Hello Jennifer,
Monday, December 22, 2003, 2:32:45 PM, you wrote:
JF> I am so sick of these spam emails but not sure how to stop them. Could
JF> anyone give me any guidance? I am currently using sa 2.55 and planning
JF> to upgrade to 2.61 next week.
The rules I'm using (2.60, should work OK in
On Fri, Dec 19, 2003 at 10:27:01AM -0800, Don Caprio wrote:
> This email had a rating of 5.3 however the X-Spam-Level: only has two
> stars?
>
> Anyone know what's up with this?
I could have sworn this was in the FAQ.
The problem is that the message is being filtered through SpamAssassin twice.
Joao Reis,
| Dec 22 10:04:50 socrates amavis[12387]: (12387-04) SA TIMED OUT,
| backtrace: at
| /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line
| 1489\n\teval {...} called at
| /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line
| 1489\n\tMail::SpamAssas
Newbe to postfix/spamassassin here, so be gentle.
I just added spamassassin to my postfix installation on a solaris server.
I'm seeing a problem where the score does not match the X-Spam-level.
i.e.
...
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on
dcms.com
X
On Fri, 19 Dec 2003 21:21:02 +, Iain Stevenson wrote
> System:
>
> Linux ppc (basicallu Yellowdog), 2.4.21 kernel
> Postfix
> amavisd-new-20030314
> spamassassin 2.6 or 2.61
> clamav-0.65
>
> System is configured to use the spamd interface to spamassassin. If
> I install the 2.6 or 2.61 ver
Hi all,
I have a strange problem with SpamAssassin and I can't find out a solution
to this:
We use a McAfee Webshield SMTP in front of my IMail server, that scans for
viruses and passes emails to IMail which runs on another port than 25. IMail
analyzes the email then using spamc/spam. When a clien
On Mon, Dec 22, 2003 at 11:00:52AM -0500, Christopher X. Candreva
carved this out of pure phosphors:
>
> And, anyone know what the x-stuff-for-pete I often see in spam is from ?
Eudora adds that to HTML mail for reasons known only to Pete.
>
>
Nix <[EMAIL PROTECTED]> writes:
> The spam-checking process skips the Bayes-checking if the database is
> locked (as blcoking on that lock for a long time would be a very bad
> idea). This warning message is just saying that Bayes was skipped.
Right, so it's no catastrophe. But it does mean that
On Mon, Dec 22, 2003 at 05:50:24PM -0600, Rachael Stewart wrote:
> I have SA 2.61 running on RedHat 8. I've compiled a set of spam and ham
> messages (using Pine) for the Bayes seed, but I'm having trouble with
> the initial call to sa-learn. Has anyone seen this before?
Do you have the MIME::Base
Hello,
I have SA 2.61 running on RedHat 8. I've compiled a set of spam and ham
messages (using Pine) for the Bayes seed, but I'm having trouble with
the initial call to sa-learn. Has anyone seen this before?
[EMAIL PROTECTED] --showdots --mbox --ham ham
...
That's correct.
Rubin
On Mon, 2003-12-22 at 17:59, Eric Six wrote:
> According to what I have read, all you have to do is drop bigevil.cf into
> /etc/mail/spamassassin and restart spamd. Is that correct or do I need to make any
> configuration changes to tell SA to use this cf file?
>
> TIA
> E
According to what I have read, all you have to do is drop bigevil.cf into
/etc/mail/spamassassin and restart spamd. Is that correct or do I need to make any
configuration changes to tell SA to use this cf file?
TIA
Eric
---
This SF.net email
At 05:32 PM 12/22/2003, Jennifer Fountain wrote:
I am so sick of these spam emails but not sure how to stop them. Could
anyone give me any guidance? I am currently using sa 2.55 and planning to
upgrade to 2.61 next week.
Thanks for any info!
Free Cable
Looks like a good job for Chris S's po
From: "Jennifer Wheeler" <[EMAIL PROTECTED]>
Date: Mon, 22 Dec 2003 15:01:25 -0500
>http://www.emtinc.net/spamhammers.htm
Indeed, yours was one of the places I *had* looked.
Forgive me if I'm confused, but it seems that your
rules are looking for a variety of tag patterns.
E.g. frobnozdigibbet a
Title: Message
I am
so sick of these spam emails but not sure how to stop them. Could anyone
give me any guidance? I am currently using sa 2.55 and planning to upgrade
to 2.61 next week.
Thanks
for any info!
Jenn
-Original Message-From: Rosales
[mailto:[EMAIL PROTECTED]
Chris Santerre <[EMAIL PROTECTED]> writes:
> If I work the regex even further so it reads:
>
> (?:domain1|domain2|domain3)\.com
>
> rather then:
>
> (?:domain1\.com|domain2\.com|domain3\.com)
>
> Will it run even faster? Less memory? Or is it a tradeoff between the two?
In fact, looking at my cop
Mike,
If you're installing on a Windows box (to integrate with GroupWise/Guinevere or
whatever), use Perl 5.6.1 instead of 5.8.
---
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.
At 01:51 PM 12/22/2003, mairhtin wrote:
Can anyone tell me why this did not get tagged? It clearly states that
the date is thursday jan 01. Does the date header
not get checked?
Mairhtin
I believe that SA does not look for a date in the future relative to the
current local system time, it lo
At Mon Dec 22 14:15:45 2003, Ian Duncalf wrote:
>
> Forgive me if I what I am asking is obvious to some but I would like to know
> how to use some of the rule sets that available e.g. bigevil.cf and
> http://www.merchantsoverseas.com/wwwroot/gorilla/90_FVGT.cf etc.
>
> I am running SpamAssassin v
At 01:58 PM 12/22/2003, Mike Schultz wrote:
When I go to the Spam Assassin directory and type perl makefile.pl it
works fine and asks for email or url to suspect spam report. then it said
file good, Writing makefile for mail::spamassassin, makefile written by
ExtUtils::MakeMake 6.17. Then when
Updated from this weekends spam. That one Guy selling the Vdrug had about 8
more domains.
If I work the regex even further so it reads:
(?:domain1|domain2|domain3)\.com
rather then:
(?:domain1\.com|domain2\.com|domain3\.com)
Will it run even faster? Less memory? Or is it a tradeoff between th
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Barton L. Phillips wrote:
> I never seem to see any BAYES_xx tests in any of my spam. I have seen a
> couple in ham but not many. I have autolearn on and have a few entries
> in my bayes files as shown by sa-learn --dump: 912 spam, 102 ham, 50876
> tok
On Mon, 22 Dec 2003, Brent J. Nordquist <[EMAIL PROTECTED]> wrote:
> I've noticed several messages (all spam) with this header:
>
> X-MT-17: 1906684
> X-MT-25: 1906684
> etc.
>
> Is there a way to write a rule that tests for a header whose name
> matches a certain pattern?
OK, thanks to Robert
Hi Sam,
>
> Probably haven't look hard enough, but has anyone
> used a rule to detect (real or pseudo) HTML tags
> embedded in text. Ostensibly they're there to
> throw off bayes and other pattern matchers.
>
> I just put up:
>
> rawbody TAG_IN_TEXT /[a-zA-Z0-9]+\<\/*[a-zA-Z0-9]*\>[a-zA-Z0-
Probably haven't look hard enough, but has anyone
used a rule to detect (real or pseudo) HTML tags
embedded in text. Ostensibly they're there to
throw off bayes and other pattern matchers.
I just put up:
rawbody TAG_IN_TEXT /[a-zA-Z0-9]+\<\/*[a-zA-Z0-9]*\>[a-zA-Z0-9]+/
describe TAG_IN_TEX
Since you're using bayes do you get the same errors when you try to use
sa-learn?
If this was me I'd simply run sa-learn in the perl debugger and debug
how the bayesstore is being written.
I don't think your problem is spamd specific.
On Dec 19, 2003, at 3:06 AM, Lukreme wrote:
I make sure th
On Mon, 22 Dec 2003, Robert Nicholson <[EMAIL PROTECTED]> wrote:
> I cannot think of any legimate emails that would contain X-MT in their
> header so why not just right the rule to check for that instead of
> worrying about which digits are present. Then you only have to worry
> about what happens
I'm not seeing any problems with 5.8.0 and I'm making heavy use of
SpamAssassin in my
perl filter scripts.
On Dec 22, 2003, at 10:22 AM, J. S. Greenfield wrote:
I've seen a few comment here that SA has issues with perl 5.8.
Anybody have a thumbnail sketch of what the issues are? Looks like
R
On 20 Dec 2003, at 12:25, Lukreme wrote:
On 19 Dec 2003, at 22:15, Lukreme wrote:
I set the permissions on all the bayes files to 700 for all users and
I still ended up having them get switched to - after some
period of time. Although, it appears that this time it was a couple
of hours:
I cannot think of any legimate emails that would contain X-MT in their
header so why not
just right the rule to check for that instead of worrying about which
digits are present. Then
you only have to worry about what happens when they change the two
characters after the X- :-)
On Dec 22, 2003,
I never seem to see any BAYES_xx tests in any of my spam. I have seen a
couple in ham but not many. I have autolearn on and have a few entries
in my bayes files as shown by sa-learn --dump: 912 spam, 102 ham, 50876
tokens. Am I doing something wrong or should I not see BAYES_xx in
confirmed spa
>> Can anyone give me a clue as to how to resolve this?
> Looks like you need to Install BerkeleyDB first... DB::File requires
it.
> Once you get those two loaded, bayes should work for ya.
Yep, the problem was that SA was looking for /usr/local/BerkeleyDB and
the sun "addpkg" was creating it
I am having a problem installing Spam Assassin 2.61 on perl 5.8.2. When I
go to the Spam Assassin directory and type perl makefile.pl it works fine
and asks for email or url to suspect spam report. then it said file good,
Writing makefile for mail::spamassassin, makefile written by
ExtUtils::
Scott Harris <[EMAIL PROTECTED]> wrote:
> Also, what are the potential future ramifications for SA as more and
> more legit mailing list emailers start adding such verbage to
> demonstrate their legitimacy?
If it's an opt-in email list (as most legit ones are), there is no
reason to add the legale
Can anyone tell me why this did not get tagged? It clearly states that the date is
thursday jan 01. Does the date header
not get checked?
Mairhtin
Return-Path: <[EMAIL PROTECTED]>
Received: from adsl-64-108-195-217.dsl.chcgil.ameritech.net
(adsl-64-108-195-217.dsl.chcgil.ameritech.n
On Mon, Dec 22, 2003 at 11:22:29AM -0500, J. S. Greenfield wrote:
> I've seen a few comment here that SA has issues with perl 5.8. Anybody
> have a thumbnail sketch of what the issues are? Looks like RHELv3 comes
> with 5.8.0, so I'm trying to figure out whether it's necessary to
> downgrade t
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Brent J. Nordquist
> Sent: Monday, December 22, 2003 11:36 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] X-MT-nn: header (variable headers in general)
>
> I've noticed several messages (all spam
I've noticed several messages (all spam) with this header:
X-MT-17: 1906684
X-MT-25: 1906684
etc.
The value is always the same, but the header name itself varies. I could
define 100 rules for all 2-digit possibilities but next they'll probably
go to three (or sixteen).
Is there a way to write
All of this sounds like where you then have you put your faith in
Bayes. Surely there are terms in these emails that are sent that
Spammers aren't using in theirs.
---
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert i
>
> > And, anyone know what the x-stuff-for-pete I often see in
> spam is from
> > ?
>
>
> Ask Pete. :)
After some Googling, it seems that this spammer has it in for
[EMAIL PROTECTED]
Take a look at news.admin.net-abuse.sightings, and you'll see that Pete
was posting a lot of these spam samp
Part of my spam filter checking consists of a known domains list. ie. I
never thru any mail that is from a user from that domain into
SpamAssassin. Likewise my whitelist. This could eventually be abused by
spammers quite easily but so far I haven't found it to be a problem. I
can always resort
On Mon, 22 Dec 2003, Evan Platt wrote:
> It was covered - IIRC, the random text is an attempt to throw off the
> Bayesian filters.
Right -- I knew THAT part. It was just that they are using Bart Simpson
lines now.
==
Chris Candreva -- [E
--On Monday, December 22, 2003 11:00 AM -0500 "Christopher X. Candreva"
<[EMAIL PROTECTED]> wrote:
>
> Got a bunch of these over the weekend, mailing list archvies didn't turn
> up any mention. What do these phrases look like to you ?
It was covered - IIRC, the random text is an attempt to thr
Hi all,
I looked around for questions regarding this on the archives site, and
the main side for SpamAssassin, but I guess I missed it. One way to
train SpamAssassin is to get thousands of emails, and use the sa-learn
command as described here:
http://www.mirror.ac.uk/sites/spamassassin.taint.org
I've seen a few comment here that SA has issues with perl 5.8. Anybody
have a thumbnail sketch of what the issues are? Looks like RHELv3 comes
with 5.8.0, so I'm trying to figure out whether it's necessary to
downgrade to 5.6.1.
Thanks.
-
Hi,
I get the following message when amavisd-new try to scan a spam mail for
spam with SA:
Dec 22 10:04:50 socrates amavis[12387]: (12387-04) SA TIMED OUT,
backtrace: at
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line
1489\n\teval {...} called at
/usr/lib/perl5/site_per
At 09:15 AM 12/22/2003, Ian Duncalf wrote:
The auto learn function is working but I am still getting quite alot through
( nearly 120 spams this weekend ).
Well, I'd advise not relying entirely on autolearn.. do some manual
training with sa-learn as well..
I am slowly winning the battle but would
Got a bunch of these over the weekend, mailing list archvies didn't turn up
any mention. What do these phrases look like to you ?
The fifth amendment does not cover
burping
I will not prescribe medication
I'm not reproduceing them all --- but it looks like someone is seeding spam
with a
Many Thanx for the info
Ian :)
>I'm pretty sure this is in the FAQ, but:
>Just put them in the same directory as your local.cf (usually
>/etc/mail/spamassassin) and restart spamd (if you're running SA that
>way).
>Rubin
On Mon, 2003-12-22 at 09:15, Ian Duncalf wrote:
> Forgive me if I what I am
I'm pretty sure this is in the FAQ, but:
Just put them in the same directory as your local.cf (usually
/etc/mail/spamassassin) and restart spamd (if you're running SA that
way).
Rubin
On Mon, 2003-12-22 at 09:15, Ian Duncalf wrote:
> Forgive me if I what I am asking is obvious to some but I would
After replacing the RPM I got from RedHat (2.44) with the RPMs found on the
SpamAssassin website (2.61) it's now catching 2/3 of the spam.
The image-only spam I'm getting is now being tagged at 2.0 - 3.6.
Now that I'm running a modern release of SpamAssassin, I'll take a look at DCC
and Razor,
Forgive me if I what I am asking is obvious to some but I would like to know
how to use some of the rule sets that available e.g. bigevil.cf and
http://www.merchantsoverseas.com/wwwroot/gorilla/90_FVGT.cf etc.
I am running SpamAssassin v2.61 on SuSe 7.3.
I am using Sendmail & the Procmail filter t
> You say you believe you changed noting important, but apparently
> _something_ important was changed. What can you remember
> about settings you
> changed since it last worked?
One of the easily missed gotcha's is editing the file in windows notepad or
another unix-unaware editor. This insert
At 06:34 PM 12/21/03 +0100, Kai Poppe/Redaktion SDCE wrote:
i've got a serious problem on my hand. Having installed postfix i set up
SpamAssassin and it perfectly worked until 2 days ago. I believe, I changed
nothing important but suddenly the mails piped from spamassassin through
sendmail to run i
Hi,
I think I found the problem. server14.asklepios.com (the host that
webshield uses in the header) resolved to a public IP address, while
asklepios.com (the host that imail uses in the header) resolved to a
private IP address (due to Active Directory). I put
server14.asklepios.com to a private a
At 05:05 PM 12/21/03 -0500, Barry Callahan wrote:
I installed Spamassassin from a RedHat RPM as a test a day or two ago, and
it's properly flagging about 1/3 of the incoming SPAM as such. I have not
played around with any of the settings yet.
Half of what's getting through has a score of 3.6 -
At 02:12 AM 12/22/03 +0100, Robert Lacroix wrote:
Hi all,
I have a strange problem with SpamAssassin and I can't find out a
solution to this:
We use a McAfee Webshield SMTP in front of an IMail server, that scans
for viruses and passes emails to IMail which runs on another port than
25. IMail anal
Rubin Bennett Sent: Monday, December 22, 2003 7:28 AM
> And, just a small 'netiquette nit to pick: ANY attempt at a helpful
> answer is "satisfactory". If you need more information, request it in a
> polite manner and it'sll probably happen. Sending a message with the
> tone of yours surely doe
Well, I gave the best answer I could based on the small amount of
information you gave the list... "It doesn't work" is a pretty open
ended problem. ;^)
To be able to tell you more, we need to know more about your setup.
What are you using for an MTA (sendmail/postfix/something else?) and MDA
(p
We are alive again so...
Spamassassin v2.60
Perl v5.6.1
==John ffitch
---
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn ever
Hi Rubin,
unfortunately your answer isn't at all satisfactory ... WHAT could be wrong
with procmail ? I haven't got a procmailrc in /etc ... so some other systems
i own don't either - spamassassin works anyways ...
I would appreciate a more detailled suggestion what could be wrong with
procmail
K
On Sat, 20 Dec 2003, Gary Smith wrote:
> So we implemented SA some time ago because our clients were getting too much spam.
> Lately we have found that several html marked up emails have been getting marked as
> spam. These ones are clearly fp's.
>
> Some of the domains include Morningstar.com
62 matches
Mail list logo
