[SAtalk] False positive on FORGED_MUA_MOZILLA

2004-01-27 Thread Scott Lambert
The attached message sent through spamcop has tripped the FORGED_MUA_MOZILLA. Maybe it needs to be looked at? -- Scott Lambert KC5MLE System Administrator Attention Customers: Refer-A-Friend and receive one month of service for free! For further details, please visit

Re: [SAtalk] SA missed an 'invisible font'?

2004-01-22 Thread Scott Lambert
mething similar. The style rule just wasn't getting nearly all of them. rawbody INCH_NOPOINT_1 /\]*\bsize(=3d|=)0/i describe INCH_NOPOINT_1 INCH CUSTOM RULE -- 0pt font size tag -- Scott LambertKC5MLE Unix

Re: [SAtalk] trusted_networks being ignored at times?

2004-01-21 Thread Scott Lambert
ist server's IP (Server B)? That way you avoid the hop through Server A. -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] --- The SF.Net email is sponsored by EclipseCon 2004 Pre

Re: [SAtalk] Turning off Habeas?

2004-01-20 Thread Scott Lambert
S and %#&&$^ come out to play. Sometimes I'm wrong but I don't get ulcers worrying about it. Bikeshed -- See : http://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/misc.html#BIKESHED-PAINTING -- Scott LambertKC5MLE Unix SysAdmin [EMAI

Re: [SAtalk] /etc/mail/spamassassin/local.cf is ignored

2004-01-20 Thread Scott Lambert
t directly rather than making a spamc call which causes a fork in spamd to filter the message. I have never used amavisd so I probably don't know what I'm talking about. -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] -

Re: [SAtalk] Turning off Habeas?

2004-01-20 Thread Scott Lambert
TOR is good for +16. A lot of people on this list need to calm down and stop over-reacting. I seem to remember something about babies and bathwater. -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED]

Re: [SAtalk] Missing Spam Headers? Why?

2004-01-19 Thread Scott Lambert
On Mon, Jan 19, 2004 at 10:18:58PM -0500, Larry Gilson wrote: > > -Original Message- > > From: [EMAIL PROTECTED] > > On Behalf Of Scott Lambert > > Sent: Monday, January 19, 2004 7:32 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [SAtalk] Miss

Re: [SAtalk] Missing Spam Headers? Why?

2004-01-19 Thread Scott Lambert
scanning time, among other things. If you are not exceeding the 30 second timeout with spamd, you may not have enough spamd processess allowed to handle the simultaneous spamc requests. -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] ---

Re: [SAtalk] Can you use a matched element in one rule against another match in a second rule?

2004-01-14 Thread Scott Lambert
On Wed, Jan 14, 2004 at 06:10:56PM -0500, Matt Kettler wrote: > At 05:46 PM 1/14/2004, Scott Lambert wrote: > >I would like to be able to match the forged HELO then use it in a > >variable for the two X-AntiAbuse lines. Possible? > > meta rules allow you to do boolean and or

[SAtalk] Can you use a matched element in one rule against another match in a second rule?

2004-01-14 Thread Scott Lambert
legit. I would like to be able to match the forged HELO then use it in a variable for the two X-AntiAbuse lines. Possible? -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] --- This

[SAtalk] Obscured web site address using javascript

2004-01-11 Thread Scott Lambert
/SpamAssassin/javascript_address_spam.zip This is the page mozilla took me to when the mbox was uncompressed or gzipped. That's why I zip'ed it instead. Sorry for the hassle. http://oceantricks.com/?affiliate_id=231902&campaign_id=401 Advertising Generic V. and Cal(whatever that

Re: [SAtalk] running SA on existing mail spools

2003-12-30 Thread Scott Lambert
checking | formail -s spamc -u ${SPLFILE} >> ${SPLFILE}; #UNLOCK the ${SPLFILE}; #RM or BACKUP or IGNORE ${SPLFILE}.checking; done; Or something like that. Error checking is left as an excersize for the reader. Additional pipelining could seperate into ${SPLFILE}.(spam|ham)

Re: [SAtalk] bayes.lock getting killed on a LONG sa-learn run

2003-12-29 Thread Scott Lambert
On Mon, Dec 29, 2003 at 12:20:33PM -0500, Kris Deugau wrote: > IMHO, kernel-level file locks are far cleaner, but I don't know whether > you can even do that cleanly with files accessed through DB_File. :/ Kernel locks don't work so well with NFS shared directories. -

Re: [SAtalk] Re: Having trouble coding a local rule

2003-12-28 Thread Scott Lambert
> Preferably not as if someone does forge it, then the mail goes straight > through... Isn't that what whitelist_from_rcvd is for? man Mail::SpamAssassin::Conf -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] ---

Re: [SAtalk] odd problem with spamassassin missing messages...

2003-12-28 Thread Scott Lambert
bayes lock file to be left laying around which added a 10 second timeout to every message. I twigged to that when my 1.6GHz Athlon started averaging 10 seconds per message. None of my 4 day job spamd servers have had sig 6 issues with identical software configurations, and a lot more e-mail. --

Re: [SAtalk] Fwd: Rude Rape actions

2003-12-28 Thread Scott Lambert
t as spam. Make sure you use the RBL checks and the DCC and RAZOR2. Last, but not least, upgrade to SA 2.61 to improve your chances of catching a lot of the newer flavors of spam. -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] -

Re: [SAtalk] The first spam to make it through since Friday...

2003-12-24 Thread Scott Lambert
area, 1 to 5 times in the body text area, 1 to 3 times > in the link text area, 1 to 4 times in the alt text area, and 1 to 5 in > the header text area. > > TrafficPost Newsletter 2003 All Rights Reserved. > > > > > To unsubscribe from the Traffic Post Newsletter HR

Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!

2003-12-04 Thread Scott Lambert
main. I have a three box cluster of Akamai boxes in my rack. Makes the frequent MS Software Updates for remote exploits come in a lot faster, even though I have an extra 100Mbps or so laying around unused. -- Scott LambertKC5MLE

Re: [SAtalk] rule help please

2003-11-20 Thread Scott Lambert
On Thu, Nov 20, 2003 at 12:42:25PM -0800, ian douglas wrote: > My rule definition: > > rawbody W98_UNSUBSCRIBE4 /prefer not to(?: ) see/i > rawbody W98_UNSUBSCRIBE4 /prefer not to ?see/i -- Scott LambertKC5MLE Unix SysAdmin [EMA

Re: [SAtalk] Hanging problems . . .

2003-10-17 Thread Scott Lambert
err log below. > Any clues??? I'm going to bet you are swapping to death. If using spamd/spamc, check out spamd's -m option. Better to let a couple through unscanned than to take the machine down. -- Scott Lambert [EMAIL PROTECTED]

Re: [SAtalk] Not recognizing /etc/mail/spamassassin/local.cf?

2003-09-15 Thread Scott Lambert
e. > Are the perl DBD libraries installed? Can you use mysql from the command line? -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] --- This sf.net email is spon

Re: [SAtalk] SA 2.60 was hit-and-miss for me

2003-09-12 Thread Scott Lambert
On Fri, Sep 12, 2003 at 09:39:18PM +0200, Chr. von Stuckrad wrote: > So may be something like this hit us too... > > On Fri, Sep 12, 2003 at 02:57:14PM -0400, Scott Lambert wrote: > > If spamc can't connect to spamd, (all slots full on the spamd server), > > it just

Re: [SAtalk] SA 2.60 was hit-and-miss for me

2003-09-12 Thread Scott Lambert
server), it just passes the message through. If spamd dies while running under something like DJB's daemontools, one to several messages could get through while the spamd daemon is being restarted. You probably need more spamd hardware/time slots. -- Scott LambertKC

Re: [SAtalk] spamd vs spamassassin from .forward files

2003-09-11 Thread Scott Lambert
On Wed, Sep 10, 2003 at 04:03:02PM -0700, John Schneider wrote: > Please forgive me if this is already answered in the list archives. But, if > it is, I didn't find it: cd ${WHEREYOUUNPACKEDTHESOURCE}; find . -name 'README*' -print; cat ${FILETHATLOOKSRELEVANT

Re: [SAtalk] user_prefs file - local rules not being used

2003-08-14 Thread Scott Lambert
in --lint" to make sure you don't have errors in your user_prefs? -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] --- This SF.Net email sponsored by: Free pre-built ASP.NET sites

Re: [SAtalk] perfmance and machine sizing

2002-10-31 Thread Scott Lambert
Linux so you can offload the spamassassin checks. You can do that for cheap. -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] --- This sf.net email is sponsored by: Influence the future of Java(

Re: [SAtalk] Building A SpamAssassin Box, how much horsepower?

2002-10-25 Thread Scott Lambert
On Fri, Oct 25, 2002 at 11:48:18AM -0400, Andrew wrote: > Scott Lambert <[EMAIL PROTECTED]> wrote: > > > I have a similar number of accounts on my mail server. I have a P4 1.5GHz > > 1G RAM Dell workstation running spamd. The box coasts most of the day and > >

Re: [SAtalk] Building A SpamAssassin Box, how much horsepower?

2002-10-24 Thread Scott Lambert
now if that information is helpful to your situation. -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] --- This sf.net email is sponsored by: Influence the future of Java(TM) technology. Join t

Re: [SAtalk] Generating Statistics

2002-10-23 Thread Scott Lambert
bert/SpamAssassin/ if anyone wants to look. -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] --- This sf.net email is sponsored by: Influence the future of Java(TM) technology. Join the Ja

Re: [SAtalk] spamd uses a lot of CPU

2002-10-23 Thread Scott Lambert
se but, until then, it is not a major burden to us to add the entries for the users who need/want special settings. -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED] --- This sf.net email is

Re: [SAtalk] spamd uses a lot of CPU

2002-10-23 Thread Scott Lambert
had 20257 non-spam messages and 24260 spam messages. 54.496% spam messages. Here is a typical weekend report: SpamAssassin statistics for 2002/10/20: Time spent processing all messages: 32233 Total messages processed: 28454 Average processing time per message: 1.13281 A

Re: [SAtalk] spamd uses a lot of CPU

2002-10-22 Thread Scott Lambert
ly for my ISP in that configuration. We haven't seen any appreciable load increase on the mail servers since beginning use of SpamAssassin site wide. -- Scott LambertKC5MLE Unix SysAdmin [EMAIL PROTECTED]

Re: [SAtalk] Spamassassin (non-time-based) Graphs?

2002-10-14 Thread Scott Lambert
13-15 | *** 15-17 | * 17-19 | * 19-21 | ** 20-50 | ** something like that? Easy to do with a quick perl or awk script. Send it to your self as e-mail or embed it in a web page as PRE section. -- Scott LambertKC

Re: [SAtalk] Re: Spamd 2.42 Problems

2002-10-10 Thread Scott Lambert
n't seem to be getting the DJB magic incantations right for running spamd under daemontools. Would someone care to tell me how it should be configured? My users love SpamAssassin. They kill me when it's down for 10 minutes. Thanks! -- Scott LambertKC5MLE