[SAtalk] odd problem with spamassassin missing messages...

Hello, I am having a weird problem with spamassassin missing messages completely. Spamd logs that it accepted the mail to syslog but it does not add any headers. This has been happening a lot lately (20x a day or so) and I am unsure if it is an error in my setup or a problem with spamassassin. SA

[SAtalk] SA not adding any headers

I'm trying to get SA to work with my qmail server and I'm getting very frustrated. I'm running spamd and invoking spamc from a .qmail file. If I pipe a sample mail message to spamc from the command line, I get the message returned on stdout with various X-Spam-* headers added just as I would e

[SAtalk] Re: procmail and stale spamassassin.lock

Just wanted to let everyone know, my bayes journal sync problems went away with SA 2.61 I'm using bayes_learn_to_journal 1 and bayes_journal_max_size 0, then running an sa-learn --rebuild twice a day. That seems to be working very well for me. On Mon, Nov 17, 2003 at 02:12:31PM -0800, Chip Paswa

[SAtalk] Re: eBay Spoof

These are two entirely different issues. The first one, about eBay no longer allowing usernames with email addresses in them, which was all plaintext, looks legit. They stopped allowing you to register a new ID using an email address a year ago or more, so this new policy doesn't surprise me m

RE: [SAtalk] Re: Ebay spoof?

At 03:45 PM 12/26/2003, you wrote: Interesting. The message body appeared as plain text. However, the similar spam that we received here (see attached) was thick with HTML that obscured its purpose. Do you have something in your mail delivery pipeline that converts HTML to text? I think you can ha

RE: [SAtalk] Ebay spoof?

> -Original Message- > From: Martin Radford > Sent: Friday, December 26, 2003 4:21 PM > > > At Fri Dec 26 22:31:27 2003, Gary Funck wrote: > > > > As far as 66.135.209.220 goes: > > > > # dig -x 220.209.135.66 +recursive > > You're looking up the wrong IP address. If you reverse the

[SAtalk] Re: Ebay spoof?

Martin Radford wrote: > > At Fri Dec 26 22:31:27 2003, Gary Funck wrote: > > > > As far as 66.135.209.220 goes: > > > > # dig -x 220.209.135.66 +recursive > > You're looking up the wrong IP address. If you reverse the octets, > you must append ".in-addr.arpa" Ah, I suppose that explains that.

Re: [SAtalk] Ebay spoof?

At Fri Dec 26 22:31:27 2003, Gary Funck wrote: > > As far as 66.135.209.220 goes: > > # dig -x 220.209.135.66 +recursive You're looking up the wrong IP address. If you reverse the octets, you must append ".in-addr.arpa" > Compare this to a legit IP (pointing to a machine named 'data') in ebay.

[SAtalk] Re: Ebay spoof?

Gary Funck wrote: > Interesting. The message body appeared as plain text. > However, the similar spam that we received here (see attached) > was thick with HTML that obscured its purpose. > > Do you have something in your mail delivery pipeline that converts HTML to > text? Nope. Nothing like th

RE: [SAtalk] SpamAssassin only working on 127.0.0.1 & not on external mail

> -Original Message- > From: Douglas Kirkland [mailto:[EMAIL PROTECTED] > Sent: Friday, December 26, 2003 3:49 PM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] SpamAssassin only working on 127.0.0.1 & not on > external mail > > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On

Re: [SAtalk] Re: Ebay spoof?

On Friday, December 26, 2003 @ 2:52:10 PM [-0700], Bryan Hoover wrote: > Gary Funck wrote: >> >> It is best to post the entire message as an attachment. In this case, >> I'd bet that the apparent Ebay link goes somewheree elese (do "view source" >> on the message). > Original message attached --

Re: [SAtalk] SpamAssassin only working on 127.0.0.1 & not on external mail

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Friday 26 December 2003 15:00, Wendel, Jesse wrote: > I finally figured out what was going on. Don't have it solved, but have a better question at least. > > First though, I tried Carl's suggestion - no joy. Tried uninstalling and reinstalling

RE: [SAtalk] Re: Ebay spoof?

> -Original Message- > From: Bryan Hoover > Sent: Friday, December 26, 2003 2:52 PM [...] > > Original message attached -- pretty much the same I think, as that > pasted was from a straight 'cat /var/mail/bhoover', but your 'dig' is > interesting. Interesting. The message body appeared a

RE: [SAtalk] SpamAssassin only working on 127.0.0.1 & not on external mail

I finally figured out what was going on. Don't have it solved, but have a better question at least. First though, I tried Carl's suggestion - no joy. Tried uninstalling and reinstalling - no joy. What I finally figured out had to do with out I'd set up my local vs. virtual domains in qmail.

[SAtalk] Re: Ebay spoof?

Gary Funck wrote: > > It is best to post the entire message as an attachment. In this case, > I'd bet that the apparent Ebay link goes somewheree elese (do "view source" > on the message). Original message attached -- pretty much the same I think, as that pasted was from a straight 'cat /var/mail

RE: [SAtalk] Ebay spoof?

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Bryan > Hoover > Sent: Friday, December 26, 2003 1:59 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Ebay spoof? > > > Does anyone know if the following mail is an ebay spoof? I think I've > got an accou

Re: [SAtalk] Ebay spoof?

At 01:59 PM 12/26/2003, Bryan Hoover wrote: Does anyone know if the following mail is an ebay spoof? I think I've got an account with them, but it's been so long since I used it... And the site requires you to sign in in order to make a report, or request info -- apparently ebay does not provide

[SAtalk] Ebay spoof?

Does anyone know if the following mail is an ebay spoof? I think I've got an account with them, but it's been so long since I used it... And the site requires you to sign in in order to make a report, or request info -- apparently ebay does not provide a direct contact email address. Bayes won't

Re: [SAtalk] The first spam to make it through since Friday...

On Wed, 24 Dec 2003, Scott Lambert wrote: > We complained to them about spam to "@inch.com" this morning. They > responded saying they were 100% opt-in. We went looking through the > maillog. > > Dictionary spam. The nerve of some people. Define several unused names. Send their mail to somepla

[SAtalk] Test Post, Please Disgard

This is a test post. Please disregard. Keep up the good work people! --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everythin

RE: [SAtalk] hundreds of spamd processes spawning

I think it's because your MTA issues a seperate request to spamd for each recpient in a single mail. When you have a mail that has 100 recpients your problem would occur.   /robert From: Michael P. Varre [mailto:[EMAIL PROTECTED] Sent: Freitag, 26. Dezember 2003 20:43To: [EMAIL PROTECTED]C

RE: [SAtalk] hundreds of spamd processes spawning

Thanks, I’ll give that a try…any idea why this might be happening to begin with?   From: Robert 'JFK' Lacroix [mailto:[EMAIL PROTECTED] Sent: Friday, December 26, 2003 12:32 PM To: Michael P. Varre Cc: [EMAIL PROTECTED] Subject: RE: [SAtalk] hundreds of spamd processes spawning

RE: [SAtalk] hundreds of spamd processes spawning

Start spamd with the argument -m 20, that maximizes the concurrently spawned instances to 20.   /robert From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael P. VarreSent: Freitag, 26. Dezember 2003 16:23To: [EMAIL PROTECTED]Subject: [SAtalk] hundreds of spamd processes

[SAtalk] Updated Textpad Syntax file for SA

Updated to handle new keywords in versions 2.60 & 2.61. See for instructions on how to install if you use Textpad. Mike sasynfile.zip Description: sasynfile.zip

[SAtalk] hundreds of spamd processes spawning

Good morning and happy holidays everyone!   I’m running spamd + vpopmail + qmailscanner + mysql + clamuko.  I have a problem where every once in a while hundreds of spamd processes are spawning.  It absolutely crushes the server.  I have determined it is not because of any large lists bei

Re: [SAtalk] The first spam to make it through since Friday...

On Wed, 24 Dec 2003, Scott Lambert wrote: > We complained to them about spam to "@inch.com" this morning. They > responded saying they were 100% opt-in. We went looking through the > maillog. > > Dictionary spam. The nerve of some people. Looks like they were added to the Spamhaus SBL as of 14