC: 61-126 # Obfuscate text by using ISO 8859-1 character set DEC encoding rawbody MY_RBDY_OBFU_ISOD /&\#(6[5-9]|[7-9][0-9]|1[0-1][0-9]|12[0-6])\D/ describe MY

RE: [SAtalk] [RD] Evil rules HUGE update!

2003-10-09 Thread Larry Gilson
Hi Robert, > -Original Message- > From: Robert Leonard III > > Here is a newbie question.. how would I implement those > rules? Can I put them in my /etc/mail/spamassassin > directory, or put them someplace else? Do I have to reference > them in some way, or by them being in the righ

Re: [SAtalk] Bayes on Passthrough Mail System

2003-10-09 Thread jnichols
> Can I use Bayes? I had assumed not, since I have no mailboxes on the system > and all mail simply passes through to the Exchange Server.. > > Am I out of luck with Bayes, or am I missing something obvious? > I do that w/Bayes and it works great. :-) Only thing that you lose seems to be the abil

Re: [SAtalk] GA Question

2003-10-09 Thread Justin Mason
Philip Tucker writes: > I'm trying to run the GA against my corpus of mail to see how much improvement I can > get from the new rule weightings. A couple questions: > > 1) The documentation says a large corpus is necessary. How large are we talking? > 1000? 10,000? 1,000,000 messages? Hi

Re: [SAtalk] SA 2.60 *VERY* slow.

2003-10-09 Thread Mike Van Pelt
On Thu, Oct 09, 2003 at 02:14:34PM -0500, Dallas L. Engelken wrote: > > Mike Van Pelt writes: > > >This is nuts. I'm going to have to back out 2.60 tonight > > >if I can't get this resolved today. (Which I really hate > > >to do; 2.60 does seem to catch more spam.) > > I've noticed that the way b

Re: [SAtalk] RCVD_IN_BSP_TRUSTED

2003-10-09 Thread Kelson Vibber
Kevin <[EMAIL PROTECTED]> wrote: What test does "RCVD_IN_BSP_TRUSTED" refer to? Bonded Sender - www.bondedsender.com It's a publicly-accessible whitelist designed to cut down on false positives. Basically you post a bond to guarantee that you won't send any spam, and they put your server's IP a

Re: [SAtalk] deploying SpamAssassin on MTA level for only some recipient addresses

2003-10-09 Thread Kris Deugau
[EMAIL PROTECTED] wrote: > a friend of mine wants to deploy SpamAssassin with Sendmail on the > MTA level. MIMEDefang or milter-spamc/miltrassassin/spamass-milter > are possible solutions. > The problem is to restrict Spam Tagging for only some addresses : > messages to [EMAIL PROTECTED] should not

[SAtalk] GA question

2003-10-09 Thread Philip Tucker
Title: GA question I'm trying to run the GA against my corpus of mail to see how much improvement I can get from the new rule weightings.  A couple questions: 1) The documentation says a large corpus is necessary.  How large are we talking?  1000?  10,000?  1,000,000 messages? 2) The docume

[SAtalk] GA Question

2003-10-09 Thread Philip Tucker
Title: GA Question I'm trying to run the GA against my corpus of mail to see how much improvement I can get from the new rule weightings.  A couple questions: 1) The documentation says a large corpus is necessary.  How large are we talking?  1000?  10,000?  1,000,000 messages? 2) The docume

[SAtalk] Bayes on Passthrough Mail System

2003-10-09 Thread Robert Leonard III
I have a linux box running SA 2.60, QMail, Qmailscanner that is a mail proxy for my Exchange server.. SA tags the mail, and forwards it on to my exchange server... Can I use Bayes? I had assumed not, since I have no mailboxes on the system and all mail simply passes through to the Exchange Server

Re: [SAtalk] [RD] Evil rules HUGE update!

2003-10-09 Thread Robert Leonard III
Here is a newbie question.. how would I implement those rules? Can I put them in my /etc/mail/spamassassin directory, or put them someplace else? Do I have to reference them in some way, or by them being in the right place are they automatically applied? Sorry for the ignorance, but I'm willing t

Re: [SAtalk] SA newbie question...

2003-10-09 Thread Patrick Morris
Brad wrote: body MOON /moon/i score MOON5.0 I'm not positive, but I think the "describe" line is also necessary. This message is intended only for the use of the person(s) listed above as the intended recipient(s), and may contain information that is PRIVILEGED and C

[SAtalk] Popcorn, Backhair, and Weeds

2003-10-09 Thread Jennifer Wheeler
Chris S. is going to be posting these on his site when he gets time, and I believe he was also waiting on my tweaks. I have tweaked to the best of my ability, which is scarce. :) I will post these now since there was some discussion on catching tidal waves of hidden tags obscuring known spam wor

Re: [SAtalk] [RD] Evil rules HUGE update!

2003-10-09 Thread jnichols
> PLEASE tell me if there are any mistakes or FP's. There should not be, but > after 1758 lines at 3 times, my brain gets a little goofy :-) > It looks great! Thanks! I did notice it was full of ^M characters, tho.. I stripped them out. :) > PS: 50% of the Internet lists users think Top Posting

[SAtalk] SA newbie question...

2003-10-09 Thread Brad
In the message below, I have substituted the word "moon" for the male organ waker upper drug. If I use the V word it'll be blocked. I have a RH9 mail server and have done a default installation of SA 2.6. It appears to be working as I am getting 75% of spam marked as *SPAM* However, I

RE: [SAtalk] deploying SpamAssassin on MTA level for only some recipient addresses

2003-10-09 Thread Covington, Chris
Stéphane, Your subject is misleading; MTA level does not mean with SA, it means with a Sendmail/Postfix/Amavisd-new/MIMEDefang etc. configuration. You could always create rules to subtract points from everyone except those users: header TO_NONSAUSER ToCc !~ //[EMAIL PROTECTED]/i/i describe TO

[SAtalk] [RD] Evil rules HUGE update!

2003-10-09 Thread Chris Santerre
Well I got around to updating my evilrules.cf file. Ummm.are you sitting down? The first version had 274 rules for spam hosts. This version has 1758 rules!! Yup! I went thru it by hand 3 times before running the reg2ule.pl script. I also posted a link to the 'evil' file that created these rules

Re: [SAtalk] How does a message like this get through?

2003-10-09 Thread Robert A. Hayden
However, it sucks for dreadful typists like me :-) On Thu, 9 Oct 2003, Tom Satter wrote: > Have there been any suggestions that one of the rules be something like > "percentage of mis-spelled words" in the text section? In particular, > a high score on this would remove most of the problems seen

RE: [SAtalk] deploying SpamAssassin on MTA level for only some recipient addresses

2003-10-09 Thread mutt
Chris, > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > [EMAIL PROTECTED] > Sent: Thursday, October 09, 2003 3:59 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] deploying SpamAssassin on MTA level for only some > recipient addresses > > > > Hi,

RE: [SAtalk] deploying SpamAssassin on MTA level for only some recipient addresses

2003-10-09 Thread Covington, Chris
Amavisd-new can do that. Chris -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Thursday, October 09, 2003 3:59 PM To: [EMAIL PROTECTED] Subject: [SAtalk] deploying SpamAssassin on MTA level for only some recipient addresses Hi,

Re: [SAtalk] Spamstats

2003-10-09 Thread Matthias Fuhrmann
On Thu, 9 Oct 2003, Mike Carlson wrote: > Anyone have problems getting spamstats to return numbers for the spam counts? Tha > faq on gryzor's website is of little help. [...] > Oct 9 13:17:41 altair spamd[31462]: identified spam (8.7/5.5) for root:1002 in 4.7 > seconds, 3405 bytes. > Oct 9 13

Re: [SAtalk] How does a message like this get through?

2003-10-09 Thread Tom Satter
Have there been any suggestions that one of the rules be something like "percentage of mis-spelled words" in the text section? In particular, a high score on this would remove most of the problems seen below. If the site could configure SA to use aspell with a given set of dictionaries that were

Re: [SAtalk] How does a message like this get through?

2003-10-09 Thread Matt Kettler
At 12:25 PM 10/9/2003, Eric Vollmer wrote: My question is, what is the threshold for subject/body text like V(A)G1NAS or C()CKS to actually invoke a score to be added to the overall score? There is no static rule in the current ruleset that will ever add score for those particular phrases. Howev

RE: [SAtalk] Phrases I have modified....

2003-10-09 Thread Jennifer Wheeler
Summoning the hermit out of her cave huh? ;) yeah I'll give a hand. -Original Message- From: Chris Santerre [mailto:[EMAIL PROTECTED] Sent: Thursday, October 09, 2003 9:40 AM To: 'VonEssen, John'; [EMAIL PROTECTED] Subject: RE: [SAtalk] Phrases I have modified I have some notes o

Re: [SAtalk] SA 2.60 *VERY* slow.

2003-10-09 Thread Mike Van Pelt
On Thu, Oct 09, 2003 at 09:19:23AM -0700, Patrick Morris wrote: > Mike Van Pelt wrote: > > >It's still having spells of rejecting connections as > >"it's busy" when CPU is less than 50%. > > > >(This is on a Solaris box.) > > > > > Are you running MIMEDefang with the multpilexor? If so, have you

Re: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread Kai Schaetzl
Fabiano Bonin wrote on Thu, 09 Oct 2003 11:56:29 -0300: > maybe the spammers will remove our addresses > from its lists, and the traffic will decrease. > No, no, no, don't count on this, really :-) Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.co

Re: [SAtalk] help - freezing!

2003-10-09 Thread Kai Schaetzl
wrote on Thu, 9 Oct 2003 15:36:34 +0200 (CEST): > so ppl, if sy meet this problem and solved it, please reply > No, I haven't, but it really doesn't look like a spamd problem. spamd is only one of several victims of this. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Intern

RE: [SAtalk] tag vs deleted spam w/ SA

2003-10-09 Thread Luzynski, Steve
> -Original Message- > From: [EMAIL PROTECTED] [mailto:spamassassin- > [EMAIL PROTECTED] On Behalf Of Roger > Sent: Wednesday, October 08, 2003 3:34 PM > To: Matt Kettler > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] tag vs deleted spam w/ SA > > Matt Kettler wrote: > > > Is there a lis

[SAtalk] deploying SpamAssassin on MTA level for only some recipient addresses

2003-10-09 Thread mutt
Hi, a friend of mine wants to deploy SpamAssassin with Sendmail on the MTA level. MIMEDefang or milter-spamc/miltrassassin/spamass-milter are possible solutions. The problem is to restrict Spam Tagging for only some addresses : messages to [EMAIL PROTECTED] should not be scanned but [EMAIL PROTE

Re: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread David Rodgers
it's not the nice way to do it but if you are trying to get rid of spam from a particular source you can set a firewall rule with ipf/iptables etc to reject smtp connections from the ip address and it will never make it to the mail daemon let alone the mail queue for processing. David Rodgers On

[SAtalk] ham id's as spam

2003-10-09 Thread Chris Barnes
I get email from a person that is routinely mis-identified as spam: X-Originating-Email: [EMAIL PROTECTED] From: Person's name <[EMAIL PROTECTED]> X-Spam-Status: Yes, hits=5.7 required=5.0 tests=AWL,FAKED_HOTMAIL_DAV, FROM_ENDS_IN_NUMS,HTML_40_50,HTML_IMAGE_ONLY_04,HTML_MESSAGE, MIME_HTML_NO_CHA

[SAtalk] Spamstats

2003-10-09 Thread Mike Carlson
Anyone have problems getting spamstats to return numbers for the spam counts? Tha faq on gryzor's website is of little help.   I just get this:   File /var/log/maillog : from Oct  9 00:00:00 to Oct  9 13:15:00Total number of emails processed by the spam filter : 0Number of spams 

RE: [SAtalk] SA 2.60 *VERY* slow.

2003-10-09 Thread Covington, Chris
Why don't you try Amavisd-new? You wouldn't have the problem of waiting for SA before incoming email gets accepted. Chris -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike Van Pelt Sent: Thursday, October 09, 2003 11:23 AM To: [EMAIL PROTECTED] Subjec

RE: [SAtalk] SA 2.60 *VERY* slow.

2003-10-09 Thread Dallas L. Engelken
> -Original Message- > From: Justin Mason [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 09, 2003 12:20 PM > To: Mike Van Pelt > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] SA 2.60 *VERY* slow. > > > > Mike Van Pelt writes: > >This is nuts. I'm going to have to back out 2.60 to

[SAtalk] spamd max-children limit

2003-10-09 Thread Dallas L. Engelken
maillog shows - Oct 9 13:21:07 spamd1 spamd[31846]: hit max-children limit (10): waiting for some to exit top shows - 31846 root 9 0 21372 20M 2148 S 0.0 2.7 0:34 spamd 30880 root 9 0 21372 20M 2148 S 0.0 2.7 0:00 spamd 30990 root 9 0 21372 20M 2148 S

Re: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread Matthias Fuhrmann
On Thu, 9 Oct 2003, Fabiano Bonin wrote: [...] > If there was a way to reject the spam in the mail server (returning the > rejection to the sender), maybe the spammers will remove our addresses > from its lists, and the traffic will decrease. > > Is this step possible? If yes, where can i find mo

[SAtalk] Question about my setup: Feedback please

2003-10-09 Thread Jason Williams
Hello everyone. I just wanted to get some feedback regarding my particular setup with postfix and SA. Right now, I have a mail gateway server on my DMZ. Its running OpenBSD 3.3, Postfix-2.0.16 and SpamAssassin 2.55, as well as spampd (which is working great BTW). I've setup SA on the gateway

Re: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread Dan Wilder
On Thu, Oct 09, 2003 at 01:19:00PM -0400, Vivek Khera wrote: > > While it is possible to reject at SMTP time, it is unlikely to get you > off of most spam sources, since they don't care about bounces or > having clean lists. Also, by the time you do this, you've already > wasted your bandwidth to

RE: [SAtalk] How does a message like this get through?

2003-10-09 Thread Colin A. Bartlett
I don't think there is a test that specifically looks for those words with the parentheses. You might have to write your own test. Of course, if your running Bayes, these kinds of words are picked up as spamish by Bayes over time. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticw

Re: [SAtalk] Catching Lots of Remarks in HTML Messages

2003-10-09 Thread Fred I-IS.COM
A rule for this already exists, it's called: OBFUSCATING_COMMENT If you like, you can give this test a higher score in your local.cf file. No, the rules are not additive! Frederic Tarasevicius Internet Information Services, Inc. Robert Wagner wrote: > We seem to be getting more messages like:

Re: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread Kris Deugau
Fabiano Bonin wrote: > BUT, in my particular point of view, spam generates 2 big problems: > > 1 - Lots of crap in our mailboxes > 2 - Lots of internet traffic > > Today, SpamAssassin is solving problem number 1 greatly, but problem > number 2 is unsolved, since i will continue to receive all thi

RE: [SAtalk] How does a message like this get through?

2003-10-09 Thread Chris Santerre
There isn't any rule to catch this particular one. However here are 2 hot off the press!   body MY_MTPARENS /\(\)/describe MY_MTPARENS Empty parens found.score MY_MTPARENS .44   body MY_CHARPARENS /[a-zA-Z]\([a-zA-Z]\)[a-zA-Z]/describe MY_CHARPARENS Char(char)Charscore MY_CHARPARENS .70  

Re: [SAtalk] Bayes informations

2003-10-09 Thread Theo Van Dinter
On Thu, Oct 09, 2003 at 12:13:29PM -0400, Jean-S?bastien Guay-Leroux wrote: > I want to know which 15 tokens the Bayes engine used to calculate the final > Bayes Score. I also want to know what is the score of those 15 tokens. run with -D to get the token list, "sa-learn --dump data" to get the t

Re: [SAtalk] SA 2.60 *VERY* slow.

2003-10-09 Thread Justin Mason
Mike Van Pelt writes: >This is nuts. I'm going to have to back out 2.60 tonight >if I can't get this resolved today. (Which I really hate >to do; 2.60 does seem to catch more spam.) It could be doing bayes rebuilds for some reason -- try running "sa-learn --rebuild" before starting SpamAssassin

Re: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread Vivek Khera
> "FB" == Fabiano Bonin <[EMAIL PROTECTED]> writes: FB> If there was a way to reject the spam in the mail server (returning the FB> rejection to the sender), maybe the spammers will remove our addresses FB> from its lists, and the traffic will decrease. While it is possible to reject at SMTP

Re: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread Jonathan Vanasco
Check the archives -- there may be a sendmail hook to do this. I know for a fact you can do this with Exim via the sa-exim patch. (sa-exim.sf.net) A similar postfix project was discussed a month or so back. I believe a sendmail one was too. On Thursday, October 9, 2003, at 10:56 AM, Fabiano

RE: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread Me
>> Of course, I probably am wrong about part, and possibly all, of this. >> That is the funniest thing I heard all week.. Thanks for the SMILE.. Thanks, Todd Routhier Lightwave Technologies, LLC. -- ISP Board http://www.ispBoard.com ISP Information Exchange Start Your Own ISP! http://www

Re: [SAtalk] tag vs deleted spam w/ SA

2003-10-09 Thread Vivek Khera
> "R" == Roger <[EMAIL PROTECTED]> writes: R> Matt Kettler wrote: >> Is there a list for amavisd-new? Someone here might know the answer, >> but if not, that'd probably be the better place to ask. R> Yes I've asked the question on the amavisd-new mailing list and looked R> over the amavisd-

RE: [SAtalk] Outbook 2003

2003-10-09 Thread Jason Staudenmayer
X-Spam-Status: No, hits=4.2 tagged_above=0.0 required=6.3 It hasn't been marked as spam it just had those tests run on it that's all. -Original Message- From: Thiago Lima [mailto:[EMAIL PROTECTED] Sent: Thursday, October 09, 2003 11:22 AM To: [EMAIL PROTECTED] Subject: [SAtalk] Outbook 2

[SAtalk] Bayes informations

2003-10-09 Thread Jean-Sébastien Guay-Leroux
Hi list,   I want to know if there is a way, or a patch to spamassassin, to get a little bit more information about the scoring of a SPAM/HAM with Bayes.   I want to know which 15 tokens the Bayes engine used to calculate the final Bayes Score.  I also want to know what is the score of

Re: [SAtalk] SA 2.60 *VERY* slow.

2003-10-09 Thread Patrick Morris
Mike Van Pelt wrote: It's still having spells of rejecting connections as "it's busy" when CPU is less than 50%. (This is on a Solaris box.) Are you running MIMEDefang with the multpilexor? If so, have you tried raising the maximum number of allowed connections? ---

Re: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread Bob Apthorpe
Hi, On Thu, 09 Oct 2003 11:56:29 -0300 Fabiano Bonin <[EMAIL PROTECTED]> wrote: > I am using SpamAssassin sice yesterday and i put it in production today, > site wide. > It's amazing. > It's filtering 95% on my daily messages, and all blocked messages are > really spams. > > BUT, in my particula

[SAtalk] How does a message like this get through?

2003-10-09 Thread Eric Vollmer
A little background on my mail system, my internet facing mail servers are postfix 1.1.12 which passes mail to amavisd-new for spam scanning.  Once the spam check is done it passes it to our Symantec AV Gateway for virus scanning, also munges the headers from the original smtp transaction.  Once

[SAtalk] RCVD_IN_BSP_TRUSTED

2003-10-09 Thread Kevin
What test does "RCVD_IN_BSP_TRUSTED" refer to? And for future reference where can i find out about other test results? I checked on the default tests site but a search revealed nothing. Thanks, /KRM -- "UNIX was not designed to coddle the weak." --Fyodor keyserv

Re: [SAtalk] Catching Lots of Remarks in HTML Messages

2003-10-09 Thread Hannu Liljemark
On Thu, Oct 09, 2003 at 09:15:29AM -0500, Robert Wagner wrote: > We seem to be getting more messages like: > GIRLS T > HAT RE See what the OBFUSCATING_COMMENT test in 2.6x and 2.5x does. -- (Mr.) Hannu Liljemark | Appelsiini Finland Oy | http://appelsiini.com

Re: [SAtalk] Filter inbound attach footer outbound.

2003-10-09 Thread Hannu Liljemark
On Wed, Oct 08, 2003 at 02:35:08PM -0400, Matt Chapman wrote: > I am trying to get my MimeDefang/Spamassassin/Sendmail relay > box to filter inbound mail but not filter outbound... On > top of that, attach a footer to mails that are destined > outbound only. One way besides $RelayAddr (or whatev

RE: [SAtalk] Custom Rules - HTML and Line Breaks

2003-10-09 Thread Larry Gilson
Thanks Chris! --Larry > -Original Message- > From: Chris Santerre [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 09, 2003 10:59 AM > To: 'Larry Gilson' > Cc: Spamassassin-Talk (E-mail) > Subject: RE: [SAtalk] Custom Rules - HTML and Line Breaks > > > You are correct. MK (I think

[SAtalk] Outbook 2003

2003-10-09 Thread Thiago Lima
Title: Message       Hi,       I'm seeing to many messages marked as spam and there're not. Looking further I found that all messages came from users using Outlook 2003 (office XP 2003)       Looking in the headers :       X-Mailer: Microsoft Office Outlook, Build 11.0.5510     X-Spam-Stat

[SAtalk] SA 2.60 *VERY* slow.

2003-10-09 Thread Mike Van Pelt
This is nuts. I'm going to have to back out 2.60 tonight if I can't get this resolved today. (Which I really hate to do; 2.60 does seem to catch more spam.) Other things I have done: Put the MIMEDefang directory on ramdisk. Turned on MIMEDefang queueing with a depth of 10. It's still having s

[SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread Fabiano Bonin
I am using SpamAssassin sice yesterday and i put it in production today, site wide. It's amazing. It's filtering 95% on my daily messages, and all blocked messages are really spams. BUT, in my particular point of view, spam generates 2 big problems: 1 - Lots of crap in our mailboxes 2 - Lots of i

Re: [SAtalk] Outbook 2003

2003-10-09 Thread Adam Denenberg
Thiago, http://bugzilla.spamassassin.org/show_bug.cgi?id=2553 adam On Thu, 2003-10-09 at 11:22, Thiago Lima wrote: > > Hi, > > I'm seeing to many messages marked as spam and there're not. > Looking further I found that all messages came from users using > Outlook 2003 (office X

RE: [SAtalk] Custom Rules - HTML and Line Breaks

2003-10-09 Thread Chris Santerre
You are correct. MK (I think) has a rule like this submitted to the Emporium and it hits just like you described. I don't know of anyway around this. Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense

Re: [SAtalk] Is there a way to reject a message before it arrives?

2003-10-09 Thread mikea
On Thu, Oct 09, 2003 at 11:56:29AM -0300, Fabiano Bonin wrote: > I am using SpamAssassin sice yesterday and i put it in production today, > site wide. > It's amazing. > It's filtering 95% on my daily messages, and all blocked messages are > really spams. > > BUT, in my particular point of view, sp

RE: [SAtalk] Catching Lots of Remarks in HTML Messages

2003-10-09 Thread Chris Santerre
Hold on a little while. I've seen a set of rules that will knock your socks off on these. They are VERY nice, and are being tweaked as we speak. Hand crafted rules by another rule addict. They will "pop"-up soon ;) Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.mercha

[SAtalk] 2.60 does not rewrite subject

2003-10-09 Thread Alexander Bruns
Hi, I am using spamassassin 2.60 with qmail-scanner-1.16 and qmail-1.03 and vpopmail. The smtp-port is opening qmail-scanner and spamassassin iss caled by qmailscanner. The Spam-Mails are marked as spam by the X-Spam-Status Email-header. This works. But the subject is not rewritten. my /etc/

[SAtalk] Catching Lots of Remarks in HTML Messages

2003-10-09 Thread Robert Wagner
We seem to be getting more messages like: GIRLS THAT RE I was curious if Spamassassin would catch these with a rule like: body LOTS_REMARKS /\b\b/i describe LOTS_REMARKS HTML Lots of Remarks The other question is-> Are the rules additive? Such that i

RE: [SAtalk] RBL check

2003-10-09 Thread Upwood, Jim
I fixed this by lowering the scores of my RBL checks. I still use RBLs but none of them have a score of more than 1.0 -Jim -Original Message- From: Covington, Chris [mailto:[EMAIL PROTECTED] Sent: Thursday, October 09, 2003 9:41 AM To: Scott Harris; SpamAssassin-Talk list Subject: RE: [

RE: [SAtalk] Phrases I have modified....

2003-10-09 Thread Chris Santerre
I have some notes on these as well. I think it would be great to put on the wiki! Or maybe I'll just make a separate cf file on "remove me" phrases. I'll try to get that started today. I am s far behind in work it isn't funny. However I did get to go to a great sushi bar in Manhattan yesterday!

[SAtalk] Unable to report spam to Razor - SA2.60

2003-10-09 Thread System Administration
For some reason I can't get spam reporting to work from this account. Razor is installed and the Razor2 patch is install in perl but still no luck. I tried Googling on the main error messages and only found someone else with the same problem but no answers. SA is finding spam and kicking it out

[SAtalk] Wierdness

2003-10-09 Thread David Rodgers
I am seeing some wierdness with Subject rewriting. I have done google searches and through the mail list archive and seen nothing so I will ask here. We use spamassassin sitewide in our company. We scan the messages and then they are sent to the end user with the subject tag [SPAM!] to sort as th

RE: [SAtalk] RBL check

2003-10-09 Thread Covington, Chris
I disabled RBL checks because valid Cable/DSL users in DHCP pools would use their valid mail servers but trip the DHCP pool RBLs based on the first IP address in the received chain. I believe this is a bug though; it shouldn't be checking the very first IP address under those circumstances. Chris

Re: [SAtalk] Re: holy cow, FN city

2003-10-09 Thread Fred
I once came up with a partial solution to this problem. I used a bunch of dictionaries to find letter pairs that did not show up. Granted it's possible for these to cause FP's due to uncommon abbrevations and other oddities, but they work good for me! Maybe if the regex was modified to check if th

[SAtalk] help - freezing!

2003-10-09 Thread gtnet
Hi ppl! i've been using spamassassin for about a month. but i've some problem with it. here is a log: Oct 8 17:33:23 ircnet spamd[25867]: connection from localhost.localdomain [127.0.0.1] at port 4158 Oct 8 17:37:35 ircnet spamd[6705]: info: setuid to nobody succeeded Oct 8 17:46:01

RE: [SAtalk] Re: OT: anti-spam email-only host

2003-10-09 Thread Larry Gilson
Nice site Nancy! --Larry > -Original Message- > From: Nancy McGough > On 8 Oct 2003 Jonathan Vanasco ([EMAIL PROTECTED]) wrote: > > Nope. None of those. > > > > It was for 1 person, cost like $25 a year, and left people enroll a > > domain then manage multiple aliases to handle oversp

[SAtalk] Question about installing SA (first time user).

2003-10-09 Thread David A . Roth
Hello folks. I'm a newbie to SA, so please be kind. :-) I want to be able to install SA for personal use on my ISP's web server (linuxwebhost.com) which is running "Red Hat Linux release 7.3 (Valhalla)". This is as far as I have gotten: % perl Makefile.PL PREFIX=~/sausr SYSCONFDIR=~/saetc the

[SAtalk] spamassassin -t test - error message about "Use of inherited AUTOLOAD..."

2003-10-09 Thread David A . Roth
After getting everything to compile, and installed, I did the following test as suggested in the USAGE document: spamassassin -t < sample-spam.txt > spam.out and got this error: Use of inherited AUTOLOAD for non-method Sys::Hostname::SYS_gethostname() is deprecated at /usr/lib/perl5/5.6.1/i

[SAtalk] SA and MySQL slow down

2003-10-09 Thread bart
Hi I have spamassassin working with MySQL fine. If there is no user in the DB that spamassassin is checking the mail for it seem to take a long time to do the check say 7 seconds for the test email. If there is config for a users in the DB it takes under a second for the test email. Is there any

RE: [SAtalk] Spamd problems with big loads

2003-10-09 Thread Steve Halligan
> I'm using SA 2.6 spamd/spamc > > I'm using it in a very loaded server, I get arround 2 mail connections > per second. > I want to know if there are people having this kind of load, or even > bigger, cause I don't think this should be a big load for the server. > > The server is Pentium III 1 g

RE: [SAtalk] RBL check

2003-10-09 Thread Scott Harris
I turned mine off today for just that reason. A lot of the legitimate mailing lists were being blocked. Unfortunately now I'm starting to see the opt*, lf* and ls* coming back. After a week of testing I'm VERY please to not have to add those to my site RBL, but very dissatisfied with dropping le

[SAtalk] Filter inbound attach footer outbound.

2003-10-09 Thread Matt Chapman
Hi, I am trying to get my MimeDefang/Spamassassin/Sendmail relay box to filter inbound mail but not filter outbound... On top of that, attach a footer to mails that are destined outbound only. I have the server currently relaying mail inbound to exchange servers and filtering fine. I have a

RE: [SAtalk] RBL check

2003-10-09 Thread Scott Harris
I turned mine off today for just that reason. A lot of the legitimate mailing lists were being blocked. Unfortunately now I'm starting to see the opt*, lf* and ls* coming back. After a week of testing I'm VERY please to not have to add those to my site RBL, but very dissatisfied with dropping le

RE: [SAtalk] Question about whitelist NOT AWL

2003-10-09 Thread Colin A. Bartlett
You can put the configuration commands for white/blacklists directly in your local.cf file or into any other .cf file you place in the /etc/mail/spamassassin directory. There is also a usr/share/spamassassin directory that contains .cf files that you can modify but bear in mind that these files wil

Re: [SAtalk] SA 2.60 vs. razor2

2003-10-09 Thread Kristian Koehntopp
On Wednesday 08 October 2003 23:17, Hannu Liljemark wrote: > http://spamassassin.taint.org/faq/index.cgi?req=show&file=faq02.006.htp Fix worked fine. Thanks. Kristian -- Kristian Köhntopp, NetUSE AG, Dr.-Hell-Straße, D-24107 Kiel Tel: +49 431 386 435 00, Fax: +49 431 386 435 99 -

Re: [SAtalk] incorectly identified trusted host

2003-10-09 Thread Tim B
David B Funk wrote: On Tue, 7 Oct 2003, Tim B wrote: Yes I have.. that was the first thing I tried... it still thinks when there's just one other host that the host is trusted. Havn't seen that one, sounds like a true bug. I guess I will open a bugzilla request then. thanks for th

[SAtalk] Question about whitelists NOT AWL

2003-10-09 Thread Stephen Bradley
I have been using SA for a long long time now and upgraded to 2.60 this week. I cannot figure out where to put my hard coded white/black lists now. I use spamd/spamc and I know it reads the /etc/mail/spamassassin/local.cf file because I can change the score and it shows up after a restart. SA is

[SAtalk] AWL not being generated

2003-10-09 Thread Andrew M
All the documentation for version 2.60 says that autowhitelist is turned on by default and that by default the autowhitelist is stored in each users config directory (e.g. ~/.spamassassin/autowhitelist) When I installed spamassissin, it installed with no problem and is doing a great job of filt

RE: [SAtalk] Question about whitelist NOT AWL

2003-10-09 Thread Stephen Bradley
Okay After the input from everyone here is what I found out. MY white/black lists would not work in /etc/mail/spamassassin/local.cf in any way shape or form. I tried putting them into the users_prefs file everywhere it may have wanted it. I tried putting them in 60_whitelist.cf and when I did sp

Re: [SAtalk] [SAtalk]Out of Memory: Killed process 10665 (spamd)

2003-10-09 Thread Kai Schaetzl
Jan Erik Skogsholm wrote on Thu, 09 Oct 2003 11:04:55 +0200: > Oct 8 16:31:17 nospam kernel: Out of Memory: Killed process 10665 (spamd). > Don't know if there is a connection, but look at the thread Subject: [SAtalk] spamd grabbing LOOTs of memory Kai -- Kai Schätzl, Berlin, Germany G

Re: [SAtalk] Question about whitelist NOT AWL

2003-10-09 Thread Kai Schaetzl
Stephen Bradley wrote on Wed, 8 Oct 2003 17:45:42 -0400: > BUT, if I put my black/white list entries in that file or any other file in > the SA directories > it will not work. None of the entries are read. > You *did* restart spamd, did you? Kai -- Kai Schätzl, Berlin, Germany Get your web

RE: [SAtalk] Question about whitelist NOT AWL

2003-10-09 Thread Colin A. Bartlett
Maybe you can give us more info about what's not working about it. Do you mean that is just skips the whitelist config settings? One thing you can do is run spamd with the -D option and view the debug output. It will tell you what it's doing with the message as it processes it. Maybe that will help

[SAtalk] Re: OT: anti-spam email-only host

2003-10-09 Thread Nancy McGough
On 8 Oct 2003 Jonathan Vanasco ([EMAIL PROTECTED]) wrote: > Nope. None of those. > > It was for 1 person, cost like $25 a year, and left people enroll a > domain then manage multiple aliases to handle overspammed addresses. > > Can't remember the name -- the closest thing to it i've found is > sim

[SAtalk] 2.60 bayes lock recap

2003-10-09 Thread Matthew McGehrin
So based on recommendations from the list, I am now using learn to journal for updates in 2.60. I decreased the max_size to half, and it seems to be running every couple of hours, which is acceptable. Thanks again for all the suggestions. bayes_learn_to_journal 1 bayes_journal_max_size 51200

[SAtalk] [SAtalk]Out of Memory: Killed process 10665 (spamd)

2003-10-09 Thread Jan Erik Skogsholm
Hello ! This happen some time and what can I do to avoid this. I have to reboot the computer. Jan Erik Oct 8 16:31:17 nospam kernel: Out of Memory: Killed process 10665 (spamd). Oct 9 02:15:09 nospam kernel: (scsi0:A:1:0): Locking max tag count at 64 Oct 9 08:03:51 nospam kernel: Out of Memory