Re: Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Chris Thielen
Darren Coleman wrote: Hi Loren, Firstly, thanks for your help. I have searched around rulesemporium without much success trying to find these LOCAL_OBFU_* rules. I don't suppose you could tell me the filename that they occur in could you? (I assume they will be in /etc/mail/Spamassassin or whereve

Bayes: this is really nice, should use and train it. Highly recommended.

2005-01-12 Thread Fajar Priyanto
Hi folks, Thanks for telling me to train SA of hams too. After some training, SA catches about 90% of spam, which the most score often comes from BAYES_XX BODY. My SA on the notebook is 3.0.2 And I did it on my 2.64 on the server too with similar result. This bayes thing is really something :) -

phishing rule

2005-01-12 Thread Dan
I am trying to write a rule to catch phishing schemes of this nature: http://legit-stie.com/login Is there anything wrong with this regexp? /href=\"\d{1,3}(\.\d{1,3}){3}[^\"]*\"[^\>]*\>\s*http/ I realize that it is probably really error-prone, but that is why I am throwing it out to this list. H

Re: Web interface for managing user_prefs

2005-01-12 Thread Todd Rittinger
We're using the SASQL plugin with Squirrelmail and it seems to work OK with 3.02. Be well, TR On Wednesday 12 January 2005 17:55, Fahy, Michael wrote: > We use spamassassin via sendmail, spamass-milter, spamc/spamd on Fedora. > > > > We are looking for a way to enable users to manage their own u

Re: Web interface for managing user_prefs

2005-01-12 Thread Andy Jezierski
"Fahy, Michael" <[EMAIL PROTECTED]> wrote on 01/12/2005 04:55:55 PM: > We use spamassassin via sendmail, spamass-milter, spamc/spamd on Fedora. >   > We are looking for a way to enable users to manage their own > user_prefs file through a web interface. [snip] If you don't mind changing some of

Re: Web interface for managing user_prefs

2005-01-12 Thread Rick Macdougall
Fahy, Michael wrote: We use spamassassin via sendmail, spamass-milter, spamc/spamd on Fedora. We are looking for a way to enable users to manage their own user_prefs file through a web interface. There is a nice plug-in for squirrelmail (an open source webmail product, http://www.squirrelmail

Web interface for managing user_prefs

2005-01-12 Thread Fahy, Michael
We use spamassassin via sendmail, spamass-milter, spamc/spamd on Fedora.   We are looking for a way to enable users to manage their own user_prefs file through a web interface. There is a nice plug-in for squirrelmail (an open source webmail product, http://www.squirrelmail.org) that ena

Re: upgrading methods

2005-01-12 Thread Martin McWhorter
I like to use RPMs from YUM or APT repositories where ever I can on RPM based distrabutions. But I think for spamassassin, you are better off going with CPAN to keep it up to date. Martin Hans du Plooy wrote: I was wondering what method you guys & gals prefer for upgrading spamassassin on the m

Using LDAP and Multiple Domains - Help

2005-01-12 Thread Angel F. Rosa
Hello, We are trying to setup spamassassin and ldap. I you have any experiance out there with this? We would appriciate the help. Can I manage or configure the local.cf file to handle multiply Domains? Thanks, AFR

Re: upgrading methods

2005-01-12 Thread Craig McLean
On Wed, 2005-01-12 at 14:54 -0600, Bob McClure Jr wrote: > On Wed, Jan 12, 2005 at 10:42:42PM +0200, Hans du Plooy wrote: > > I was wondering what method you guys & gals prefer for upgrading > > spamassassin > > on the more mainstream rpm based distros (MDK/Fedora/rh/SUSE). > > > > I have a SUSE

RE: Training byessian filter in a gatway situation.

2005-01-12 Thread Ken Goods
Anthony Metcalf wrote: > Hi All, > I have been hunting around on the web now for some weeks, trying to > find an answer to my question. I think I am incapable of being > succinct enough to get an answer through searching though. :) > > If there is a howto out there, or some other source that

Re: Re[2]: bayes?!

2005-01-12 Thread kalin mintchev
thanks Robert... > And don't worry about the ratio -- I feed Bayes spam/ham in a 10:1 ratio, and it's working wonderfully. ok.. unfortunately i have to report that for me there isn't much difference. overnight i got 88 messages in my mailbox. 72 of them were spam - not detected by sa. in the same

Re: upgrading methods

2005-01-12 Thread Kris Deugau
Hans du Plooy wrote: > I was wondering what method you guys & gals prefer for upgrading > spamassassin on the more mainstream rpm based distros > (MDK/Fedora/rh/SUSE). I'm not running RedHat on my own systems any more, but I still have one legacy RH7.3 system at work. All of my own new installs h

RE: spamc exit code 98

2005-01-12 Thread Dallas L. Engelken
> > I suspect some kind of timeout error (since I said "-t 60" > and that's how log it took), but I'd like to be sure. I also > notice that in this case the message size is close to the > default maximum message size. > If it reaches the timeout, it will exit 74 (EX_IOERR). Also, spamc wi

spamc exit code 98

2005-01-12 Thread Larry
> From: Daryl C. W. O'Shea [mailto:[EMAIL PROTECTED] > > Larry wrote: > > What does it mean when spamc exits with an exit code of 98? > > > > I'm running version 3.0.2 and invoking spamc with > > > > spamc -E -t 60 -d blahblah.ornl.gov > > Are you sure it's 98 and not 68 (host name unknown), or 7

RE: spamc exit code 98

2005-01-12 Thread Dallas L. Engelken
> > What does it mean when spamc exits with an exit code of 98? > > I'm running version 3.0.2 and invoking spamc with > > spamc -E -t 60 -d blahblah.ornl.gov > Spamc exit codes... EX_USAGE64 command line usage error EX_DATAERR 65 data format error

Re: upgrading methods

2005-01-12 Thread Bob McClure Jr
On Wed, Jan 12, 2005 at 10:42:42PM +0200, Hans du Plooy wrote: > I was wondering what method you guys & gals prefer for upgrading spamassassin > on the more mainstream rpm based distros (MDK/Fedora/rh/SUSE). > > I have a SUSE 9.1 server, running spamassassin through amavisd-new. Works > like a

upgrading methods

2005-01-12 Thread Hans du Plooy
I was wondering what method you guys & gals prefer for upgrading spamassassin on the more mainstream rpm based distros (MDK/Fedora/rh/SUSE). I have a SUSE 9.1 server, running spamassassin through amavisd-new. Works like a charm. I decided to give the CPAN thing a try. logged in, updated all

Re: ALL_TRUSTED hitting because of "has reserved IP"?

2005-01-12 Thread Daryl C. W. O'Shea
Justin Mason wrote: agh, I thought we had this fixed previously. Regardless, it's thoroughly fixed in current SVN... - --j. It (removing 71/8 etc) wasn't committed to 3.0, only trunk. 3.0 hasn't been changed since September. Daryl

Re: ALL_TRUSTED hitting because of "has reserved IP"?

2005-01-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kris Deugau writes: > I understand some of why these are hardcoded like this, but this is VERY > dangerous - just because it's reserved by IANA does NOT mean it can't be > allocated to someone tomorrow! I once had a number of these "reserved" > /8 bl

Re: ALL_TRUSTED hitting because of "has reserved IP"?

2005-01-12 Thread Sandy S
> [snip] > > > debug: looking up A records for 'merlin.boreal.org' > > debug: A records for 'merlin.boreal.org': 216.70.16.15 > > debug: received-header: 'from' 71.8.49.195 has reserved IP > > This is definitely weird; 71.0.0.0/8 is NOT special in any way I know > of. > > > Notice that the IP t

Re: Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Jon Drukman
Christopher John Shaker wrote: In my useage, SpamAssassin 3.0.2 works *way* better than the 2.XX versions of SpamAssassin. I've been training my Baysian filters, and they work really well now. SA 3.0.2 works so well that I've deleted most of my apx 400 local rules, which plugged leaks through S

Re: spamc exit code 98

2005-01-12 Thread Daryl C. W. O'Shea
Larry wrote: What does it mean when spamc exits with an exit code of 98? I'm running version 3.0.2 and invoking spamc with spamc -E -t 60 -d blahblah.ornl.gov Are you sure it's 98 and not 68 (host name unknown), or 78 (config error)? Neither spamc nor spamd have an exit code of 98 anywhere in the

spamc exit code 98

2005-01-12 Thread Larry
What does it mean when spamc exits with an exit code of 98? I'm running version 3.0.2 and invoking spamc with spamc -E -t 60 -d blahblah.ornl.gov

Re: ALL_TRUSTED hitting because of "has reserved IP"?

2005-01-12 Thread Kris Deugau
Sandy S wrote: > I know there's been a lot of talk on the ALL_TRUSTED rule, but I > don't remember seeing this issue and couldn't find it in a search of > the list archives. > > We've gotten several spams recently that made it through because they > hit the ALL_TRUSTED rule. We have a standard se

Re: annoying changes in 3.0

2005-01-12 Thread Kenneth Porter
--On Tuesday, January 11, 2005 9:36 PM -0800 Loren Wilton <[EMAIL PROTECTED]> wrote: But the trick here is that at least one or more releases will contain both features. This is different than saying "feature X will be replaced at the next major release. We'll tell you what to use in its place

RE: Training byessian filter in a gatway situation.

2005-01-12 Thread Chris Santerre
>-Original Message- >From: Anthony Metcalf [mailto:[EMAIL PROTECTED] >Sent: Wednesday, January 12, 2005 7:44 AM >To: users@spamassassin.apache.org >Subject: Training byessian filter in a gatway situation. > > >Hi All, > I have been hunting around on the web now for some >weeks, try

Re: Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Christopher John Shaker
In my useage, SpamAssassin 3.0.2 works *way* better than the 2.XX versions of SpamAssassin. I've been training my Baysian filters, and they work really well now. SA 3.0.2 works so well that I've deleted most of my apx 400 local rules, which plugged leaks through SA 2.XX. Chris Shaker [EMAIL PR

ignore me - testing my spf record

2005-01-12 Thread Nate Schindler
Title: ignore me - testing my spf record testing

Re: Curious output from spamassassin --local --debug

2005-01-12 Thread Cameron Bales
On Wed, 12 Jan 2005 10:23:50 -0500, Kevin Morwood <[EMAIL PROTECTED]> wrote: > Cameron, > > The spamassassin program is waiting for input. If you are checking > rules add '--lint' to your command line. Alternately you might want to > direct some input into it. > > I found this out once when I m

sql preferences

2005-01-12 Thread Paul Houselander
Hi Im trying to use SQL user preferences and SQL awl. I want my users to be able to choose whether they use awl, so in my test setup have created a user and entered use_auto_whitelist 0 in the userprefs table. It seems to skip it, mentioning administrator setting, can you not set this on a per u

RE: Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Darren Coleman
> -Original Message- > From: Darren Coleman [mailto:[EMAIL PROTECTED] > Sent: 12 January 2005 15:29 > To: Jack L. Stone; Loren Wilton; users@spamassassin.apache.org > Subject: RE: Lots of spam being missed with SA 3.0.2 + lots of RulesEmp > rules > > Hmm.. > > I got the following on that

Re: SA3.0.1 via MailScanner

2005-01-12 Thread Martin Hepworth
Ade might want to ask on the MS list. There have been some issues with the Perl Mime tools recently so this *may* be the issue. you don't mention which version of MS you are using -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Ade Fewings wrote: Dear all Fo

Re: spamd eating memory

2005-01-12 Thread Martin Hepworth
Bill wouldn't like to comment on the changes, I just see people see get positive results from it (ie lowest memory usage). I don't use spamd to invoke spamassassin myself so haven't suffered from the problem. (I use MailScanner) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel

SA3.0.1 via MailScanner

2005-01-12 Thread Ade Fewings
Dear all Forgive me straight away if any of this has been answered before or is stupid on my part. Going through a bit of a baptism-of-fire at the moment with regard to mail servers. We have two mail servers running on Solaris 9 Sparc. Sendmail 8.12.10 utilizing MailScanner to call SpamAssass

Re: spamd eating memory

2005-01-12 Thread Bill Moseley
On Wed, Jan 12, 2005 at 09:43:33AM +, Martin Hepworth wrote: > There's a bugilla reference to this and a patch for the patch there as well > http://bugzilla.spamassassin.org/show_bug.cgi?id=3983 That patch is about a change in how the spamd processes are used, right? Instead of using all --m

RE: Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Darren Coleman
Hmm.. I got the following on that message (having reconfigured SURBL): Content analysis details: (8.0 points, 5.0 required) 0.3 RM_hm_EmtyMsgidMessage ID is empty, or just spaces - probable spamsign 0.3 SARE_WEOFFER BODY: Offers Something 2.5 MANGLED_CIALIS BODY: ma

Re: spamd eating memory

2005-01-12 Thread Michael Parker
On Wed, Jan 12, 2005 at 07:19:38AM -0800, Bill Moseley wrote: > > Since only one child process is so large and that they are all stared > at the same time (e.g. processed the same number of requests) I would > think its memory usage would be related to a specific message that > spamd process handl

ALL_TRUSTED hitting because of "has reserved IP"?

2005-01-12 Thread Sandy S
I know there's been a lot of talk on the ALL_TRUSTED rule, but I don't remember seeing this issue and couldn't find it in a search of the list archives. We've gotten several spams recently that made it through because they hit the ALL_TRUSTED rule. We have a standard setup and haven't had trouble

Re: Curious output from spamassassin --local --debug

2005-01-12 Thread Kevin Morwood
Cameron, The spamassassin program is waiting for input. If you are checking rules add '--lint' to your command line. Alternately you might want to direct some input into it. I found this out once when I missed typing '--lint' while I was testing my installation. HTH, Kevin Cameron Bales wrot

Re: spamd eating memory

2005-01-12 Thread Bill Moseley
On Tue, Jan 11, 2005 at 09:57:02PM -0800, Loren Wilton wrote: > BTW, this probably means that you have a really big whitelist or bayes db, > and possibly expire isn't working as you think it is. Might be worth > checking on that. I'm not using bayes (AFAIK ;), as I'm doing site-wide filtering wit

Re: FORGED_MUA_OUTLOOK false positives

2005-01-12 Thread Menno van Bennekom
> Tony > > you guys running that rule live at cam.ac.uk? > Just after posting I added almost the same rule as in the bug-4065 description only without the BAY/DAV checks and it works fine here. Now I changed it to the rule as in the bug fix and that also works fine! By the way this phx.gbl is not d

Re: FORGED_MUA_OUTLOOK false positives

2005-01-12 Thread Tony Finch
On Wed, 12 Jan 2005, Martin Hepworth wrote: > > you guys running that rule live at cam.ac.uk? I haven't actually finished testing it properly yet, because it has got muddled up in the upgrade to SA 3.0.2 which I keep forgetting to finish :-) Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dota

Re: FORGED_MUA_OUTLOOK false positives

2005-01-12 Thread Martin Hepworth
Tony you guys running that rule live at cam.ac.uk? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Tony Finch wrote: On Wed, 12 Jan 2005, Menno van Bennekom wrote: I noticed that FORGED_MUA_OUTLOOK falsely triggers with this hotmail-email that is sent from Out

Re[2]: bayes?!

2005-01-12 Thread Robert Menschel
Hello kalin, Tuesday, January 11, 2005, 6:33:53 PM, you wrote: km> also does the amount of processed messages matter after the initial km> feed of more or less the same amounts of spam and ham? km> because the spam piles much faster then miscategorized ham... Yes, spam piles much faster tha

Re: Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Jack L. Stone
At 04:36 AM 1.12.2005 -0800, Loren Wilton wrote: >Well, just for grins I ran it here: > >Content analysis details: (11.3 points, 4.6 required) > > pts rule name description > -- >-- > 2.6 LOCAL_OBFU_TADALAFIL_SU

Curious output from spamassassin --local --debug

2005-01-12 Thread Cameron Bales
Hi I'm curious about what the output from spamassassin --local --debug looks like on somebody else's system. I'm getting what seems to me odd behaviour. The command is hanging on my machine (althouth SpamAssassin is working fine) example: [Machine:~] user% spamassassin --local --debug debug: Spa

Re: FORGED_MUA_OUTLOOK false positives

2005-01-12 Thread Tony Finch
On Wed, 12 Jan 2005, Menno van Bennekom wrote: > > I noticed that FORGED_MUA_OUTLOOK falsely triggers with this hotmail-email > that is sent from Outlook-Express via the http-hotmailserver. http://bugzilla.spamassassin.org/show_bug.cgi?id=4065 Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://do

FORGED_MUA_OUTLOOK false positives

2005-01-12 Thread Menno van Bennekom
Hi, I noticed that FORGED_MUA_OUTLOOK falsely triggers with this hotmail-email that is sent from Outlook-Express via the http-hotmailserver. I think the meta __FORGED_OE is triggered, because the Message-ID is not ending with 'hotmail.com': Received: from hotmail.com (bay19-dav15.bay19.hotmail.com

Re: Clam AntiVirus plugin for SpamAssassin 3.x

2005-01-12 Thread Daryl C. W. O'Shea
Cameron Bales wrote: > > > Could the plugin on the page: > http://wiki.apache.org/spamassassin/ClamAVPlugin > have some sort of version number/date attached so we could easily know > what version we are talking about on the list, and if additions > mentioned on the list have been incorporated? Sur

Re: Clam AntiVirus plugin for SpamAssassin 3.x

2005-01-12 Thread Cameron Bales
> > --030204020505030202030005 > > Content-Type: text/plain; > > name="clamav.pm" > > Content-Transfer-Encoding: 7bit > > Content-Disposition: inline; > > filename="clamav.pm" > > > > package ClamAV; > > use strict; > > use Mail::SpamAssassin; > > use Mail::SpamAssassin::Plugin; > > u

RE: Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Darren Coleman
Hi Loren, Firstly, thanks for your help. I have searched around rulesemporium without much success trying to find these LOCAL_OBFU_* rules. I don't suppose you could tell me the filename that they occur in could you? (I assume they will be in /etc/mail/Spamassassin or wherever your local.cf file

RE: Training byessian filter in a gatway situation.

2005-01-12 Thread Sunny Forro
Anthony, I have a similar setup. The best solution I have found so far is to setup IMAP on the filter box and drag emails into the IMAP accounts. I toyed with using forwarded mails to those accounts. The only way I found for that to work was to forward to the literal account name, something

Re: AWL problem??

2005-01-12 Thread Matt Kettler
At 08:24 AM 1/12/2005, John Fleming wrote: > > the AWL adjustment is most likely ignored by the bayes stuff...this make it a score of -5.5 > > -- > Martin Hepworth So it was tagged SPAM because of the total hits (32), yet learned as HAM due to AWL? No, you have it almost exactly backwards. The

Re: annoying changes in 3.0

2005-01-12 Thread Matt Kettler
At 02:28 AM 1/12/2005, Dan Hollis wrote: > But also to be fair, even though you give people N releases with both > features available to do the conversion, there are going to be some > significant number of users that simply won't do the conversion until they > are forced to, even though they had 3

SARE Custom rules

2005-01-12 Thread Joe Zitnik
I posted this some time ago, but I was wondering if anyone had any information on the timeframe for when some of the SARE custom rules would be updated? I know there had been some posts by the developers about updating and testing, but nothing new as of yet.

Re: AWL problem??

2005-01-12 Thread Martin Hepworth
John AutoWhiteList completely different from BAYES, but they do seem to interact. The AWL said this is spam, but bayes said no and ignored the AWL info. Alot of peope tend to have problems with the AWL and I always turn it off. -- Martin Hepworth Snr Systems Administrator Solid State Logic Te

Re: AWL problem??

2005-01-12 Thread John Fleming
- Original Message - From: "Martin Hepworth" <[EMAIL PROTECTED]> To: "John Fleming" <[EMAIL PROTECTED]> Cc: "Spamassassin" Sent: Wednesday, January 12, 2005 7:58 AM Subject: Re: AWL problem?? John Fleming wrote: I've never seen this before - I don't know squat about AWL, but I sure nee

RE: [SPAM-TAG] Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Darren Coleman
Thanks all. I did think SURBL was enabled but obviously it isn't. Loren: I will also have a look at additional rules that I may have missed. Thanks again. Daz > -Original Message- > From: Jeff Chan [mailto:[EMAIL PROTECTED] > Sent: 12 January 2005 12:08 > To: Spamassassin > Subject: R

Training byessian filter in a gatway situation.

2005-01-12 Thread Anthony Metcalf
Hi All, I have been hunting around on the web now for some weeks, trying to find an answer to my question. I think I am incapable of being succinct enough to get an answer through searching though. :) If there is a howto out there, or some other source that will answer this question, pleas

Re: AWL problem??

2005-01-12 Thread Martin Hepworth
John Fleming wrote: I've never seen this before - I don't know squat about AWL, but I sure need help understanding the following headers! X-Spam-Status: Yes, hits=26.1 required=5.0 tests=AWL,BAYES_00,SARE_HEAD_XBEEN autolearn=ham version=2.64 X-Spam-Report: * -4.9 BAYES_00 BODY: Bayesian sp

Re: Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Martin Hepworth
Loren Wilton wrote: Well, just for grins I ran it here: Content analysis details: (11.3 points, 4.6 required) pts rule name description -- -- 2.6 LOCAL_OBFU_TADALAFIL_SUBJ Obfuscated 'TADALAFIL' in subject 0

AWL problem??

2005-01-12 Thread John Fleming
I've never seen this before - I don't know squat about AWL, but I sure need help understanding the following headers! X-Spam-Status: Yes, hits=26.1 required=5.0 tests=AWL,BAYES_00,SARE_HEAD_XBEEN autolearn=ham version=2.64 X-Spam-Report: * -4.9 BAYES_00 BODY: Bayesian spam probability is 0

Re: Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Loren Wilton
Well, just for grins I ran it here: Content analysis details: (11.3 points, 4.6 required) pts rule name description -- -- 2.6 LOCAL_OBFU_TADALAFIL_SUBJ Obfuscated 'TADALAFIL' in subject 0.3 SARE_WEOFFER

Re: [SPAM-TAG] Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Jeff Chan
On Wednesday, January 12, 2005, 3:20:17 AM, Darren Coleman wrote: > Hi, > I'm running the latest version of SpamAssassin (3.0.2), with a healthy > Bayes database (I believe) and pretty much all of the available rules > from rulesemporium.com and I have noticed recently, particularly from > comment

Lots of spam being missed with SA 3.0.2 + lots of RulesEmp rules

2005-01-12 Thread Darren Coleman
Hi, I'm running the latest version of SpamAssassin (3.0.2), with a healthy Bayes database (I believe) and pretty much all of the available rules from rulesemporium.com and I have noticed recently, particularly from comments from my users, that SA is missing a lot of clear spasm. I have attached o

Re: spamd eating memory

2005-01-12 Thread Martin Hepworth
Bill gmame's search was screwed yesterday. will try agian today and bookmark the thing ;-) ok the search term on gmame you need is "low memory" There's a bugilla reference to this and a patch for the patch there as well http://bugzilla.spamassassin.org/show_bug.cgi?id=3983 -- Martin Hepworth Snr

Re: annoying changes in 3.0

2005-01-12 Thread Dan Hollis
On Tue, 11 Jan 2005, Loren Wilton wrote: > But also to be fair, even though you give people N releases with both > features available to do the conversion, there are going to be some > significant number of users that simply won't do the conversion until they > are forced to, even though they had 3

RE: feed MimeDefanged mail to sa-learn?

2005-01-12 Thread Gary Funck
> From: Keith Whyte > Sent: Tuesday, January 11, 2005 11:15 PM [...] > > anyway, on the messages where that regex does trigger, the resulting > mail is unreadable in Pine, which complains about not being able to open > text attachment, and thunderbird on windows via imap, which in some > cases j

Re: feed MimeDefanged mail to sa-learn?

2005-01-12 Thread Keith Whyte
Gary Funck wrote: Attached, is a Perl script, mdf2sa.pl, which converts spam messages that have been marked up by MIMEDefang, into a form that is similar to the message format used by SA. Also attached is a simple Hi Gary, just tried out that script, and sorry to say it didn't work at all. a lo

Re: spamd eating memory

2005-01-12 Thread Loren Wilton
> By the way, I set --max-conn-per-child=20 (yes, very low) and that > seems to have solved the problem with a given spamd process eating > memory. > > But I'm still seeing a lot of: > > Jan 11 10:03:57 mardy spamd[13158]: server hit by SIGCHLD > Is that a result of the child process being kill

Re: annoying changes in 3.0

2005-01-12 Thread Loren Wilton
> > Once you go that route, you must ALWAYS go that route, for every change, or > > your efforts are more-or-less pointless. 90% backward compatibility isn't > > really much better than 0%. If the user has to edit a config file to > > upgrade, it's a pain. Well, of course you don't have to always

Re: White list problem

2005-01-12 Thread Matt Kettler
At 08:46 PM 1/11/2005, List Mail User wrote: Every one seem to be missing the forged HELO which (incorrectly) used the IP address of the receiving machine. This seems to have fooled both your MTA; The critical headers are: > > Received: from 61.32.186.51 by kukla (envelope-from <[EMAIL P

Re: White list problem

2005-01-12 Thread List Mail User
>>From [EMAIL PROTECTED] Tue Jan 11 18:23:25 2005 >... > >On Tue, Jan 11, 2005 at 05:46:58PM -0800, List Mail User wrote: >> Every one seem to be missing the forged HELO which (incorrectly) used >> the IP address of the receiving machine. This seems to have fooled both your >> MTA; The criti

Body checks not identifying spam

2005-01-12 Thread Ray Anderson
I'm thinking it's because the message is in multi-part embedded multi-part mime mail, but I'm not sure. I'm stuck running 2.55 for another 3 months or so before I move to FC3, so until then, does anyone have any advice? This is the second message that's like this, and I'm sure the numbers are goi

Re: bayes?!

2005-01-12 Thread kalin mintchev
also does the amount of processed messages matter after the initial feed of more or less the same amounts of spam and ham? because the spam piles much faster then miscategorized ham... i'm asking because if i use a script that periodically will process spam and ham from 2 accounts where they

Re: White list problem

2005-01-12 Thread Ollie Acheson
On Tue, Jan 11, 2005 at 05:46:58PM -0800, List Mail User wrote: > Every one seem to be missing the forged HELO which (incorrectly) used > the IP address of the receiving machine. This seems to have fooled both your > MTA; The critical headers are: > > > > Received: from 61.32.186.51 by kuk

Re: White list problem

2005-01-12 Thread Ollie Acheson
On Tue, Jan 11, 2005 at 07:54:56PM -0500, Matt Kettler wrote: > At 07:26 PM 1/11/2005, Ollie Acheson wrote: > >The message below passed through spamassassin with a -93.1 score as a > >result > >of a -100 USER_IN_WHITELIST, but my user.prefs has nothing resembling the > >information in "From:" > >

Re: White list problem

2005-01-12 Thread List Mail User
Every one seem to be missing the forged HELO which (incorrectly) used the IP address of the receiving machine. This seems to have fooled both your MTA; The critical headers are: > > Received: from 61.32.186.51 by kukla (envelope-from <[EMAIL PROTECTED]>, > > uid 71) with qmail-scanner-

Re: White list problem

2005-01-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler writes: > At 07:42 PM 1/11/2005, Justin Mason wrote: > >Ollie Acheson writes: > > > The message below passed through spamassassin with a -93.1 score as a > > result > > > of a -100 USER_IN_WHITELIST, but my user.prefs has nothing resembl

Re: bayes?!

2005-01-12 Thread kalin mintchev
>>yes. but there isn't anything indicating that the spam db are used or >>tests are being done against them. should there be any? >>i read in the documentation that use_bayes is set to 1 (true) by default >>so i don't have to add anything in the user-conf except the db location: >> >>bayes_path /p

Re: Clam AntiVirus plugin for SpamAssassin 3.x

2005-01-12 Thread Daryl C. W. O'Shea
Justin Mason wrote: Well, both are good arguments to keep that behaviour out of code, and in the config file, such as: in one file: loadplugin MyAvPlugin add_header all X-Virus-Status __MYAVPLUGINSTATUS__ in the other: loadplugin MyOtherAvPlugin add_header all X-Virus-Status __MYOTH

Re: White list problem

2005-01-12 Thread Matt Kettler
At 07:42 PM 1/11/2005, Justin Mason wrote: Ollie Acheson writes: > The message below passed through spamassassin with a -93.1 score as a result > of a -100 USER_IN_WHITELIST, but my user.prefs has nothing resembling the > information in "From:" what about the info in Return-Path:? Justin.. The Re

Re: Clam AntiVirus plugin for SpamAssassin 3.x

2005-01-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Daryl C. W. O'Shea writes: > Justin Mason wrote: > > Hi Daryl -- > > > > I've been thinking about this -- the ability for plugins to add > > headers. > > > > If a plugin can add new template-tags (as described in > > Mail::SpamAssassin::Conf), and

Re: White list problem

2005-01-12 Thread Matt Kettler
At 07:26 PM 1/11/2005, Ollie Acheson wrote: The message below passed through spamassassin with a -93.1 score as a result of a -100 USER_IN_WHITELIST, but my user.prefs has nothing resembling the information in "From:" 1) you checked your user_prefs (hopefully not user.prefs) did you check the *res

Re: Clam AntiVirus plugin for SpamAssassin 3.x

2005-01-12 Thread Daryl C. W. O'Shea
Justin Mason wrote: > Hi Daryl -- I've been thinking about this -- the ability for plugins to add headers. If a plugin can add new template-tags (as described in Mail::SpamAssassin::Conf), and the plugin's config file then sets them using add_header, that should work, right? That would be the best

Re: White list problem

2005-01-12 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ollie Acheson writes: > The message below passed through spamassassin with a -93.1 score as a result > of a -100 USER_IN_WHITELIST, but my user.prefs has nothing resembling the > information in "From:" what about the info in Return-Path:? > > Spamas

White list problem

2005-01-12 Thread Ollie Acheson
The message below passed through spamassassin with a -93.1 score as a result of a -100 USER_IN_WHITELIST, but my user.prefs has nothing resembling the information in "From:" Spamassassin is running at system level, called by qmail-scanner-queue.pl (along with clamav). qmail installed as net-qmail-