[SAtalk] memory leaking spamd procs

2003-12-21 Thread jpff
(writing on behalf of the day job) We are suffering from run-away spamd processes, growing to large memory usage and in effect killing all mail delivery. This last happened Sunday pm and until someone gets to the office we are still without mail. Looking through the archives I found a message fro

Re: [SAtalk] To: you Cc: friend -- New spammer trick?

2003-12-21 Thread Evan Platt
--On Sunday, December 21, 2003 3:13 PM -0700 Bob Proulx <[EMAIL PROTECTED]> wrote: In the last month my girlfriend and I have been getting a number of spams which have been addressed To: me and Cc: to her. This seems to be a new spammer trick. Use not just a database of email addresses but a da

[SAtalk] spamp.py and 4 hard messages

2003-12-21 Thread PieterB
Hello, I created a Python script that can process Unix mbox files and generate statistics on the Bayesian filtering of SpamAssassin. I've ran the script (called 'spamp.py') on a Unix mbox containing a total of 4381 messages. The mbox contained 2615 dutch non-spam messages, 1 misclassified englis

[SAtalk] Scanning bounce message attachments ?

2003-12-21 Thread Simon Byrnand
Hi All, Recently our domain has been "joe jobbed" by some spammer, so our users are getting a lot of bounce messages with spam attachments. Unfortunately SpamAssassin is letting most of them through because the header tests won't match the headers from the attached spam message. Is there any w

[SAtalk] Strange DNSBL problem with spamassassin

2003-12-21 Thread Robert Lacroix
Hi all, I have a strange problem with SpamAssassin and I can't find out a solution to this: We use a McAfee Webshield SMTP in front of an IMail server, that scans for viruses and passes emails to IMail which runs on another port than 25. IMail analyzes the email then using spamc/spamd. When a clie

Re: [SAtalk] Non-functioning sa-learn in SA 2.61 on Mandrake 9.2 system

2003-12-21 Thread Casper Gasper
The message that is returned looks something like this: Learned from 0 message(s) (5 message(s) examined) It appears that sa-learn is examining the file but is not learning from the messages. It looks to me that sa-learn is working -- you're just feeding it messages that it's already learnt fro

Re: [SAtalk] Image-only spam

2003-12-21 Thread Robert Nicholson
Are you making use of any of the distributed clearing houses such as DCC etc? On Dec 21, 2003, at 4:05 PM, Barry Callahan wrote: I installed Spamassassin from a RedHat RPM as a test a day or two ago, and it's properly flagging about 1/3 of the incoming SPAM as such. I have not played around w

Re: [SAtalk] Image-only spam

2003-12-21 Thread Barry Callahan
Heh. Ya know what? You were right. RedHat gave me 2.44. I just upgraded to 2.6.1 We'll see how it goes. Thanks. Barry Tom Meunier wrote: Before you play with the settings, consider updating to the current version of SpamAssassin. You're probably using 2.44; the current version is 2.61.

Re: [SAtalk] Non-functioning sa-learn in SA 2.61 on Mandrake 9.2 system

2003-12-21 Thread Larry Rosenman
--On Sunday, December 21, 2003 17:48:35 -0500 Clive Dove <[EMAIL PROTECTED]> wrote: On Sunday 21 December 2003 15:28, Ian Southam wrote: > My sa-learn is no longer working. I had it functioning under Mandrake > 9.1 and > again under Mandrake 9.2 upgraded from 9.1. Check you have a perl modul

Re: [SAtalk] Non-functioning sa-learn in SA 2.61 on Mandrake 9.2 system

2003-12-21 Thread Clive Dove
On Sunday 21 December 2003 15:28, Ian Southam wrote: > > My sa-learn is no longer working. I had it functioning under Mandrake > > 9.1 > > and > > > again under Mandrake 9.2 upgraded from 9.1. > > Check you have a perl module called DB_File installed. Without this, > sa-learn will quietly fail (u

RE: [SAtalk] Image-only spam

2003-12-21 Thread Gary Funck
Try Fred's rules, http://www.merchantsoverseas.com/wwwroot/gorilla/90_FVGT.cf esp. this combo image only rule: metaFVGT_combo_IMAGEONLY1 ((HTML_IMAGE_ONLY_02 + MIME_HTML_ONLY + MIME_HTML_ONLY_MULTI) > 1) describeFVGT_combo_IMAGEONLY1 FVGT - Image only type spam? score

RE: [SAtalk] Image-only spam

2003-12-21 Thread Tom Meunier
Before you play with the settings, consider updating to the current version of SpamAssassin. You're probably using 2.44; the current version is 2.61. At this point, that much spam getting through would be expected behavior. -tom > -Original Message- > From: [EMAIL PROTECTED] > [mailto:

[SAtalk] To: you Cc: friend -- New spammer trick?

2003-12-21 Thread Bob Proulx
In the last month my girlfriend and I have been getting a number of spams which have been addressed To: me and Cc: to her. This seems to be a new spammer trick. Use not just a database of email addresses but a database of To: Cc: headers combined in an attempt to get through people's filters. An

[SAtalk] Image-only spam

2003-12-21 Thread Barry Callahan
I installed Spamassassin from a RedHat RPM as a test a day or two ago, and it's properly flagging about 1/3 of the incoming SPAM as such. I have not played around with any of the settings yet. Half of what's getting through has a score of 3.6 - 4.0. This is not the group that overly concerns

Re: [SAtalk] replacing .cf files

2003-12-21 Thread Martin Radford
At Sun Dec 21 20:04:48 2003, Amnon wrote: > > Since I didn't get any replies to my question about replacing the > .cf files in /usr/share/spamassassin with the newer ones that are on > the SA site (running ver. 2.60), I decided to try it anyway. Well > no errors, log looks fine, and spam is being

Re: [SAtalk] replacing .cf files

2003-12-21 Thread Theo Van Dinter
On Sun, Dec 21, 2003 at 03:04:48PM -0500, Amnon wrote: > So I guess one cannot just replace the .cf files with newer ones, right? Can, with some kluging. Want to? Probably not. Most rule changes take place via code than via the cf files. -- Randomly Generated Tagline: I can't believe I ate th

Re: [SAtalk] Non-functioning sa-learn in SA 2.61 on Mandrake 9.2 system

2003-12-21 Thread Ian Southam
> My sa-learn is no longer working. I had it functioning under Mandrake 9.1 and > again under Mandrake 9.2 upgraded from 9.1. Check you have a perl module called DB_File installed. Without this, sa-learn will quietly fail (unless you have debug switched on). -- Ian --

Re: [SAtalk] replacing .cf files

2003-12-21 Thread Brook Humphrey
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sunday 21 December 2003 12:04 pm, Amnon wrote: > So I guess one cannot just replace the .cf files with newer ones, right? not sure what version you are using but it would appear not. On a side not when I upgraded my servers to using 2.60 I found it

[SAtalk] replacing .cf files

2003-12-21 Thread Amnon
Since I didn't get any replies to my question about replacing the .cf files in /usr/share/spamassassin with the newer ones that are on the SA site (running ver. 2.60), I decided to try it anyway. Well no errors, log looks fine, and spam is being flaged. That is until. Later on in the day I n

Re: [SAtalk] ... SA 2.61 eats mails ...

2003-12-21 Thread Rubin Bennett
SA Can't delete anything, so it's either your MDA (probably Procmail) or your email client (broken filter?) that's doing the deleting. HTH, Rubin On Sun, 2003-12-21 at 12:34, Kai Poppe/Redaktion SDCE wrote: > Hello list, > > i've got a serious problem on my hand. Having installed postfix i set u

[SAtalk] Non-functioning sa-learn in SA 2.61 on Mandrake 9.2 system

2003-12-21 Thread Clive Dove
My sa-learn is no longer working. I had it functioning under Mandrake 9.1 and again under Mandrake 9.2 upgraded from 9.1. I had been running Spamassassin 2.60 and upgraded to 2.61. The only change that I made apart from installing the rpm was to delete my prior ~/.spamassassin/user_prefs and

Re: [SAtalk] Re: random words spam

2003-12-21 Thread Chris Thielen
David Gibbs said: > [EMAIL PROTECTED] wrote: >> Is there an sa recipe for this latest innovation, with body as follows? > > This spam seems to be designed to bypass bayesian analysis ... and it > appears to work. Almost every piece of spam like this I've seen has the > BAYES_00 rule, which has a n

RE: [SAtalk] MSGID_FROM_MTA_SHORT problem

2003-12-21 Thread Gary Funck
Known problem/bug? http://bugzilla.spamassassin.org/show_bug.cgi?id=2311 If it is not working for you, you can disable the test by setting its score to 0: SCORE MSGID_FROM_MTA_SHORT 0 in your user_prefs, or local.cf depending upon whether you're running as a user or a sysadmin. > -Original

RE: [SAtalk] a few newbie questions

2003-12-21 Thread Gary Funck
Couple of things: 1) this SA Talk list can help you more if you attach an example of the offending message, complete with headers (all headers, unchanged). That way we can run it through our collection of tweaked rules, and let you know what's working for us. , 2) Mosie on over to Chris Santerre's

[SAtalk] ... SA 2.61 eats mails ...

2003-12-21 Thread Kai Poppe/Redaktion SDCE
Hello list, i've got a serious problem on my hand. Having installed postfix i set up SpamAssassin and it perfectly worked until 2 days ago. I believe, I changed nothing important but suddenly the mails piped from spamassassin through sendmail to run into the appropiate mailboxes are deleted the in

Re: [SAtalk] Provider issue

2003-12-21 Thread Erik van der Meulen
On Sat, Dec 20, 2003 at 12:29:26PM +0100, Erik van der Meulen wrote: > Now I thought of the following scenario: > If I filter my incoming mail first with: > spamassassin -d > in order to get 'vanilla' messages (remove signs of my ISP's check) and > consecutively do a normal SA spam-check as I

[SAtalk] Re: random words spam

2003-12-21 Thread David Gibbs
[EMAIL PROTECTED] wrote: Is there an sa recipe for this latest innovation, with body as follows? This spam seems to be designed to bypass bayesian analysis ... and it appears to work. Almost every piece of spam like this I've seen has the BAYES_00 rule, which has a negative score. Almost all th

[SAtalk] spamd timeouts

2003-12-21 Thread Jack Gostl
Every now and then a spam slips through with no header markups. I finally tracked some of these down and found that spamd took so long to finish that spamc finally timed out. (In this case, 742 seconds.) I'm not sure what causes this. I'm running 2.60, and I thought that very slow RBLs were handl

[SAtalk] random words spam

2003-12-21 Thread es
Is there an sa recipe for this latest innovation, with body as follows? pique tantrum bob deduce bizarre proscribe tropopause amtrak goal canst fool earphone anisotropic horrify casein traversable anion cell stolen contact uproot descent Thanks Newbie question - how do I automatically have my sp

[SAtalk] MSGID_FROM_MTA_SHORT problem

2003-12-21 Thread Andreas Kotowicz
Hi, I just received an email from a friend that was marked as spam - though it isn't spam. (I'm using spamassassin 2.61). here are the headers: MIME-Version: 1.0 Content-Type: multipart/related; boundary="=_NextPart_000_0075_01C3C7D9.80663B40" X-Mailer: Microsoft Office Outlook, Build 11.0.55

[SAtalk] a few newbie questions

2003-12-21 Thread Geoffrey Lane
I would like to increase the accuracy of my spamassassin rules... First I have used kmail and piped my mail through the standard "/usr/bin/spamassassin" without any switches if size of message is less than 250kb and my next rule filters the mail with a X-Spam-Status: YES header to filter to a mb