how do you turn _off_ AWL ?
also, where would one put sitewide whitelists ? (assuming
/etc/mail/spamassassin as default directory)
thanks in advanced
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Devel
Did it change the spam message over the 5.0 threshold? or did it just
reduce the score of some insanely high scoring spam by 4.5?
Read the very fine FAQ on this matter...
http://wiki.spamassassin.org/w/AwlWrongWay
It explains what the AWL REALLY is, which is not what you might think it is.
At
In recent efforts to stop the flow of spam that's somehow getting through
my best attempts at blocking it, I've been studying the spam that does get
caught and have found something dreadfully scary. On several messages that
are obviously blatent spam, I've been seeing things like this:
-4.5 A
Matt Kettler Sent: Friday, December 12, 2003 11:16 AM
> At 10:10 AM 12/12/2003, Colin A. Bartlett wrote:
> >I have found that AWL works quite well and I keep it enabled. The only
time
> >that it is a pain is if I send myself or someone else a test using GTUBE.
> >That f's up the AWL until I send a
At 10:10 AM 12/12/2003, Colin A. Bartlett wrote:
I have found that AWL works quite well and I keep it enabled. The only time
that it is a pain is if I send myself or someone else a test using GTUBE.
That f's up the AWL until I send a few hams. There's a way to remove the
sender from the AWL but I c
At 01:46 PM 12/12/03 +, Peter McGarvey wrote:
pts rule name description
-- --
-4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.]
56 AWL
Peter McGarvey Sent: Friday, December 12, 2003 8:46 AM
> I've seen several instanaces where the AWL mechanism has cause non-spam
> email to be classed as spam. Here is example report from one of these:
>
> -4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> 56 AWL
I've seen several instanaces where the AWL mechanism has cause non-spam
email to be classed as spam. Here is example report from one of these:
Content analysis details: (50.7 points, 5.0 required)
pts rule name description
--
Thanks, but I realized that I was using redhat's service spamassassin
start command and the script sent spamd the -a command. Thanks again for
your help.
Jeremy
On Thu, 2003-10-30 at 23:10, Matt Kettler wrote:
> At 08:13 PM 10/30/03 -0800, Jeremy Hein wrote:
> >I added use_auto_whitelist 0 to
> >
At 08:13 PM 10/30/03 -0800, Jeremy Hein wrote:
I added use_auto_whitelist 0 to
/etc/mail/spamassassin/local.cf
but it still subtracts AWL in my report.
Maybe I'm writing to the wrong config file? How do I find out where the
right one is and how do I find out if spamassassin is using that option.
1)
I added use_auto_whitelist 0 to
/etc/mail/spamassassin/local.cf
but it still subtracts AWL in my report.
Maybe I'm writing to the wrong config file? How do I find out where the
right one is and how do I find out if spamassassin is using that option.
Thanks for your help,
Jeremy
On Thu, 2003-10-3
At 08:00 PM 10/30/2003, Jeremy Hein wrote:
Hi,
Does anyone know what this is and how to configure it? It seems to be
subtracting from the score different amounts each time. I can't figure
out why or what to do about it.
Read the FAQ.. the AWL is a score averager, and it's supposed to vary in
scor
Hi,
Does anyone know what this is and how to configure it? It seems to be
subtracting from the score different amounts each time. I can't figure
out why or what to do about it.
AWL: Auto-whitelist adjustment
Thanks,
Jeremy
---
This SF.net em
hanks!
- Original Message -
From: "Robert Leonard III" <[EMAIL PROTECTED]>
To: "'Spamassassin-Talk (E-mail)'" <[EMAIL PROTECTED]>
Sent: Thursday, October 16, 2003 10:56 PM
Subject: [SAtalk] AWL not running... Or is it?? Please help.
> The last little b
On 16 Oct 2003 at 22:56, Robert Leonard III wrote:
> The last little bit of configuration is at hand.. SA 2.6 is running, on RH9,
> Qmail, Qmail-Scanner.. Sitewide Bayes.. Works wonderfully!!!
>
> But I can't get the AWL running! I have enabled it in the local.cf and
> given it a directory with
The last little bit of configuration is at hand.. SA 2.6 is running, on RH9,
Qmail, Qmail-Scanner.. Sitewide Bayes.. Works wonderfully!!!
But I can't get the AWL running! I have enabled it in the local.cf and
given it a directory with the correct permissions.. But I see no evidence
that it is bei
All the documentation for version 2.60 says that autowhitelist is turned on
by default and that by default the autowhitelist is stored in each users
config directory (e.g. ~/.spamassassin/autowhitelist)
When I installed spamassissin, it installed with no problem and is doing a
great job of filt
At 04:44 PM 10/8/2003, Marc Steuer wrote:
1. Is it possible to re-set AWL scores to 0 for particular e-mail
addresses?
Yep, see the manpage for spamassassin:
spamassassin --remove-addr-from-whitelist
---
This SF.net email is sponsored by: SF.
Friends,
I'm new to SA and have two questions to pose to the group.
1. Is it possible to re-set AWL scores to 0 for particular e-mail
addresses?
2. is there a Win32 version of an Outlook to RFC822 mailbox converter, (to
use with messages destined for sa-learn).
Thanks,
Marc
---
[ Apologies if this already appeared; I don't see it in the archives. ]
Howdy,
Just upgraded to 2.60, seems to work great for the most part! Catching
even more spam than before (as to be expected).
One thing which has become a bit of a problem - AWL seem to be much slower
in some cases, althoug
Howdy,
Just upgraded to 2.60, seems to work great for the most part! Catching
even more spam than before (as to be expected).
One thing which has become a bit of a problem - AWL seem to be much slower
in some cases, although I'm not sure why. My AWL is currently 146M, so
it's pretty hefty. I'v
At 12:44 PM 8/18/2003 -0400, rf wrote:
Hi,
How can I tweak or turn off (0.0) the AWL automatic whitelist adjustment,
that in effect gives a credit towards the 5.0 points necessary to trigger
a SPAM message?
In the long list of tests, I can find no protocol for a rule to accomplish
this.
Don't
Hi,
How can I tweak or turn off (0.0) the
AWL automatic whitelist adjustment, that in effect gives a credit towards the
5.0 points necessary to trigger a SPAM message?
In the long list of tests, I can find
no protocol for a rule to accomplish this.
Thanks, rf
Ok, USER_IN_WHITELIST has nothing to do with the AWL, but yes, it does look
at Sender:
Snipping from EvalTests.pm's subroutine all_from_addrs, which is used in
check_from_in_whitelist:
return $self->{main}->find_all_addrs_in_line
($self->get ('From') . # std
Justin Mason wrote:
Tom Allison said:
debug: lock: created /home/harvey/.spamassassin/auto-whitelist.lock.penguin.3
452
debug: lock: 3452 trying to get lock on /home/harvey/.spamassassin/auto-white
lis
t pass 0
debug: lock: link to /home/harvey/.spamassassin/auto-whitelist.lock ok
debug: lock: u
Tom Allison said:
> debug: lock: created /home/harvey/.spamassassin/auto-whitelist.lock.penguin.3
> 452
> debug: lock: 3452 trying to get lock on /home/harvey/.spamassassin/auto-white
> lis
> t pass 0
> debug: lock: link to /home/harvey/.spamassassin/auto-whitelist.lock ok
> debug: lock: unlinked
debug: lock: created /home/harvey/.spamassassin/auto-whitelist.lock.penguin.3452
debug: lock: 3452 trying to get lock on /home/harvey/.spamassassin/auto-whitelis
t pass 0
debug: lock: link to /home/harvey/.spamassassin/auto-whitelist.lock ok
debug: lock: unlinked /home/harvey/.spamassassin/auto-whi
Yes, I know about that issue with a global AWL. I've even authored some of
the posts discussing how horribly the AWL performs when there's a global
database.
So yes, I understand how the AWL smears your all_spam_to scores all over
the place and causes problems. I understand this and the mechani
Matt,
did you ever deploy SA system-wide and have all_spam_to for
some user set? In the case where you scan a mail once before any
delivering, SPAM comes through if only one receiver is in
all_spam_to and the spammers address goes into your central AWL
file with a very low score. The next SPAM fro
Ok, I don't know the answer to your question, but I'm wondering why you're
even asking it.
By default if you have different user_prefs files, then you don't have a
global AWL database.
The global AWL case only happens if SA is always run as one user, such as
root when run from a milter. In whi
Hi,
what is the reason for auto_whitelist_path being privileged? I want to
overwrite the setting from the global local.cf file in the user_prefs
file. Otherwise whitelist_to will lower scores for SPAM and this will
"poison" my global AWL.
cu,
Jan
---
Matt Kettler said:
> From what I can tell very few, if any at all, of the SpamAssassin
> developers use a global AWL. The fact that the severe 2.42 "white listing
> spammers using dictionary attacks against sites with global AWLs" wasn't
> caught prior to release strongly suggests they don't.
> Personally, I think the AWL is in general a fundamentally broken concept,
> however there are people out there who think otherwise. I will
> likely never use the AWL feature of SA in any form of production
environment.
> I see very minimal benefit from it's use, and a very long history of
severe
Well, this sounds reasonable, unfortunately I suspect it would be rather
difficult and kludgey for the AWL to be able to tell the difference. The
AWL operates as a score averager, nothing more, nothing less.
Personally, I think the AWL is in general a fundamentally broken concept,
however there
Over the last week I've started receiving more and more spam with negative
scores
due to the AWL. About half an hour ago I reset the AWL be sure (I also did
this
when installing 2.43). check_whitelist is already showing the AWL
whitelisting
spam:
tmh@betty:~/spamassassin-2.41/tools$ ./check_whit
On October 22, 2002 07:17 pm, Michael Moncur wrote:
> > Hmm? I upgraded to 2.43 the day it was released and noticed all
[snip]
> It sounds like your particular situation isn't one where
> autowhitelisting will do much good.
My conclusion too. I use tmda to handle my 1-1 type correspondence
> Hmm? I upgraded to 2.43 the day it was released and noticed all my
> spam email was being let through after about 2 weeks. I run spamd with
> the -a (autowhitelist optio) on. I have since turned off the
> auto-whitelist option and everything works fine since.
Version 2.43 definitely fixed
On Tue, Oct 22, 2002 at 06:58:31PM -0700, joe wrote:
> On October 22, 2002 06:26 pm, Duncan Findlay wrote:
> > On Wed, Oct 23, 2002 at 03:08:47AM +0200, Steffen Evers wrote:
> > > But it does exactlly the opposite: AWL gives -5.0 points, so it is
> > > no longer recognized as spam!
> > >
> > > Is t
On October 22, 2002 06:26 pm, Duncan Findlay wrote:
> On Wed, Oct 23, 2002 at 03:08:47AM +0200, Steffen Evers wrote:
> > But it does exactlly the opposite: AWL gives -5.0 points, so it is
> > no longer recognized as spam!
> >
> > Is this an intended behaviour?
>
> Yes... sort of. It WAS intended be
On Wed, Oct 23, 2002 at 03:08:47AM +0200, Steffen Evers wrote:
> But it does exactlly the opposite: AWL gives -5.0 points, so it is no
> longer recognized as spam!
>
> Is this an intended behaviour?
Yes... sort of. It WAS intended behaviour at the time. But we are
wiser now, and that change was r
Hi!
Using 2.42 (Debian testing package on woody)
AWL seems not to work the way it supposed to be:
I have removed the AWL files in order to reset the AWL data.
Than I have piped through the same spam message (9.50 hits, 5 required)
several times with 'spamassassin -a < spam-mail > spam-mail1.resul
on [mailto:lars@;unet.net.ph]
Sent: Sunday, October 20, 2002 8:05 AM
To: [EMAIL PROTECTED]
Subject: Re: [SAtalk] AWL issue
On Sat, Oct 19, 2002 at 03:16:05PM +0100, Nix wrote:
> On 19 Oct 2002, Lars Hansson moaned:
> I hope it's the originating IP that's being tracked and not the IP
altogether.
-Original Message-
From: Ollie Acheson [mailto:oacheson@;acheson.org]
Sent: Saturday, October 19, 2002 10:34 AM
To: [EMAIL PROTECTED]
Subject: Re: [SAtalk] AWL issue
On a related issue, I just upgraded to 2.43 primarily because of the
earlier AWL problems.
My question is, how
On a related issue, I just upgraded to 2.43 primarily because of the
earlier AWL problems.
My question is, how long will it take for the erroneous AWL entries
to work their way out of my AWL db?
Would I be better off deleting the AWL db and letting it start over?
Thanks,
Ollie
On Fri, Oct 18
On 19 Oct 2002, Lars Hansson moaned:
> On Sat, 2002-10-19 at 01:22, Matt Kettler wrote:
>> if it's 2.43, the AWL tracks both the from address AND the orginating IP.
>
> Uh, I do hope it's the IP that actually delivered the mesage to you that
> is being tracked and not the originating one?
I hope
1 or [EMAIL PROTECTED] at 172.1.1.1? If
it's [EMAIL PROTECTED] at 172.1.1.1, then AWL would be basically saying
[EMAIL PROTECTED] is a spammer which he's not.
-Original Message-
From: Lars Hansson [mailto:lars@;unet.net.ph]
Sent: Saturday, October 19, 2002 1:34 AM
To: [EMAIL PROTECT
From: Matt Kettler [mailto:mkettler@;evi-inc.com]
Sent: Friday, October 18, 2002 1:23 PM
To: Rose, Bobby; [EMAIL PROTECTED]
Subject: Re: [SAtalk] AWL issue
What version of SA are we talking about?
if it's 2.43, the AWL tracks both the from address AND the orginating
IP.
it would be highl
What version of SA are we talking about?
if it's 2.43, the AWL tracks both the from address AND the orginating IP.
it would be highly unlikely that a spammer could forge such a thing and
drive their score up.
Can you provide some more detail about which SA you are running? there's
major change
Should SA have a minimum message size check to counter an AWL score. I
had someone sending test messages, but because their AWL score was 23.5
it was tagged as spam. I'm still scratching my head on how they got
such a high AWL score.
My thought on that matter is that if a spammer was to send t
Hi everyone. I've looked through the archives and couldn't find a solution.
I see other people have had this problem though so I thought I'd post.
Here's the situation. I'm sure everyone has seen the spam that comes in
looking like you sent it to yourself. I get spam sent to me "from me"...
spamm
Great. I will look for 2.43. In the meantime, off goes AWL.
Ollie
On Sat, Oct 12, 2002 at 05:15:10PM -0400, Matt Kettler wrote:
> Yes, the 2.42 AWL had a new feature that turned out to be a bug. It's also
> a problem that's already been recognized and is already fixed in CVS.
>
> http://www.hug
Yes, the 2.42 AWL had a new feature that turned out to be a bug. It's also
a problem that's already been recognized and is already fixed in CVS.
http://www.hughes-family.org/bugzilla/show_bug.cgi?id=1071
Relevant quotes:
--- Additional Comments From [EMAIL PROTECTED] 2002-10-08 06:51 -
Same here. Lots of obvious spam, many rules invoked, but AWL letting
the dirt in. Very disappointing.
Ollie
On Mon, Oct 07, 2002 at 12:07:36PM -0500, Rob.Remus wrote:
> Since upgrading from 2.40 to 2.42 we have been seeing some strange stuff
> with the AWL. We're getting obvious spam matching n
Since upgrading from 2.40 to 2.42 we have been seeing some strange stuff
with the AWL. We're getting obvious spam matching numerous rules, including
the AWL, which results in negative scores, some < -90.
X-MailScanner-SpamCheck: not spam, SpamAssassin (score=-57.2, required 5,
AWL, C
OK, I've made the AWL now gradually lower scores for a From/IP address
combo over time (in HEAD); I reckon this should be safe, now that we track
IPs and the forged-From thing is not a problem any more.
--j.
---
This sf.net email is sponsored
On Mon, 15 Jul 2002 the voices made Stacey Conrad write:
> Does the auto whitelisting work against you if, say, a user forwards you
> their spam for blocking?
The name is confusing, because it's more of an "auto white or black
list"-thing; sliding the scores up or down to even the average score
I am running spamd with the -a flag. I was under the impression that
turning on the auto-whitelisting feature was a good thing, until I received
an email from a friend with the following score:
SPAM: Content analysis details: (13.3 hits, 9 required)
SPAM: IN_REP_TO (-3.4 points) Fo
Olivier, I think it's probably only for recent subscribers that you're now in
the toilet:
[craig@belphegore spamassassin]$ tools/check_whitelist |fgrep ait.ac
-3.8 (-118.8/31) -- [EMAIL PROTECTED]
-2.3 (-207.9/91) -- [EMAIL PROTECTED]
Anyone who's seen 120-odd messages from you will ha
Read the README :) It explains how the AWL works in detail. What's happened is
probably that you've only recently joined the list, and the only mail you'd
previously seen from Olivier was his 30_text_fr.cf posting, which scores
somewhere in the region of 60, polluting his AWL listing.
C
Kingsl
>I was surprised to see that the "AWL: Auto-whitelist
>adjustment" rule added 31.1 (thirty-one point one!) to
>the score of the following email from this very list
>server.
I hope I will not get white/blak listed on this answer...
The previous mail I sent had a very very bad score, so I got my
I was surprised to see that the "AWL: Auto-whitelist
adjustment" rule added 31.1 (thirty-one point one!) to
the score of the following email from this very list
server.
That was easily enough to mis-flag it as spam.
I'd appreciate it if someone would explain how an AWL
adjustment is supposed
I am trying to deploy spamassassin site-wide on a Sun/Solaris machine but am
having a few difficulties.
[a.] I can't get spamd to run. I am using 'perl spamd' (because perl isn't
in the /usr/perl5/5.00503/bin/perl path) and get the error:
Can't locate syslog.ph in @INC (did you run h2ph?) (@INC
Craig Hughes wrote:
> I think the probably most effective blacklist-type use of the AWL
> would be in
> calculating zero-frequency a-priori probabilities for new
> recipients who were
> not previously in the AWL. As I mentioned before, if after say 1 month of
> populating the AWL through normal
Matt Sergeant wrote:
MS> Personally I think the implementation of whitelisting is broken - if
MS> it's whitelisted or blacklisted we should be scanning period. But our
MS> white/blacklisting is implemented separately here, so you're unlikely to
MS> see a fix coming direct from me, I'm afraid (unl
Nathan Neulinger wrote:
NN> Was this changed recently? Cause it most definately did not work for me
I definitely think there's something weird going on in the short-circuit code.
I'll take a look at it and it'll probably be pretty clear what's up.
C
___
Well, AWL can't really run first. It more or less *has* to run last. But
there's no reason it can't run last, after the early-terminate has terminated:
while(early-terminate condition not met)
{
step through some rules
}
check awl here
as opposed to treating AWL as just another rule.
C
Mat
Nathan Neulinger wrote:
> Matt Sergeant wrote:
>
>>On Thu, 2002-05-02 at 19:31, Neulinger, Nathan wrote:
>>
>>>The biggest problem with -S is due to the ordering of the rule checks.
>>>If all of the negative rules (or at least the _large_ negative rules)
>>>were processed first, it would probably
Matt Sergeant wrote:
>
> On Thu, 2002-05-02 at 19:31, Neulinger, Nathan wrote:
> > The biggest problem with -S is due to the ordering of the rule checks.
> > If all of the negative rules (or at least the _large_ negative rules)
> > were processed first, it would probably be ok
>
> All the large
On Thu, 2002-05-02 at 19:31, Neulinger, Nathan wrote:
> The biggest problem with -S is due to the ordering of the rule checks.
> If all of the negative rules (or at least the _large_ negative rules)
> were processed first, it would probably be ok
All the large negative rules *are* processed first
Charlie Watts wrote:
CW> And, hey, if you've got ESP math working even to the point of a test
CW> release, you can quit your day job.
CW>
CW> I haven't actually noticed it to be a useful blacklisting tool, anyway.
CW> I've had it in my head that it could be useful as both, but haven't seen
CW> it
And, hey, if you've got ESP math working even to the point of a test
release, you can quit your day job.
I haven't actually noticed it to be a useful blacklisting tool, anyway.
I've had it in my head that it could be useful as both, but haven't seen
it dragging otherwise-uncaught spam across the
Neulinger, Nathan wrote:
NN> The biggest problem with -S is due to the ordering of the rule checks.
NN> If all of the negative rules (or at least the _large_ negative rules)
NN> were processed first, it would probably be ok, but right now (or at
NN> least with 2.20) - if you enabled it, the white
Sidney Markowitz wrote:
SM> The fact that the -S option is reasonable points out that the scoring is
SM> not a linear measure of spamminess. The function P(s) of the probability
SM> that a message with score s is spam stays near 0 until some small
SM> positive s, then asymptotically approaches 1
I think that AWL will just be whitelist-only if you use -S; you're not going to
be able to get around that I think. If you use -S, you're not going to be able
to guess what the score would have been if you'd let thing keep running and not
short-circuited. I can't think of any posisble adjustment
souri - Rolla Phone: (573) 341-4841
Computing Services Fax: (573) 341-4216
> -Original Message-
> From: Sidney Markowitz [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, May 02, 2002 1:11 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] AWL ve
On Thu, 2002-05-02 at 09:16, Charlie Watts wrote:
> It has just occured to me that this will adjust the AWL math because
> I won't be getting "big" positive numbers into the AWL any more.
The fact that the -S option is reasonable points out that the scoring is
not a linear measure of spamminess.
I've been running with the site-wide AWL and the spamd -S early-terminate
option.
It has just occured to me that this will adjust the AWL math because I
won't be getting "big" positive numbers into the AWL any more.
And I suppose this makes it more of an Auto-WHITE-list than an Auto-WHITE
& BLAC
Charlie Watts wrote:
CW> Date: Tue, 9 Apr 2002 10:31:02 -0600 (Mountain Daylight Time)
CW> From: Charlie Watts <[EMAIL PROTECTED]>
CW> To: [EMAIL PROTECTED]
CW> Subject: [SAtalk] AWL as loophole
CW>
CW> I may have posted about this yesterday, but if so - I don't see
I may have posted about this yesterday, but if so - I don't see that I
did.
I'm starting to get more and more spam that is From: and To: my address.
This stuff is ending up in my Inbox because the AWL loves me. It would
otherwise be tagged.
It has been discussed before, a bit - a way to short-ci
79 matches
Mail list logo
