Hi Mark,
> The config was set up by an integrator, as my Linux knowledge is
> somewhat limited. Is there something missing here in getting the bayes
> to work on the remote boxes?
>
start spamassassin in debug mode (-D or --debug) and look at the output in
syslog.
Perhaps it is a problem of b
I'm attempting to build SpamAssassin 2.60 with my user account at my
ISP. I get the following errors with the initial perl Makefile.PL
command. Not sure where to begin troubleshooting this. Perl version
is 5.004_04.
Hugh
shell3:~/spamass/Mail-SpamAssassin-2.60$ perl Makefile.PL
PREFIX=~/sa
Hi Dan,
> Hey guys!
>
> Does anyone know if spam can be forwarded onto another mailbox? Right now
> I have being trapped in /var/virusmails.
>
with this procmail recipes ham mails are put in the user's "normal" mailbox,
spam mails are put into a user specific spambox. LOGNAME is the name of the
I have had my bayes databases get corrupted a good bit in the past. What is
the recommended way to protect what SA has learned? Should I use the journal
technique and then just rebuild periodically?
Just want to make sure the db does not get corrupted, thus losing all the
spam/ham
it learned.
Is it necessary to have SA bayes learn 'ham' as well as 'spam'?
---
This SF.Net email sponsored by: ApacheCon 2003,
16-19 November in Las Vegas. Learn firsthand the latest
developments in Apache, PHP, Perl, XML, Java, MySQL,
WebDAV, and more!
I'm using SpamAssassin 2.60 with Exim 4.24 on FreeBSD, compiled
from ports. Perl is 5.6.1 (I have the same problem with 5.8.1).
Large messages don't make it through to spamd completely, instead
I get a log entry from spamd like this:
bad protocol: header error: (Content-Length mismatch:
Expec
Hello,
I'm wondering, i have install spamassassin, qmail,
qmail-scanner maildrop mysql vpopmail clamav etc etc. On a Debian Woody
I have run the ./configure script on qmail-scanner
with the right command, the script found spamassassin, but it's not including
it to the configuration (se
On Friday 14 November 2003 08:25, Dan Kohn wrote:
> See the bottom of
> http://www.stearns.org/doc/spamassassin-setup.current.html.
> Unfortunately, it doesn't include kmail.
Thanx for link, redirect in work fine, but adds то From: text "by way of
%identity name% %identity from%". This is not cu
Hello,
I'm wondering, i have install spamassassin, qmail,
qmail-scanner maildrop mysql vpopmail clamav etc etc. On a Debian Woody
I have run the ./configure script on qmail-scanner
with the right command, the script found spamassassin, but it's not including
it to the configuration (se
> Large messages don't make it through to spamd completely,
> instead I get a log entry from spamd like this:
It is not a good idea to try to pass large files thru SA. There is a large
performance hit on big files. I do not pass anything larger than 128K thru
SA on my system. I have yet to see a
Razor doesn't seem to be working. This is the output I get with
spamassassin -D:
Nov 14 08:56:05.758908 report[31327]: [ 8] Checking with Razor Discovery Server
216.52.3.2
Nov 14 08:56:05.758989 report[31327]: [ 6] No port specified, using 2703
Nov 14 08:56:05.759036 report[31327]: [ 5] Connectin
--On Wednesday, November 12, 2003 2:43 AM -0800 Kenneth Porter
<[EMAIL PROTECTED]> wrote:
> Are there any rules to catch the salutation-in-subject pattern?
>
> This looks like something requiring an eval rule. It would check if the
> subject starts with "name,", where "name" is the first word in t
I am trying to build a new spamassassin box and I am running into a problem
that whenever I send a test message perl core dumps.
I am using FreeBSD 4.9, with sendmail and spamass-milter.
I run through the steps outlined in the activation.txt file of the
spamass-milter port and when I run the fo
on 11/14/03 8:59 AM, Philip Mak at [EMAIL PROTECTED] wrote:
> Razor doesn't seem to be working. This is the output I get with
> spamassassin -D:
>
> Nov 14 08:56:05.758908 report[31327]: [ 8] Checking with Razor Discovery
> Server 216.52.3.2
> Nov 14 08:56:05.758989 report[31327]: [ 6] No port sp
> Nov 14 08:56:05.758908 report[31327]: [ 8] Checking with
> Razor Discovery Server 216.52.3.2 Nov 14 08:56:05.758989
> report[31327]: [ 6] No port specified, using 2703 Nov 14
> 08:56:05.759036 report[31327]: [ 5] Connecting to 216.52.3.2 ...
> debug: razor2 report timed out after 10 secs.
>
At 05:49 AM 11/14/03 -0500, MIKE YRABEDRA wrote:
Is it necessary to have SA bayes learn 'ham' as well as 'spam'?
Yes. SA won't even try to use bayes scoring until 200 spam AND 200 ham
messages are trained.
---
This SF.Net email sponsored by: A
On Wed, Oct 22, 2003 at 01:25:06PM -0700, Hugh Caley wrote:
> command. Not sure where to begin troubleshooting this. Perl version
> is 5.004_04.
SA only supports back to 5.005. Anything earlier than that, and it's
anyone's guess whether or not it'll work.
--
Randomly Generated Tagline:
Psych
On Fri, Nov 14, 2003 at 07:32:59AM +0200, Thomas Kinghorn wrote:
> I am a little confused as to what triggers the autolearn function.
Read the docs, it's in there. If you're not getting autolearning,
you may need to adjust your autolearn settings. But read the docs,
it'll help you out.
--
Rand
Use amavisd-new with Postfix as a content-filter and have all spam
scoring over your threshold redirected to a mail-enabled Public folder
for review.
Also create a public folder for end users to drop in (with Outlook, move
the message) false negatives. Then create an IMAP script to remove and
s
Hello all,
Considering a postfix mail server, with all virtual users (mysql or
ldap), what is the best way to have a bayes db on a per-user basis? I
will use maildrop as VDA.
I'd like to hear some testimonials, some how-i-did tips, etc.
Thanks, and regards.
--
Marcio Merlone
On Fri, Nov 14, 2003 at 10:25:54AM -0500, Matt Kettler wrote:
> Yes. SA won't even try to use bayes scoring until 200 spam AND 200 ham
> messages are trained.
... not to mention that only learning spam means bayes will be skewed
to think everything is spam.
--
Randomly Generated Tagline:
Uh, so
At 07:32 AM 11/14/03 +0200, Thomas Kinghorn wrote:
I am a little confused as to what triggers the autolearn function.
For autolearning purposes, a second score for the email is calculated. This
score is calculated as if bayes were disabled. ie: bayes rules don't count,
and the appropriate non-b
Hallo!
I got a spam today that just missed being spam by a few fractions of a
point. The "Click here" URL was:
http://biz.yahoo.com/prnews/031112/lnw017_1.html
It's not a redirect, but an actual 'press release' on Yahoo itself.
But the content is pretty much the stuuf of 'stock alert' spams..
Hallo!
Another spam today, with the infamous empty return path.
(Return-Path: <>)
But I didn't see any test that was catching this. Is there something
legitimate about an empty return path that makes it a bad test?
- Charles
---
This SF. Net
FYI.
Begin forwarded message:
Date: Fri, 14 Nov 2003 16:45:05 +
From: [EMAIL PROTECTED]
To: Marcio Merlone <[EMAIL PROTECTED]>
Subject: Undeliverable Mail: [SAtalk] SA-learn per VIRTUAL user
We were unable to deliver your email.
The domain you are sending to may have been recently register
At 12:26 PM 11/14/2003, Charles Gregory wrote:
Another spam today, with the infamous empty return path.
(Return-Path: <>)
But I didn't see any test that was catching this. Is there something
legitimate about an empty return path that makes it a bad test?
An empty return path is RFC required to be a
At 12:29 PM 11/14/2003, Marcio Merlone wrote:
FYI.
Begin forwarded message:
Date: Fri, 14 Nov 2003 16:45:05 +
From: [EMAIL PROTECTED]
FYI, this has been mentioned on the list frequently, and has been going on
since 10/29 at least..
Unfortunately the list admins can't track which address is
I decided to upgrade SA from 2.55 to 2.60. Some things I read lead me to
believe that there are additional tools to deal with obfuscated HTML tags
hiding text.
Anyway, I downloaded the sources, built it, and installed it with no
problems. I rebuilt the Bayes db. When I started it (in debug mode
On Fri, Nov 14, 2003 at 12:26:33PM -0500, Charles Gregory is rumored to have said:
>
> Another spam today, with the infamous empty return path.
> (Return-Path: <>)
>
> But I didn't see any test that was catching this. Is there something
> legitimate about an empty return path that makes it a bad
> It did however use a trick to avoid the standard
> FROM_AND_TO_SAME so your
> rule can help out by adding some score.. However, 104.1 is a
> bit excessive,
> since there's no white list to over-ride. (Bret is smart and did not
> whitelist_from himself).
No whitelist of myself necessary here as t
> I'm new to the list, and I'm trying to figure out a way of detecting
> words with obfuscated characters (i.e. "@pp!3", "app13" = "apple").
You could try using popcorn, weeds, and backhair rules. You can get them
here:
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
Bret
All DSNs have them afaik, such as bounces, return receipts, etc.
Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Charles Gregory wrote:
Hallo!
Another spam today, with the infamous empty return path.
(Return-Path: <>)
But I didn't see any tes
I've been getting messages from aol lately that are triggering this rule. My
DNS is not broken, and it's not hitting on any of the other "major ISPs".
Does anybody know if aol has changed something lately, or maybe know a
workaround? I looked in 20_head_tests.cf, and for the actual rule, it says
ev
On Fri, 14 Nov 2003 14:13:27 -0500
Matt Kettler <[EMAIL PROTECTED]> wrote:
> FYI, this has been mentioned on the list frequently, and has been going on
> since 10/29 at least..
Sorry, didn't meant to bug anybody. I was on one of those threads. I
just thought it could be useful somehow. THAT rep
Good day, all,
As many of you know, I've been maintaining a blacklist of spammer
domains that's ready to use in Spamassassin (see
http://www.stearns.org/sa-blacklist for more information). I'm now trying
to take these domains and check the URI's in the body for them as well.
My first
On Fri, Nov 14, 2003 at 11:40:43AM -0500, Charles Gregory wrote:
> Hallo!
>
> I got a spam today that just missed being spam by a few fractions of a
> point. The "Click here" URL was:
> http://biz.yahoo.com/prnews/031112/lnw017_1.html
>
> It's not a redirect, but an actual 'press release' on
Hello--
I would like one of my users to receive spamassassin template messages in
french, while the rest continue receiving them in english. Is this possible
?
I have not found in the documentation exactly how to do this.
I know the template is /usr/share/spamassassin/30_text_fr.cf
What do I pu
> Anyway, I downloaded the sources, built it, and installed it with no
> problems. I rebuilt the Bayes db. When I started it (in debug mode) it
> logged this and then exited:
My first install (2.55) was via CPAN, and upgraded (also via CPAN) to 2.60
on RedHat 7.3 and had zero problems.
-id
--
The ISP I work for is currently using SA site-wide with flat config files
and no user config files. There are three boxes running SA that are
connected to by the SMTP host, and we scp the configs between the three
machines. The users have home directories on the SMTP box, but no shell
access. They
Title: Blank Stationery
I'm running Bayes site wide with about
45,000 messages per day. Is there any harm in increasing the
bayes_expiry_max_db_size and bayes_journal_max_size limits?
If it's ok to make bigger, what is the
maximum before something bad starts happening?
<>
Hey all, im having a terrible time trying to get sa to
stop scanning outgoing messages. normally i wouldnt
care but every time a user sends to
[EMAIL PROTECTED] a remotedomain.com/user folders
are created by sa. this is obviously a huge
nuiscense, so i figure i'd just stop scanning
outgoing...rig
On Fri, Nov 14, 2003 at 02:40:32PM -0800, Mike Varre wrote:
> nuiscense, so i figure i'd just stop scanning
> outgoing...right? cant figure out how to though!
>
> running sa 2.55, qmail, qmailscanner.
FYI: This is a qmail/qmailscanner question, not really related to SA.
So you may want to go pok
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Smart,Dan writes:
> I'm running Bayes site wide with about 45,000 messages per day. Is there
> any harm in increasing the bayes_expiry_max_db_size and
> bayes_journal_max_size limits?
>
> If it's ok to make bigger, what is the maximum before someth
At Fri Nov 14 13:53:42 2003, Kenneth Porter wrote:
> There seems to be some concern that a more aggressive version of
> this rule would cause too many false positives, but I've *never*
> seen a legitimate message with my name in the subject line. Are
> there really people who do this?
I don't thi
Mike Varre wrote:
> Hey all, im having a terrible time trying to get sa to
> stop scanning outgoing messages. normally i wouldnt
> care but every time a user sends to
> [EMAIL PROTECTED] a remotedomain.com/user folders
> are created by sa. this is obviously a huge
> nuiscense, so i figure i'd jus
Ok, ive spent the better part of the day in the
tcprules, obviously with no luck...
from the example on the qmailscanner website, my
comments added...
#/etc/tcpserver/smtp.rules
#
# had this explicit specified yet everything was still
scanned.
#127.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/v
We've been seeing a problem with spamd that happens at random times.
Occasionally, a spamd thread will spin, clocking up CPU time and never
finish. This causes other spamd processes to hang and eventually all
memory and swap is used up by multiple spamd and sendmail processes.
We've set limits
[EMAIL PROTECTED] (Justin Mason) writes:
> Smart,Dan writes:
>> I'm running Bayes site wide with about 45,000 messages per day. Is there
>> any harm in increasing the bayes_expiry_max_db_size and
>> bayes_journal_max_size limits?
>>
>> If it's ok to make bigger, what is the maximum before somet
--On Friday, November 14, 2003 3:52 PM -0800 Mike Varre <[EMAIL PROTECTED]>
wrote:
> Ok, ive spent the better part of the day in the
> tcprules, obviously with no luck...
>
> no matter what i do, it still scans it.
As someone else mentioned, you may get better luck in a qmailscanner group.
Spa
On Fri, 14 Nov 2003, Charles Gregory wrote:
> I got a spam today that just missed being spam by a few fractions of a
> point. The "Click here" URL was:
> http://biz.yahoo.com/prnews/031112/lnw017_1.html
We've gotten several hundred of those at ny PPOE in the
past few days. It's a stand
On Fri, 14 Nov 2003, William Stearns wrote:
> Good day, all,
G'day.
> My first attempt to do URI rules is at
> http://www.stearns.org/sa-blacklist/sa-blacklist.2003111402.uri.cf
My, that's a big list. And a whole lot of regexes
> Would someone be willing to just take a qui
Hello Charles,
See my stats below -- I developed a rule for this test, and running it
against my corpus I found that it matched more ham than spam.
Bob Menschel
Friday, November 14, 2003, 9:26:33 AM, you wrote:
CG> Hallo!
CG> Another spam today, with the infamous empty return path.
CG> (Retur
Marcio Merlone wrote:
FYI.
Begin forwarded message:
Date: Fri, 14 Nov 2003 16:45:05 +
From: [EMAIL PROTECTED]
To: Marcio Merlone <[EMAIL PROTECTED]>
Subject: Undeliverable Mail: [SAtalk] SA-learn per VIRTUAL user
Testing to see if my access file blocks this annoying bounce
--
I have seen some users posting statistics for SA. I see the logging is
built into maillog, but what packages are good at processing the log
files? I have found a program called "Sawmill" but that seems a little
larger than I was looking for. I would like to know some basic statistics
such
> Razor doesn't seem to be working. This is the output I get with
> spamassassin -D:
>
> Nov 14 08:56:05.758908 report[31327]: [ 8] Checking with Razor
Discovery Server 216.52.3.2
> Nov 14 08:56:05.758989 report[31327]: [ 6] No port specified, using
2703
> Nov 14 08:56:05.759036 report[31327]: [
Maybe I am doing something wrong, but it seems that the patch
file Razor2.patch in PA 2.6 doesn't match the current source code of
Razor 2.36.
I am getting these errors trying to patch:
# patch -p0 < /export/home/tvn/tmp/Razor2.patch
Looks like a unified context diff.
Hunk #1 failed at line 969.
H
Must be the drugs I'm on for this cold. DOH!
I *MEANT* to say your procmailrc file is *USUALLY* in /etc ... and it is procmailrc , not procmail.rc.
(I'm dealing with some things that make my brain fog...and the cough medicine is icing on the cake).
Mairhtin
On Thu, 13 N
Having just read the FAQ's can I just check the requirements for the source
SPAM/HAM mail for sa-learn?
Do the contents of the sources messages need to be false positives for the
HAM file and false negatives for the SPAM file?
I can see that I'll be able to assemble 200 false negatives easily, h
Hi,
I get a lot of spam that is 'just not spam' (score 4.8 or 4.9) because it
contains "vi.agra", "v.iagra", etc etc in all variants. I would like to
scan mails with spamassassin AFTER all the punctuation characters and
underscores have been crossed out.
Any way how to do this?
Using SA 2.60 with
What he is saying is : include in your post the file procmail.rc . You'll have to find it, but on most redhat systems it is in /etc/mail/spamassassin ... you should probably do a find on the file though, for safety's sake.
Mairhtin
On Thu, 13 Nov 2003 11:16:03 -0600, maximo lopez w
Folks:
Anybody
have any experience in flagging this type of obscuration: with a rule? Did it generate lots of false
positives (for SPAM)?
Mark
M.
How to determine, whether the Russian dictionaries for check of contents of
the letters are established? The option on check of the Russian letters are
enabled as "ok_languages ru".
Sergey
---
This SF. Net email is sponsored by: GoToMyPC
GoToMy
I've been getting a particular spam repeatedly that manages to slip through
SA virtually every time - I've posted most of it (edited for
inoffensiveness, and to munge the URL's so he doesn't get hits) here along
with the SA analysis:
(begin spam)
Received: (qmail 5167 invoked by alias); 14 Nov 200
Good evening, Carl,
On Fri, 14 Nov 2003, Carl R. Friend wrote:
>On Fri, 14 Nov 2003, William Stearns wrote:
>
> > My first attempt to do URI rules is at
> > http://www.stearns.org/sa-blacklist/sa-blacklist.2003111402.uri.cf
>
>My, that's a big list. And a whole lot of regexes
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
I'm getting an increasing number of messages, probably from the same
idiot, with just huge paragraphs of current news or giberish tacked
on to the end of the message. It's obviously fooling bayes, but is
there anything we can do about this?
- -
65 matches
Mail list logo
