Re[2]: [SAtalk] Can I delete ham/spam email once I run sa-learn on them w/o impacting the database?

Hello Blake, Wednesday, October 29, 2003, 6:53:41 AM, you wrote: BTG> Also, any given email in my SPAM folder will only go BTG> through sa-learn a maximum of 7 times. But this should BTG> not matter. Question: Since once it's learned once, BTG> sa-learn ignores it, right? It depends on the size

[SAtalk] Re: Consonant and Vowel Pairs or Sequences

On 28 Oct 2003 16:21:58 +0200, I posted to spamassassin-talk: > 2. (For completeness, figure out the mapping between the original > naming scheme and the one used in SpamAssassin. This is outlined > in lm/README but it would be beneficial to get an actual mapping. > I attach one I

[SAtalk] Re: [RD] Open source is Naughty!!!

On Wed, 29 Oct 2003 13:53:02 -0500, Chris Santerre <[EMAIL PROTECTED]> posted to spamassassin-talk: > /pen.s/i > Which was just trying to get past obfuscations. Well, anything that > mentions: > "Open source" in subject gets tagged as naughty! > So would this be better: > /[^oO]pen.s/i This

[SAtalk] RE: How can I mark all mails with specific words in the subject as spam?

In article <[EMAIL PROTECTED]>, [EMAIL PROTECTED] says... > It isn't SA you want, it's procmail. The formail tool in the procmail > package will do anything like this that you want. > > William L. Polhemus, Jr. P.E. > Polhemus Engineering Company > Katy, Texas USA > I know that procmail could fi

[SAtalk] How to turn off and on SpamAssassin?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Spamasssasin taking %40 of the processes on my Cobalt RAQ 550 box I need to stop and restart spam services, How could I do it from command line? Kind Regards Tunc -BEGIN PGP SIGNATURE- Version: PGP 8.0.2 iQCVAwUBP6DNZBPf6GbuWkEpAQLhe

[SAtalk] Re: How can I mark all mails with specific words in the subject as spam?

On Thu, 30 Oct 2003 09:16:50 +0100, Gerhard Hofmann <[EMAIL PROTECTED]> posted to spamassassin-talk: gmane.mail.spam.spamassassin.general: > In article <[EMAIL PROTECTED]>, [EMAIL PROTECTED] > says... >> It isn't SA you want, it's procmail. The formail tool in the procmail >> package will do a

RE: [SAtalk] Bayes spam-ham or ham-spam ratios

Your bayes_auto_learn_threshold_nonspam should be a LOT lower than 6. If you've actually been learning emails which score 5.9 as non-spam then you've most likely poisoned your bayes database, especially with 2.55 as many spams are now being proliferated to deliberately score less than 5 with SA2.5

[SAtalk] outlook corpus?

All, I have amassed a pretty large corpus of spam (over 16,000 messages). Unfortunately they are just in a folder in my Outlook. (Sorry. I like it.) And, they are all attached to the SA-generated report message. I've mined Google and the archives. I've found some references to converting Outlook f

RE: [SAtalk] Bayes spam-ham or ham-spam ratios

Sound advice. Thanks for the reply and input - both are greatly appreciated! And thanks again to Ryan More and Matt Kettler. --Larry > -Original Message- > From: Giles Coochey > Sent: Thursday, October 30, 2003 6:55 AM > To: Larry Gilson; [EMAIL PROTECTED] > Subject: RE: [SAtalk] Bayes

RE: [SAtalk] Exessive HTML Code

Thanks Jennifer! I should have know you would be on top of this. --Larry > -Original Message- > From: Jennifer Wheeler > Sent: Wednesday, October 29, 2003 11:11 AM > To: 'Larry Gilson'; 'Mark Ritchie'; > [EMAIL PROTECTED] > Subject: RE: [SAtalk] Exessive HTML Code > > > > > > Yes,

[SAtalk] How do I filter something like this?

I can't see any recognized words in this: There is no other way to enlarge your penis... Please STOP and read if you are serious and interested in gaining length and width to your penis! hisuoadvycqsmb rbnzokbewprt Stop buying pumps and doing useless exercises! These method

[SAtalk] File of mail for sa-learn

Title: Message What is the format of the files of ham/spam fed to sa-learn? Can I use Outlook .pst files?   Thanks   Alan Stanier Essex University Computing Service  

RE: [SAtalk] Duplicate postings. (clarification)

On Wed, 29 Oct 2003, Colin A. Bartlett wrote: > Charles Gregory Sent: Wednesday, October 29, 2003 4:33 PM > > > Just at a rough guess, I would say that whoever resides on or near > > [EMAIL PROTECTED] or 'force9.net' has > > something strange in their mail handling that is re-mailing articles? >

[SAtalk] What's the best way to filter the following?:

What's the best way to filter the following?: hi, howard.brazee http://www.xzxdd.com/mi/";>http://www.erfdewwq.com/h.jpg";> http://www.xzxdd.com/h.html";>aoveiyr --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.

Re: [SAtalk] outlook corpus?

On Thu, 30 Oct 2003 07:17:07 -0500, Colin A. Bartlett <[EMAIL PROTECTED]> wrote: want are really attached to those in my Outlook. Anyone know of a tool or method of generating an mbox or other file from my Outlook messages for use in checking rules and such? Colin, check this: http://www.sourc

RE: [SAtalk] What's the best way to filter the following?:

> -Original Message- > From: Howard Brazee [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 30, 2003 8:55 AM > To: Spamassassin-Talk (E-mail) > Subject: [SAtalk] What's the best way to filter the following?: > > > What's the best way to filter the following?: > > hi, howard.brazee >

RE: [SAtalk] How do I filter something like this?

> -Original Message- > From: Howard Brazee [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 30, 2003 8:45 AM > To: Spamassassin-Talk (E-mail) > Subject: [SAtalk] How do I filter something like this? > > > I can't see any recognized words in this: > > > > > *snip* OBFU This is a

Re: [SAtalk] RE: How can I mark all mails with specific words in the subject as spam?

Gerhard Hofmann wrote: I thought I could furtherly improve configuration by adding something like "whitelist_subject" or "blacklist_subject". It seems to me that'd be pretty redundant... There's a mechanism in place already to score e-mails that have specific tags in the subject. For examp

[SAtalk] Using MRTG to display highest connection counts

Hello, Is there someone who has used MRTG to display highest connection counts? Though not necessarily spam, I would like to get an overview of who has been trying to connect an inordinate amount of times during the day. Thanks, - Mark --- T

Re: [SAtalk] File of mail for sa-learn

At 01:58 PM 10/30/03 +, you wrote: What is the format of the files of ham/spam fed to sa-learn? Can I use Outlook .pst files? You can't directly use the outlook .pst format with sa-learn.. sa-learn supports 2 file formats: The default is single-message per file in RFC 822 format, or a direc

RE: [SAtalk] outlook corpus?

> > All, > > I have amassed a pretty large corpus of spam (over 16,000 messages). > Unfortunately they are just in a folder in my Outlook. > (Sorry. I like it.) > And, they are all attached to the SA-generated report > message. I've mined > Google and the archives. I've found some references

Re: [SAtalk] outlook corpus?

At 07:17 AM 10/30/03 -0500, Colin A. Bartlett wrote: I've mined Google and the archives. I've found some references to converting Outlook files to mbox format. That would work I believe except that the messages I want are really attached to those in my Outlook. Anyone know of a tool or method of g

RE: [SA Hits: 10.90] [SAtalk] How do I filter something like this ?

In addition to the Popcorn/Backhair rules chris mentioned, also look for a rawbody rule to catch the *invisible* text: My rule looks like: describe MY_RBDY_INVSTXTMY: Invisible text color rawbody MY_RBDY_INVSTXT//i scoreMY_RBDY_INVSTXT2.0 I know Outlook is going to wrap the

Re[2]: [SAtalk] Can I delete ham/spam email once I run sa-learn on them w/o impacting the database?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Abigail, Blake, Tuesday, October 28, 2003, 10:19:18 PM, Abigail wrote: AM> The only reason to keep old spam on hand is (a) if you might AM> need to retrieve it because of false positives, and (b) if AM> your Bayes database gets corrupted and yo

RE: [SAtalk] [RD] Useless HTML Code

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Larry Gilson > Sent: Thursday, October 30, 2003 7:35 AM > To: 'Jennifer Wheeler'; [EMAIL PROTECTED] > Subject: RE: [SAtalk] Exessive HTML Code > > Thanks Jennifer! I should have know you would b

RE: [SAtalk] Re: [RD] Open source is Naughty!!!

> > This requires there to be _a_ letter before "p" which isn't always > what you want either. Yup, Definetly not what I want. > > > Or I could easily just do this: > > /\bpen.s/i > > But I thought that spammers could use punctuation to get past that. > > Actually, > > $ perl -le 'print

re: [SAtalk] How do I filter something like this?

Funny you should ask, as 2.60 filtered the forward just fine on my side with pbw installed. Even without Backhair this would have been filtered. -Mark -Original Message- From: Howard Brazee [mailto:[EMAIL PROTECTED] Sent: Thursday, October 30, 2003 7:45 AM To: Spamassassin-Talk (E-mail)

Re: [SAtalk] "Failed to run BAYES_NN SpamAssassin test, skipping" problems

Matt Kettler wrote: >> At 05:23 PM 10/29/2003, Greg Earle wrote: >> I've run "truss" on the running "spamd" and I'm not seeing anything in >> the truss output that points to where it's looking for the ndbm file >> that it doesn't like. The only lines that are relevant to Bayes-named >> files are:

[SAtalk] Autowhitelist

Title: Autowhitelist Addresses from my mail domain is being saved in the auto-whitelist file. 1) How do I prevent addresses from being auto-whitelisted? 2) How do I delete addresses that are already auto-whitelisted? Gareth Segree mailto:[EMAIL PROTECTED] Technical Support Analyst The Gleane

[SAtalk] How filter ...

Hi folks, How could I filter this type of spam: Penis P.enis Pe.nis Pen.is Peni.s In the html body? Thanks for your advices Andrea --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more product

RE: [SAtalk] outlook corpus?

Don't worry about the fact that the spam messages are attachements of the report (and that the attachment has no headers). Sa-learn will realise this and strip it out. - at least that's what I've been told, and bayes is working like a treat for me- with a spam corpus of 3300 messages using libpst a

Re: [SAtalk] How filter ...

There's a thread currently going on about this exact same subject. Check out the "Open Source is Naughty" thread. Andrea Riela wrote: Hi folks, How could I filter this type of spam: Penis P.enis Pe.nis Pen.is Peni.s In the html body? Thanks for your advices Andrea --

[SAtalk] How to upgarade 2.55 to 2.70?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Any advise on upgrading SA, Can you help me to find documents for just upgrading, I am using Cobalt 550 server with mailscanner, DCC and Pyzor installed. Best Regards O. TUNC ERESEN ISP & Security Consultant Mobile: (44)07785 363 481 17

Re: [SAtalk] How to upgarade 2.55 to 2.70?

> > Any advise on upgrading SA, Can you help me to find documents for > just > upgrading, Have you tried http://www.spamassassin.org/doc.html? Or alternatively, there is documentation included with the distribution you could try reading. That having been said, 2.70 is the development version

[SAtalk] updating rules without upgrading SpamAssassin

Hi, I would like to know if there is a way to update the rules with out updating SpamAssassin. Thanks. Vasantha --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help

[SAtalk] Significant increase in spam lately

Has anyone else noticed a hugs increase in the amount of spam lately? In the last month or so the volume has more than doubled and a very large portion of it gets through spamassassin 2.41. I have been running spamassassin for almost two years. I have resisted upgrading because of the changes

[SAtalk] This isn't Porn???

This message wasn't tagged by any porn rules. Looking at the rules, it doesn't look like this is porn, hehe. I understand that someone is working on enhancing the porn filter, so maybe this might help. If the header's look a bit funny, it's because I'm pulling my yahoo email into my own mail server

[SAtalk] 2.70 says it fails dns test but doesn't

I get this when making test with the cvs content I just retrieved. Actually, looks to me like it did *not* fail the test? t/dns...Not found: P_1 = [127.0.0.2] # Failed test 2 in t/SATest.pm at line 388 Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive

RE: [SAtalk] Exessive HTML Code

Hi Mark, > -Original Message- > From: Mark Ritchie [mailto:[EMAIL PROTECTED] > Sent: Wednesday, October 29, 2003 9:46 AM > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] Exessive HTML Code > > > > > Do you really think it would be a problem if we found more > than 3 instances of in e

Re: [SAtalk] updating rules without upgrading SpamAssassin

On Thu, 30 Oct 2003 11:06:13 -0500 Vasantha Narayanan <[EMAIL PROTECTED]> wrote: > Hi, > > I would like to know if there is a way to update the rules with out > updating SpamAssassin. Not really; while 3rd-party rules like Chris Santerre's evilrules.cf may be portable between versions, using (s

RE: [SAtalk] updating rules without upgrading SpamAssassin

Yes and no. > > Hi, > > I would like to know if there is a way to update the rules with out > updating SpamAssassin. > > Thanks. > > Vasantha > You can get custom rules from either the link in my sig, or the wiki at www.exit0.us . However you will miss out on some things that are in upgrade

RE: [SAtalk] updating rules without upgrading SpamAssassin

> -Original Message- > From: Vasantha Narayanan > Sent: Thursday, October 30, 2003 11:06 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] updating rules without upgrading SpamAssassin > > > Hi, > > I would like to know if there is a way to update the rules with out > updating SpamAssas

Re: [SAtalk] Autowhitelist

At 10:33 AM 10/30/2003, Segree, Gareth wrote: Addresses from my mail domain is being saved in the auto-whitelist file. 1) How do I prevent addresses from being auto-whitelisted? you don't, unless you disable the AWL entirely. 2) How do I delete addresses that are already auto-whitelisted? spamassa

RE: [SAtalk] Significant increase in spam lately

> > Has anyone else noticed a hugs increase in the amount of spam lately? > In the last month or so the volume has more than doubled and a very > large portion of it gets through spamassassin 2.41. > > I have been running spamassassin for almost two years. I have > resisted upgrading because

Re: [SAtalk] Re: [RD] Open source is Naughty!!!

On Thu, 30 Oct 2003 10:24:19 -0500 Chris Santerre <[EMAIL PROTECTED]> wrote: > /* era */ wrote: > > > > Yrg'f ubcr gurl qba'g qvfpbire Havpbqr nal gvzr fbba. > > Ook. ?huh? ^^ perldoc Crypt::Rot13 :) -- Bob --- This SF.net em

[SAtalk] Understanding AWL processing

My server handles exactly one mailbox: my own. I am running SA 2.60 through MimeDefang, with some MimeDefang changes to enable AWL processing. I've noticed an increasing amount of spam getting through that uses the age-old trick of forging my address in the From: line. This somehow triggers the

RE: [SAtalk] This isn't Porn???

The "problem" is that the porn rules are short circuited by BAYES. I ran into this when I upgraded from 2.55, but it went away when I trained more messages under 2.6. I also changed the porn rules to contribute a very low score even with BAYES on, to avoid any possible autolearning. Balam >

Re: [SAtalk] Significant increase in spam lately

Chris Santerre wrote: >> Has anyone else noticed a hugs increase in the amount of spam lately? >> In the last month or so the volume has more than doubled and a very >> large portion of it gets through spamassassin 2.41. >> >> I have been running spamassassin for almost two years. I have >> resis

Re: [SAtalk] "Failed to run BAYES_NN SpamAssassin test, skipping" problems

Update: If I run # su courier -c "/usr/perl5/bin/sa-learn --showdots --rebuild" to rebuild the SA database, the "bayes_journal" file gets rotated/removed(?) and I stop getting the "Failed to run BAYES_NN ... " error messages ... ... for awhile. I thought that had fixed it, and that I had a cor

RE: [SAtalk] SA Upgrade 2.41->2.60 Stops Adding Headers

Theo Van Dinter wrote: > On Wed, Oct 29, 2003 at 03:10:53PM -0800, Mark Schoonover wrote: >> provided, and it adds the headers just fine. Running spamd with -D, >> and I can see it detecting spam just fine, it just won't add the >> default headers. > > hrm. if passing through spamc doesn't add t

RE: [SAtalk] Significant increase in spam lately

Chris Santerre Sent: Thursday, October 30, 2003 12:01 PM > My ratio has been about the same. ~55% average spam. My SA server, which is used by my own company and another small ISP, is currently receiving about 75% SPAM. And, yes, I too have noticed (casually) a marked increase in spam in the last

Re: [SAtalk] Significant increase in spam lately

Robert Abatecola wrote: > Has anyone else noticed a hugs increase in the amount of spam lately? > In the last month or so the volume has more than doubled and a very > large portion of it gets through spamassassin 2.41. At the very least, you should upgrade to 2.44 (or 2.45 if it ever existed)- th

Re: [SAtalk] Significant increase in spam lately

On Thu, Oct 30, 2003 at 01:01:49PM -0500, Colin A. Bartlett wrote: > Chris Santerre Sent: Thursday, October 30, 2003 12:01 PM > > > My ratio has been about the same. ~55% average spam. > > My SA server, which is used by my own company and another small ISP, is > currently receiving about 75% SPAM

Re: [SAtalk] SA load crashing server?

Well, I just upgraded the RAM on this server to 1GB, and if anything, the proc load went up. At times, it was over 50.00, usually in the high 30.'s. Limiting the number of spamd's seems to have abated the crashes, but the smtp performance is so poor that I was getting inundated with complaints f

RE: [SAtalk] Re: [RD] Open source is Naughty!!!

> > On Thu, 30 Oct 2003 10:24:19 -0500 Chris Santerre > <[EMAIL PROTECTED]> wrote: > > > /* era */ wrote: > > > > > > Yrg'f ubcr gurl qba'g qvfpbire Havpbqr nal gvzr fbba. > > > > Ook. ?huh? ^^ > > perldoc Crypt::Rot13 :) > > -- Bob > LOL rot13.com Let's hope they don't dis

Re: [SAtalk] How filter ...

At 10:23 AM 10/30/2003, Andrea Riela wrote: Hi folks, How could I filter this type of spam: Penis P.enis Pe.nis Pen.is Peni.s This regex should work for a custom rule to match those patterns. /P(\.?)e(\.?)n(\.?)i(\.?)s/ You'll probably want to make it a bit more useful like this:

RE: [SAtalk] Significant increase in spam lately

Nice stats Mike! Custom script? > -Original Message- > From: mikea > Sent: Thursday, October 30, 2003 1:19 PM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] Significant increase in spam lately > > > On Thu, Oct 30, 2003 at 01:01:49PM -0500, Colin A. Bartlett wrote: > > Chris Santerre

[SAtalk] stats script

I have, from time to time, published stats generated by my mailstats2.pl Perl script. Pretty much every time I get mail remarking on how pretty the output is and asking for a copy. Since I can't put it up on the corporate webserver at work, I'll offer to post it if: 1) Anyone is interested, an

[SAtalk] Re: This isn't Porn???

spamassassin-talk <[EMAIL PROTECTED]> wrote: > I also changed the porn rules to contribute a very low score even > with BAYES on, to avoid any possible autolearning. Fyi, autolearn ignores any score that Bayes adds. It has to reach that minimum score prior to Bayes being run before it can be auto

Re: [SAtalk] Significant increase in spam lately

At 7:58 AM -0800 10/30/03, Robert Abatecola wrote: Has anyone else noticed a hugs increase in the amount of spam lately? In the last month or so the volume has more than doubled and a very large portion of it gets through spamassassin 2.41. A month ago, we were seeing about 6-7 spams a da

RE: [SAtalk] stats script

Everyone has an opinion so since you ask, I'll give you mine. Your script includes stats on SA so therefore it is SA related. Anything that can help me keep a grip on what is happening to my mailservers is worthwhile. Logs and stats really help in this area and your stats include SA. So as far

RE: [SAtalk] stats script

Please post, I wrote my own but would like to see if you included something in yours that could be useful -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of mikea Sent: Thursday, October 30, 2003 2:13 PM To: SA Mailing list Subject: [SAtalk] stats script I hav

[SAtalk] stats script, by (fairly) popular demand

There are probably some adjustments to be made. Use at your own risk. Enjoy. If you improve on it, please make the improvements available to the list. Mike Andrews [EMAIL PROTECTED] Tired old sysadmin #!/usr/bin/perl # # program to produce total mail item / spam (%) / discarded (%) /

RE: [SAtalk] stats script

Ditto -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Mark Emerle Sent: Thursday, October 30, 2003 12:15 PM To: mikea; SA Mailing list Subject: RE: [SAtalk] stats script Please post, I wrote my own but would like to see if you included something in your

FW: [SAtalk] stats script

http://www.iscomp.com/files/scripts/mail/ -Original Message- From: 'mikea' Sent: Thursday, October 30, 2003 2:58 PM To: Larry Gilson Subject: Re: [SAtalk] stats script On Thu, Oct 30, 2003 at 02:51:49PM -0500, Larry Gilson wrote: > Everyone has an opinion so since you ask, I'll give y

[SAtalk] Whitelist / Rule Question...

I am going nuts. I can't resolve this. I have SA 2.55 running with out any other major issues except for a nagging issue of an external user that continues to be identified as spam no matter how I try to white list them. I have marked up the offending header below by adding `000` to the end of a

RE: [SAtalk] stats script

Come one Come ALL!!! Get the script here. http://members.lycos.co.uk/njadmin/mailstats.php3 Larry Gilson scribbled on Thursday, October 30, 2003 2:52 PM: > Everyone has an opinion so since you ask, I'll give you mine. Your > script > includes stats on SA so therefore

RE: [SAtalk] stats script, by (fairly) popular demand

> Date: Thu, 30 Oct 2003 14:26:14 -0600 > From: "'mikea'" <[EMAIL PROTECTED]> > To: SA Mailing list <[EMAIL PROTECTED]> > Subject: [SAtalk] stats script, by (fairly) popular demand > > There are probably some adjustments to be made. > > Use at your own risk. Enjoy. > > If you improve on it, pl

Re: [SAtalk] Broken Rule

On Wed, 2003-10-29 at 11:36, Tobin wrote: > Hello, > > I was wondering if anyone could help me fix a broken rule. Im getting a > error > > "Failed to compile body spamassassin tests, skipping: > (syntax error at /ect/mail/spamassassin/local.cf, rule Porn, line 1, > near "/) > > and > > "Failed

Re[2]: [SAtalk] [RD] Useless HTML Code

CORRECTION TO RULES: Matt, I liked your rules and added them to my system and ran a debug, and it reported the following error: error> Bareword found where operator expected at rule error> MY_USELESS_S, line 1, near "/<\/s>/I" (Missing error> operator before I?) Failed to compile body error> Spam

[SAtalk] stats script, by (fairly) popular demand

Interesting...once I changed to the Debian mail.log.#.gz filename spec, I got the following: Mails spamassassin rejected scanner total mails Total says 'spam' by rulesetsays virusundelivered Oct 12 35052 0 ( 0.00%)0 ( 0.00%)0 ( 0.00%) 0 ( 0.00%)

Re: [SAtalk] Re: [RD] Open source is Naughty!!!

> "CS" == Chris Santerre <[EMAIL PROTECTED]> writes: >> >> ... punctuation matches \b just fine. CS> I didn't know that! (Or completely blew by that fact when CS> reading.) But that makes sense. Thanks! Actually, it doesn't match the punctuation. It matches the /transition/ from word to no

RE: [SAtalk] [RD] Open source is Naughty!!!

I figure now might be a decent time to mention this: http://www.exit0.us/index.php/ChrissMediocreObfuScript Jennifer Wheeler said: > Someone suggested a range to me awhile back when I asked about this, > sorry I cant give props to whoever it was. > > /\bp[e3]n[\xCC-\xCF\xEC-\xEF][sz52]\b/i > > Jen

[SAtalk] spamc/spamd performance testing

Hi, I have been running some performance tests on spamc/spamd and I wanted to make sure my results were consistent with expected performance. All tests were run on: Dual 2.8 Ghz Xeon (4 logical CPUs) box w/2GB RAM Redhat 8.0, Spam Assassin 2.60 I've been using the spamc/spamd combination.

RE: Re[2]: [SAtalk] [RD] Useless HTML Code

> -Original Message- > From: Abigail Marshall [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 30, 2003 2:49 PM > To: Yackley, Matt; [EMAIL PROTECTED] > Subject: Re[2]: [SAtalk] [RD] Useless HTML Code > > CORRECTION TO RULES: > > Matt, I liked your rules and added them to my system

[SAtalk] Re: stats script

mikea <[EMAIL PROTECTED]> wrote: > I have, from time to time, published stats generated by my > mailstats2.pl Perl script. Pretty much every time I get > mail remarking on how pretty the output is and asking for > a copy. It looks like it requires Posix - does that mean sendmail (or exim, or...) u

RE: [SAtalk] stats script, by (fairly) popular demand

'mikea' scribbled on Thursday, October 30, 2003 3:26 PM: > There are probably some adjustments to be made. > > Use at your own risk. Enjoy. > > If you improve on it, please make the improvements available > to the list. > > Mike Andrews > [EMAIL PROTECTED] > Tired old

RE: Re[2]: [SAtalk] [RD] Useless HTML Code

> > CORRECTION TO RULES: > > Matt, I liked your rules and added them to my system and ran > a debug, and it reported the following error: > *snip* > > It looks like the problem is that you used a capital /I > rather than lower case /i - in any case, that fixed it for > me. > Thank Abigail! I

[SAtalk] [RD] Need eval test for message len?

I'm trying to write a rule to count how many chr's are in a HTML message. My test rule looks like:   full    T_FOO    /.{60,110}<\/html>/i   The problem is that none of the test options (rawbody, body, full) provide the ability to test the entire message like this.   I am guessing I need an e

[SAtalk] Announcement: Obfuscated rule generator available for download

Just so it doesn't get lost in the shuffle for those that use threads, I'm posting a new thread announcing an obfuscated rule generator script available for download. See http://www.exit0.us/index.php/ChrissMediocreObfuScript -Chris --- This S

RE: [SAtalk] Announcement: Obfuscated rule generator available fo r download

> Just so it doesn't get lost in the shuffle for those that use > threads, I'm > posting a new thread announcing an obfuscated rule generator script > available for download. > > See http://www.exit0.us/index.php/ChrissMediocreObfuScript > > -Chris > OMG that is S cool! And it is so cl

RE: Re[2]: [SAtalk] [RD] Useless HTML Code

> that rule is where > a break was. Looks like Outlook decided to capitalize the I > for me for some > reason. LOL, I can see the little clippy now... "I see you are writing regex, shall I screw it up for you?" :D -Chris --- This SF.net em

RE: [SAtalk] [RD] Open source is Naughty!!!

Glad you like it... By the way, notice that the script naively assumes the body definition always comes before the describe and/or score line? If you move the describe line below the body line, it will then use the correct rule name (LOCAL_OBFU_J_TEST_P). Also, I think word boundaries at the sta

RE: [SAtalk] [RD] Open source is Naughty!!!

> -Original Message- > From: [EMAIL PROTECTED] [mailto:spamassassin- > [EMAIL PROTECTED] On Behalf Of Chris Thielen > Sent: Thursday, October 30, 2003 4:22 PM > To: Spamassassin-Talk > Subject: RE: [SAtalk] [RD] Open source is Naughty!!! > > I figure now might be a decent time to mention

RE: [SAtalk] stats script, by (fairly) popular demand

> > my $s = grep /is spam/, @wholefile; # spam My log does have "is spam" in the log yet the script is returning 0's for me as well. Trying to hunt it down. I've even tried other strings from the MailScanner-generated logs from /var/log/maillog to no avail. -id ---

[SAtalk] Installation probs - make test fails...

Hi! Trying to run "make test" on a 2.60 installation gives me these errors (RedHat 8.0); t/spamd_protocol_10.ok 1/10 Not found: symbolshit = GTUBE # Failed test 2 in t/SATest.pm at line 385 Not found: response-11 = SPAMD/1.1 0 EX_OK # Failed test 3 in t/SATest.pm at line 38

Re: [SAtalk] stats script, by (fairly) popular demand

You will need to adjust the search string to match your mail logs. my $t = grep /connect from/, @wholefile;# total my $s = grep /identified spam/, @wholefile; # spam my $d = grep /reject:/, @wholefile; # ruleset

RE: [SAtalk] stats script, by (fairly) popular demand

> You will need to adjust the search string to match your mail logs. Here's my maillog snippet: Oct 30 14:12:40 ns1 MailScanner[3201]: New Batch: Scanning 1 messages, 4214 bytes Oct 30 14:12:40 ns1 MailScanner[3201]: Archived message h9UMAPR07828 to mbox file /var/spool/MailScanner/archive Oct

Re: [SAtalk] stats script

i've got a couple of these scripts, but they don't seem to parse my log files. i'm running exim 4.22 with SA 2.55. exim logs to mainlog in /var/log/exim and SA logs to maillog in /var/log. i'm assuming there's a problem since my setup doesn't log the results in one file. i've cancatated the two

Re: [SAtalk] stats script, by (fairly) popular demand

--On Thursday, October 30, 2003 2:26 PM -0600 'mikea' <[EMAIL PROTECTED]> wrote: > my $s = grep /is spam/, @wholefile; # spam This doesn't work with my copy of SA, which is using spamc/spamd. Instead of "is spam", I get "identified spam". --

RE: [SAtalk] stats script, by (fairly) popular demand

> But the line that contains "is spam" doesn't seem to increment the counter. > /shrug still looking at that myself. ... because I upgraded to SA 2.60 this week and set MailScanner to log spam messages via syslog, which wasn't in place for last week. (slapping self upside the head) For this week

[SAtalk] Re: [RD] Need eval test for message len?

On Thu, 30 Oct 2003 16:15:50 -0500, Fred I-IS.COM <[EMAIL PROTECTED]> posted to gmane.mail.spam.spamassassin.general: > I'm trying to write a rule to count how many chr's are in a HTML message. > My test rule looks like: > fullT_FOO/.{60,110}<\/html>/i > The problem is that none of th

[SAtalk] Bugzilla #2561 (uninitialized value in BayesStore.pm)

I was going to append a comment to the bugzilla but it reported an internal error, so I'll post the comment here before I lose it: I ran into the same thing, and ended up putting a dbg statement above the line in question to see what was going on. Looks like oldmagic was getting a corrupt value f

Re: [SAtalk] Re: stats script

On Thu, Oct 30, 2003 at 03:37:02PM -0600, Chris Barnes wrote: > mikea <[EMAIL PROTECTED]> wrote: > > I have, from time to time, published stats generated by my > > mailstats2.pl Perl script. Pretty much every time I get > > mail remarking on how pretty the output is and asking for > > a copy. > >

Re: [SAtalk] Using MRTG to display highest connection counts

On Thu, Oct 30, 2003 at 02:17:35PM +, Mark wrote: > Hello, > > Is there someone who has used MRTG to display highest connection counts? > Though not necessarily spam, I would like to get an overview of who has been > trying to connect an inordinate amount of times during the day. It's not MTR

[SAtalk] SA Time out error

Here is an error I happened to notice today in my mail log. Don't know if it's something that indicates a defect. The message being tested at the time was rejected as Spam with a score of 53, but I don't know what tests were run. My environment is SA 2.60 running with Amavis-new and Postfix

[SAtalk] AWL

Hi, Does anyone know what this is and how to configure it? It seems to be subtracting from the score different amounts each time. I can't figure out why or what to do about it. AWL: Auto-whitelist adjustment Thanks, Jeremy --- This SF.net em

[SAtalk] Checking HTML garbage

Hi, Is there anyway to have spamassasin check for this kind of HTML garbage. If so, I could get rid of nearly all my spam. Thanks, Jeremy Hein --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be

Re: [SAtalk] stats script, by (fairly) popular demand

On Thu, Oct 30, 2003 at 02:45:39PM -0800, Kenneth Porter wrote: > --On Thursday, October 30, 2003 2:26 PM -0600 'mikea' <[EMAIL PROTECTED]> > wrote: > > > my $s = grep /is spam/, @wholefile; # spam > > This doesn't work with my copy of SA, which is using spamc/spamd. Inste

Re: [SAtalk] Re: [RD] Need eval test for message len?

[EMAIL PROTECTED] wrote: > On Thu, 30 Oct 2003 16:15:50 -0500, Fred I-IS.COM <[EMAIL PROTECTED]> > posted to gmane.mail.spam.spamassassin.general: > > Try adding an /s: > > fullT_FOO//is > > Normally the . in a Perl regular expression cannot match a newline, > but adding the /s changes

  1   2   >