Re: [SAtalk] Reporting

2002-02-22 Thread Matt
Question: Does Spam Assassin report the score (in the email or maillog) even if the message is not tagged as spam? Im using MailScanner to call Spam Assassin and I only see the score if it is reported as a spam message. Theo Van Dinter said: > On Fri, Feb 22, 2002 at 03:18:54PM -0600, Mark Ro

Re: [SAtalk] Reporting

2002-02-22 Thread Matt
rack these numbers if you use MailScanner and SpamAssassin. Theo Van Dinter said: > On Fri, Feb 22, 2002 at 04:52:00PM -0500, Matt wrote: >> Does Spam Assassin report the score (in the email or maillog) even if >> the message is not tagged as spam? > > It's in the mes

Re: [SAtalk] Reporting

2002-02-22 Thread Matt
Sorry for the typo... I meant to say: "I can get that with the -t option" Matt said: > Aha. > > I cant get that with the spamassassin -t option. > > However, Im using MailScanner to call SpamAssassin. Alas, there is no > way for the X-Spam-Status header to appear

[SAtalk] detecting spam..

2002-02-28 Thread Matt
Is there a place/mailing list that I can send a SPAM message that got through my SA setup. I'd like to have the SA wizards take a look at the message to see if there is anything they can learn from it. I can post it here, if that is proper.

[SAtalk] Installing on a Raq; failed--compilation aborted

2002-05-05 Thread Matt
ted at /usr/bin/spamassassin line 89. [root local]# failed--compilation aborted Can anyone tell me what this means and how to fix it? Are there any newer rpm's to try? I would rather use an rpm since they give the option to uninstall. Thanks Matt _

Re: [SAtalk] Installing on a Raq; failed--compilation aborted

2002-05-06 Thread Matt
; FYI: I always rebuild from the SRPM for this exact reason. > It's really easy: "rpmbuild --rebuild " > > It'll generate a new binary RPM, then you can install it. Sorry for the long post but see below. Thanks Matt [root local]# rpm - e spamassassin error: package s

Re: [SAtalk] Installing on a Raq; failed--compilation aborted

2002-05-06 Thread Matt
t doesn't come back with anything, what version of perl do you > have installed? [root local]# perl -v This is perl, version 5.005_03 built for i386-linux I guess I need to update perl? How tough is this to do? How do I do it? What are the chances it will crash the Ra

Re: [SAtalk] Installing on a Raq; failed--compilation aborted

2002-05-06 Thread Matt
> Then, set your path to have that directory first (*) ie: > PATH=/tmp:$PATH > export PATH Is there a way to take /tmp back out of the path after I am done? Thanks! Matt > (*) - Note: This is a security issue if users can log into this machine > or otherwise make files in th

Re: [SAtalk] Installing on a Raq; failed--compilation aborted

2002-05-06 Thread Matt
Also, how do install it now? That is after I built the source rpm. I can't even find it? Thanks Matt > > Then, set your path to have that directory first (*) ie: > > PATH=/tmp:$PATH > > export PATH > > Is there a way to take /tmp back out of the path after I

Re: [SAtalk] Installing on a Raq; failed--compilation aborted

2002-05-07 Thread Matt
ow do I update the locate database? Thanks Matt ___ Have big pipes? SourceForge.net is looking for download mirrors. We supply the hardware. You get the recognition. Email Us: [EMAIL PROTECTED] ___

Re: [SAtalk] Installing on a Raq; failed--compilation aborted

2002-05-07 Thread Matt
> On Tue, May 07, 2002 at 09:47:43AM -0500, Matt wrote: > > [root /]# rpm --showrc | grep _rpmdir > > -14: _rpmdir%{_topdir}/RPMS > > ok, now continue the chain looking for _topdir and so on. You will > eventually get a full path. > > So for me: > > ecl

Re: [SAtalk] Installing on a Raq; failed--compilation aborted

2002-05-07 Thread Matt
what I get. I give up. Matt > Matt I have installed SpamAssassin on both the cobalt RaQ3 and RaQ4 > > To install I downloaded the RPM from this URL. > > http://www.hughes-family.org/spamassassin/ > > Specifically this one > http://www.hughes-family.org/spamassassin

[SAtalk] (no subject)

2002-09-30 Thread matt
59-1 Content-Transfer-Encoding: quoted-printable X-Mailer: Ximian Evolution 1.0.7 Date: 13 Sep 2002 08:35:33 -0600 Message-Id: <1031927733.17653.27.camel@loghog> Mime-Version: 1.0 ReSent-Date: Fri, 13 Sep 2002 17:39:20 +0100 (BST) ReSent-From: Matt Sergeant <[EMAIL PROTECTED]> ReSent-To:

Re: [SAtalk] disable razor2?

2002-10-10 Thread matt
edit /etc/mail/spamassassin/local.cf add the following line: score RAZOR2_CHECK 0 any rule with score 0 is never run. At 02:43 PM 10/10/2002 -0700, you wrote: >I'm looking for a way to disable razor2, until I can find out what is >causing it to fail. > >I can't find anything

Re: {SPAM} [SAtalk] Whitelist Help

2002-10-11 Thread matt
Could you be more specific than " I have "[EMAIL PROTECTED]" in my spamassassin conf file."? What exact SA command did you use? whitelist_from? whitelist_from_rcvd? Please include the exact whole line that's whitelisting this. Also, which spamasssassin conf file did you add it to? local.c

Re: [SAtalk] SPAM message tricked SA???

2002-10-11 Thread matt
Is it just me, or did you forget to include the message that tricked SA? I seem to have gotten a set of full headers, but no message. My suggestion, put the email back together again and run it through command-line spamassassin -tD and see what it says. Often errors in configuration aren't men

Re: [SAtalk] how do deal[sz] and special[sz] in the headers score in the GA corpus?

2002-10-11 Thread matt
I don't think there's been a full GA run done since it was added, but if you browse the saDev list you can see people posting the test-rule freqs against their portions of the corpus. For example, on 10/10 Justin Mason reported (among a ton of other test rules): 0.9572.9570.0031

RE: [SAtalk] SPAM message tricked SA???

2002-10-11 Thread matt
Hmm, I'm guessing the user your running spamd as can't read the SA config files for some reason. It's just a guess, but since it thought the required hits were 0, this tells me it might have been completely unconfigured. This might also happen if spamc times out trying to connect to spamd. Aga

Re: [SAtalk] slipped through..

2002-10-11 Thread matt
Really short spams are something SA alone isn't very good at. Fortunately systems like Razor are wonderful at them, and the DNS blacklists help too: Using 2.42 I get: X-Spam-Status: Yes, hits=8.4 required=5.9 tests=CTYPE_JUST_HTML,MSGID_CHARS_SPAM,RAZOR2_CHECK,RCVD_IN_DSBL,

Re: [SAtalk] slipped through..

2002-10-12 Thread matt
and respond. Unlikely yes, but it is still possible. I'd rather put forth effort on adding features to SA which aren't likely to be already present in procmail. Better rules, faster processing, better GA scoring, better input data (corpus), etc. At 09:16 PM 10/11/2002 -0600, you wrote:

Re: [SAtalk] HABEAS_SWE

2004-01-15 Thread Matt Kettler
At 08:34 AM 1/15/04 -0500, Jeff Fulmer wrote: Why does HABEAS_SWE score -8.0? EVERYmessage that I recieve that matches that criteria is spam. I've since added 16 point to HABEAS_SWE. Read the archives of this list.. this has been discussed almost nonstop since the weekend... or read www.habeas.c

Re: [SAtalk] Spam confuses bayes auto_learn

2004-01-15 Thread Matt Kettler
At 11:14 AM 1/15/04 +0100, Gunther Heintzen wrote: X-Spam-Status: No, hits=2.6 required=3.9 tests=FORGED_HOTMAIL_RCVD2, HTML_MESSAGE autolearn=ham version=2.61 It should be autolearn=no because hits=2.6 ist beetween 0.1 and 12.0 Autolearning is not based on the normal message score, it's based o

Re: [SAtalk] what can we do with those spam mails

2004-01-15 Thread Matt Kettler
At 09:49 AM 1/15/04 +0100, Sönke Ruempler wrote: I wonder if i can to something against these spam messages: Simple starting things to check (if you're not already doing them) 1) use razor, dcc and/or pyzor. 2) Make sure your bayes is heavily trained (really, this batch of "poison" has not been

Re: [SAtalk] Books...

2004-01-15 Thread Matt Kettler
At 07:50 AM 1/15/2004, Tim B wrote: Hey does anyone know if there are any spamassassin books comming out? None that I'm aware of. I've been thinking of writing more guides to go with the rule-writing guide I made, but haven't started yet. --

Re: [SAtalk] is spamassassin poisoning my mail spool?

2004-01-15 Thread Matt Kettler
At 07:11 AM 1/15/2004, Adrian Simmons wrote: I have a setup involving procmail, SA and Razor, at the moment, every time I do a razor-report (with "| /usr/bin/spamassassin -r" in my procmailrc) my mail spool gets poisoned with something like this: X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.

RE: [SAtalk] rewriting subject lines.

2004-01-15 Thread Yackley, Matt
Hi Marc, Have you added a line to tell SA what you want the subject line to be changed to? Along with the rewrite_subject line, try adding a "subject_tag" like subject_tag[SPAM] Or subject_tag***SPAM*** HTH, Matt Fr

Re: [SAtalk] disembodied emails

2004-01-15 Thread Matt Kettler
At 02:59 PM 1/15/2004, Pierre Thomson wrote: For some reason, my users don't like to receive these non-communications. They slip right past SA with only a BAYES_99 penalty, not enough to stop them. I could add a SUBJECT_MISSING test but it can't have a high score; any other bright ideas? BAYE

RE: [SAtalk] Above threshhold but not tagged

2004-01-15 Thread Yackley, Matt
mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > Hi John, Can you please post the headers from the message in question, without that we won't be able to help much... Thanks, matt --- The S

Re: [SAtalk] Above threshhold but not tagged

2004-01-15 Thread Matt Kettler
At 03:37 PM 1/15/2004, John Fleming wrote: Newbie question - I just got one of those d-rug type emails that scored several points above my spam cutoff and wasn't on a whitelist, yet the subject wasn't tagged as expected. What can cause that? tnx are you sure it was above and not a large negative

Re: [SAtalk] FP on MY_HTTP_ODD_PORT

2004-01-15 Thread Matt Kettler
At 03:41 PM 1/15/2004, Alan Munday wrote: Just had the mail below trigger on: 2.0 MY_HTTP_ODD_PORT URI: Link to a server on nonstandard port Why Vailresorts would want to go to the effort of declaring port 80 in their link is a mystery. However it is clearly not a non-standard port. Note:

Re: [SAtalk] Delete vs tagging spam

2004-01-15 Thread Matt Kettler
At 04:01 PM 1/15/2004, Andrew Cranson wrote: Would it be possible for an additional mysql preferance for a threshold to be added to an upcoming spamassassin release for mail deletion? e.g. A user sets required_hits to 5, and sets deletion_hits to 10, any mail between 5 and 10 is tagged, anything ab

RE: [SAtalk] Help needed with url rule

2004-01-15 Thread Yackley, Matt
UM Message contains URL that Brian wants to catch scoreBI_U_RIDNUM 0.001 Hope I didn't mess that up and watch out for line wraps -matt --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on

Re: [SAtalk] Help needed with url rule

2004-01-15 Thread Matt Kettler
At 05:23 PM 1/15/2004, Brian Ipsen wrote: What would a rule look like to match a pattern like (I've read a little about matching, but not enough to get it working): http://(anything).(com|net|org|info)?rid=[0-9]{1,5} use the uri ruletype.. it will only search within web links: uri MY_URI_RULE /\

Re: [SAtalk] adding rules changes Bayes?

2004-01-15 Thread Matt Kettler
At 08:01 PM 1/15/2004, Theodore Heise wrote: My problem is that now Bayes doesn't seem to be working right, as if SA is ignoring my learned tokens? It also seems to be now missing some rules that I presume are default (e.g., MSGID_FROM_MTA_SHORT, PRIORITY_NO_NAME, and CLICK_BELOW) The results for

Re: [SAtalk] is spamassassin poisoning my mail spool?

2004-01-15 Thread Matt Kettler
At 08:05 PM 1/15/2004, Adrian Simmons wrote: After running SA with the -D switch when reporting it looks like there might be some problems with my Razor installation: Jan 15 12:29:55.046480 report[14997]: [ 6] computing sigs for mail 1.0, len 9577 Jan 15 1razor2 report failed: Bad file descripto

Re: [SAtalk] Fw: Help!!

2004-01-15 Thread Matt Kettler
At 06:49 PM 1/15/2004, Alice Pawlowich wrote: Can someone please help me to remove, unsubscribe or disable the spam assassin? I am a new computer owner and really didn't know what I was getting into. But do know that I opened an attachment that contained a virus. I open a lot off these spam warn

Re: [SAtalk] adding rules changes Bayes?

2004-01-16 Thread Matt Kettler
At 07:56 AM 1/16/04 -0500, Theodore Heise wrote: cat tmp | formail -s sendmail theo Apparently this must process the mail differently than the normal receiving routine. If I use "bounce" in Pine, the Bayes results are approximately the same as before adding the new rules. I don't quite underst

Re: [SAtalk] Creating rules for the following

2004-01-16 Thread Matt Kettler
At 09:03 AM 1/16/04 -0500, Segree, Gareth wrote: Text => Rule 1) Received: from [109.42.168.192] by 24.193.45.130 with HTTP => Received =~ /with HTTP/i That works.. 2) Subject: ?ISO-8859-1? => Subject =~ /(ISO-8859|iso-8859)/ (score = 3.0) Won't work.. that's a character encoding tag

Re: [SAtalk] SpamAssassin Check

2004-01-16 Thread Matt Kettler
At 10:03 AM 1/16/04 +0530, Rahul Baweja wrote: Hi, How can i check if the Spam Assassin is working or not? send yourself a GTUBE: http://www.spamassassin.org/gtube/ --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on

Re: [SAtalk] Failed to parse

2004-01-16 Thread Matt Kettler
At 09:55 AM 1/16/2004, Michael H. Collins wrote: line in Spamassassin configuration, skipping: report_header 1 Failed to parse line in Spamassassin configuration, skipping: defang_mime 0 but it has been working for a couple of months through upgrades. And those lines look good in the local.cf

[SAtalk] [RD] Anti-drug.cf now available

2004-01-16 Thread Matt Kettler
Due to the fun of online pharmacies, I've made this ruleset in my spare time. http://mywebpages.comcast.net/mkettler/sa/antidrug.cf It's not perfect, and needs some cleanup and some more obfuscated variants added in. However some of the rather abusive pill-spammers of late have made me decide t

Re: [SAtalk] [RD] Anti-drug.cf now available

2004-01-16 Thread Matt Kettler
Due to the LARGE number of emails coming in citing the same suggestion, I'll publicly explain one of the rules. I very much on purpose did not use "." for __DRUGS_MALEDYSFUNCTION7 and __DRUGS_MALEDYSFUNCTION8. I very purposefully match \W in one, and _ in the other. Between the two it will mat

Re: [SAtalk] Acronym Update

2004-01-16 Thread Matt Kettler
At 01:13 PM 1/16/2004, Carl Chipman wrote: For the new people on the list, I was wondering what the following acronyms mean: LART Luser Attitude Readjustment Tool. See http://www.catb.org/~esr/jargon/html/L/LART.html UBE/UCE Unsolicited Bulk Email / Unsolicited Commercial Email. -

Re: [SAtalk] Acronym Update

2004-01-16 Thread Matt Thoene
On Friday, January 16, 2004 @ 10:13:21 AM [-0700], Carl Chipman wrote: > LART Linux Advanced Radio Terminal > UBE/UCE Upper Body Excerciser/Unforeseen Circumstances Excepted acronymfinder.com :) -- Matt -

Re: [SAtalk] RBL Check and logfile question

2004-01-16 Thread Matt Kettler
At 04:26 PM 1/16/2004, David Roback wrote: spamd[28929]: debug: RBL: success for 1 of 1 queries There is a line for a RBL query, but shouldn't the RBL tests shop up in the "tests line" in the debug log? If RBL is not running site wide, any ideas why? The thing that strikes me most about that li

[SAtalk] [RD] antidrug 0.2 available

2004-01-16 Thread Matt Kettler
Fixes a few minor issues: 1) corrected spelling of sildenafil citrate. 2) added vigara to the v-word mis-spelling list 3) added optional leading and trailing gap-characters to the gapped versions of rules. 4) added some gapped and obfu versions of Cilais 5) added some commentary --

RE: [SAtalk] Where are values kept for the built-in rules?

2004-01-17 Thread Yackley, Matt
he increase into your local.cf or user_prefs file. If you wanted to increase EXCUSE_2 from the default of 0 to 1 point, use the following line: score EXCUSE_2 1.0 HTH, matt --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open

Re: [SAtalk] Razor issue on Debian

2004-01-18 Thread Matt Kettler
At 03:02 PM 1/18/04 +0100, Erik van der Meulen wrote: I get: debug: Razor Agents 1.20, protocol version 2. razor 1.20 is a very old version of razor, and 1.x versions are no longer supported by SA. try getting razor 2.36 and applying the taint-safeness patch. --

Re: [SAtalk] SpamAssassin checks on Received headers (and RBL's such as RCVD_IN_SORBS)

2004-01-18 Thread Matt Kettler
At 11:22 PM 1/18/04 +0100, PieterB wrote: What's the best practice preventing this? Changing SpamAssassin in some way, masquerading/munging Received-headers, or something else? 1) work with the RBL to get de-listed 2) change ISPs to move your IP to a different block. And that's about it.. The fac

RE: [SAtalk] [RD] antidrug 0.2 available

2004-01-18 Thread Matt Kettler
ECTED] On Behalf Of Matt Kettler Sent: Saturday, January 17, 2004 12:06 AM To: Spamassassin-Talk Subject: [SAtalk] [RD] antidrug 0.2 available Fixes a few minor issues: 1) corrected spelling of sildenafil citrate. 2) added vigara to the v-word mis-spelling list 3) added optional leading and trailin

Re: [SAtalk] SpamAssassin checks on Received headers (and RBL's such as RCVD_IN_SORBS)

2004-01-18 Thread Matt Kettler
At 08:23 PM 1/18/04 -0500, Gerry Doris wrote: My ip is listed in SORBS for the simple reason that it is in a dynamic block of addresses administered by my ISP. SORBS just states that I should use my ISP mail server which I already do. Since SORBS only adds 0.10 to the spamassassin total I'm not co

RE: [SAtalk] SpamAssassin checks on Received headers (and RBL's such as RCVD_IN_SORBS)

2004-01-18 Thread Matt Kettler
At 05:49 PM 1/18/04 -0800, Mitch \(WebCob\) wrote: Problem with this fix is it only fixes things for my users locally - when my users send mail to someone else, they would have to set the same networks as trusted. This is untrue.. What ALL affected admins must do is set trusted_networks to is _the

Re: [SAtalk] Dump bayes db please explain the columns

2004-01-19 Thread Matt Kettler
At 04:25 AM 1/19/2004, Mrvka Andreas wrote: hi, i've made a dump of my bayes db but i don't know exactly the columns. please explain them. thanks. Andrew Let's use this fictitious example line: 0.029 0 2 1071094490 word The above line indicates: 0.029: the calculated spam pr

Re: [SAtalk] Help with report pse

2004-01-19 Thread Matt Kettler
At 10:40 AM 1/19/2004, John Fleming wrote: Does that use timing from the sender's computer time, ISP times, or what? It compares the date and time of the "Date:" header against the timestamps added into the Received: headers by the various mail relays. since the error is in the 6-12 hour range,

Re: [SAtalk] /etc/mail/spamassassin/local.cf is ignored

2004-01-19 Thread Matt Kettler
At 11:16 AM 1/19/2004, Claude Frantz wrote: But when messages are passed via sendmail (dual config) and amavis, the config file in /etc/mail/spamassassin/local.cf is not used. What is wrong here ? what signs of said failure are you seeing? Keep in mind that any spam-markup changes you apply to loc

[SAtalk] New Ruleset: EvilNumbers

2004-01-19 Thread Matt Yackley
only see one rule triggered per email. Recent corpus check showed 0 ham hits (Thanks Bob!). These rules are not available in stores, but can be picked up at: http://www.merchantsoverseas.com/wwwroot/gorilla/evilnumbers.cf http://www.yackley.org/sa-rules/evilnumbers.cf Enjoy! Matt Yackley

Re: [SAtalk] habeas problems

2004-01-19 Thread Matt Kettler
One more suggestion, in addition to reducing the score for HABEAS_SWE, if you use bayes, I'd suggest telling bayes to ignore SWE headers. bayes_ignore_header X-Habeas-SWE-1 bayes_ignore_header X-Habeas-SWE-2 bayes_ignore_header X-Habeas-SWE-3 bayes_ignore_header X-Habeas-SWE-4 bayes_ignore_header

Re: [SAtalk] habeas problems

2004-01-19 Thread Matt Kettler
At 11:27 AM 1/19/2004, Ron Culler wrote: I'm having problems with forged headers allowing email with the habeas tags. What is the best way to force a score for habeas tagged email? I use spamassassin with spamd and sql based user black/white lists but a common bayes db. put something similar to t

Re: [SAtalk] New Ruleset: EvilNumbers

2004-01-19 Thread Matt Yackley
|-|\.)0292|286(\s|-|\.)2187)/ --example-- Hopefully they won't start writing them as (555)(555)(), but I guess if they do, that will also be a great spam sign! I plan on testing Sylvain's idea as well, keep the comments, questions & suggestions coming. -matt -

Re: [SAtalk] Weeds Question

2004-01-19 Thread Matt Yackley
that are worried about false positives caused by the original version. You should only run one of those files. Jen has a short explanation on her site: http://www.emtinc.net/spamhammers.htm HTH, matt --- The SF.Net email is sponsore

Re: [SAtalk] New Ruleset: EvilNumbers

2004-01-19 Thread Matt Yackley
nate set with "[\s\(\)\-\.]+" now, so far so good. I'll also take a look at \W+ and \W* to see if it looks like they could FP on attachments or such. Thanks for the syntax tips -matt "Can't wait to see what phone numbers in spam will look like in a few weeks" ;)

Re: [SAtalk] Turning off Habeas?

2004-01-19 Thread Matt Yackley
ne.org/search.php?query=habeas&email=&group=spamassassin&sort=date -matt --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of

Re: [SAtalk] bigevil location

2004-01-19 Thread Matt Yackley
le which spamassassin will read for rules in ~.spamassassin/ would be user_prefs. HTH, matt --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse

Re: [SAtalk] SpamAssassin checks on Received headers (and RBL's such as RCVD_IN_SORBS)

2004-01-20 Thread Matt Kettler
At 09:02 PM 1/19/04 +0100, Anders Sveen wrote: I'm actually listed because it originates from a dynamic ip-range. Nothing more. It surprises me that they lists ip's for only beeing dynamic, but then I discovered the way RBLs are being used by mailservers and then it actually made sense. It doesn

Re: [SAtalk] how many spam/ham do I have in my bayes db?

2004-01-20 Thread Matt Kettler
At 12:27 PM 1/20/04 +, Adrian Simmons wrote: Is there an easy way to get a total of the spam/ham in the bayes db? I've noticed the total come up in the log when running SA in debug mode, and one could probably dump the db and go hunting for the magic numbers, but is there really nothing easi

Re: [SAtalk] Header Test (RBL) Question

2004-01-20 Thread Matt Kettler
At 09:13 AM 1/20/04 -0500, David Roback wrote: debug: DNS MX records found: 0 Shouldn't I be seeing more than 1 query for all messages? Hmm.. looks like your DNS is flaking out.. I'm pretty sure you should always have at least one MX success from the DNS_AVAILABLE test... What happens further

Re: [SAtalk] Custom Subject rules not being picked up

2004-01-20 Thread Matt Kettler
Are you sure you want that rule to be case sensitive, lower-case only? try header SUBJECT_VICODIN Subject =~ /\bvicodin\b/i (note the added i at the end) At 11:48 AM 1/20/04 +, David Logan wrote: header SUBJECT_VICODIN Subject =~ /\bvicodin\b/ describe SUBJECT_VICODIN Mentions vicodin scor

Re: [SAtalk] bigevil location

2004-01-20 Thread Matt Kettler
At 11:49 AM 1/20/04 +0800, Fritz Mesedilla wrote: Hello folks! I wanted to update my bigevil list but when I did a locate on them I got this: /var/amavis/.spamassassin/bigevil.cf /etc/mail/spamassassin/bigevil.cf Now I really forgot where the correct location is. Both files are identical. I know bi

Re: [SAtalk] What's up with OPT_HEADER rule?

2004-01-20 Thread Matt Kettler
At 09:54 PM 1/19/04 -0500, Barry Jaspan wrote: The OPT_HEADER (in 2.5x and 2.6x) rule does not make much sense to me: header __OPT_HEADER_SUBJALL =~ /^(?:Resent-)?Subject:.*opt.?(in|out|oem|ed|ion-in|[EMAIL PROTECTED])(?:\b|\d|\@)/im header __OPT_HEADER_ALL ALL =~ /opt.?(?:in|out|oem|ed|

Re: [SAtalk] Schools Slapped? FVGT

2004-01-20 Thread Matt Kettler
At 08:49 AM 1/20/04 -0600, Scott Williams , Area4 wrote: I just started using the FVGT rules and got this FP. Do I understand this right, the rule below penalizes (scores high) anyone with a .us domain? Yes, but it only penalizes them when used in a web-page link. Your From: address, etc won't c

Re: [SAtalk] changing the description text of tagged messages

2004-01-20 Thread Matt Kettler
At 10:50 AM 1/20/2004, Ricardo Kleemann wrote: Hi, How can I change the text that is included in tagged messages, that includes the servername and also includes my email address? perldoc Mail::SpamAssassin::Conf see the "report" and "clear_report_template" options. (note: don't edit 10_misc.cf..

[SAtalk] [RD] Antidrug 0.3 posted

2004-01-20 Thread Matt Kettler
Changes: -now catches some gapped-and-obfuscated v-words. on a test-list of 100 v-word spellings v 0.2 caught 37 of them. v 0.3 catches 65. more improvements in the works. (thanks for the list Gary) comments at top have a link to where the file comes from The ruleset is located at:

Re: [SAtalk] Enable localized rule descriptions

2004-01-20 Thread Matt Kettler
If you want your server to be in german, tell it. export LANG=de note: this may affect other programs on the system that are language-smart as well. At 12:01 PM 1/20/2004, Christopher Kunz wrote: just a quick question: How do I enable localized rule descriptions? There's a lot of german rule d

Re: [SAtalk] SA-learn with multiple users

2004-01-20 Thread Matt Kettler
At 12:14 PM 1/20/2004, Kenneth Andresen wrote: Will SA-learn filter all mails for everybody using the same rules, or how can it work with different rule set for each user/mail account? by default bayes databases and rulesets are specific to the user that executes SA (note: that's execution, which

Re: [SAtalk] Subjects not marked as spam anymore

2004-01-20 Thread Matt Kettler
At 12:24 PM 1/20/2004, Pat Traynor wrote: Spamassassin a couple of times, and I have to suspect that a new version changed things. Is this something that I can configure somewhere? start off with spamassassin --lint I suspect you've got some old and invalid things like defang_mime that are causi

Re: [SAtalk] URI Rules

2004-01-20 Thread Matt Kettler
sounds like you're making your own version of bigevil.cf. Chris S found that memory usage was greatly reduced by using regex combos to reduce the number of rules. At 12:31 PM 1/20/2004, Dan Kennedy wrote: How efficient are URI rules? I am probably going to have several hundred of these rules, an

Re: [SAtalk] Automated ruleset download

2004-01-20 Thread Matt Kettler
At 01:52 PM 1/20/2004, JRiley wrote: Just curious, if there is a script (be it perl or otherwise), that anyone has written, that will perform an automated 'download' of the different SARE (or other) SA rulesets? I wouldn't think this would too difficult to do, and have a scheduled restart of th

Re: [SAtalk] how many spam/ham do I have in my bayes db?

2004-01-20 Thread Matt Kettler
'magic' :) Well, at least for me. The above statement is rather amusing when you re-read your original question.. "one could probably dump the db and go hunting for the magic numbers" Apparently you only subconsciously knew what the term "magic" meant :) Thank

Re: [SAtalk] SpamAssassin checks on Received headers (and RBL's such as RCVD_IN_SORBS)

2004-01-21 Thread Matt Kettler
At 04:33 PM 1/20/04 +0100, Ralf Vitasek wrote: i tested many things with the trusted users settings and googled around but i had no luck so far. except that i stumbled on a posting from this lists archive that makes me think that something is broken and that it would be fixed in the upcoming 2.

Re: [SAtalk] This spam scores too low

2004-01-21 Thread Matt Kettler
At 11:56 AM 1/21/04 +0100, Jürgen R. Plasser wrote: Is there any way to get rid (say: score > 5) of those mails with SA? Some rules? I have SA 2.61 and the latest Bigevel rules installed. Well, antidrug is a good start. http://mywebpages.comcast.net/mkettler/sa/antidrug.cf

Re: [SAtalk] bayes should ignore habeas headers?

2004-01-21 Thread Matt Kettler
At 12:37 AM 1/21/04 -0500, Pedro Sam wrote: My question, should bayes ignore the habeas headers by default? Perhaps not by default, but right now it's probably a good idea. In general, any sudden shift of behavior from something commonly seen only in nonspam to commonly seen in both causes troubl

Re: [SAtalk] 'spamassassin -d' not stripping SA reports from email

2004-01-21 Thread Matt Kettler
At 10:41 PM 1/20/04 -0600, C. Bensend wrote: Is the problem that I'm _forwarding_ the tagged emails from one host to the other? I don't have the capability to bounce, I can only forward. A forwarded message is a brand new message. That brand new message is NOT sa tagged, even though it may con

Re: [SAtalk] Spelling mistakes in spam

2004-01-21 Thread Matt Kettler
At 09:51 AM 1/21/2004, Nicholson, Rob wrote: We've been looking and trialling No Spam Today which is based upon spamassasin. When we first tried it, it was catching probably 99% of all spam. However, over the past three months this figure has decreased noticeably. It appears to be because spamme

Re: [SAtalk] missed spam?

2004-01-21 Thread Matt Kettler
At 10:55 AM 1/21/2004, Paul Diaguila wrote: X-Spam-Score: 1.8 BAYES_30,HTML_60_70,HTML_IMAGE_ONLY_02,HTML_MESSAGE,HTML_TAG_BALANCE_BODY,MSGID_GOOD_EXCHANGE,OACYS_CONS_6,RM_rb_ANCHOR,RM_rb_BODY,RM_rb_HTML,RM_sl_Parens,SUBJECT_ENCODED_MY_TEST What am I missing? What version of SA are you running?

Re: [SAtalk] Not able to run sa-learn

2004-01-21 Thread Matt Kettler
At 10:36 AM 1/21/2004, Jody Cleveland wrote: I'm running spamassassin 2.62 with MailScanner on redhat 9. What I'm trying to run is this: sa-learn -p /etc/MailScanner/spam.assassin.prefs.conf --spam --mbox /var/spool/mail/bayes But, it just sits there. Sa-learn --rebuild and --force-expire work fine

Re: [SAtalk] No To line in header

2004-01-21 Thread Matt Kettler
Well, your rule is pretty wildly off.. ToCc is going to look for a header named ToCc, not To headers and/or CC headers. header __TO_EXISTS exists:to header __CC_EXISTS exists:cc meta NO_TO_OR_NO_CC (!__TO_EXISTS || !__CC_EXISTS) Or perhaps you want meta NO_TO_AND_N

Re: [SAtalk] No To line in header

2004-01-21 Thread Matt Kettler
At 01:02 PM 1/21/2004, st semps wrote: You see I thought that ToCc was valid. I thought I had read that somewhere. Obviously Im wrong. Actually, it apparently is valid.. my bad.. However, the string returned won't contain the To: or Cc: parts, just the email addresses. --

RE: [SAtalk] Not able to run sa-learn

2004-01-21 Thread Matt Kettler
Correction: the rm should rm bayes.lock, not bayes_*.lock. My typo. At 01:41 PM 1/21/2004, Jody Cleveland wrote: Here's what I get: debug: Syncing Bayes journal and expiring old tokens... debug: lock: 21404 created /etc/MailScanner/bayes/bayes.lock.mystique.winnefox.org.21404 debug: lock: 21404 tr

RE: [SAtalk] Not able to run sa-learn

2004-01-21 Thread Matt Kettler
At 01:41 PM 1/21/2004, Jody Cleveland wrote: Here's what I get: debug: Syncing Bayes journal and expiring old tokens... debug: lock: 21404 created /etc/MailScanner/bayes/bayes.lock.mystique.winnefox.org.21404 debug: lock: 21404 trying to get lock on /etc/MailScanner/bayes/bayes with 0 retries The t

[SAtalk] [Ruleset Update] EvilNumbers ver. 1.12 & new language packs

2004-01-21 Thread Matt Yackley
Thanks to Sylvain, Doug K. & Chris P. for their ideas on improving the rules! Changes: Added some more entries (many more to come within the next few days, just need time to process them) Changed "(\s|-|\.)" in phone numbers to "\W+", file should require less memory to run, is easier to read and

Re: [SAtalk] Why won't SA see my user_prefs?

2004-01-21 Thread Matt Kettler
At 02:00 PM 1/21/2004, [EMAIL PROTECTED] wrote: The spam I was trying to catch doesn't seem to be going through the rules I added. What else do I have to do? I'd start off with a run of spamassassin --lint to make sure you don't have a typo. After that, if it still doesn't work check the debug ou

Re: [SAtalk] doing a kind of "! whitelist_from_rcvd" possible ?

2004-01-21 Thread Matt Kettler
At 04:56 PM 1/21/2004, you wrote: Hi SA offers the possibility of having a "smarter" whitelist which whitelists only if the sending relay is "related" to the sending email, like whitelist_from_rcvd [EMAIL PROTECTED] example.com is there a possibility to somehow do the opposite, ie "blacklist [E

Re: [SAtalk] Surprise mail from myself

2004-01-21 Thread Matt Kettler
Why not change your domain whitelist to a whitelist_from_rcvd command, instead of whitelist_from. You'll avoid the forgery problem outright. At 04:43 PM 1/21/2004, Brad Hazledine wrote: Has anyone written a rule that catches mail supposedly sent by yourself to yourself? Example here... Receive

Re: [SAtalk] Surprise mail from myself

2004-01-21 Thread Matt Kettler
At 06:56 PM 1/21/2004, Kelson Vibber wrote: I suspect he did: >At 04:43 PM 1/21/2004, Brad Hazledine wrote: >>However, the rule seems to pick up the "by fargo.caledoncard.com" in the >>header and thinks that all is well. No, he did not use whitelist_from_rcvd. If you bring in more context, rather

RE: [SAtalk] doing a kind of "! whitelist_from_rcvd" possible ?

2004-01-22 Thread Matt Kettler
At 10:52 PM 1/21/2004, Mitch \(WebCob\) wrote: I've been told this can filter legitimate mail. Agreed Mitch.. if you read the rest of my message, I had a long warning about that. courier added a freemail concept, BUT, the yahoo servers send directly from the webmail appliances, which are not mx

[SAtalk] [RD] Antidrug 0.4 posted

2004-01-22 Thread Matt Kettler
I would have posted this sooner, but the editor I use on my home machine got mangled and won't run. (yay, time for a physical disk test). Changes: -Added an optional X to the end of the v-drug test, to catch another spelling. -Fixed a typo in the mis-spelled c-drug test. -added a few c

Re: [SAtalk] Set up

2004-01-22 Thread Matt Kettler
At 08:21 PM 1/21/04 -0600, George Matos wrote: I just got my domain name and am trying to setup spam assassin. I have never used it before so I was looking for some setup instructions etc. what kind of MTA (mailserver software) are you running? What OS/distro are you running it on? -

Re: [SAtalk] Help: Still getting through the 2.62

2004-01-22 Thread Matt Kettler
At 01:05 AM 1/22/2004, Thomas Kinghorn wrote: I have attached a few mails that are still getting through. These are scoring extremely low. The number of mails like these that slip through is on the increase. Any ideas as to how I can block them? I am using SA2.62, Exim 4.30 (with the exiscan 4.

Re: [SAtalk] trouble sending mail to this list

2004-01-22 Thread Matt Kettler
Define "refuses to send it to the list"? Does it bounce, or has it just not shown up yet? The sourceforge.net lists are on occasion incredibly slow.. 4-hour posting delays are NOT unheard of, although uncommon. Just because it takes a while, don't assume it's not in the queue.. sf.net processe

Re: [SAtalk] stats

2004-01-22 Thread Matt Thoene
so domains but I'm at a 78%/28% spam/ham ratio! Egads. -- Matt --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity.

  1   2   3   4   5   6   7   8   9   10   >