Re: [SAtalk] FVGT file problem, aslo 2.61 problem

On Wed, Jan 07, 2004 at 04:07:40PM -0800, Russell Mann wrote: > Jan 7 15:38:38 judah spamd[28532]: razor2 check skipped: Bad file > descriptor Insecure dependency in connect while running with -T switch at > /usr/local/lib/perl5/5.6.1/i686-linux/IO/Socket.pm line 108. > > I've downgraded back to

Re: [SAtalk] FVGT file problem, aslo 2.61 problem

At 04:07 PM 1/7/04 -0800, Russell Mann wrote: Jan 7 15:55:05 judah spamd[543]: Failed to run FVGT_rtbl_CBL SpamAssassin test, skipping: ^I(Can't locate object method "check_rbl_txt" via package "Mail::SpamAssassin::PerMsgStatus" (perhaps you forgot to load "Mail::SpamAssassin::PerMsgStatus"?) at /

Re: [SAtalk] AWL scoring spam as ham?? WTH??

Did it change the spam message over the 5.0 threshold? or did it just reduce the score of some insanely high scoring spam by 4.5? Read the very fine FAQ on this matter... http://wiki.spamassassin.org/w/AwlWrongWay It explains what the AWL REALLY is, which is not what you might think it is. At

Re[2]: [SAtalk] Any rule to catch this spam?

Hello Kenneth, Wednesday, January 7, 2004, 10:02:44 AM, you wrote: KP> --On Wednesday, January 07, 2004 11:38 AM -0600 [EMAIL PROTECTED] wrote: >> Attached is a spam that seems to sneak by us all of the time. Anyone >> know of a good rule to catch this? KP> X-Spam-Status: No, hits=5.9 required=

Re: [SAtalk] Silly spam

http://www.emtinc.net/spamhammers.htm i'll probably have an update to the chickenpox set by the end of the week. and i see someone already pointed you to chris' site. There is also the wiki, i believe there is a link from rulesemporium. jennifer > On Wed, 7 Jan 2004, Kurt Buff wrote: > >> Seve

[SAtalk] AWL scoring spam as ham?? WTH??

In recent efforts to stop the flow of spam that's somehow getting through my best attempts at blocking it, I've been studying the spam that does get caught and have found something dreadfully scary. On several messages that are obviously blatent spam, I've been seeing things like this: -4.5 A

Re: [SAtalk] Silly spam

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wednesday 07 January 2004 16:08, ian sison (mailing list) wrote: > Hi, i'm a newbie to the list, is there are URL which has the rules > for the above custom rules you mentioned above? > Here is link to some of the stuff. http://www.merchantsovers

RE: [SAtalk] spam/ham corpus in outlook

[EMAIL PROTECTED] wrote: > > I've been developing a spam / ham corpus from those things > which my config of SA doesn't catch. Problem is I get these > in Outlook, and now I want to Bayes them. How do you guys get > your spam corpus set up? Do you just not use Outlook? Is > there a way to get t

[SAtalk] Anyone working on an eval to count unique words?

Looking at some of the samples of "hash buster" and "bayes poisoning" spam that have been posted, it would seem to me the they go out of their way to create a large number of unique words, either gobbledygook or random word lists. SA should be able count the number of unique "words" and repeated w

Re: [SAtalk] Silly spam

On Wed, 7 Jan 2004, Kurt Buff wrote: > Several instances of the attached message got through, and I'm wondering > what might catch this - we're running v2.60, with popcorn, backhair, weeds, > smallpox, nov2rules and bigevil, plus a couple of minor custom rules. Hi, i'm a newbie to the list, is th

[SAtalk] FVGT file problem, aslo 2.61 problem

Hello, I just started putting some of the public rule sets into practice, and it looks like the 90_FVGT.cf file has a rule that doesn't work for me. Jan 7 15:55:05 judah spamd[543]: Failed to run FVGT_rtbl_CBL SpamAssassin test, skipping: ^I(Can't locate object method "check_rbl_txt" via package

[SAtalk] Silly spam

Several instances of the attached message got through, and I'm wondering what might catch this - we're running v2.60, with popcorn, backhair, weeds, smallpox, nov2rules and bigevil, plus a couple of minor custom rules. Kurt Buff Sr. Network Administrator Zetron, Inc. 425.820.6363 x463 [EMAIL PROTE

[SAtalk] spam/ham corpus in outlook

Hello, I've been developing a spam / ham corpus from those things which my config of SA doesn't catch. Problem is I get these in Outlook, and now I want to Bayes them. How do you guys get your spam corpus set up? Do you just not use Outlook? Is there a way to get these exported so that SA Baye

Re: [SAtalk] Just got a piece of spam through.. had 0pt font size?

At 05:47 PM 1/7/2004, Billy Huddleston wrote: lowland clangula anastatica precincts . neon revisal lampshade avocado tuba anhima interdum wrack as you can see.. it's using a 0pt font-size to hide the bayes poison, please note, I this was just a small sample of the poison.. any rules that'll catch

[SAtalk] Just got a piece of spam through.. had 0pt font size?

lowland clangula anastatica precincts . neon revisal lampshade avocado tuba anhima interdum wrack as you can see.. it's using a 0pt font-size to hide the bayes poison, please note, I this was just a small sample of the poison.. any rules that'll catch the 0pt font size? Thanks, Billy

Re: [SAtalk] text/html spam auto learning as ham

At 05:29 PM 1/7/2004, Fred Inklaar wrote: Seems to me that we need yet another test, one that compares the MIME text/plain content with the text/html content, and rings the alarm bell when they have nothing in common. It's invalid to assume that the two need to be related. Just because SOME mailc

RE: [SAtalk] Finding a rule to catch a particular spam

Pyzor and BigEvil nailed both of them. The second one hit a whole ton of RBLs also. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Geoff Soper > Sent: Wednesday, January 07, 2004 4:18 PM > To: Chris Santerre > Cc: [EMAIL PROTECTED] > Subject: *

RE: [SAtalk] Finding a rule to catch a particular spam

Here they are, I hope they've extracted OK. So does anybody have a way of catching them? Thanks, Geoff > Yes you may post the spam. Is it the white image with a doctor standing > there looking like G.W.Bush contemplating his exhistence? The one selling > 6 > kinds of Mr. Wiggly enhancing drugs? >

RE: [SAtalk] Email Not Caught

I did notice the misspellings in the email but shouldn't it have scored it with *something*? It gave it a score of 0.0. That just seems very odd. Isn't there a rule for Base64 encoded emails? --Mike -Original Message- From: Jennifer Wheeler [mailto:[EMAIL PROTECTED] Sent: Wednesday, Janu

Re: [SAtalk] Email Not Caught

- Original Message - From: "Andy Donovan" <[EMAIL PROTECTED]> > I'll need to be enlightened on what BIGEVIL > is .. is it really that simple .. drop the file into > your SA folder?? or am I confussed ? Drop it into the directory where your local.cf file lives (typically /etc/mail/spamas

Re: [SAtalk] 1/2 OT - SA up2date debian package

On Wednesday, January 07, 2004 8:20 PM [GMT+1=CET], Marcio Merlone <[EMAIL PROTECTED]> wrote: > On Wed, 7 Jan 2004 19:00:53 + > Dougie Nisbet <[EMAIL PROTECTED]> (DN) wrote: > >>> Sorry for this ot, but does anybody know where can I get an up to >>> date debian package of SA? I have only SA 2.

Re: [SAtalk] Email Not Caught

I'll need to be enlightened on what BIGEVIL is .. is it really that simple .. drop the file into your SA folder ?? or am I confussed ? --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Manage

Re: [SAtalk] RCVD_IN_DYNABLOCK,RCVD_IN_SORBS in 2.61 when sending myself a test message?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 "Mitch (WebCob)" writes: >Sorry for the duplicate if this did make it through the first time - I >didn't see my echo, or any feedback, so I thought I'd send again. > >I'm playing with a way to skip spamc altogether for local users (the third >case bel

Re: [SAtalk] 1/2 OT - SA up2date debian package

2.61 rolls fine under woody in a production environment. We've been backporting SA .debs from backports.org and/or rolling our own backported builds from Debian unstable/testing sources for our SA upgrades for a bit now. No problems. -jr * Mike Schrauder <[EMAIL PROTECTED]> [200

RE: [SAtalk] RCVD_IN_DYNABLOCK,RCVD_IN_SORBS in 2.61 when sending myself a test message?

Sorry for the duplicate if this did make it through the first time - I didn't see my echo, or any feedback, so I thought I'd send again. I'm playing with a way to skip spamc altogether for local users (the third case below) - not sure if that is the best way though as it certainly involves a littl

Re: [SAtalk] Sneaky spam

At 02:45 PM 1/7/2004, Rubin Bennett wrote: another one... only scored 0.9 on my sitewide SA, and 2.5 on my personal with Bayes. On my 2.61 it managed to hit DCC and SORBS, so if you've got the bandwidth/time for net checks, you might want to give DCC a shot. I'm also using some of the FVGT rules,

RE: [SAtalk] Amavisd, mailscanner, or straight to SA

Lol. I know the feeling. I ended up going straight to SA because at the time amavis seemed superfluous. --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced bra

RE: [SAtalk] Re: SPF Support in SA?

I suppose that would work. The job site isn't an MTA in the middle of a pipeline, it's originating the message. It's just sending it on behalf of one of its customers. Is that still considered a "forward"? I imagine job sites do this to make sure all bounces and replies go to the customer so th

Re: [SAtalk] Sneaky spam

Rubin Bennett wrote: another one... only scored 0.9 on my sitewide SA, and 2.5 on my personal with Bayes. Is this address in BigEvil? Dunno, I didn't think BigEvil had IPs in it http://211.158.7.146/ebooks/";>More Info Here Can we just add 211.0.0.0/8 into BigEvil? Run "host" against whatever d

Re: [SAtalk] problems with spamd after updating spamassassin from 2.53 to 2.61

On Wed, Jan 07, 2004 at 11:42:56AM -0600, Dale wrote: > I am getting an error when trying to start spamd > Undefined subroutine &Mail::SpamAssassin::Util::untaint_var called at > /usr/local/bin/spamd line 95. > this started after I updated SpamAssassin from 2.53 to 2.61 can someone > help? My init

RE: [SAtalk] Sneaky spam

It will be in the next update ;) Thanks --Chris > -Original Message- > From: Rubin Bennett [mailto:[EMAIL PROTECTED] > Sent: Wednesday, January 07, 2004 2:46 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Sneaky spam > > > another one... > only scored 0.9 on my sitewide SA, and 2.5 on m

Re: [SAtalk] Update on SQL-ization of AWL, Bayes, etc.?

On Wed, Jan 07, 2004 at 01:26:20PM -0600, Cal Evans wrote: > Is it currently in the CVS version? Are there reasonable docs? > (Reasonable to a sys-admin, I don't yet need the dummies guide.) :) > It currently only exists in my development tree, it's not in CVS or SVN. If you want a not quite re

[SAtalk] Sneaky spam

another one... only scored 0.9 on my sitewide SA, and 2.5 on my personal with Bayes. Is this address in BigEvil? Rubin -- Rubin Bennett <[EMAIL PROTECTED]> RB Technologies From [EMAIL PROTECTED] Wed Jan 7 14:28:37 2004 Return-Path: <[EMAIL PROTECTED]> X-Original-To: [EMAIL PROTECTED] Delivered-

RE: [SAtalk] Re: SPF Support in SA?

In my experience the FORGED_*_RCVD rules do not always work well. At least, they don't play well with some job search sites. I'm looking at an example right now of a message with a MAIL FROM of [EMAIL PROTECTED] (I'm assuming that's what you mean by "envelop from"). The "From header from" is th

Re: [SAtalk] Update on SQL-ization of AWL, Bayes, etc.?

Is it currently in the CVS version? Are there reasonable docs? (Reasonable to a sys-admin, I don't yet need the dummies guide.) :) Let me know how I may be of service, =C= * Cal Evans * http://www.eicc.com * We take care of your IT, * So you can take care of your business. * * I think inside the

RE: [SAtalk] Any rule to catch this spam?

> > Mike, If you look at Rich's X-spam status header, he's already using > bigevil and netchecks, but at the time the message ran, the I'll make sure I look a little more closely next time. I just copied the message and ran it through to see what I came up with out of habit when I see these ty

Re: [SAtalk] 1/2 OT - SA up2date debian package

On Wed, 7 Jan 2004 19:00:53 + Dougie Nisbet <[EMAIL PROTECTED]> (DN) wrote: DN> > Sorry for this ot, but does anybody know where can I get an up to DN> > date debian package of SA? I have only SA 2.2 available on DN> > apt-get... (...) DN> Are you running woody? (stable). Being able to keep fa

[SAtalk] Re: Making bigevil faster by finding common prefixes

On Wed, 7 Jan 2004 11:03:35 -0500, Chris Santerre <[EMAIL PROTECTED]> writes: > > Are you having trouble doing the conversion automatically? > > Yup ;) > > > I can > > describe the algorithm to transform the regexps and to find > > maximum-size prefixes if you (or someone else) wants to > > imp

Re: [SAtalk] Update on SQL-ization of AWL, Bayes, etc.?

On Wed, Jan 07, 2004 at 01:07:36PM -0600, Cal Evans wrote: > Can you give us an idea of what version of SA this will be available in? > I'd love to see it in 2.70 but that's up to the devs. I think it might take some soak time, at least for the bayes changes, just due to the re-implementation of

RE: [SAtalk] 1/2 OT - SA up2date debian package

> -Original Message- > From: Marcio Merlone [mailto:[EMAIL PROTECTED] > Sent: Wednesday, January 07, 2004 1:12 PM > To: SA List > Subject: [SAtalk] 1/2 OT - SA up2date debian package > > > Hello all, > > Sorry for this ot, but does anybody know where can I get an up to date > debian pack

Re: [SAtalk] Update on SQL-ization of AWL, Bayes, etc.?

Can you give us an idea of what version of SA this will be available in? Let me know how I may be of service, =C= * Cal Evans * http://www.eicc.com * We take care of your IT, * So you can take care of your business. * * I think inside the sphere. Michael Parker wrote: On Tue, Jan 06, 2004 at 02:05

Re: [SAtalk] 1/2 OT - SA up2date debian package

On Wednesday 07 January 2004 6:12 pm, Marcio Merlone wrote: > Hello all, > > Sorry for this ot, but does anybody know where can I get an up to date > debian package of SA? I have only SA 2.2 available on apt-get... > > Thanks. > > -- > -- >Marcio Merlone Are you running woody? (stable). Being

Re: [SAtalk] Re: SPF Support in SA?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Philip Tucker writes: > I have a couple questions about SPF and its usage in SpamAssassin. > > 1) Would SPF obselete the FORGED_*_RCVD rules? Not just yet, anyway. They work quite well for the most part ;) > 2) How does SPF deal with senders who a

RE: [SAtalk] Any rule to catch this spam?

> Get BigEvil at > http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm > There are 2 other rulesets there that had rules that hit on this mail that came from Chris Santerre's page. http://www.merchantsoverseas.com/wwwroot/gorilla/90_FVGT.cf http://www.merchantsoverseas.com/wwwroot/gori

[SAtalk] 1/2 OT - SA up2date debian package

Hello all, Sorry for this ot, but does anybody know where can I get an up to date debian package of SA? I have only SA 2.2 available on apt-get... Thanks. -- -- Marcio Merlone [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] ICQ UIN #13746928 - Linux user #104911 ---

RE: [SAtalk] Any rule to catch this spam?

At 12:52 PM 1/7/2004, Mike Kuentz (2) wrote: Net tests and the BigEvil will do the trick. 3.0 BigEvilList_191 URI: Generated BigEvilList_191 1.1 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org [] 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received v

Re: [SAtalk] Email Not Caught

At 12:21 PM 1/7/2004, Mike Carlson wrote: I have a message that is not getting caught by the spam filter. In fact it scores 0.0 if I look at the header. Why would the attached message not get caught by the spam filters? It gets caught on mine... If I look at the message source in Outlook Expres

Re: [SAtalk] Any rule to catch this spam?

--On Wednesday, January 07, 2004 11:38 AM -0600 [EMAIL PROTECTED] wrote: > Attached is a spam that seems to sneak by us all of the time. Anyone > know of a good rule to catch this? X-Spam-Status: No, hits=5.9 required=6.0 tests=BAYES_50,BigEvilList_191, HTML_MESSAGE,NORMAL_HTTP_TO_IP,RCVD

RE: [SAtalk] Any rule to catch this spam?

Net tests and the BigEvil will do the trick. 3.0 BigEvilList_191 URI: Generated BigEvilList_191 1.1 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org [] 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blo

[SAtalk] Blocking Gibberish Spam

Hi All, SpamAssassin has been blocking spam like a charm until few weeks ago when I started to get hit by the new wave of gibberish spam. I upgraded to SA 2.61 in hope that there are new rules to detect these hashbusters, but it didn't seem to help. Any suggestion on what I can do next to remedy t

RE: [SAtalk] Any rule to catch this spam?

Sorry forgot to mention that we are using 2.61 Richard Humphrey System Administrator MultiCam LP 972-929-4070 X2408 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, January 07, 2004 11:38 AM To: Spamassassin-List Subject

RE: [SAtalk] Re: SPF Support in SA?

--On Wednesday, January 07, 2004 11:04 AM -0600 Philip Tucker <[EMAIL PROTECTED]> wrote: > How would SPF address this kind of message? It's my understanding that a > DNS query would be sent to yahoo.com, which would respond with its outgoing > SMTP IP addresses - not containing HotJobs' IP - and

RE: [SAtalk] Email Not Caught

I am running 2.61. Are these rules not enabled or something? I cannot figure out why they are not getting caught.   --Mike   From: SethSent: Wed 1/7/2004 11:32 AMTo: Mike CarlsonCc: [EMAIL PROTECTED]Subject: Re: [SAtalk] Email Not Caught These are the rules that it flagged on my 2.60 installa

[SAtalk] problems with spamd after updating spamassassin from 2.53 to 2.61

I am getting an error when trying to start spamd Undefined subroutine &Mail::SpamAssassin::Util::untaint_var called at /usr/local/bin/spamd line 95. this started after I updated SpamAssassin from 2.53 to 2.61 can someone help? Thanks.

Re: [SAtalk] Email Not Caught

These are the rules that it flagged on my 2.60 installation: HTML_MESSAGE MIME_BASE64_LATIN MIME_BASE64_TEXT Seth On Wed, 2004-01-07 at 10:21, Mike Carlson wrote: > I have a message that is not getting caught by the spam filter. In > fact it scores 0.0 if I look at the header. Why would the atta

RE: [SAtalk] Weightloss spam

I have had this rule for a while because of all of the weight loss spam we have been getting: body CS_LOSE_WEIGHT /los[et] the weight/i describe CS_LOSE_WEIGHT Add for losing weight score CS_LOSE_WEIGHT3 This is how SA scored the message below: X-Spam-Status: No,

[SAtalk] Any rule to catch this spam?

Attached is a spam that seems to sneak by us all of the time. Anyone know of a good rule to catch this? Richard Humphrey System Administrator MultiCam LP 972-929-4070 X2408 Some addresses changed to protect the innocent :-) Return-Path: <[EMAIL PROTECTED]> Received: from myparentime.com ([213

Re: [SAtalk] Continuing saga of runaway spamd

I just added a gig of swap and all my probs went away. [EMAIL PROTECTED] wrote: This is a followup to my previous mail about a problem we are seeing at $DAYJOB and it is getting serious. After we upgraded to SA 2.61 as was suggested by this list we had a mail-machine crash again when spamd expan

[SAtalk] Email Not Caught

I have a message that is not getting caught by the spam filter. In fact it scores 0.0 if I look at the header. Why would the attached message not get caught by the spam filters?   If I look at the message source in Outlook Express is says it is Base64 Encoded. Could that be the problem? Is the

RE: [SAtalk] Re: SPF Support in SA?

I have a couple questions about SPF and its usage in SpamAssassin. 1) Would SPF obselete the FORGED_*_RCVD rules? 2) How does SPF deal with senders who are not forwarding a message, but are sending on behalf of a user? We have seen the latter case often with resume sites. e.g., [EMAIL PROTECTED

RE: [SAtalk] Finding a rule to catch a particular spam

Yes, and the other is the one with the 'America Society of the Treatment of Aging' graphic. What's the best way for me to extract them intact from Outlook Express (I don't think I can extract a raw mail from SquirrelMail) Thanks, Geoff > Yes you may post the spam. Is it the white image with a doc

Re: [SAtalk] Forwarding spam to a mailbox

At 11:22 AM 1/7/2004, Kevin Roberts wrote: I am using spam-assassin 2.55 and I was wondering if anyone knows how sa will look at a fowarded message to a mailbox, then I have sa to train from that mailbox? read the bayesfaq on the SA website http://wiki.spamassassin.org/w/BayesFaq In particular: h

Re: [SAtalk] Weightloss spam

Chris Santerre wrote: I gained 12 lbs over the holidays and time off from hockey. I plan to lose the weight off again. But lots of people talk about losing weight. Some of these phrases would be in legit casual emails. --Chris (So far: no goals, no assists, plenty of penalties.) Santerre Wow,

RE: [SAtalk] Weightloss spam

At 11:32 AM 1/7/2004, Chris Santerre wrote: I gained 12 lbs over the holidays and time off from hockey. I plan to lose the weight off again. But lots of people talk about losing weight. Some of these phrases would be in legit casual emails. --Chris (So far: no goals, no assists, plenty of penaltie

Re: [SAtalk] Continuing saga of runaway spamd

Rumor has it that Eric W. Bates may have mentioned these words: We experienced a similar problem on FreeBSD. The problem was addressed when we upgraded perl from 5.5 to 5.8. As a workaround until we managed to upgrade we launched spamd under the control of Dan Bernstein's Daemontools which can

RE: [SAtalk] Finding a rule to catch a particular spam

Yes you may post the spam. Is it the white image with a doctor standing there looking like G.W.Bush contemplating his exhistence? The one selling 6 kinds of Mr. Wiggly enhancing drugs? If so..I'm working on it :) --Chris > -Original Message- > From: Geoff Soper [mailto:[EMAIL PROTEC

RE: [SAtalk] Where's all my spam at?

At 11:14 AM 1/7/2004, Gary Smith wrote: About two months ago I got garbage on the bottom of my emails that I sent to this list. Also, you might notice that there is no sf footer on it. Not sure why but I think that the sf list server is having a couple problems. Anybody else having the same p

RE: [SAtalk] Weightloss spam

I gained 12 lbs over the holidays and time off from hockey. I plan to lose the weight off again. But lots of people talk about losing weight. Some of these phrases would be in legit casual emails. --Chris (So far: no goals, no assists, plenty of penalties.) Santerre > -Original Message-

[SAtalk] Finding a rule to catch a particular spam

I'm getting two spams quite frequently and wondered how I can find a rule to catch them (assuming one already exists)? There's no obvious phrase I can catch them on, they are HTML with a single image and are getting low scores. Do I post an example of them here? If so then how do I extract them cor

[SAtalk] Forwarding spam to a mailbox

Hello all, I am using spam-assassin 2.55 and I was wondering if anyone knows how sa will look at a fowarded message to a mailbox, then I have sa to train from that mailbox? Scenario: I receive a spam message that made it through sa 2.55 default settings and I forward the message to the mailbox th

RE: [SAtalk] Where's all my spam at?

About two months ago I got garbage on the bottom of my emails that I sent to this list. Also, you might notice that there is no sf footer on it. Not sure why but I think that the sf list server is having a couple problems. Anybody else having the same problem? It only happens when I post to

[SAtalk] procmail recipe cancels spamassassin routing

I'd appreciate help debugging the following procmailrc. I'm using SpamAssassin 2.54 (1.174.2.17-2003-05-11-exp) on FreeBSD. == ## BEGIN PROCMAILRC ## TMPLOGFILE=$LOGFILE TMPLOGABSTRACT=$LOGABSTRACT TMPVERBOSE=$VERBOSE DROPPRIVS=yes LOGFILE=/dev/null LOGABSTRACT=yes VERBOSE=no :0fw |/usr/

RE: [SAtalk] A cron job to delete old spam?

We are using archmbox: http://adc-archmbox.sourceforge.net > -Original Message- > From: Kris Deugau [mailto:[EMAIL PROTECTED] > Sent: Friday, January 02, 2004 5:10 PM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] A cron job to delete old spam? > > > Liu Shuai wrote: > > I want to set

[SAtalk] RE: Making bigevil faster by finding common prefixes

> -Original Message- > From: Scott A Crosby [mailto:[EMAIL PROTECTED] > Sent: Tuesday, January 06, 2004 7:01 PM > To: Chris Santerre > Cc: Spamassassin-Talk (E-mail) > Subject: Making bigevil faster by finding common prefixes > > > On Wed, 24 Dec 2003 10:59:50 -0500, Chris Santerre > <[E

Re: [SAtalk] Weightloss spam

At 09:46 AM 1/7/2004, Timothy Donahue wrote: I was thinking searching for the following phrases, each with a score of .5: lose the weight, struggling to lose, believe how simple, amazing patch, shed the pounds, guaranteed to work, your money back Sounds good. I'd also suggest that you look at the

[SAtalk] [Fwd: remember ORBL.ORG?]

From NANOG: If anyone has any legacy mailhubs sitting around that used to use it, better check it out. It was a harmless until yesterday, when the domain was snagged by Pool.com and parked with wildcard DNS. -mark -- Time to check the mail servers and make sure they're not hitting dead RLBs! :)

Re: [SAtalk] Continuing saga of runaway spamd

We experienced a similar problem on FreeBSD. The problem was addressed when we upgraded perl from 5.5 to 5.8. As a workaround until we managed to upgrade we launched spamd under the control of Dan Bernstein's Daemontools which can be configured to automatically impose limits and restart misbeh

Re: [SAtalk] Wrapper script to speed up sa-learn?

Dave Kliczbor wrote: > So this script does not meet my requirements (sorry, I did not fully > specify them in my first mail). > It should: > 1) read the message file > 2) go into the background > 3) call sa-learn > 4) clean up if necessary > > As soon as 2) is done, the original message file i

Re: [SAtalk] bayes expiry error

On Wed, Jan 07, 2004 at 09:09:32AM -0500, Adam Denenberg wrote: > i am getting the following bayes error when trying to do a > force-expire. Is there any way around this so i can expire my old > tokens? > > debug: bayes: expiry check keep size, 75% of max: 75 > debug: bayes: token count: 0,

Re: [SAtalk] Error when using spamd/spamc

yep ..but i fear my perl/cpan setup is a bit wierd ... ill try a clean install someday when i have the time ... /thomas On 7/1-2004, at 15.18, Eric W. Bates wrote: Are you running the latest version of Time::HiRes? Thomas von Hassel wrote: anyone have a hint on this one ? ...i would love to u

Re: [SAtalk] SA+Sendmail+MTA

Christian 'CBE' Benner wrote: > I use sendmail as a MTA with spamass-milter and amavis-milter > > All is workig very fine but I'll not only mark SPAM messages > via Subject tag but save it as a file to a directory. I don't know how configureable spamass-milter and amavis-milter are, but one of th

[SAtalk] Weightloss spam

Does anyone have any suggestions for rules to block the spam I have included below? I am running SA 2.60. I have included the source from the message body, and the SA score summary. I was thinking searching for the following phrases, each with a score of .5: lose the weight, struggling to lose,

Re[2]: [SAtalk] Those Re: Bunch of capital letters messages

Hello Kenneth, Tuesday, January 6, 2004, 7:29:04 AM, you wrote: KP> I'm using this set of rules posted to the list last month. Drop this in KP> /etc/mail/spamassassin as rnd_uc_char.cf. OVERALL% SPAM% HAM% S/ORANK SCORE NAME 8594570035159100.815 0.000.00 (al

Re: [SAtalk] Wrapper script to speed up sa-learn?

Ivar Snaaijer said: > I could be stating the obvious here but why not run it with & at the > end ? Because I run it in a slightly time-critical environment. As soon as the call returns from sa-learn, the message file is moved (from Maildir/tmp to Maildir/cur). > My guess is that on most systems p

RE: [SAtalk] Amavisd, mailscanner, or straight to SA

>-Original Message- >From: JC [mailto:[EMAIL PROTECTED] > > Reading through a few of the last threads from people asking about >how to implement SA, I noticed how often it's suggested that people Use >Amavis or mailscanner, or similar to act as a go-between for the mail server >and sp

[SAtalk] bayes expiry error

Hello, i am getting the following bayes error when trying to do a force-expire. Is there any way around this so i can expire my old tokens? debug: bayes: found bayes db version 2 synced Bayes databases from journal in 0 seconds: 569 unique entries (569 total entries) debug: bayes: expiry chec

[SAtalk] RE: Spell Checking the Subject Header (RESULTS)

> > This doesn't tell me much. How many spams and hams are in the > corpus? This would be a spectacular rule if the corpus is 23% > spam --- it would catch nearly every one. If on the other > hand, the corpus was 80% spam, this would be a bad rule --- > it would have caught nearly every ham. >

Re: [SAtalk] Any good reason why this would not be marked as spam?

At 02:30 PM 1/7/04 +0100, Thomas Nilsen wrote: As you can see from the header info, the message got 8, and we have the spam level set to 8.. Why would it not tag this email as spam? Read the fine FAQ... in short 7.95 rounds to 8.0 when reduced to 2 digits, but is less than 8.0. http://wiki.spa

Re[2]: [SAtalk] X-Mailer is totally bogus

Thanks Robert for your helpful way of vetting rules posted here. Anthony, note: On Tue, 6 Jan 2004, Robert Menschel <[EMAIL PROTECTED]> wrote: > header XMAILERBOGUS X-Mailer =~ /^[a-z][^A-Z0-9]*$/ > describe XMAILERBOGUS X-Mailer header has NO uppercase letters, NO numbers... How > do you

[SAtalk] Any good reason why this would not be marked as spam?

Title: Any good reason why this would not be marked as spam? As you can see from the header info, the message got 8, and we have the spam level set to 8.. Why would it not tag this email as spam? - Microsoft Mail Internet Headers Version 2.0 Received: from mail.roxar.com

RE: [SAtalk] Continuing saga of runaway spamd

Interesting to me mostly because spamc/spamd by default won't even look at a 1.2mb email. I'm interested in how/where that happened. -tom > -Original Message- > > After we upgraded to SA 2.61 as was suggested by this list we > had a mail-machine crash again when spamd expanded beyond

[SAtalk] spamassassin and qmail

HEllo dear all, On a test machine, (qmail+inetd) using qmail-queue substitution method ex: qmail-queue: #!/bin/sh /usr/bin/spamc | /var/qmail/bin/qmail-queue.orig all work fine, 99% spam detected! ...but when i try to setup another pc with qmail+tcpserver the substitution method not appear to

Re: [SAtalk] rules matching against entire body

On Sun, 2004-01-04 01:03:07, Jan-Pieter Cornet wrote: > Much to my surprise, I found out that the current (2.60) SpamAssassin > code doesn't allow matches against the entire body or against the entire > rawbody (unless you make it an eval test). The regex matching is done on > a line-by-line basis.

Re: [SAtalk] Continuing saga of runaway spamd

On Wednesday 07 January 2004 09:52, David B Funk wrote: Hi, I was seeing the same behaviour on a SuSE 8.2 machine just before christmas. Most Emails got scanned like they should, only every few hours there has been a spamd process hanging eating up more and more memory, untill it grew so big t

Re: [SAtalk] Continuing saga of runaway spamd

On Wed, 7 Jan 2004 [EMAIL PROTECTED] wrote: > This is a followup to my previous mail about a problem we are seeing at > $DAYJOB and it is getting serious. > > After we upgraded to SA 2.61 as was suggested by this list we had a > mail-machine crash again when spamd expanded beyond all available > m

[SAtalk] Re: Spell Checking the Subject Header (RESULTS)

On Tue, 6 Jan 2004 20:34:13 -0800, Robert Menschel <[EMAIL PROTECTED]> writes: > I have just updated my masscheck script, so future reports should look > more like: > > score RM_u_UnsubscribePHP3.000 # Dec 2003; 218s/0h of 81383 corpus > > (65609s/15774h) Thanks! Scott --

[SAtalk] spam archiving

In case anyone's interested in routines to auto-archive spam, I improved the Procmail recipes I recently pointed to, so that archiving is done in the more appropriate FIFO fashion. I made a few other changes too. ftp://ftp.wecs.com/procmail/archcron-fifo.zip Bryan -- Were I to wish for anything

RE: [SAtalk] Continuing saga of runaway spamd

> but was the advocate for adding spamassassin, so this matters to me :-) > > I did suggest yesterday disabling bayesian and auto learning, but I > could not see any evidence of a spamassassin bayes database anywhere. > We are running spamd from exim, if that has any import, and all > running on