Re: 80K file attachments

On Tuesday, November 23, 2004, 11:10:19 AM, Pat Traynor wrote: > On Tue, 23 Nov 2004, Raymond Dijkxhoorn wrote: >> Spam? Virus! :) >> >> > Is anyone else seeing this, and is there a rule set that I could put >> > into place to take care of it? >> >> Your virus scanner should take care of them, m

Re: Drastic reduction in Phishing scores from 2.63 -> 3.01?

At 03:55 PM 11/23/2004, Greg Earle wrote: My 3.01 (bog-standard, no changes to defaults yet) testbed machine scored them at 4.9 and let them through! X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on myother.do.main X-Spam-Level: X-Spam-Status: No, score=4.9 required=5.0 tests=ALL_TR

Re: Drastic reduction in Phishing scores from 2.63 -> 3.01?

Greg Earle wrote: 2 identical Phishing scams came in yesterday: ... My 2.63 production machine scored them at 11.5: ... I'm sure the "ALL_TRUSTED" isn't helping any, but that doesn't completely explain the 6.2 drop in score. Did all the tests that are common to the two scores/versions get lowered

Re: MD or SA? Not always getting bayes_ scores

At 02:22 PM 11/23/2004, Adam Beatham wrote: Is there a possibility of some disconnect between mimedefang and SA that would prevent it from stamping a bayes_* score? Highly unlikely, unless it wasn't stamping any rules at all. Really from the perspective of MD, BAYES_20 is no different from any ot

Re: SpamAssassin failed to parse line, skipping?

Theo Van Dinter kluge.net> writes: > > On Tue, Nov 23, 2004 at 11:42:09AM -0800, Henry Kwan wrote: > > [root beans Mail-SpamAssassin-3.0.1]# spamassassin --lint > > config: SpamAssassin failed to parse line, skipping: num_check_received 5 > > lint: 1 issues detected. please rerun with debug en

Drastic reduction in Phishing scores from 2.63 -> 3.01?

2 identical Phishing scams came in yesterday: From: [EMAIL PROTECTED] Subject:SunTrust Bank INFORMS YOU Date: November 22, 2004 10:04:25 PM PST My 2.63 production machine scored them at 11.5: X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on my.do.main

Re: need testers for a new memory patch

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 thanks Andy -- sounds like very good results there. anyone else tried it yet? - --j. Andy Jezierski writes: > [EMAIL PROTECTED] wrote on 11/19/2004 08:09:26 PM: > > > So, I have a new patch that should greatly improve memory usage > > if you have a

Re: Problem starting spamd

Matt Kettler wrote: At 11:44 AM 11/23/2004, Brian O'Neill wrote: When I tried to do spamd restart I got these error messages. mail:/etc/mail/spamassassin# spamd restart cannot write to /root/.spamassassin/bayes_journal, Bayes db update ignored: Permission denied Cannot open bayes databases /root/.

Re: Problems with UNIX socket

Michael Barnes wrote: > Also, it seems easier and more flexable to just use the default TCP > socket instead of a UNIX socket. I'm not familiar with any > advantages of using a UNIX socket over a TCP one. Speed. If you're at the limits of your hardware, and you need to squeeze a bit of extra per

Re: SpamAssassin failed to parse line, skipping?

On Tue, Nov 23, 2004 at 11:42:09AM -0800, Henry Kwan wrote: > [EMAIL PROTECTED] Mail-SpamAssassin-3.0.1]# spamassassin --lint > config: SpamAssassin failed to parse line, skipping: num_check_received 5 > lint: 1 issues detected. please rerun with debug enabled for more > information. > > Is this

SpamAssassin failed to parse line, skipping?

Hi. Just upgraded from 2.64 to 3.01 and everything seems to working fine except that --lint gives me one error: [EMAIL PROTECTED] Mail-SpamAssassin-3.0.1]# spamassassin --lint config: SpamAssassin failed to parse line, skipping: num_check_received 5 lint: 1 issues detected. please rerun with de

Re: uridnsbl_max_domains config is broken

On Tue, Nov 23, 2004 at 01:56:37PM -0500, Larry wrote: > There is an option documented in the URIDNSBL plugin called > uridnsbl_max_domains, but there is no code in URIDNSBL.pm to parse this > option from the config file. Therefore, I get the following error: In general, bugs need to be reported

Re: MD or SA? Not always getting bayes_ scores

First off, thank you both (Matt and Jim) for your help. So I just ran a couple messages that had made it into my inbox with no bayes_* tags through spamassassin -D. Both of them report the same standard rule matches as they did originally, but through -D, both of them have a bayes_* match as wel

Re: 80K file attachments

Pat Traynor wrote: Well, my email doesn't get any further than my Linux box, so I'm not in any danger of being infected. But I provide email storage for others who are using SpamAssassin, and I like to eliminate whatever I can before it gets to them. The virus doesn't bother me. It's the emails

Re: uridnsbl_max_domains config is broken

- Original Message - From: "Larry" <[EMAIL PROTECTED]> > I am using SpamAssassin 3.0.1. > > There is an option documented in the URIDNSBL plugin called > uridnsbl_max_domains, but there is no code in URIDNSBL.pm to parse this > option from the config file. Therefore, I get the following

Re: MD or SA? Not always getting bayes_ scores

At 02:00 PM 11/23/2004, Adam Beatham wrote: This may or may not be a SA problem, but I'm stumped. I don't know when it exactly it happened, but recently I've noticed more and more spam trickling into my inbox. After looking, it appears that not every message gets scored with a bayes_* tag.. some

Re: MD or SA? Not always getting bayes_ scores

Adam Beatham wrote: Howdy, This may or may not be a SA problem, but I'm stumped. I don't know when it exactly it happened, but recently I've noticed more and more spam trickling into my inbox. After looking, it appears that not every message gets scored with a bayes_* tag.. some do, some don't.

Re: 80K file attachments

On Tue, 23 Nov 2004, Raymond Dijkxhoorn wrote: > Spam? Virus! :) > > > Is anyone else seeing this, and is there a rule set that I could put > > into place to take care of it? > > Your virus scanner should take care of them, most likely its > W32/[EMAIL PROTECTED] Well, my email doesn't get any

uridnsbl_max_domains config is broken

I am using SpamAssassin 3.0.1. There is an option documented in the URIDNSBL plugin called uridnsbl_max_domains, but there is no code in URIDNSBL.pm to parse this option from the config file. Therefore, I get the following error: # spamassassin --lint config: SpamAssassin failed to parse line, s

MD or SA? Not always getting bayes_ scores

Howdy, This may or may not be a SA problem, but I'm stumped. I don't know when it exactly it happened, but recently I've noticed more and more spam trickling into my inbox. After looking, it appears that not every message gets scored with a bayes_* tag.. some do, some don't. I'm running SA 3.0.

Re: Problems with UNIX socket

On Tue, Nov 23, 2004 at 11:25:28AM -0600, Jon Dossey wrote: > > Setup: Redhat FC2, sendmail 8.13.1, spamassassin 3.0.1, and > spamass-milter 0.2.0 > > Error: Nov 23 11:21:45 hostname spamd[3966]: Can't unlink > /var/run/spamd.socket: Permission denied > > Here's the info on the socket: > srw-rw-

Re: 80K file attachments

Install ClamAV and it'll help you with viruses, SA is a mail filter which does not do virus checking.

Re: 80K file attachments

Hi! Over the past 24 hours or so, I'm getting a LOT of emails of various types that all have an 80K file attached to it. e.g.: ++ User-Service: http://www.hotmail.com ++ MailTo: [EMAIL PROTECTED] [ Part 2, Application/OCTET-STREAM (Name: "hotmail.zip") 78KB. ]

per domain user_pref in postfix+amavis-new+spamassassin

Hi, thanks so much for your help regarding subject tagging. For postfix+amavis-new/clamd+spamassasssin setup, can it be set up to have a perdomain user_pref? http://wiki.apache.org/spamassassin/UsingSQL it is correct that, although spamassassin read it's local.cf file, the whole setting stuff

80K file attachments

Over the past 24 hours or so, I'm getting a LOT of emails of various types that all have an 80K file attached to it. e.g.: Return-Path: <[EMAIL PROTECTED]> Received: from jywwvxqt.com (67.111.167.138.ptr.us.xo.net [67.111.167.138]) by ssih.com (8.11.0/8.11.0) with

Re: need testers for a new memory patch

Michael Barnes <[EMAIL PROTECTED]> wrote on 11/23/2004 10:07:45 AM: > > On Tue, Nov 23, 2004 at 09:34:42AM -0600, Andy Jezierski wrote: > > I'm running on a FreeBSD 5.2.1 system with 192MB of ram > > [snip] > > I'm not trying to be rude.  But if I were stuck with the same crappy > server hard

Problems with UNIX socket

Setup: Redhat FC2, sendmail 8.13.1, spamassassin 3.0.1, and spamass-milter 0.2.0 Error: Nov 23 11:21:45 hostname spamd[3966]: Can't unlink /var/run/spamd.socket: Permission denied Here's the info on the socket: srw-rw-rw- 1 spamd root0 Nov 23 11:21 spamd.socket And worth noting: spam

Re: no dbs present, cannot tie DB R/O: /root/.spamassassin/bayes_toks

On Tue, Nov 23, 2004 at 10:54:04AM -0600, Johnson, S wrote: > The real file exists in /var/amavis/.spamassassin/bayes_toks. Anyone > know where this path is set? User Contributed Perl Documentation Mail::SpamAssassin::Conf(3) user has their own, in their "~/.spamassassin" directory

Re: Problem starting spamd

At 11:44 AM 11/23/2004, Brian O'Neill wrote: When I tried to do spamd restart I got these error messages. mail:/etc/mail/spamassassin# spamd restart cannot write to /root/.spamassassin/bayes_journal, Bayes db update ignored: Permission denied Cannot open bayes databases /root/.spamassassin/bayes_*

no dbs present, cannot tie DB R/O: /root/.spamassassin/bayes_toks

I just upgraded from 2.62 to 3.0.1 and ran into the error:   no dbs present, cannot tie DB R/O: /root/.spamassassin/bayes_toks   when I type in sa_learn –dump –D   I had bayes running before the upgrade.  I wouldn’t mind restarting the bayes DB if I had to. (I’ve got lots of spam and

Problem starting spamd

When I tried to do spamd restart I got these error messages. mail:/etc/mail/spamassassin# spamd restart cannot write to /root/.spamassassin/bayes_journal, Bayes db update ignored: Permission denied Cannot open bayes databases /root/.spamassassin/bayes_* R/W: tie failed: Permission denied So I ch

Re: selected rulesets for better performance

On Tue, Nov 23, 2004 at 03:14:18PM +, Ronan wrote: > 70_sare_adult.cf > 70_sare_bayes_poison_nxm.cf > 70_sare_genlsubj0.cf > 70_sare_header0.cf > 70_sare_html0.cf > 70_sare_oem.cf > 70_sare_random.cf > 70_sare_specific.cf > 70_sare_spoof.cf > 70_sare_unsub.cf > 70_sare_uri.cf > 72_sare_bml_post

Re: need testers for a new memory patch

On Tue, Nov 23, 2004 at 09:34:42AM -0600, Andy Jezierski wrote: > I'm running on a FreeBSD 5.2.1 system with 192MB of ram Please ignore this if this box is an old personal machine or a test box, or this is some donated box for a charity organization or something similar. I've always considered

RE: SURBL and DNS wildcards

>-Original Message- >From: Jeff Chan [mailto:[EMAIL PROTECTED] >Sent: Monday, November 22, 2004 8:26 PM >To: Jim Maul >Cc: Chris Santerre; SpamAssassin Users >Subject: Re: SURBL and DNS wildcards > > >On Monday, November 22, 2004, 11:08:26 AM, Jim Maul wrote: >> Chris Santerre wrote:

Re: need testers for a new memory patch

[EMAIL PROTECTED] wrote on 11/19/2004 08:09:26 PM: > So, I have a new patch that should greatly improve memory usage > if you have a low memory situation (where "low" == "< 100MB of > free RAM", typically ;) > > It should apply cleanly to 3.0.0.   I'd be very interested in > feedback from people

selected rulesets for better performance

im running 3.0.1 with the SURIBLS but im starting to get the load related spam acl condition: spamd connection to 127.0.0.1, port 783 failed: Connection timed out which of the following could i cut back on or does it depend on which types of spam our site is getting?? 70_sare_adult.cf 70_sare_b

Re: setting scores in local.cf

At 12:02 PM 11/23/2004 +, Ronan wrote: can i add the following line to local.cf for sitewide effect? score ALL_TRUSTED -1.8 i ask because ive tried this already and it is still coming through as the default -2.8 SA checks the rule files first then uses local.cf as an overiding authority isnt

Re: setting scores in local.cf

aww D'oh! i lint'd and checked path but... i didnt restart spamd. thanks matt computing 101... Matt Kettler wrote: At 12:02 PM 11/23/2004 +, Ronan wrote: can i add the following line to local.cf for sitewide effect? score ALL_TRUSTED -1.8 i ask because ive tried this already and it is still com

RE: Number of spamd process running

From: Chris [mailto:[EMAIL PROTECTED] > > On Monday 22 November 2004 09:29 am, Bowie Bailey wrote: > > From: Chris [mailto:[EMAIL PROTECTED] > > > > > You missed something... > > > > SA 3.0.1 pre-spawns it's children. Rather than spawning a child for > > each incoming connection, it pre-spawns a

Re: Bayes question

At 01:58 AM 11/23/2004 -0500, Austin Weidner wrote: Really trying to figure out bayes. Auto learn is set up, and my headers are showing autolearn=spam However, when I do sa-learn --dump magic, there are zero spams and zero hams. By using the -D (debug) option, I can see sa-learn is looking at: debu

Re: BayesStore.pm

At 12:47 AM 11/23/2004 -0600, Andy Norris wrote: Thanks for your help. I did run sa-learn --sync. Also, where do I find the command line that launches spamd (I'm using sendmail)? It will be in the service script. It should be in /etc/rc.d/init.d/ on most linux boxes. /etc/init.d/ on a few linuxe

setting scores in local.cf

can i add the following line to local.cf for sitewide effect? score ALL_TRUSTED -1.8 i ask because ive tried this already and it is still coming through as the default -2.8 SA checks the rule files first then uses local.cf as an overiding authority isnt that right? thanks ronan -- Regards Ronan

FW: Help....SA seems.......: SOLVED

Title: FW: HelpSA seems...: SOLVED Hi List. Please ignore my previous posting. Finger trouble cause the issue. Typo in my exim configuration file. Thanks Tom

Bayes question

Really trying to figure out bayes. Auto learn is set up, and my headers are showing autolearn=spam However, when I do sa-learn --dump magic, there are zero spams and zero hams. By using the -D (debug) option, I can see sa-learn is looking at: debug: bayes: 17216 tie-ing to DB file R/O /root/.spa

Re: BayesStore.pm

Hi Matt, Thanks for your help. I did run sa-learn --sync. Also, where do I find the command line that launches spamd (I'm using sendmail)? Thanks again, Andy At 11:52 pm 2004-11-22, Matt Kettler wrote: At 10:09 PM 11/22/2004 -0600, Andy Norris wrote: I have attempted to upgrade from 2.64 to 3.0.1

Re: SA 3.01 DCC and Pyzor

At 09:00 PM 11/22/2004 -0600, Chris wrote: With 2.63 and DCC active I'd see a body #, fuz1 # and fuz2 #, I no longer see that. I do have the dcc_body_max; _fuz1_max and _fuz2_max set to the suggested 99 in my local.cf. I also used to see the number of times a msg had been reported to pyzor, t

Re: BayesStore.pm

At 10:09 PM 11/22/2004 -0600, Andy Norris wrote: I have attempted to upgrade from 2.64 to 3.0.1, and the service will not start. I did pay attention to the upgrade document. When I attempt to start the service, I get: Starting spamd: The -a option has been removed. Please look at the use_auto_wh

Help....SA seems to have stopped working on most mail.

Title: HelpSA seems to have stopped working on most mail. Hi List. Don’t know if its only me but SA seems to have just stopped running. Could it be the Internet Headers Version 2.0 ? All was fine then nothing. I have insrtalled the latest version of SA but still nothing. Below are

BayesStore.pm

Hi All, I have attempted to upgrade from 2.64 to 3.0.1, and the service will not start. I did pay attention to the upgrade document. When I attempt to start the service, I get: Starting spamd: The -a option has been removed. Please look at the use_auto_whitelist config option instead. When I sp

SA 3.01 DCC and Pyzor

With 2.63 and DCC active I'd see a body #, fuz1 # and fuz2 #, I no longer see that. I do have the dcc_body_max; _fuz1_max and _fuz2_max set to the suggested 99 in my local.cf. I also used to see the number of times a msg had been reported to pyzor, that too seems to be gone. Although SA

installing SA for the first time

I have just installed 3.0.1 on my OpenBSD 3.6 stable (Nov. 16) system using cpan. I can't seem to locate the spamd daemon although the spamc client is there. It's curious because OpenBSD already has a daemon named spamd. Also, if anyone has any experience running SA with smtp-vilter (a sendma

Re: Number of spamd process running

On Monday 22 November 2004 09:29 am, Bowie Bailey wrote: > From: Chris [mailto:[EMAIL PROTECTED] > > You missed something... > > SA 3.0.1 pre-spawns it's children. Rather than spawning a child for > each incoming connection, it pre-spawns a set number of children to > deal with the connections.

Re: SURBL and DNS wildcards

On Monday, November 22, 2004, 11:08:26 AM, Jim Maul wrote: > Chris Santerre wrote: >>>-Original Message- >>>From: Jeff Chan [mailto:[EMAIL PROTECTED] >> FWI, Chris finally got his copy of JO:E Saturday night. Chris has gotten >> about 6 total sleep hours over the weekend :) >> >> Chris i