[SAtalk] Spamassassin hangs, procmail kills it, corrupted mailbox

2002-05-16 Thread Mark Bynum
Hello, I've been getting an increasing problem where spamassassin will hang (take longer than procmail, by default, thinks it should take) and procmail will kill it. Then procmail, I think, sticks a corrupted message in my mailbox because it thinks it got the whole message when it didn't. This on

Re: [SAtalk] two newbie questions

2002-05-16 Thread Nix
On Wed, 15 May 2002, Craig R. Hughes mused: > Nix wrote: > > N> On Wed, 15 May 2002, Michael Stenner said: > N> > Genetic Algorithm. Clever method for optimizing complicated > N> > mathematical systems. > N> > N> Or, rather, for searching large and irregularly defined spaces (spaces > N> that ar

Re: *****SPAM***** [SAtalk] One detected as -67 points??

2002-05-16 Thread Christian Wendt
Am Mit, 2002-05-15 um 16.18 schrieb Jim Scott: > SPAM: Content analysis details: (39.9 hits, 5 required) > SPAM: Hit! (-0.1 points) Subject: ends in a question mark > SPAM: Hit! (3.0 points) BODY: Contains "Toner Cartridge" [...] > SPAM: Hit! (3.0 points) Listed in Razor, see http://razor.so

Re: [SAtalk] botched MIME tests?

2002-05-16 Thread Matt Sergeant
Vivek Khera wrote: > I read email with VM in XEmacs, and every once in a while it complains > about bothced MIME like this: > > From: <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Subject: Learn How To Grow Your Portfolio >9806Dl5 > Date: Wed, 15 May 2002

[SAtalk] Re: [STALK] spamc/spamd hanging (was spamd dying)

2002-05-16 Thread Dave Strickler
I know this sounds like a stupid newbie work around, but I thought I would throw it out there and see who tells me "now Dave, this can't be done because"  ;-)   I found the .sh file that is used to start/stop/status the spamd. I now have a cron job that monitors for the spamd process to d

Re: [SAtalk] submitting spam to the razor

2002-05-16 Thread David T-G
Michael, et al -- ...and then Michael Stenner said... % % On Wed, May 15, 2002 at 03:41:01PM -0500, David T-G wrote: % > % Razor wants all spam that is VERIFIED BY A HUMAN to be spam.* So yes, % > % > So even if SA says that it racks up an 11.7 I should send it in, either % > 'cuz I got it at

Re: [SAtalk] checking my own spam pool for fine tuning

2002-05-16 Thread David T-G
Craig -- ...and then Craig R Hughes said... % % Check out the /masses directory in the distribution. It has all that stuff in % there, and a README which I think is more or less up to date. Ah, cool. Thanks. I have some questions about what constitutes "spam scattered through mailboxes" and

[SAtalk] Report entire mbox file?

2002-05-16 Thread David Gibbs
Folks: I've got procmail filtering my spam into a special mailbox in my IMAP folders. Is there any way to submit the entire mailbox, full of collected spam, through the reporting feature (spamassassin -r)? razor-report has the -M parameter that allows this, it would be nice if SA had something si

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread Theo Van Dinter
On Thu, May 16, 2002 at 08:41:06AM -0500, David Gibbs wrote: > Is there any way to submit the entire mailbox, full of collected spam, > through the reporting feature (spamassassin -r)? > razor-report has the -M parameter that allows this, it would be nice if SA > had something similar. You may be

[SAtalk] SpamAssassin on firewall or relay box

2002-05-16 Thread Brian Snipes
Are there any step-by-step FAQs or HowTos on implementing SpamAssassin on a relay server and does anyone currently have this implemented? Which would be the easiest to setup/manage with SpamAssassin as a relay box - Exim, Postfix, Sendmail, Qmail, ...? Brian Snipes __

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread David T-G
David -- ...and then David Gibbs said... % % I've got procmail filtering my spam into a special mailbox in my IMAP % folders. Always a good idea. % Is there any way to submit the entire mailbox, full of collected spam, % through the reporting feature (spamassassin -r)? It depends on your mai

RE: [SAtalk] SpamAssassin on firewall or relay box

2002-05-16 Thread Dallas Engelken
> -Original Message- > From: Brian Snipes [mailto:[EMAIL PROTECTED]] > Sent: Thursday, May 16, 2002 9:15 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] SpamAssassin on firewall or relay box > > > Are there any step-by-step FAQs or HowTos on implementing > SpamAssassin on a > relay serv

Re: [SAtalk] SpamAssassin on firewall or relay box

2002-05-16 Thread dman
On Thu, May 16, 2002 at 09:14:44AM -0500, Brian Snipes wrote: | Are there any step-by-step FAQs or HowTos on implementing SpamAssassin on a | relay server and does anyone currently have this implemented? Which would be | the easiest to setup/manage with SpamAssassin as a relay box - Exim, Postf

[SAtalk] Re: several messages

2002-05-16 Thread Bart Schaefer
On Wed, 15 May 2002, Henrick Yau wrote: > >From > > becomes > > rom On Thu, 16 May 2002, Mark Bynum wrote: > I've been getting an increasing problem where spamassassin will hang (take > longer than procmail, by default, thinks it should take) and procmail > will kill it. > > Every time t

Re: [SAtalk] submitting spam to the razor

2002-05-16 Thread Scott Nelson
At 08:12 AM 5/16/02 -0500, David T-G wrote: >% > So now how far back should I go? I have *lots* of old, confirmed >% > spam (see my other thread; I have lots of confirmed not-spam, too). >% > Is anything over, say, an hour old useful? >% >% Sure. >% >% 1) internet propagation can be weird >% >

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread David Gibbs
Theo Van Dinter said: > On Thu, May 16, 2002 at 08:41:06AM -0500, David Gibbs wrote: >> Is there any way to submit the entire mailbox, full of collected spam, >> through the reporting feature (spamassassin -r)? >> razor-report has the -M parameter that allows this, it would be nice >> if SA had so

Re: [SAtalk] Can I train the GA?

2002-05-16 Thread Vivek Khera
> "ON" == Olivier Nicole <[EMAIL PROTECTED]> writes: ON> Now, a score has to be assigned for each rule, so the GA and as ON> importantly a corpus of spam/non-spam is used. But going into too many ON> details may also be confusing as most of the users will not need to ON> deal with the GA. Gi

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread Theo Van Dinter
On Thu, May 16, 2002 at 10:25:43AM -0500, David Gibbs wrote: > One enhancement I could suggest though ... provide an option to remove the > message from the mbox file after it has been reported. I don't want to go editing files. The way I use it is that I have a script which takes the mbox and r

[SAtalk] INPUT_MAIL_FILTER lines for spamass-milter?

2002-05-16 Thread Graham Dunn
Anyone have a set of timeout values that works well for them? I'm seeing the problem that messages > 250kb will get timed out when going through spamassassin... I'm using INPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/sendmail/spamass.sock, F=, T=C:15m;S:4m;R:4m;E:10m') (picked off the web

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread Hallikainen HAROLD Friends
After reading this thread fo a while, I wonder why one would want to report spam that sa has already caught? It seems to me (and I've only been using SA a few days), that you'd want to report spam that it missed. By the way, I'm VERY impressed with SA! I had one false positive from

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread Theo Van Dinter
On Thu, May 16, 2002 at 08:42:15AM -0700, Hallikainen HAROLD Friends wrote: > After reading this thread fo a while, I wonder why one would want > to report spam that sa has already caught? It seems to me (and I've only > been using SA a few days), that you'd want to report spam that it misse

Re: [SAtalk] 2nd of 2 problems... using spamc vs. spamassassindirect...

2002-05-16 Thread Chuck Wolber
I'm seeing the same problem as well. We discussed this a while back and nothing really came of it. Periodically I will try some different arguments in the startup script or the procmail recipe, but the fact remains that everything seems to be ignored unless you use spamassassin -P in the procmail

Re: [SAtalk] 2nd of 2 problems... using spamc vs. spamassassin direct...

2002-05-16 Thread Ward Vandewege
This works just fine for me: # Run the mail through SpamAssassin :0fw | spamc # And check the results... :0 * ^X-Spam-Flag: YES personal/dialupmaybespam/ spamc is in my path, I'm running SA 2.20. My spamc lives in /usr/local/bin/spamc. Sure you don't have path problems? Bye for no

[SAtalk] Undisclosed.Recipients@

2002-05-16 Thread Chris Petersen
like the subject says... This is one of the most common spam recipients that I receive... would be nice to get it added to the master list. also, what's the reasoning for not letting users define filtration regex's in their user files? -Chris __

Re: [SAtalk] Undisclosed.Recipients@

2002-05-16 Thread Michael Stenner
On Thu, May 16, 2002 at 09:52:13AM -0700, Chris Petersen wrote: > also, what's the reasoning for not letting users define filtration regex's > in their user files? It depends on your setup. If each user is invoking spamassassin directly form procmailrc, then it's no problem. If spamd is runnin

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread Chuck Wolber
> I've got procmail filtering my spam into a special mailbox in my IMAP > folders. Is there any way to submit the entire mailbox, full of > collected spam, through the reporting feature (spamassassin -r)? > razor-report has the -M parameter that allows this, it would be nice if > SA had somethin

Re: [SAtalk] 2nd of 2 problems... using spamc vs. spamassassindirect...

2002-05-16 Thread Chuck Wolber
This works for me: -- :0fw | /usr/bin/spamassassin -P - This results in no discernable scanning: - :0fw | /usr/bin/spamc - > > > # Run the mail through SpamAssassin > :0fw > | spamc > > # And check the results... > :0 > * ^X-Spam-Flag: YES > per

Re: [SAtalk] Undisclosed.Recipients@

2002-05-16 Thread Chris Petersen
> It depends on your setup. If each user is invoking spamassassin > directly form procmailrc, then it's no problem. If spamd is running > as root (or some other user), then there can be security concerns, > especially since some of the rules require an eval. aha, that makes sense, then...Ev

[SAtalk] spam-alike that came through

2002-05-16 Thread David T-G
Hi, all -- I'm curious as to why the attached mail made it through with such a low score. I've just read six months' worth of postings regarding the sightings list and am now thoroughly confused regarding how I should submit (RFC822 MIME attachment, I think), what I should submit (actual spam th

Re: [SAtalk] 2nd of 2 problems... using spamc vs. spamassassin direct...

2002-05-16 Thread dman
On Thu, May 16, 2002 at 10:12:53AM -0700, Chuck Wolber wrote: | This results in no discernable scanning: | | - | :0fw | | /usr/bin/spamc | - What happens if you run echo "test" | spamc at a shell prompt? You did start spamd before running spamc, right? -D -- A)bort, R)

Re: [SAtalk] Undisclosed.Recipients@

2002-05-16 Thread dman
On Thu, May 16, 2002 at 09:52:13AM -0700, Chris Petersen wrote: | like the subject says... This is one of the most common spam recipients | that I receive... Is it a properly formatted header according to the relevant RFCs? If not, this entry in an ACL in my exim.conf rejects it at SMTP time

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread Skip Montanaro
>> Is there any way to submit the entire mailbox, full of collected >> spam, through the reporting feature (spamassassin -r)? Chuck> Check out something called formmail I think you might have better luck searching for "formail". ;-) Try this: formail -s spamassassin -r <

Re: [SAtalk] Undisclosed.Recipients@

2002-05-16 Thread Chris Petersen
> Is it a properly formatted header according to the relevant RFCs? If > not, this entry in an ACL in my exim.conf rejects it at SMTP time. not sure there. presumably it's all ok. > If you want, how about coming up with a test like exim's that looks > for syntactic validity of the header. All

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread David T-G
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Skip, et al -- ...and then Skip Montanaro said... % % >> Is there any way to submit the entire mailbox, full of collected ... % I think you might have better luck searching for "formail". ;-) Try this: % % formail -s spamassassin -r < mbox

[SAtalk] Speed/Performance Issue

2002-05-16 Thread Justin Robinson
Hi all, I just barely subscribed to the list and I have a question...     We did a bit of an experiment in using SpamAssassin over the past month and just disabled it last night.  We have roughly 9000 email accounts on our server and we mass-enabled spam assassin for them.  Only 78 used the

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread Theo Van Dinter
On Thu, May 16, 2002 at 02:24:51PM -0500, David T-G wrote: > Oh! So spamassassin expects and can handle only a single message at a > time, or at least particularly with the -r flag? Maybe I didn't really > submit some 8300 messages of collected spam to razor after all! Correct. You probably re

[SAtalk] What's wrong with this rule?

2002-05-16 Thread Skip Montanaro
Given these lines in my user_prefs file: header MUSI_CAL_GIG_GOPHER Subject: =~ /Musi-Cal Tour Fetch:/ describe MUSI_CAL_GIG_GOPHERSubject: indicates it's a Gig Gopher message score MUSI_CAL_GIG_GOPHER -5.0 spamd -F reports (wrapped): debug: Failed to parse line in S

Re: [SAtalk] What's wrong with this rule?

2002-05-16 Thread Theo Van Dinter
On Thu, May 16, 2002 at 03:40:42PM -0500, Skip Montanaro wrote: > header MUSI_CAL_GIG_GOPHER Subject: =~ /Musi-Cal Tour Fetch:/ > > The format looks just like the examples in the Mail::SpamAssassin::Conf man > page and the 20_header_test.cf file to me. The regular expression is pretty > tri

Re: [SAtalk] Speed/Performance Issue

2002-05-16 Thread Daniel Rogers
On Thu, May 16, 2002 at 03:39:44PM -0400, Justin Robinson wrote: > We did a bit of an experiment in using SpamAssassin over the past month and > just disabled it last night. We have roughly 9000 email accounts on our > server and we mass-enabled spam assassin for them. Only 78 used the opt-out >

Re: [SAtalk] 2nd of 2 problems... using spamc vs. spamassassindirect...

2002-05-16 Thread Bart Schaefer
On Thu, 16 May 2002, Chuck Wolber wrote: > This works for me: > -- > :0fw > | /usr/bin/spamassassin -P > - > This results in no discernable scanning: > - > :0fw > | /usr/bin/spamc Just for grins, what happens if you change that to :0fw | /usr/bin/spamc -u

Re: [SAtalk] Speed/Performance Issue

2002-05-16 Thread Theo Van Dinter
On Thu, May 16, 2002 at 01:49:26PM -0700, Daniel Rogers wrote: > Were you using spamc/spamd? For a few days there, Razor was responding very slowly. Have you optimized the SA configuration to do only local checks? With enough waiting around for something like Razor, your load would go up signif

Re: [SAtalk] Report entire mbox file?

2002-05-16 Thread David T-G
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo, et al -- ...and then Theo Van Dinter said... % % On Thu, May 16, 2002 at 02:24:51PM -0500, David T-G wrote: % > Oh! So spamassassin expects and can handle only a single message at a % > time, or at least particularly with the -r flag? Maybe

RE: [SAtalk] Speed/Performance Issue

2002-05-16 Thread Justin Robinson
We are not using Razor, so I do not believe it should be an issue with that. Justin -Original Message- From: Theo Van Dinter [mailto:[EMAIL PROTECTED]] Sent: Thursday, May 16, 2002 4:55 PM To: Justin Robinson; spamtalk (E-mail) Subject: Re: [SAtalk] Speed/Performance Issue On Thu, M

Re: [SAtalk] What's wrong with this rule?

2002-05-16 Thread Skip Montanaro
>> The format looks just like the examples in the >> Mail::SpamAssassin::Conf man page and the 20_header_test.cf file to >> me. The regular expression is pretty trivial too. What am I >> missing? Theo> Try "Subject", not "Subject:". Nope, that's not it... :-( I had alread

[SAtalk] From rule

2002-05-16 Thread Matt Thoene
Hello, I just got the below spam and didn't see a hit for the empty "From" line. Shouldn't the NO_REAL_NAME test have caught this? Thanks. -- Matt X-Mail-Format-Warning: Bad RFC822 header formatting in >From matt Thu May 16 13:19:16 2002 Return-Path: <[EMAIL PROTECTED]> Delivered-To: [EM

Re: [SAtalk] What's wrong with this rule?

2002-05-16 Thread Skip Montanaro
>>> What am I missing? Theo> Try "Subject", not "Subject:". Skip> Nope, that's not it... :-( I had already tried "subject" and "Subject". Skip> Should have mentioned it in my post. Found it. In the ::Conf man page it says: These settings differ from the ones above, in tha

[SAtalk] mimedefang-filter

2002-05-16 Thread Daniel Rogers
By popular demand, here's my mimedefang-filter script. If you use it, please be sure to change the email addresses in it. :) The only part that I still do in /etc/procmailrc is to check for 'X-Spam-Flag: YES' and redirect the mail accordingly. (And yes, I know that mimedefang says you shouldn'

Re: [SAtalk] Speed/Performance Issue

2002-05-16 Thread Sidney Markowitz
On Thu, 2002-05-16 at 12:39, Justin Robinson wrote: > We are running FreeBSD 4.3-Release, sendmail 8.12.2, procmail 3.15.1, and > spamassassin 2.11 Some of the bugs that have been reported and fixed since 2.11 had to do with rules with regexps that took really long times at high loads on some inp

Re: [SAtalk] Undisclosed.Recipients@

2002-05-16 Thread Daniel Quinlan
Chris Petersen <[EMAIL PROTECTED]> writes: > anyway, just a suggestion. It's a "check" on a variety of other spam > filters that I've seen, so I thought I'd mention it. We already have both a check for valid undisclosed recipients and invalid ones. I recently tweaked the invalid one to match

Re: [SAtalk] shirts?

2002-05-16 Thread Jeremy Zawodny
On Wed, May 15, 2002 at 03:34:47PM -0400, Bryan Fullerton wrote: > One of my users who really, really likes SA was wondering if there > are t-shirts available. :) If the GNUS MUA can have a t-shirt, certainly SA can. :-) Jeremy -- Jeremy D. Zawodny | Perl, Web, MySQL, Linux Magazine, Yaho

Re: [SAtalk] Weird false negative...

2002-05-16 Thread Jeremy Zawodny
On Wed, May 15, 2002 at 04:29:03AM -0600, Michael Moncur wrote: > >Using the -t flag I'm told the USER_IN_WHITELIST test contributed a -100 to > >the hits. Unfortunately, I don't have any ebay.com addresses (or glob > >patterns involving ebay.com) in my user_prefs file. > > I think the 60_whitel

[SAtalk] Whitelist Mystery

2002-05-16 Thread Harold L. Brooks
The whitelist_from, whitelist_to, AWL and blacklist functions are not working. Everything else in SA 2.20 seems to work well. These are critical features for my users. I have installed SA 2.20 on a RH 6.2 box. Sendmail. There is only one "real" user on the system, me. I am also

[SAtalk] Wolfgang Fuertbauer: Ich binaußer Haus! / I'm out of the office

2002-05-16 Thread Wolfgang . Fuertbauer
Ich werde ab 16.05.2002 nicht im Büro sein. Ich kehre zurück am 21.05.2002. Ich werde Ihre Nachricht(en) nach meiner Rückkehr beantworten. mfg I will answer after returning to the office. Regards Wolfgang Fuertbauer ___ Have big pi

[SAtalk] spamc/spamd not working with -a ...

2002-05-16 Thread Skip Montanaro
>From the messages I've seen recently on this subject, I don't think I'm the only person who can't get the spamc/spamd combination working. I'm using SA v2.11 on a Mandrake 8.1 system with perl 5.6.1. (Well, now I'm running 2.20. See below.) If I run spamd from a terminal window as root like

[SAtalk] Manipulate SA settings remotely?

2002-05-16 Thread Skip Montanaro
I have a question for those of you who administer machines that run SA. If your users don't have login accounts (e.g., /bin/false as a shell), how do they fiddle their user_prefs? Or don't they? Thx, -- Skip Montanaro ([EMAIL PROTECTED] - http://www.mojam.com/) "Excellant Written and Communic

[SAtalk] Re: several messages

2002-05-16 Thread Mark Bynum
Is this same problem in procmail 3.15.2 or 3.21? I'd rather try and get a better procmail than have everyone have to add those two lines to procmail, so that it works on every recipe. Have you asked for the patch on the procmail-dev list? I'll ask, if not. Thanks, Mark On Thu, May 16, 2002 at 0

RE: [SAtalk] Manipulate SA settings remotely?

2002-05-16 Thread Justin Robinson
I wrote a simple CGI interface which allows them to make modifications to their accounts. It simply puts the information into a mysql table. Justin -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Skip Montanaro Sent: Thursday, May 16, 2002 11:38 PM T