Hello,
I would like to reduce the number of messages spamd puts in the syslog.
E.g., normal processing such as:
Dec 10 13:52:30 reidster spamd[29891]: connection from localhost [127.0.0.1]
at port 37145
Dec 10 13:52:30 reidster spamd[29906]: processing message <[EMAIL PROTECTED]>
for Debi
Chr. von Stuckrad wrote:
Hi!
I'm just curious whether a very strange spam is send to
'many' users. Today many addresses here were hit by
absolutely *useless* messages, which *look* like real
spam, as long as you look at the subject, which ist
the often recurring theme of 'telephone-cd with reverse
Hi!
I'm just curious whether a very strange spam is send to
'many' users. Today many addresses here were hit by
absolutely *useless* messages, which *look* like real
spam, as long as you look at the subject, which ist
the often recurring theme of 'telephone-cd with reverse
search enabled'. But l
Cool.
Have to turn up logging to 2, but I'll try it on Monday and see what that
brings.
Thanks,
Kurt
-Original Message-
From: Bill Landry [mailto:[EMAIL PROTECTED]
Sent: Friday, December 10, 2004 13:30
To: users@spamassassin.apache.org; Kurt Buff
Subject: Re: Soliciting advice from the
It's come through now after receiving a few messages from the list. I
should have been more patient, sorry!
Some more info on the wiki would seem to be a good idea? Especially
mentioning the digest lists which are effectively separate lists and not
an option of the normal list.
Thanks,
Geoff
>>
> -Original Message-
> From: Geoff Soper [mailto:[EMAIL PROTECTED]
> Sent: Friday, December 10, 2004 3:30 PM
> To: users@spamassassin.apache.org
> Subject: List options?
>
>
> I've just rejoined the list after leaving it a while ago.
>
> Can someone point me in the direction of some lis
- Original Message -
From: "Kurt Buff" <[EMAIL PROTECTED]>
> > > I would love to know how this report was generated.
> > >
> > > Thanks,
> >
> > Generally speaking, it was was sa-stats.pl found in the tools
> > directory of the SA 3.0.1 tarball.
> >
> > Specifically speaking:
> > sa-stats
I've just rejoined the list after leaving it a while ago.
Can someone point me in the direction of some list options such as setting
digest mode, suspending my subscription and leaving the list? I didn't
receive a welcome message from the list, I can't see anything at
http://wiki.apache.org/spamas
Well, I'd try stopping spamass-milter and sendmail, cleaning up the
socket (read: deleting it), then I'd make sure spamd was running, and
accepting connections, then I'd restart the services.
Everything works well after restart.But I've to do this every 1-2 hours.
:'(
Is there any better solut
Hello Loren,
Friday, December 10, 2004, 10:33:02 AM, you wrote:
>> > Got a couple spams today that slipped by SA with a plain text and HTML
>> > part, and this was the plain text part:
>> > "Get a capable html e-mailer"
>> ...
>> I've seen this mentioned a couple of times recently. If it's really
Matthew said...
> On Fri, 10 Dec 2004 11:02:03 -0500 (EST), JP <[EMAIL PROTECTED]> wrote:
> > > Report Title : SpamAssassin - Spam Statistics
> > > Report Date : 2004-12-10
> > > Period Beginning : Thu 09 Dec 2004 06:00:00 AM PST
> > > Period Ending: Fri 10 Dec 2004 06:00:00 AM PST
> >
On Fri, Dec 10, 2004 at 08:31:57PM +0100, Per Jessen wrote:
> > No. The issue is that "cumulus-bonuspunkten" looks like an ID tag.
>
> Should SUBJ_HAS_UNIQ_ID really fire on that - simply a hyphenated word? There
> are plenty of those around (although less in german then in english).
It's not
On Fri, 10 Dec 2004 11:02:03 -0500 (EST), JP <[EMAIL PROTECTED]> wrote:
> > Report Title : SpamAssassin - Spam Statistics
> > Report Date : 2004-12-10
> > Period Beginning : Thu 09 Dec 2004 06:00:00 AM PST
> > Period Ending: Fri 10 Dec 2004 06:00:00 AM PST
> >
> > Reporting Period : 24
From: Michael Barnes [mailto:[EMAIL PROTECTED]
>
> On Thu, Dec 09, 2004 at 04:31:29PM -0500, Bowie Bailey wrote:
> > > Hash Busting - slightly modify each copy of message to foil
> > > 'fingerprinting' techniques
> >
> > SpamAssassin does not use message fingerprinting, so this is
> > irrelevant.
My understanding is that spamd should not be running when spamassassin is
used in conjunction with MailScanner as MailScanner uses spamassassin
directly, and not as a daemon?
So is this a MailScanner issue, then?
Thanks Mike,
Andy
At 01:44 pm 2004-12-10, you wrote:
Is spamd running?
On Fri, 10 D
>
> Did someone copy the wrong files over to the new SARE server?
>
Not exactly
" Nevermind, I finally hacked this out myself.This is probably why
those _uri.cf files were supposedly 'missing', because they were in
rulebase/ and not rules/, which if the redirect were in place, it would
h
Is spamd running?
On Fri, 10 Dec 2004, Andy Norris wrote:
>
> Sorry to bother again, but I feel we must be getting closer...
>
> This in the logs (/var/log/maillog) now...(!)
>
> Dec 10 13:44:40 tireswing spamc[22597]: connect() to spamd at 127.0.0.1
> failed, retrying (1/3): Connection refus
Yassen Damyanov wrote:
> On Friday 10 December 2004 18:21, Kris Deugau wrote:
> > I've
> > had trouble in the past with Bayes learning very low-scoring spam
> > as ham - so I lowered the autolearn-as-ham threshold to -0.1.
> I came to a conclusion that some real spams got scored very low and
> poi
Sorry to bother again, but I feel we must be getting closer...
This in the logs (/var/log/maillog) now...(!)
Dec 10 13:44:40 tireswing spamc[22597]: connect() to spamd at 127.0.0.1
failed, retrying (1/3): Connection refused
Dec 10 13:44:41 tireswing spamc[22597]: connect() to spamd at 127.0.0.1
f
Robert Leonard wrote:
Hmm.. well, all 3 of those files I mentioned were first time downloads this
morning.. I manually got them using wget.. I've been running 3.0 for some
time now (months) and this is the first time I've seen these errors..
Nobody else is getting this when they lint with these r
Theo Van Dinter wrote:
> On Fri, Dec 10, 2004 at 01:25:43PM +0100, Per Jessen wrote:
>> Why does SUBJ_HAS_UNIQ_ID fire on this subject:
>>
>> Subject: =?iso-8859-1?Q?MIGROL_Heiz=F6l-Angebot_mit_Cumulus-Bonuspunkten?=
>>
>> Is this a bug in the RFC2047 decoding in SA 2.64?
>
> No. The issue is
- Original Message Follows -
Date: Fri, 10 Dec 2004 10:51:48 -0800
---snip---
> Actual score is 5.991
It never occured to me to add them up manually. Thanks, your
right.
=
Kevin W. Gagel
Network Administrator
Information Technology Services
(250) 561-5848 local 448
On Fri, 2004-12-10 at 08:32 -0800, Robert Leonard wrote:
> When I lint this rule I get numerous events warning that the describe
> field is more the 50 characters in length.. Is this something new, or
> something I can fix (short of going through and modifying each of
> these lines by hand)?
>
>
On 9 Dec 2004 at 13:14, Michael Chan wrote:
> All,
> I have a system setting in procmail which puts email
> marked as spam from spamassassin into each user's
> spambucket at the server side. But some user wants
> the spam to be deliver to them marked by spamassassin
> as spam mail. I plan to use
bayes: bayes db version 0 is not able to be used, aborting! at
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/BayesStore/DBM.pm line 160.
bayes: bayes db version 0 is not able to be used, aborting! at
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/BayesStore/DBM.pm line 160.
???
Is this a ma
Title: 70_sare_header0 70_sare_header1 and 70_sare_genlsub problems
Hmm.. well, all 3 of those files I
mentioned were first time downloads this morning.. I manually got them using
wget.. I've been running 3.0 for some time now (months) and this is the first
time I've seen these errors..
Nob
> I'm using a filtering rule that checks for a minimum amount
> of *'s in the spam-level header. If it finds 6 or more then
> the message is redirected to my spam folder for later
> review.
>
> I was suprised to see this message did not get redirected as
> it scored 6. Yet the spam level has only 5
Hi!
I'm experiencing some performance problems with SA.
The sending of emails trough my sendmail is much more slower after the
installation of spamassassin. I changed the value of -m to 20 and it's
working better, but still gets a little slow sometimes.
Could be this value what is affecting the
This should help explain the rules:
http://spamassassin.apache.org/tests.html
Steve
>Thanks a LOT to all who posted back (what a supportive community!
>This was my first post) especially to Kris.
>
>On Friday 10 December 2004 18:21, Kris Deugau wrote:
>> Yassen Damyanov wrote:
>> >
>> > debug: r
I'm using a filtering rule that checks for a minimum amount
of *'s in the spam-level header. If it finds 6 or more then
the message is redirected to my spam folder for later
review.
I was suprised to see this message did not get redirected as
it scored 6. Yet the spam level has only 5 *'s.
I'm us
Title: 70_sare_header0 70_sare_header1 and 70_sare_genlsub problems
You either have very old versions of those files, or are using
a pre-3.0 version of something.
We cleaned up all of those 3.0 warnings a couple of months
back, *except* in a couple of files that were specifically 3.0 only.
Thanks a LOT to all who posted back (what a supportive community!
This was my first post) especially to Kris.
On Friday 10 December 2004 18:21, Kris Deugau wrote:
> Yassen Damyanov wrote:
> >
> > debug: running meta tests; score so far=5.53
> > debug: auto-learn? ham=0.2, spam=8, body-hits=4.166,
> > Got a couple spams today that slipped by SA with a plain text and HTML
> > part, and this was the plain text part:
> >
> > "Get a capable html e-mailer"
> >
> > Do you sense a certain frustration with us? ;)
>
> I sense a great string to filter on.
>
> I've seen this mentioned a couple of times
On Fri, Dec 10, 2004 at 01:25:43PM +0100, Per Jessen wrote:
> Why does SUBJ_HAS_UNIQ_ID fire on this subject:
>
> Subject: =?iso-8859-1?Q?MIGROL_Heiz=F6l-Angebot_mit_Cumulus-Bonuspunkten?=
>
> Is this a bug in the RFC2047 decoding in SA 2.64?
No. The issue is that "cumulus-bonuspunkten" looks
Bill,
This does not move spam into a new file. In fact, it moves all into a new
file.
I want to be able to move ONLY SPAM or ONLY HAM into a new file.
thanks
Andrew
- Original Message -
From: "William Stearns" <[EMAIL PROTECTED]>
To: "Andrew Xiang" <[EMAIL PROTECTED]>
Cc: "Jim Maul" <[E
>-Original Message-
>From: JP [mailto:[EMAIL PROTECTED]
>Sent: Friday, December 10, 2004 11:02 AM
>To: users@spamassassin.apache.org
>Subject: Re: Soliciting advice from the list members
>
>
>> Report Title : SpamAssassin - Spam Statistics
>> Report Date : 2004-12-10
>> Period Be
>
>
> Yassen Damyanov wrote:
> >
> > Hi SA User List,
> >
> > Here's my case: postfix + amavisd-new + SpamAssassin 2.64
> working on
> > a Gentoo Linux box, serving as a mail server for serveral virtual
> > domains.
> >
> > Some SpamAssassin details: Bayes learning activated
> recently, b
Title: 70_sare_header0 70_sare_header1 and 70_sare_genlsub problems
When I lint this rule I get numerous events warning that the describe field is more the 50 characters in length.. Is this something new, or something I can fix (short of going through and modifying each of these lines by hand
Kris Deugau wrote:
Rob Kudyba wrote:
Well there is a company that sprouted from Vipul's Razor that uses
the concept of collaborative filtering and adaptive learning from
over a million trusted users, in a type of-- if you will--"[EMAIL PROTECTED]
net"--(ah hem) and I don't believe this 'net is i
Yassen Damyanov wrote:
>
> Hi SA User List,
>
> Here's my case: postfix + amavisd-new + SpamAssassin 2.64
> working on a Gentoo Linux box, serving as a mail server for
> serveral virtual domains.
>
> Some SpamAssassin details: Bayes learning activated recently,
> based on about 300 spam mails a
> Got a couple spams today that slipped by SA with a plain text and HTML
> part, and this was the plain text part:
>
> "Get a capable html e-mailer"
>
> Do you sense a certain frustration with us? ;)
I sense a great string to filter on.
I've seen this mentioned a couple of times recently. If it's
Does the /var/run/sendmail/spamass.sock exist?
Yes,there is.
srwxr-xr-x 1 root root 0 Dec 10 10:53 spamass.sock=
(there is "=" behind the file when use "ls")
System log file says:
Milter (spamassassin): local socket name /var/run/sendmail/spamass.sock unsafe
This SA can runs well for a moment
On Fri, 2004-12-10 at 07:13, Kenneth Porter wrote:
> Got a couple spams today that slipped by SA with a plain text and HTML
> part, and this was the plain text part:
>
> "Get a capable html e-mailer"
>
> Do you sense a certain frustration with us? ;)
I have a specific kill rule for MUA snobbery
Rob Kudyba wrote:
> Well there is a company that sprouted from Vipul's Razor that uses
> the concept of collaborative filtering and adaptive learning from
> over a million trusted users, in a type of-- if you will--"[EMAIL PROTECTED]
> net"--(ah hem) and I don't believe this 'net is incorporated in
On Thu, 2004-12-09 at 13:14, Michael Chan wrote:
> All,
> I have a system setting in procmail which puts email
> marked as spam from spamassassin into each user's
> spambucket at the server side. But some user wants
> the spam to be deliver to them marked by spamassassin
> as spam mail. I plan to
> rulesemporium just moved to a new server. Looks like some of the
files didn't make it.
>
>> Is it just me or are the following rules missing?
>>
>> 70_sare_unsub.cf
>> 70_sare_uri.cf
>
i dont see those 2 files in the packs phil sent me dunno what to
tell ya.
d
> Report Title : SpamAssassin - Spam Statistics
> Report Date : 2004-12-10
> Period Beginning : Thu 09 Dec 2004 06:00:00 AM PST
> Period Ending: Fri 10 Dec 2004 06:00:00 AM PST
>
> Reporting Period : 24.00 hrs
> --
I would love to know h
Title: Missing rules at the Emporium?
rulesemporium just moved to a new server. Looks like
some of the files didn't make it.
Loren
- Original Message -
From:
Robert
Leonard
Cc: SA List
Sent: Friday, December 10, 2004 7:35
AM
Subject: Missing rules at th
Title: Missing rules at the Emporium?
SARE has
moved to a new home. Its possible these didn't get moved
over. And SARE is working on a new surprise. More testing
needed. :)
--Chris
-Original Message-From: Robert Leonard
[mailto:[EMAIL PROTECTED]Sent: Friday, December 10, 200
On Thu, Dec 09, 2004 at 04:31:29PM -0500, Bowie Bailey wrote:
> > Hash Busting - slightly modify each copy of message to foil
> > 'fingerprinting' techniques
>
> SpamAssassin does not use message fingerprinting, so this is
> irrelevant.
I was under the impression that razor and pyzor were "finger
Title: Missing rules at the Emporium?
Is it just me or are the following rules missing?
70_sare_unsub.cf
70_sare_uri.cf
Adam,
I'm sure everyone else that replies may say basically the same as me,
but here's my input about SA and your management's questions.
> Hash Busting - slightly modify each copy of message to foil
> 'fingerprinting' techniques
AFAIK, the fingerprinting techinques are "fuzzy" and can withstand
At 04:47 PM 12/10/2004 +0200, Yassen Damyanov wrote:
debug: Score set 2 chosen.
debug: auto-learn? no: inside auto-learn thresholds
debug: is spam? score=0.629 required=6.8
tests=BAYES_00,DATE_IN_PAST_12_24,SARE_ADULT2,SARE_OBFUPORNO
Then the message is tagged "X-Spam-Status: No, hits=0.6".
This
Howdy,
As some of you may or may not know the support for PostgreSQL in the
BayesSQL storage engine was there but not really. It works but it
doesn't really work well.
To help I've created a PostgreSQL specific module that has the
following properties:
1) Changed the token type column to bytea
Got a couple spams today that slipped by SA with a plain text and HTML
part, and this was the plain text part:
"Get a capable html e-mailer"
Do you sense a certain frustration with us? ;)
debug: is spam? score=0.629 required=6.8
tests=BAYES_00,DATE_IN_PAST_12_24,SARE_ADULT2,SARE_OBFUPORNO
Then the message is tagged "X-Spam-Status: No, hits=0.6".
This is an obvious adult site adv. and SARE rules do a good job. But why the
score
is lowered at the end?
BAYES_00. That says Bayes is
On Friday 10 December 2004 14:47, Yassen Damyanov might have typed:
> debug: auto-learn? no: inside auto-learn thresholds
> debug: is spam? score=0.629 required=6.8 tests=BAYES_00,
Your Bayes DB for the amavis install reckoned the mail was -4.9 points.
Found part of the problem. I did not import my db after upgrading, do
my bayes db were not working. Fixed that with:
sa-learn --import
sa-learn --sync
Hope this save someone else some time.
Shane
> shane mullins wrote:
> > When we first built our spam filters, over a year ago, it worked
gr
Hi SA User List,
Here's my case: postfix + amavisd-new + SpamAssassin 2.64
working on a Gentoo Linux box, serving as a mail server for
serveral virtual domains.
Some SpamAssassin details: Bayes learning activated recently,
based on about 300 spam mails and 200 ham mails, which accumulate
in IMAP
On Thu, 09 Dec 2004 16:04:28 -0500, Adam Lanier <[EMAIL PROTECTED]> wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> My managment has recently asked me how SpamAssassin is prepared to deal
> with a number of recent trends in spam technology. This was prompted by
> a recent seminar the
Shane
apply extra rules mentioned in www.rulesemporium.com/rules.htm
(Don't use the bigevil on though, turn on the URIRBL handling in SA3.01)
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
shane mullins wrote:
When we first built our spam filters, over a year
And the key point is that if commercial anti-spam vendors
are using points such as these to either differentiate
themselves from other commercial efforts or SpamAssassin,
they're either:
A) Using SpamAssassin underneath
B) Inferior to SpamAssassin
C) Equivalent functionally to SpamAssassin
Jeff C.
So true... Linux world was full of anti-spam peddlers who's products
were based on SA. All's they do is wrap it into a closed box, put a
front end gui on it and make it impossible for you to customize. And
oh, they also charge you a licensing fee for it.
It's good if you don't know how to con
When we first built our spam filters, over a year ago, it worked great
out of the box. It was incredible. But, over time some spam started to
get through. We were running SA 2.64. So I upgraded to SA 3.01. And
about the same amount of spam was still getting through. Could someone
please point
You could try using MailScanner from http://www.mailscanner.info .
Wraps everything nicely for you.
Phil
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
> -Original Message-
> From: news [mailto:[EMAIL PROTECTED] On Behalf Of Nat Brazil
> Sent: 09 December 2004 19
Hi All,
We've installed a Fedora Core 2 server running Sendmail
Got that running :) Thats good for our knowledge level!
We're windows geeks learning unix, have pity on us LOL :)
Now trying to get SA and ClamAV working
Got SA working, but I'd link tutorial info on
tweaking it. I ran debug below,
Why does SUBJ_HAS_UNIQ_ID fire on this subject:
Subject: =?iso-8859-1?Q?MIGROL_Heiz=F6l-Angebot_mit_Cumulus-Bonuspunkten?=
It looks as SA mistakenly interprets the underscores as underscores - which in
an RFC2047 encoded string, they're not - http://rfc.net/rfc2047.html ,
Is this a bug in the RF
>>
>> There were 3 replies to my suggested rules. I am responding to those
>> comments, plus giving statistics on what I've found in the spam & ham
>> I've collected.
>>
>>
>> Display name statistics:
>>
>> Since I haven't collected the data on the other local users for their
>> display nam
On Thursday, December 9, 2004, 8:28:47 PM, Loren Wilton wrote:
>> These are the recent trends raised by my management:
>>
>> Hash Busting - slightly modify each copy of message to foil
>> 'fingerprinting' techniques
> Since SA doesn't do fingerprinting this doesn't have quite the desired
> effect.
> These are the recent trends raised by my management:
>
> Hash Busting - slightly modify each copy of message to foil
> 'fingerprinting' techniques
Since SA doesn't do fingerprinting this doesn't have quite the desired
effect.
It can break a meta rule looking for particular text, but the quick an
This sounds like it is probably worth a bugzilla report.
Loren
- Original Message -
From: "Clarke Brunt" <[EMAIL PROTECTED]>
To:
Sent: Thursday, December 09, 2004 5:29 AM
Subject: Hashcash plugin bugs
> Hello
>
> I'm using SpamAssassin 3.0.1 (and have checked Bugzilla and late
On Thu, 2004-12-09 at 11:24, David Brodbeck wrote:
> On Thu, 09 Dec 2004 08:25:07 -0800, SA wrote
> > For some time I have been trying to determine why spamassassin
> > performance on our server hasn't been as rapid as it should be. I think
> > I've discovered a possible cause. The server can be
There were 3 replies to my suggested rules. I am responding to those
comments, plus giving statistics on what I've found in the spam & ham
I've collected.
Combining these techniques may distinguish about 27% of the spam in my
sample (100%- ((100 - 18%) * (100 - 11%)) = 27%) or maybe 36% of spa
Does the /var/run/sendmail/spamass.sock exist?
- Original Message -
From: "Allan Sun" <[EMAIL PROTECTED]>
To:
Sent: Thursday, December 09, 2004 2:55 PM
Subject: Broken pipe
> Hi everyone,
>
> I just installed SA 3.0.1 on my mail server,Mandrake 10.0,Sendmail
> 8.12.11,SpamAss-Milter
74 matches
Mail list logo
