Re: [SAtalk] Razor server timeout problems ?

2004-01-28 Thread Simon Byrnand
At 04:33 29/01/2004, Matt Kettler wrote: At 02:00 AM 1/28/2004, Simon Byrnand wrote: Has anyone else noticed frequent timeouts with Razor2 ? I disabled it Friday due to timeouts. Ah... Yes I just disabled it myself last night after about half an hour of debugging to make sure it wasn't a sof

[SAtalk] Razor server timeout problems ?

2004-01-28 Thread Simon Byrnand
Has anyone else noticed frequent timeouts with Razor2 ? I'm seeing timeouts nearly all the time from most of the Razor servers causing spamd to take 10 seconds instead of the usual 1 second or so... (I've also noticed more spam than usual slipping through) Anyone know whats up ? Couldn't see anyt

Re: [SAtalk] Re: Having trouble coding a local rule

2003-12-29 Thread Simon Byrnand
At 10:44 29/12/2003 +1000, Peter Kiem wrote: > Just a guess ... because the "From" address is not > "[EMAIL PROTECTED]"? I thought the from rule worked on the envelope sender of the email and not the easily forged from header :( You mean on the easily forged envelope sender instead of the easily fo

Re: [SAtalk] Bayes_99 causing many false positives.

2003-12-28 Thread Simon Byrnand
At 15:11 28/12/2003 -0500, David A. Roth wrote: On Sunday, December 28, 2003, at 01:40 PM, Simon Byrnand wrote: I upgraded from 2.60 to 2.61 and I am getting many false positives. It seems that Bayes is pushing it with a score of 5.4. What are people to do to get around this? Do you set Bayes

Re: [SAtalk] False positives

2003-12-28 Thread Simon Byrnand
> To Spamassassin: Who is this 'SpamAsassin' you're writing to ? > My publication is double-opted in by 15,000 families with children with > autism. We are routinely victimized by incompetent software like > spamassassin because of false positives. Whoa, steady on there... not a good start to y

Re: [SAtalk] Bayes_99 causing many false positives.

2003-12-28 Thread Simon Byrnand
> I upgraded from 2.60 to 2.61 and I am getting many false positives. It > seems that Bayes is pushing it with a score of 5.4. What are people to > do to get around this? Do you set Bayes for a lower score? Do you > disable? Thanks! > > 5.4 BAYES_99 BODY: Bayesian spam probability is

[SAtalk] Scanning bounce message attachments ?

2003-12-21 Thread Simon Byrnand
Hi All, Recently our domain has been "joe jobbed" by some spammer, so our users are getting a lot of bounce messages with spam attachments. Unfortunately SpamAssassin is letting most of them through because the header tests won't match the headers from the attached spam message. Is there any w

Re: [SAtalk] Re: Virginia Busts Spammers

2003-12-12 Thread Simon Byrnand
> "Scott Williams , Area4" wrote: >> >> If you see two spammers hang hopefully a 100 will stop or atleast move >> off shore. > > I was just thinking, I know spam is a big problem, and all that, but > reading the article, I don't know. I hate to sound schizophrenic, but I > mean, surely these guy

Re: [SAtalk] /tmp/sa.*

2003-12-12 Thread Simon Byrnand
> I had a problem earlier where SA was hanging up incoming messages. the > spamd process would spawn but never finish till my box was 100% busy. > > apparently the problem had to do with an upgrade of 2.44 to 2.60. I > removed > the old whitelist and bayes files for all my users and spamd recreat

Re: [SAtalk] Re: DCC incidence

2003-12-10 Thread Simon Byrnand
> "Covington, Chris" wrote: >> >> On my site DCC hits approximately 20% of False Positives also (that is, >> of the 1-2% of false positives, 20% have Razor hits), so don't give it >> too much weight. Razor2 is the worse for that (50% of false >> positives)... but I've weighted my scoring according

Re: [SAtalk] Bayesian 100% on all my mail

2003-11-26 Thread Simon Byrnand
> On Tue, 25 Nov 2003, Robert Menschel wrote: > >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> Hello Aaron, >> >> Tuesday, November 25, 2003, 8:58:58 AM, you wrote: >> >> AY> ... Recently I started getting a lot of false positives with SA >> 2.60. >> AY> I noticed that all my mail was g

Re: [SAtalk] A faster and more scalable matching engine.

2003-11-25 Thread Simon Byrnand
> At 03:27 11/25/2003 -0600, Scott A Crosby wrote: > ... except one caveat: What was the memory utilization like? That's *my* > big problem with SA - I had to bump the RAM in my mailserver twice (256M > -> > 512M -> 1G) for SA alone, and it's still shakey to the point I cannot > deploy it sitewide

Re: [SAtalk] What level to delete at?

2003-11-24 Thread Simon Byrnand
At 16:58 24/11/2003 -0500, Matt Chapman wrote: Hello, I have been deleting at a score of 5 via Mimedefang. I notice that some spam is scoring at 3.5 and 4ish. Is is better to tag at say 3-4.9 and delete if it is any higher? What are some of the setups out there? What score do you delete at?

Re: [SAtalk] v0 Bayes expiry run (Was: sa-learn crash and coredump)

2003-11-24 Thread Simon Byrnand
At 14:49 24/11/2003 -0800, Ted Cabeen wrote: Simon Byrnand <[EMAIL PROTECTED]> writes: > I could be wrong, but I'd say that "bus error" means your system > either ran right out of memory (including virtual memory) during the > execution of sa-learn (and sa-learn us

Re: [SAtalk] sa-learn crash and coredump

2003-11-24 Thread Simon Byrnand
At 10:58 21/11/2003 -0800, Ted Cabeen wrote: I'm getting a crash and core-dump when I try to run sa-learn -D --force-expire on my sizeable bayes database. Here's the output I get, and the backtrace from the core file. debug: Score set 0 chosen. debug: running in taint mode? no debug: using "/usr/l

RE: [SAtalk] Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Simon Byrnand
>> >> I've read numerous antispam articles, and NONE have given SA justice. >> > > I think the main reason for the poor reporting of SA is mainly due to the > fact that every one of the reviews has been done by a company that has an > agenda. That agenda being, collecting advertising funding from c

RE: [SAtalk] Score

2003-11-23 Thread Simon Byrnand
At 23:01 23/11/2003 +, Alan Munday wrote: Thanks Simon I am using stars as I used the Advosys how-to as my starting point. I've started playing with the scripts and wondered if SA left any variables set e.g. hit value, that I could use rather than re-reading the file as I thought this would be

Re: [SAtalk] Score

2003-11-23 Thread Simon Byrnand
At 21:57 23/11/2003 +, Alan Munday wrote: Just had a mail in which had different *'s and score. I was expecting these to be the same as I egrep the file and count the stars in post processing. X-Spam-Level: X-Spam-Status: No, hits=5.0 required=5.0 tests=BAYES_20,HTML_30_40, HT

Re: [SAtalk] spamd not recognizing %d or %l

2003-11-22 Thread Simon Byrnand
> in the foreground of shell I run: > /usr/bin/spamd --username=popuser -D > --virtual-config-dir=/var/qmail/mailnames/%d/%l/configs/ -a > > > in my syslog files I see this: > Using default config for qmailq: > /var/qmail/mailnames///configs//user_prefs > > atleast I know why I can not get per use

Re: [SAtalk] Problem with Bayes

2003-11-20 Thread Simon Byrnand
At 14:29 20/11/2003 -0800, Chip Paswater wrote: I'm having some trouble with Bayes. Occasionally, mail will stop flowing in my system. This is because my procmail spamassassin.lock file becomes stale. I've futher discovered that it's because the bayes DB gets locked and somehow dies midway duri

Re: [SAtalk] Pyzor trouble

2003-11-19 Thread Simon Byrnand
At 01:38 20/11/2003 +0100, Mark wrote: Has anyone else problems with Pyzor? I am getting these, all throughout the day, Pyzor: couldn't grok response "66.250.40.33:24441 TimeoutError: " I did a "/usr/local/bin/pyzor discover", but to no avail. And I do not have them blocked on the firewall either.

Re: [SAtalk] Tracking down thewizard.net forwarder

2003-11-19 Thread Simon Byrnand
At 14:22 19/11/2003 -0500, Ken Bass wrote: For every submission I keep getting the below bounce / along with advertisement. This is quite ironic on a list dedicated to attacking spam. And very annoying. My own personal workaround has been to add that address to my SpamAssassin blacklist and I su

RE: [SAtalk] more spam since installing 2.60

2003-11-13 Thread Simon Byrnand
At 09:51 12/11/2003 -0500, Frank Pineau wrote: On Wed, 2003-11-12 at 09:26, Chris Santerre wrote: > > > > Is anyone else experiencing more junk mail getting through > > since installing > > 2.60? > This seems to be a common theme for any new version of SA. I've been seeing a lot more spam *period*

Re: [SAtalk] SA-LEARN Actually Crashes System!

2003-10-29 Thread Simon Byrnand
At 11:02 29/10/2003 -0600, Bill Polhemus wrote: I am running SA 2.60 installed from the RPMs on Red Hat 9, on an AMD 2100+ based system with a half-gig of RAM.   This has now happened for the second time. Before when it happened, about two weeks ago, I figured it was just a coincidence. Now, Im

Re: [SAtalk] Re: Re: [OT] What is next step?

2003-10-25 Thread Simon Byrnand
> > I will bet it'll be used, but will arrive lowercased in most cases. > > I have seen addresses munged as follows (perl code to illustrate): > > s/nospam//i; > s/spam//i; > tr/A-Z/a-z/; > > Also note: some spamware will skip any addresses that contain any > of these strings: > >

Re: [SAtalk] Re: Swap Space

2003-10-20 Thread Simon Byrnand
At 20:43 20/10/2003 -0500, David B Funk wrote: On Tue, 21 Oct 2003, Simon Byrnand wrote: > Since I use sendmail, which unfortunately doesn't have a proper way to > limit local delivery concurancy, I'm now using a combination approach - I > use -m 15, and return EX_TEMPFA

Re: [SAtalk] Re: Swap Space

2003-10-20 Thread Simon Byrnand
At 21:57 19/10/2003 -0500, Robert A. Hayden wrote: I'm wondering if maybe this should be default on new versions of SA? Set it by default for, say 25. The user can then set it higher or lower as needed, or to "0" for unlimited. Just a thought? Arguably its a fault of the MTA for allowing an unlim

RE: [SAtalk] child spamds sitting around forever

2003-10-20 Thread Simon Byrnand
At 09:39 20/10/2003 -0500, Dallas L. Engelken wrote: > -Original Message- > From: Daniel M. Drucker [mailto:[EMAIL PROTECTED] > Sent: Saturday, October 18, 2003 2:24 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] child spamds sitting around forever > > > (Running 2.60) > I'm having a proble

Re: [SAtalk] Re: Swap Space

2003-10-19 Thread Simon Byrnand
>> Yes, the situation I'm talking about is lots of spamd processes running >> at >> once using lots of memory. (Not to mention the local delivery processes >> running at the same time as well) >> >> Spamd using 800MB of ram is a bug, and one which I've never encountered >> yet in months of using sp

Re: [SAtalk] Swap Space

2003-10-18 Thread Simon Byrnand
> Simon Byrnand wrote on Thu, 16 Oct 2003 13:41:35 +1300: > >> 128MB is not enough in my experience. I found that with 128MB of ram >> that I >> had to limit concurant scanning to no more than 5 spamd processes at >> once >> or a burst of incomming traf

Re: [SAtalk] Using SPAMD ?

2003-10-18 Thread Simon Byrnand
> Quick question. > > I have the usual line in my .procmailrc file of > > :0fw: spamassassin.lock > * < 256000 > | spamassassin > > Which I *think* calls spamc? I don't have spamd running on my system and > SA is working so I assume it's either calling spamc or on demand calling > spamd. Hmm, Loo

RE: [SAtalk] Swap Space

2003-10-15 Thread Simon Byrnand
At 18:02 15/10/2003 -0500, Mike Carlson wrote: 128MB of RAM with a 238MB swap partition. It was the defaults from the FreeBSD install. I never thought it would use it all up. All it does is handle email. 128MB is not enough in my experience. I found that with 128MB of ram that I had to limit concu

Re: [SAtalk] Swap Space

2003-10-15 Thread Simon Byrnand
At 16:35 15/10/2003 -0500, Mike Carlson wrote: I have a FreeBSD box running sendmail/spamass-milter and spamassassin. This morning the box decided to run out of swap space and it kept killing the perl process. Anyone seen this before? How much swap space should I dedicate to the box? I process abou

Re: [SAtalk] Fan Mail!!! LOL We shut one down!

2003-10-14 Thread Simon Byrnand
> On Tue, Oct 14, 2003 at 08:33:03AM -0700, Patrick Morris wrote: >> I got one of these, too, last night, from a machine at a Korean ISP, and >> I've been trying to figure what I did. >> >> Somehow I feel less special now. :) >> >> Chris Santerre wrote: >> >> >Did anyone else get a nasty email this

Re: [SAtalk] bad day

2003-10-13 Thread Simon Byrnand
At 17:55 13/10/2003 -0400, landy wrote: On Mon, 2003-10-13 at 20:54, Simon Byrnand wrote: > > > > We run around 50%. And that's by count. With the MS worms flying in we > > have noticably more spam by volume than real mail. > > Our current stats are 57% Spam, 43

Re: [SAtalk] bad day

2003-10-13 Thread Simon Byrnand
> > We run around 50%. And that's by count. With the MS worms flying in we > have noticably more spam by volume than real mail. Our current stats are 57% Spam, 43% ham. And thats not counting viruses, which get blocked before spamassassin even runs. Kinda makes you wonder where the world is headi

Re: [SAtalk] Re: Autodeleting spam based on score without deleting all spam

2003-10-02 Thread Simon Byrnand
At 03:38 3/10/2003 +0200, Michael Schaap wrote: On 1-Oct-2003 01:11, David B Funk wrote: Don't /dev/null the spam, reject it. Unlike the procmail/qmail/posfix-ites you have the tools that enable you to "Do the right thing"(tm). With SA+milter+sendmail on your incoming gateway you can give an SMTP

Re: [SAtalk] BAYES broken from 2.55 to 2.6

2003-10-01 Thread Simon Byrnand
At 08:24 30/09/2003 -0700, Danny Aldham wrote: > As with any major new release of software, it pays to read the README and > INSTALL file. Right at the very top of the INSTALL file: > > Important Note For Users Upgrading From Earlier Versions > -

Re: [SAtalk] More Bayes (again)

2003-10-01 Thread Simon Byrnand
At 17:55 1/10/2003 -0400, Jack Gostl wrote: > > Now that I've straightened out my sa-learn script, I've stopped getting > > BAYES__ and false positives. The problem is that I've also stopped getting > > any Bayes hits at all. > > > > I've put a heckuvalot of spam/ham through the learning process.

Re: [SAtalk] More Bayes (again)

2003-10-01 Thread Simon Byrnand
> > Now that I've straightened out my sa-learn script, I've stopped getting > BAYES__ and false positives. The problem is that I've also stopped getting > any Bayes hits at all. > > I've put a heckuvalot of spam/ham through the learning process. Is there > any easy way to check if I've hit the thre

Re: [SAtalk] BAYES broken from 2.55 to 2.6

2003-09-30 Thread Simon Byrnand
Hi Danny, > I have recently upgraded spamassassin from 2.55 to 2.6 . It looks > like a new method of creating the BAYES database is used, that > requires the installation of the perl module DB_File, and means > any learned messages need to be re-learned. Hard to do if the > spam has been thrown aw

[SAtalk] sending SIGHUP to spamd 2.60 crashes it

2003-09-29 Thread Simon Byrnand
Hi All, I saw the recent thread discussion how sending SIGHUP to spamd in 2.60 (which is supposed to restart it) causes it to crash, and somebody mentioning that it was a bug in Perl 5.005, and that it should work ok in Perl 5.6.0 and later. I just tried it on our system which runs Perl 5.8.0 and

RE: [SAtalk] Re: Mail isn't spam, but subject line getting rewritten

2003-09-26 Thread Simon Byrnand
> No, there is no processing done before reaching me. The mail is not going > through my ISP. Are you sure its not being scanned by *someone* before you though ? It doesn't have to be your ISP. The particular messages you cited looked like it came through a mailing list, so maybe the mailing list

Re: [SAtalk] Extremely expensive SA calls

2003-09-25 Thread Simon Byrnand
At 00:04 26/09/2003 -0500, Justin Shore wrote: If I eliminate the SA -d call then that leaves me with only one other CPU-draining call: SA -r # Report to Pyzor :0 Wc | /usr/bin/pyzor report # Report to Razor :0 Wc | spamassassin -r Now one thing I never thought about till just now is if my Pyzor

Re: [SAtalk] Extremely expensive SA calls

2003-09-25 Thread Simon Byrnand
At 17:28 25/09/2003 -0500, Justin Shore wrote: Howdy all. My current installation involves calling SA from MIMEDefang which in turn is called from Sendmail. Enough background info. I'm currently calling spamassassin from a procmail recipe on a spamtrap account. The recipe does various bits of mu

Re: [SAtalk] RCVD_IN_DYNABLOCK problem

2003-09-24 Thread Simon Byrnand
At 19:47 24/09/2003 -0400, Gerry Doris wrote: SA 2.60 is giving a dynablock hit a wopping 2.62 score!!! It isn't really a problem that your SA is hitting this rule (you can always turn it off). The real problem is that everyone else's SA 2.60 is doing the same. If they retain the default 7 spam

[SAtalk] autolearning too much ?

2003-09-24 Thread Simon Byrnand
Hi Everyone, Maybe I'm not reading this right, but I just saw a message (from this list in fact) which scored as follows: X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on xxx.xxx.xxx.xxx X-Spam-Level: X-Spam-Status: No, hits=-2.4 required=5.0 tests=BAYES_00,FORGED_HOTMAIL

Re: [SAtalk] why is sa not catching the microsoft emails ?

2003-09-23 Thread Simon Byrnand
> I've been getting tons of this mail usually with virus's attached. I am > also getting messages that seem to orginate from our own server but they > don't. The reason SpamAssassin doesn't catch them is twofold: 1) It's a virus, not spam. 2) It's only just come out, after the ruleset for 2.60 wa

Re: [SAtalk] Re: Load throttling with Procmail/Sendmail. [Was: Getting slammed with virri and spam]

2003-09-13 Thread Simon Byrnand
> On Thu, Sep 11, 2003 at 04:32:47PM +1200, Simon Byrnand wrote: >> Anybody running spamc from procmail with sendmail is vulnerable to >> having >> their server overloaded because of uncontrolled concurancy of local >> deliveries - despite the options mentioned above, se

Re: [SAtalk] 2.60 RC4 deletes local.cf

2003-09-13 Thread Simon Byrnand
> Just for a data point, rc4 did not overwrite local.cf on my linux > machine. "perl Makefile.PL; make; make install" Nor mine... Regards, Simon --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

[SAtalk] Load throttling with Procmail/Sendmail. [Was: Getting slammed with virri and spam]

2003-09-11 Thread Simon Byrnand
At 23:31 9/09/2003 -0500, David B Funk wrote: On Wed, 10 Sep 2003, Jim wrote: > On Tue, Sep 09, 2003 at 12:18:10AM -0400, Debbie D wrote: > > 3 times today I noticed the server running very high loads of 4-6 and as > > high as 10, normally I run 1% or lower usually closer to .3-.6%. Three days >

RE: [SAtalk] [RD] MSGID_GOOD_EXCHANGE

2003-09-10 Thread Simon Byrnand
> > IMHO, I think finding out if a message is legit carries just as much > weight > as finding out if it is crap. If I can combine x amount of tests to > verify > that it's legitimately from an Exchange server, it would be worth it from > the perspective that I could maybe side line those message

Re: [SAtalk] Rbl checks

2003-09-08 Thread Simon Byrnand
At 23:57 8/09/2003 -0400, Matt Kettler wrote: At 08:28 PM 9/8/03 -0400, Scott Kopel wrote: It's clear that my SA is now performing rbl checks and I apologize for being slow, but I still don't see how to configure my local.cf to get SA to perform checks at specific rbl lists eg spamcop.net I check

Re: [SAtalk] Performance optimization for bigger setups

2003-09-07 Thread Simon Byrnand
At 20:37 7/09/2003 -0700, Justin Mason wrote: trey valenta writes: > On Fri, Sep 05, 2003 at 04:56:45PM +0200, Jochen Tuchbreiter wrote: > > Did any of you analyze (profile) where most of the CPU in spamassassin > > is spent? > > I ran "spamassassin --lint" through Perl's profiler back in July. I

Re: [SAtalk] Spam with score of 0.0

2003-09-07 Thread Simon Byrnand
At 12:08 7/09/2003 -0700, Jason wrote: This message made is past SpamAssassin without setting off ANYTHING? (Score of 0.0.) [snip] Very odd. You must have something wrong with your setup there, as I see heaps of spams identical to that one that score quite highly... (somewhere between 10 and 20

Re: [SAtalk] Performance optimization for bigger setups

2003-09-05 Thread Simon Byrnand
> At 04:56 PM 9/5/2003 +0200, Jochen Tuchbreiter wrote: >>Is there a chance that I may significantly increase performance by >>omitting some rules that contain costly regexps? Is there an easy way to >>find out how much time spamassassin spends on each regexp? Do you think >>that changing spamd/spa

Re: [SAtalk] osirusoft still working?

2003-09-05 Thread Simon Byrnand
> Simon Byrnand wrote: > >> At 20:43 4/09/2003 +0200, Ralf G. R. Bergs wrote: >> >>> Jim Porter wrote: >>> >>>> score RCVD_IN_OSIRUSOFT_COM 0 >>>> score X_OSIRU_DUL 0 >>>> score X_OSIRU_DUL_FH0

Re: [SAtalk] osirusoft still working?

2003-09-04 Thread Simon Byrnand
At 20:43 4/09/2003 +0200, Ralf G. R. Bergs wrote: Jim Porter wrote: score RCVD_IN_OSIRUSOFT_COM 0 score X_OSIRU_DUL 0 score X_OSIRU_DUL_FH0 score X_OSIRU_OPEN_RELAY0 score X_OSIRU_SPAMWARE_SITE 0 score X_OSIRU_SPAM_SRC 0 From what I understood, th

Re: [SAtalk] Re: Documentation: autolearn cutoff values in 2.60-rc3

2003-09-03 Thread Simon Byrnand
At 10:57 2/09/2003 +0100, Brian Morrison wrote: In article <[EMAIL PROTECTED]>, [EMAIL PROTECTED] said... > > Hello, > The documentation for 2.60-rc3 claims the bayes auto learn cutoff values > are -2 & 15. I think they have been changed to 0.1 and 12. Is that > correct? There is certainly so

Re: [SAtalk] Bayes and whitelisting

2003-09-03 Thread Simon Byrnand
At 14:20 2/09/2003 +0200, Carlo Wood wrote: On Tue, Sep 02, 2003 at 01:02:47PM +1200, Simon Byrnand wrote: > Well don't forget that the auto_learn_spam threshold is 15 in 2.55 and 12 > in 2.60, and its very rare that a spam pasted into the *body* of a message > will be autolearnt,

Re: [SAtalk] System goes down

2003-09-03 Thread Simon Byrnand
At 19:26 2/09/2003 +0100, Justin Mason wrote: Folks -- are you using the -m switch to limit how many spamds can run? If you don't use that, and you're using an MTA that also does not limit concurrent local delivery commands, like sendmail, this will be an issue. Try the -m switch. On some setups (n

Re: [SAtalk] System goes down

2003-09-03 Thread Simon Byrnand
At 15:18 2/09/2003 -0400, [EMAIL PROTECTED] wrote: FWIW, Sendmail 8.12.9 (and possibly prior versions) supports a limit: define(`confMAX_DAEMON_CHILDREN', `24')dnl All that does is limits the number of simultanous children the main sendmail process will launch in response to incomming connection

RE: [SAtalk] bayes feedback

2003-09-03 Thread Simon Byrnand
At 11:06 2/09/2003 -0500, Tom Meunier wrote: Because without a few hundred messages, it would be completely and utterly useless? It would be like meeting an airline pilot who was 5'7" tall and had a scar on his left cheek and wore his hat backwards. Bayes would think that scars on left cheeks

Re: [SAtalk] spamassasing consuming lot of memory

2003-09-03 Thread Simon Byrnand
> Hello All, > > I'm using spamassassin-2.55 with qmail. The spamassassin process is > consuming lot of memory. Is there any bug related to memory leak in > spamassassin. It would help if you gave us more information, for example how much memory it is using. It's quite normal for example for spamd

Re: [SAtalk] Bayes and whitelisting

2003-09-02 Thread Simon Byrnand
At 06:02 2/09/2003 +0100, Justin Mason wrote: On Tue, Sep 02, 2003 at 01:02:47PM +1200, Simon Byrnand wrote: > At 02:24 2/09/2003 +0200, Carlo Wood wrote: > >On Tue, Sep 02, 2003 at 09:56:54AM +1200, Simon Byrnand wrote: > I don't whitelist this mailing list and I know at

Re: [SAtalk] Bayes and whitelisting

2003-09-02 Thread Simon Byrnand
At 02:24 2/09/2003 +0200, Carlo Wood wrote: On Tue, Sep 02, 2003 at 09:56:54AM +1200, Simon Byrnand wrote: > On the other hand, there is nothing to stop the message being autolearnt if > its score before the whitelisting value is added, so for example if a spam > would normally score

Re: [SAtalk] Bayes and whitelisting

2003-09-01 Thread Simon Byrnand
At 17:50 1/09/2003 +0200, Carlo Wood wrote: On Mon, Sep 01, 2003 at 04:31:34PM +0200, Kai Schaetzl wrote: > > whitelisted mails should not be auto learned. > > That is just what Simon said and SA does. Oh... sorry. He said S> Please check the docs, Bayes auto_learn does not take notice of S> whit

Re: [SAtalk] Bayes and whitelisting

2003-09-01 Thread Simon Byrnand
At 02:14 1/09/2003 +0200, Carlo Wood wrote: Hi all, it is not clear to me how SA handles white listing. Normally, one does not want to use a white-listed mail to update the Bayes classifier because once white-listed the mail could contain ANYTHING. However, it appears that the whitelisting only s

Re: [SAtalk] Documentation: autolearn cutoff values in 2.60-rc3

2003-09-01 Thread Simon Byrnand
At 14:53 29/08/2003 -0500, Henrik Schmiediche wrote: Hello, The documentation for 2.60-rc3 claims the bayes auto learn cutoff values are -2 & 15. I think they have been changed to 0.1 and 12. Is that correct? Yep, Looks like you spotted a Documentation bug I'll put a bugzilla ticket in

Re: [SAtalk] Min Score

2003-08-31 Thread Simon Byrnand
> If you upgrade to 2.60 you need to set your autolearn ham score to 0, > instead of the default of -2 in 2.55. > > By default shouldn't the auto-learn threshold for 2.60 be set to 0? > (not at a shell prompt so can't look right now.) > If not I think it should be, otherwise it won't learn ham. > >

Re: [SAtalk] Re: SpamAssassin 2.60 rc3 released

2003-08-29 Thread Simon Byrnand
> On Friday 29 August 2003 04:34 CET Theo Van Dinter wrote: >> On Fri, Aug 29, 2003 at 01:57:27PM +1200, Simon Byrnand wrote: >> > Fixed now, but the second part of Theo's fix (assuming he did it :) >> > doesn't seem to be in there - using any \n's to add

Re: [SAtalk] [SA-Announce] SpamAssassin 2.60 rc3 released

2003-08-29 Thread Simon Byrnand
> Installed fine, upgraded fine from cvs of three weeks ago or so. Can't > comment on effectiveness yet. One thing I note is that it again needs more > RAM, it's now at almost 25 MB. Not for me it size, Size of 19996, and RSS of 17M after running for a while... the same as 2.55. Regards, Simon

Re: [SAtalk] Re: SpamAssassin 2.60 rc3 released

2003-08-29 Thread Simon Byrnand
> On Fri, 29 Aug 2003, Malte S. Stretz wrote: > >> to make it work like before (or make a symlink from /usr/local/etc to >> /etc). >> See also bug 2374 [1]. > >> [1]http://bugzilla.spamassassin.org/show_bug.cgi?id=2374 > > Ah. Reading through the suggestions on Bugzilla - having everything in > /us

Re: [SAtalk] Re: SpamAssassin 2.60 rc3 released

2003-08-29 Thread Simon Byrnand
> On Friday 29 August 2003 17:02 CET Christopher X. Candreva wrote: >> Is there a build switch to tell spamc to use a Unix doimain socket (and >> the socket name) by default ? > > Nope. > >> Also, for some reason on rc3, perl Makefile.PL built a system that was >> looking in /usr/local/etc/spamas

Re: [SAtalk] DNS Timeout Issues

2003-08-29 Thread Simon Byrnand
> Simon Byrnand <[EMAIL PROTECTED]> writes: > >> So umm, how does the rbl_timeout setting work in 2.60 then ? I didn't >> quite >> follow the logic of what you said :) I would have previously assumed >> that >> it was just a cutoff where if an ind

Re: [SAtalk] DNS Timeout Issues

2003-08-29 Thread Simon Byrnand
At 22:38 28/08/2003 -0700, Daniel Quinlan wrote: Simon Byrnand <[EMAIL PROTECTED]> writes: > Although I don't have the answer to your question, I suggest you look at > using the following options to reduce the various timeouts to minimize the > chance of a "train wreck&qu

Re: [SAtalk] SpamAssassin 2.60 rc3 released

2003-08-29 Thread Simon Byrnand
At 17:18 28/08/2003 -0700, Justin Mason wrote: - bug 2347: add_header did not support multiple newlines Fixed now, but the second part of Theo's fix (assuming he did it :) doesn't seem to be in there - using any \n's to add a newline into a report header still effectively disables automatic hea

Re: [SAtalk] DNS Timeout Issues

2003-08-29 Thread Simon Byrnand
At 21:23 27/08/2003 -0400, David Birnbaum wrote: Folks, With respect to the OSIRU DNS problems recently, we had the situation where SpamAssassin suddenly went from taking one second to process a message to 30 seconds or more. Mail suddenly started backing up, and we ended up with a real train wre

Re: [SAtalk] RBL

2003-08-28 Thread Simon Byrnand
> On Thu, Aug 28, 2003 at 10:31:50PM +1200, Simon Byrnand wrote: >> RBL checks are on by default, but you have to have the Net::DNS perl >> module installed for them to work. > > Woah! > > I DON'T have that installed! And I never got a warning anywhere?! >

Re: [SAtalk] RBL

2003-08-28 Thread Simon Byrnand
> Ok , thank you for these details. > > Could you then confirm me it is the parameter "skip_rbl_checks 0" which > enables the RBL checks..? RBL checks are on by default, but you have to have the Net::DNS perl module installed for them to work. The easiest way to do that is through CPAN. perl -M

Re: [SAtalk] Scores for OSIRU Tests

2003-08-28 Thread Simon Byrnand
> On Wed, Aug 27, 2003 at 12:44:20PM -0700, Justin Mason wrote: > > Good morning, > >> Larry Gilson writes: >> >There was another suggestion that the tests could be commented out in >> >20_head_tests.cf. Which is the best and/or recommended method? >> >> either works fine. This way is easier. > >

Re: [SAtalk] heads-up: 2.60 will drop support for bayes dbs in non-DB_File formats

2003-08-28 Thread Simon Byrnand
> Hi all -- > > We've decided, in light of several serious bugs (including crash and > concurrency bugs) that the non-DB_File database modules are not reliable > enough for use with Bayes. > > As a result, 2.60 will drop support for Bayes databases in formats > other than DB_File, and we'll add a n

Re: [SAtalk] Anyone head of these guys ? (Death2Spam)

2003-08-28 Thread Simon Byrnand
At 18:41 27/08/2003 -0700, Justin Mason wrote: Simon Byrnand writes: >Just got a sales pitch today by phone followed up by email from these guys: > >http://www.death2spam.net.nz/ > >Anybody else heard of them ? Their system claims to be based on Bayesian >filtering and claim

Re: [SAtalk] RBL

2003-08-28 Thread Simon Byrnand
At 19:11 27/08/2003 +0200, Céline REDON wrote: Thanx Bob, Would you know also how to integrate them in Spamassassin? In the local.cf file?? Thanx!! CR Umm, SpamAssassin comes preconfigured with a variety of RBL checks now, and the new version 2.60 which sould be out "any time soon" (tm) adds a

Re: [SAtalk] Anyone head of these guys ? (Death2Spam)

2003-08-28 Thread Simon Byrnand
At 18:41 27/08/2003 -0700, Justin Mason wrote: Simon Byrnand writes: >Just got a sales pitch today by phone followed up by email from these guys: > >http://www.death2spam.net.nz/ > >Anybody else heard of them ? Their system claims to be based on Bayesian >filtering and claim

Re: [SAtalk] Anyone head of these guys ? (Death2Spam)

2003-08-28 Thread Simon Byrnand
At 20:51 27/08/2003 -0400, Theo Van Dinter wrote: On Thu, Aug 28, 2003 at 12:40:12PM +1200, Simon Byrnand wrote: > I don't think I'll be switching away from SpamAssassin any time soon... > > Comments anyone ? 98% of all statistics are lies. :) Heheheh... I don't think I

Re: [SAtalk] different notification emails depending on domain

2003-08-28 Thread Simon Byrnand
At 09:30 27/08/2003 -0500, Bob Apthorpe wrote: Hi, On Tue, 26 Aug 2003 21:56:02 -0400 Theo Van Dinter <[EMAIL PROTECTED]> wrote: > On Wed, Aug 27, 2003 at 03:34:46AM +0200, Marcus Schopen wrote: > > I use amavisd-0.1. My sendmail is responsible for two domains (privat > > and work stuff). > > > >

[SAtalk] Anyone head of these guys ? (Death2Spam)

2003-08-28 Thread Simon Byrnand
Hi All, Just got a sales pitch today by phone followed up by email from these guys: http://www.death2spam.net.nz/ Anybody else heard of them ? Their system claims to be based on Bayesian filtering and claims to be a lot more effective than 6 other spam filtering programs (including SpamAssassi

[SAtalk] SpamAssassin pretending to be a virus scanner ;-)

2003-08-28 Thread Simon Byrnand
Has anyone noticed that the Sobig.f worm that is going around rampantly at the moment is getting detected quite well by SpamAssassin ? :) Normally our virus scanner runs before SA gets a chance to run, but on a test machine I'm trying 2.60-rc2 out on SA is getting to scan virus infected emails.

Re: [SAtalk] Weird behavior with SA 2.60 rc1

2003-08-27 Thread Simon Byrnand
> On Friday, August 22, 2003 @ 1:56:26 PM [-0700], Tim Buck wrote: > >> So I've reverted back to SA 2.55. Anyone else see this behavior? > > Tim...yes. I had an almost identical problem. Two or three users > suddenly started getting a lot more spam and the headers indeed showed > no SA checks. I to

Re: [SAtalk] Re: [Exim] listed at relays.osirusoft.com (fwd)

2003-08-27 Thread Simon Byrnand
> By all means do it! :) ... but it won't help that there are still > servers > that use the rbl directly from sendmail or postfix and the like.. :( And they will soon discover that they've been rejecting nearlly all mail because of it, and remove relays.osirusoft.com Regards, Simon --

Re: [SAtalk] Question about the GA...

2003-08-27 Thread Simon Byrnand
> > Simon Byrnand writes: >> I was just thinking about the GA process and although I havn't looked at >> it to see exactly how it works, I was wondering the following >> >> Presumably it starts with a certain scoreset, runs the spam through, >> sees &g

Re: [SAtalk] Re: [Exim] listed at relays.osirusoft.com (fwd)

2003-08-27 Thread Simon Byrnand
> > Larry Rosenman writes: >>FYI, since SA uses the Osirusoft RBL. > > confirmed -- relays.osirusoft.com has been switched to return > a match for every query. FPs galore.It's also suffering > a DDOS, so this may take a while to get through though. > > Good reason to get 2.60rc3 out ASAP ;) S

Re: [SAtalk] osirusoft RBL's are TOAST......

2003-08-27 Thread Simon Byrnand
> based on the below post from the Exim list, and other posts, and a bounce > that I received > listing my humble (anti-relayed) server, I'd suggest the following for > folks: > > > score RCVD_IN_OSIRU 0 > score RCVD_IN_OSIRU_RELAY 0 > score RCVD_IN_OSIRU_DIALUP 0 > score RCVD_IN_OSIRU_SPAM_SRC 0 >

[SAtalk] Question about the GA...(part 2)

2003-08-27 Thread Simon Byrnand
>The biggest problem with a score based system with an abrupt cutoff is the >uncertainty around the threshold. If the GA currently thinks its ok for a >ham to score 4.9 and still be called ham, and a spam to score 5.1 and >still be called spam, its not going to make as much effort to get a >cleaner

Re: [SAtalk] osirusoft RBL's are TOAST......

2003-08-27 Thread Simon Byrnand
> based on the below post from the Exim list, and other posts, and a bounce > that I received > listing my humble (anti-relayed) server, I'd suggest the following for > folks: > > > score RCVD_IN_OSIRU 0 > score RCVD_IN_OSIRU_RELAY 0 > score RCVD_IN_OSIRU_DIALUP 0 > score RCVD_IN_OSIRU_SPAM_SRC 0 >

[SAtalk] Question about the GA...

2003-08-26 Thread Simon Byrnand
I was just thinking about the GA process and although I havn't looked at it to see exactly how it works, I was wondering the following Presumably it starts with a certain scoreset, runs the spam through, sees what percentage score above 5, then runs the ham through and sees what percentage sco

Re: [SAtalk] Custom Rules - spamd

2003-08-26 Thread Simon Byrnand
At 00:05 26/08/2003 -0400, Larry Gilson wrote: I have not had much call to create custom rules. I just started experimenting with rules and I noticed that the rules were not checked unless I first restarted spamd. Is this normal? Yep. Regards, Simon

Re: [SAtalk] Weird behavior with SA 2.60 rc1

2003-08-25 Thread Simon Byrnand
At 00:03 25/08/2003 -0700, Matt Thoene wrote: On Friday, August 22, 2003 @ 1:56:26 PM [-0700], Tim Buck wrote: > So I've reverted back to SA 2.55. Anyone else see this behavior? Tim...yes. I had an almost identical problem. Two or three users suddenly started getting a lot more spam and the heade

[SAtalk] Re: bug in header display ?

2003-08-25 Thread Simon Byrnand
At 03:56 25/08/2003 +0200, Malte S. Stretz wrote: On Monday 25 August 2003 03:18 CET Simon Byrnand wrote: > At 21:03 24/08/2003 -0400, Theo Van Dinter wrote: > >X-Spam-Status (and all the X-Spam-* headers actually) is wrapped unless > >you set the "fold_headers" option to

  1   2   3   >