How is the resource useage with clamav? I'm tempted to install it, but
the cpus on that server are already pretty stressed just dealing with
spamc (I already offloaded spamd to another box) and everything else it
has to do, and am hesitant to add much more...
TIA,
On Wed, 28 Jan 2004, Richard B
On Tue, 27 Jan 2004, John Hall wrote:
> This is a list of all the filenames I've seen so far today:
>
> body.bat
> body.exe
> body.zip
> data.pif
> data.scr
> doc.zip
> document.pif
> document.zip
> kcmnw.exe
> message.scr
> message.zip
> pqoew.pif
> readme.scr
> readme.zip
> text.e
On Tue, 27 Jan 2004, Russell Mann wrote:
> I got one of these guys yesterday, then ClamAV has stopped them since. If
> you're using a QmailScanner setup, it can easily be configured to block
> these guys.
I configured qmail-scanner to do just that...I'm not sure I want yet
another process on the
build
> >now when I run spamc -c
> is spamd still running? This is typically what you'll get if you run
> spamc
> when spamd is down.
>
>
>
>
> ---
> This SF.net email is sponsored by: IBM Linux Tutorials.
&g
We tag it as spam at 6.0 and delete it after 5 days. Since we get over
200MB of spam a day (for less than 1300 email accounts), keeping it
indefinitely is not an option. The user has 5 days to check the Spam
folder in their web email to catch any FPs. If they like we can bypass
the filtering sy
Can someone point me to some good rules to catch most Chinese, Korean, etc
spam? We're talking non-ASCII characters, which show up in most mailers
here as a bunch of question marks...
thanks!
James Smallacombe PlantageNet, Inc. CEO and Janitor
[EMAIL PROT
You need to wait for all of spamd's children to die, including all of the
spamc's. This can take a while on a busy and/or slow server. This works
for me most of the time:
#!/bin/bash
PID=`awk '{print $1}' /var/run/spamd.pid`
kill -TERM $PID && wait || echo "ERROR!"
/usr/local/etc/rc.d/sp
Sorry, I rushed through your post...I thought you were referring to the
problem with the subject not being re-writtenwell, if anyone running
spamd and spamc from qmail-scanner is wondering why it doesn't work, here
it is :)
On Fri, 7 Nov 2003, Jennifer Fountain wrote:
> SA labels other spam
I just figured this out the other day. This is not an SA issue, but a
qmail-scanner.pl issue. To address it directly, edit this line in
qmail-scanner.pl:
my $spamc_subject='***SPAM***';
The one downside is that having (_HITS_/_REQD_) doesn't work. I suspect
that if you rebuild qmail-scanner.p
I can't help you with the subject issue (I have the same problem with
2.60), but for the version number in the header, that's a qmail-scanner
thing...you need to rebuild qmail-scanner.pl with the new spamd running
and it will fix that.
On Sun, 2 Nov 2003, Posts wrote:
> Hi,
>
> I'm new to the li
Once again, I think I might be answering my own question here, but it is
starting to dawn on me that maybe the subject tag isn't meant to work with
spamd, but only the spamassassin perl script? If not, I'm stumped...I
also tried:
report_safe 0
But that's not doing anything that I can see...
On T
I've never had much use for rewriting the subject before, but now I may
have a use for it, and just noticed that it doesn't work, In the
local.cf, I have:
rewrite_subject 1
subject_tag ***SPAM*** (_HITS_/_REQD_) **
The spams get the header report, but not the subject tag. I saw no
references i
uh, never mind...I figured it out...if you have the server listen on
localhost, it can't take remote connections (unlike bind, IIRC). I put it
on the ext IP and it works fine now..sorry!
On Thu, 30 Oct 2003 [EMAIL PROTECTED] wrote:
>
> In the quest to offload spamd onto another box, I checked t
In the quest to offload spamd onto another box, I checked the man pages
and FAQ, but I still get this error when I try to run spamd on a separate
box. From the client, I get:
Oct 30 22:27:12 mail spamc[60581]: connect(AF_INET) to spamd at
208.8.16.10 failed, retrying (#3 of 3): Connection refuse
I'm in the process of moving most of the work SA has been doing on the
mail pop3/smtp server off onto a separate box that's very lightly loaded.
So far, so good, but the maillog keeps showing the following errors for
users that aren't on the local box that spamd is running on. The mail
then gets
Well, I just upgraded the RAM on this server to 1GB, and if anything, the
proc load went up. At times, it was over 50.00, usually in the high
30.'s. Limiting the number of spamd's seems to have abated the crashes,
but the smtp performance is so poor that I was getting inundated with
If you use maildrop as your MDA (it's Maildir native), you can do
something like this in your maildroprc
MAILBOX="$HOME/Maildir/"
if ((/^X-Spam-Status:.*Yes/))
{
to "./Maildir/.Spam/."
}
> -Original Message-
> From: Francesco [mailto:[EMAIL PROTECTED]
> Sent: Monday, October 27, 2003
For the past couple of weeks or so, like most of you, I've seen total spam
volume almost double again. At this point, the server in question (dual
PIII-550 L440GX) is seeing loads as high as 30.00 and beyond, usually
during the day. However, it hasn't rebooted itself that I can recall in
over a
d also trigger the bug and upgrade perl. The workaround
> is to make sure that you're running the perl 5.005 binary, fire up the
> CPAN shell, install *just* CPAN (not the bundle) to get the most recent
> version, quit and restart the CPAN shell, and *then* install Bundle::CPAN.
&g
Trying to install SA 2.60, everyting builds and installs fine, but when I
try to start spamd, in complains about bytes.pm not being installed. it
is, but under the perl 5.8 libs. The reason for this is that a long time
ago, I thought I'd join the CPAN bandwagon and install SA with it. To my
hor
On Mon, 22 Sep 2003, drew wrote:
> Once you get the hang of it, its not too bad I personally find it much
> easier to configure then sendmail. Just be careful with the scripts, thats
> the easiest place to booger something. All I did to integrate SA into my
> Qmail install was to download the perl
On Sat, 20 Sep 2003, Fred I-IS.COM wrote:
> I noticed a small difference, I don't know if this has something to do with
> it, but in the bottom message, with -7.7, where are the other SA headers?
> Like which tests fired?
the -7.7 was from spamd/spamc, and the only SA headers I get from that ar
I've been getting some spams coming in with negative scores like this
-7.7, but when I run it through the spamassassin debugger, it comes out
with a modest postive score of 3.7. I'm not using any user prefs, either.
From [EMAIL PROTECTED] Fri Sep 19 23:36:23 2003
Return-Path: <[EMAIL PROTECTED]>
On Thu, 18 Sep 2003, Daniel Quinlan wrote:
> up <[EMAIL PROTECTED]> writes:
>
> > This is perl, version 5.005_03 built for i386-freebsd
> >
> > Not sure which DB module is installed...perl -V doesn't say...I presume
> > there's an easy way to tell?
&g
On 18 Sep 2003, Daniel Quinlan wrote:
> up wrote:
>
> >> The last time this happened, the only way I could get sa-learn to start
> >> working again was to remove _journal, _msgcount, _seen and _toks, which
> >> presumably wipes out all existing bayes data. I
The last time this happened, the only way I could get sa-learn to start
working again was to remove _journal, _msgcount, _seen and _toks, which
presumably wipes out all existing bayes data. Is there a better way?
Cannot open bayes_path /usr/local/etc/mail/spamassassin/ R/W:
Inappropriate file ty
I've been feeding sa-learn the following way for months now, but even
though I've changed nothing, I can no longer do it. I now get:
su-2.05a# sa-learn --spam --mbox ~up/mail/SPAM
Cannot open bayes_path /usr/local/etc/mail/spamassassin/ R/O:
Inappropriate file type or format
C
...or from my domain (see address). I've actually had it caught in
certain large sites filters. It may well be that they just have no clue
what .am is...
On Thu, 24 Jul 2003, Evan Platt wrote:
>
>
> --On Thursday, July 24, 2003 3:31 PM +0300 Turgut Kalfaoglu
> <[EMAIL PROTECTED]> wrote:
>
> >
On Thu, 17 Jul 2003, Malte S. Stretz wrote:
> On Thursday 17 July 2003 20:21 CET Justin Mason wrote:
> > [EMAIL PROTECTED] writes:
> > >1) Have spamd re-read local.cf when it receives a HUP signal, rather
> > > that having to be stopped and restarted
> >
> > Yep, that'll be in for 2.60.
>
> But
Sorry if this has already been broached, but this seems like it would be a
great idea and not too difficult to implement (but I could be way off):
1) Have spamd re-read local.cf when it receives a HUP signal, rather
that having to be stopped and restarted
2) Whether the #1 is doable or not, w
I use qmail-scanner, because it gives you the option of virus scanning as
well, but there are probably more efficient/elegant ways of doing this
now. In short, you'll want to install in this order:
qmail (Maildir)
maildrop (or a procmail that understands Maildir)
qmail-queue patch (see qmail-sca
ocmail/log
> VERBOSE=off
>
> :0fw: spamassassin.lock
> * < 256000
> | spamassassin
>
> :0:
> * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
> $HOME/mail/almost-certainly-spam
>
> :0:
> * ^X-Spam-Status: Yes
> $HOME/mail/probably-spam
>
Replying to my own email: If this anyone is actually trying to figure this
one out, you can stop now. Although a "make clean" didn't help, deleting
the tree and unpacking the source again did. Go figure...
On Fri, 21 Feb 2003 [EMAIL PROTECTED] wrote:
>
> Ok, CPAN was hell for me, so I tried g
On Thu, 16 Jan 2003, Chris Edwards wrote:
> | The problem or feature of the current system seems to be that you don't
> | really know who the email is from. Received: and From: headers can be
> | faked, so that you really don't know that the listed location is the
> | true originating location.
On 15 Jan 2003, Jeremy Turner wrote:
> 2. As discussed previously on this thread (I believe), it might be a
> bad idea to send an email back to a spam source. At best, the address
> doesn't exist, creating a returned bounce email and wasting bandwidth.
> At worst, the spam source could be a vali
This is a bug in qmail-scanner 1.15 that chokes on any largish
attachments, not just pdf. here's a quick patch that fixes the problem,
along with credit to the author (I posted this here a few weeks ago, but
here it goes again):
---
Basically, as of QS 1.1
the echo back. Here is a
> > > sample:
> > >
> > > Hi. This is the qmail-send program at ***
> > > I'm afraid I wasn't able to deliver your message to the following
> > > addresses. This is a permanent error; I've given up. Sorry it
On 19 Dec 2002, Daniel Quinlan wrote:
> When downloading a lot of mail at once, it might make sense to use a
> local instance of spamd/spamc instead of the spamassassin script. That
> will probably get you a nice speed-up, even with the procmail problem.
This brings me to a newbie ques
Following up on this...it turns out that the problem of email being
rejected with a threshold of 0 was NOT the result of a bug in SA. but an
issue (I'd call it a bug, but it looks like it was intentional) with
qmail-scanner 1.15. There's a quick patch that fixes it in the email
from t
On Mon, 16 Dec 2002 [EMAIL PROTECTED] wrote:
> > > I'd look in the archives, but they seem to be down right now.
> >
> > Actually, I looked for the patch. It was applied before 2.43. You are
> > using 2.43, right?
>
> yes.
>
> > How are you calling spamassassin/spamc?
>
> It's being called from qm
On Mon, 16 Dec 2002, Duncan Findlay wrote:
> On Mon, Dec 16, 2002 at 02:39:09PM -0500, [EMAIL PROTECTED] wrote:
> > On Mon, 16 Dec 2002, Duncan Findlay wrote:
> >
> > > I feel like I'm repeating my self now.
> >
> > Sorry...maybe this should be in the FAQ.
> >
> > > There's a bug in spamd in 2.43
On Mon, 16 Dec 2002, Duncan Findlay wrote:
> I feel like I'm repeating my self now.
Sorry...maybe this should be in the FAQ.
> There's a bug in spamd in 2.43 that occurrs when spamc -c is used. You
> can find a patch in the bugzilla, somewhere, or in the CVS logs.
I found the "bleeding edge" CV
whitelisting in the local.cf file worked only after killing and restarting
spamd, even though changes to the hits threshold in the same config file
work after killing and restarting qmail-send.
I must be doing something seriously wrong here:
If spamd is killed, all email is rejected as spam with
I'm not able to duplicate this problem sending attachments from a shell
account, but customers are having problems with some attachments. For
some reason, it's pushing the hit threshold to 0 :
X-Spam-Status: Yes, hits=0 required=0
when there's an attachment instead of:
X-Spam-Status: No, hits=
I thought I had this setup (SA, qmail, qmail-scanner, maildrop, etc) all
tested, but I'm finding in production mode, I'm several clues short :-/
First: running spamd, I can't seem to get it to recognize the
whitelist_from rule, either in local.cf or user_prefs (does user_prefs
even work with sp
What I like about
exit code 100 is that it doesn't queue the message and clog my queue.
Anyway, I've tested this. It definitely passes the echo back. Here is a
sample:
Hi. This is the qmail-send program at ***
I'm afraid I wasn't able to deliver your message to the following
This varies depending on the MDA. With maildrop (used with Maildir), you
would have something like:
if ((/^X-Spam-Status:.*Yes/))
{
echo "Your Email was Rejected by our SPAM filters. Sorry."
EXITCODE=100
exit
}
to "./Maildir/."
On Fri, 13 Dec 2002, James D. Stallings wrote:
>
> Do
The docs indicate that setting required_hits to 8.0 to 10.0 is prudent to
prevent false positives, but on the test server with one account, I've
already noticed several spams getting through with 7.8 and 7.9 hits (are
the spammers on to SA?) with required_hits set to 8.0.
I'm just wondering if t
Thanks for the help, Mike, Matt and Dave! I misunderstood the
qmail-scanner docs to mean that SA just needed to be installed properly.
not that spamd needed to be running.
On that note, is it best to just run spamd standalone in the background or
inetd (not interested in using daemontools unless
Need to get spamassassin working system-wide with:
qmail (with the qmail-queue patch)
tcpserver
maildrop
sqwebmail (w/ vpopmail, but no virtual users)
All the docs I could find (including the archives to this list) say to use
qmail-scanner to use spamassassin with qmail. However, qmail-scanner
50 matches
Mail list logo
