Re: question about token frequency

2005-02-01 Thread Jim Maul
Matias Lopez Bergero wrote: Theo Van Dinter wrote: On Tue, Feb 01, 2005 at 06:20:17PM -0300, Matias Lopez Bergero wrote: That 62.56% of them was recorded once means recorded by the input of sa-learn? or by SA autolearn? Can't say, there is no difference to the database between sa-learn and autole

Re: Mailscanner

2005-02-01 Thread Invalid
> Time error started   Jan 30 19:15:04 Jan 30 19:15:04 addr3ss MailScanner[11506]: MailScanner E-Mail Virus Scanner version 4.38.9 starting... Jan 30 19:15:04 addr3ss update.virus.scanners: Delaying cron job up to 600 seconds Jan 30 19:15:04 addr3ss MailScanner[11506]: Could not read directory

Re: question about token frequency

2005-02-01 Thread Matias Lopez Bergero
Theo Van Dinter wrote: On Tue, Feb 01, 2005 at 06:20:17PM -0300, Matias Lopez Bergero wrote: That 62.56% of them was recorded once means recorded by the input of sa-learn? or by SA autolearn? Can't say, there is no difference to the database between sa-learn and autolearn. I'm not very sure if t

Re: question about token frequency

2005-02-01 Thread Theo Van Dinter
On Tue, Feb 01, 2005 at 06:20:17PM -0300, Matias Lopez Bergero wrote: > That 62.56% of them was recorded once means recorded by the input of > sa-learn? or by SA autolearn? Can't say, there is no difference to the database between sa-learn and autolearn. > I'm not very sure if the autolearn is w

Re: Pb with spamassassin-3.0.2

2005-02-01 Thread Fred
francois.baert wrote: > Hello, > > Spamassassin-3.0.2 running on redhat9.0 > spamassassin --lint gives a list of warning like this: > warning: description for REMOVE_PAGE is over 50 chars > warning: description for FROM_WEBMAIL_END_NUMS6 is over 50 chars > ...ie > lint: 171 issues detected. > > Wh

Re: question about token frequency

2005-02-01 Thread Matias Lopez Bergero
Theo Van Dinter wrote: On Tue, Feb 01, 2005 at 11:24:53AM -0300, Matias Lopez Bergero wrote: 256010 entries kept, 79678 deleted token frequency: 1-occurence tokens: 62.56% token frequency: less than 8 occurrences: 29.16% what are those token frequency mean to?? nothing about it on the man page. Th

Pb with spamassassin-3.0.2

2005-02-01 Thread francois.baert
Hello, Spamassassin-3.0.2 running on redhat9.0 spamassassin --lint gives a list of warning like this: warning: description for REMOVE_PAGE is over 50 chars warning: description for FROM_WEBMAIL_END_NUMS6 is over 50 chars ...ie lint: 171 issues detected. What does it mean? Thanks for help Fran

Re: Problems upgrading to 3.0.2

2005-02-01 Thread Bill Shupp
Bill Shupp wrote: All, When trying to upgrade from 2.52 to 3.0.2 via CPAN, I get this during make test: t/spamc_B...ok 7/8 Not found: spamflag = X-Spam-Flag: YES t/spamc_B...NOK 8# Failed test 8 in t/SATest.pm at line 530 t/spamc_B...FAILED

Re: very slow performance with SA

2005-02-01 Thread Matt Kettler
At 01:39 PM 2/1/2005, Alan Shine wrote: when I'm running SA with the default ruleset (the one that comes with the installation), it proccesses 16 messages per second. I don't know if it is the avarage amount of messages that SA can proccess. anyway - 16 per second is not good enough for me - becaus

Re: very slow performance with SA

2005-02-01 Thread Alan Shine
Michael Parker <[EMAIL PROTECTED]> wrote: >On Tue, Feb 01, 2005 at 11:40:35AM -0800, Alan Shine wrote:>> 2. I can't figure out how to turn URIDNSBL off (I couldn't find it > >in the Mail::SpamAssassin::Conf). So...how can I turn it off?>Comment out the loadplugin line in init.pre>> 3. The emails t

Re: very slow performance with SA

2005-02-01 Thread Michael Parker
On Tue, Feb 01, 2005 at 11:40:35AM -0800, Alan Shine wrote: > 2. I can't figure out how to turn URIDNSBL off (I couldn't find it >in the Mail::SpamAssassin::Conf). So...how can I turn it off? Comment out the loadplugin line in init.pre > 3. The emails that are missed as spam have SA markup,

Re: Outgoing mail scanning

2005-02-01 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jim Maul writes: > EB wrote: > > We had secured the formmail.pl with the anti-spam version, and we had > > searched all httpd logs while the spamming occured, but there wasn't > > any suspicious call to cgi scripts. We think it could be something > >

Re: very slow performance with SA

2005-02-01 Thread Alan Shine
Alan Shine <[EMAIL PROTECTED]> wrote: Michael Parker <[EMAIL PROTECTED]> wrote: On Tue, Feb 01, 2005 at 10:59:02AM -0800, Alan Shine wrote:> > I understand, but allthough I'm running 5 max children ny CPU is between 0-2% idle. > > (I have dual CPU with hyper thread).> Possibly you are IO bound. Di

Re: very slow performance with SA

2005-02-01 Thread Michael Parker
On Tue, Feb 01, 2005 at 10:59:02AM -0800, Alan Shine wrote: > > I understand, but allthough I'm running 5 max children ny CPU is between 0-2% > idle. > > (I have dual CPU with hyper thread). > Possibly you are IO bound. Did you turn off bayes/awl? Maybe you're running URIDNSBL which may not

Re: Outgoing mail scanning

2005-02-01 Thread Jim Maul
EB wrote: We had secured the formmail.pl with the anti-spam version, and we had searched all httpd logs while the spamming occured, but there wasn't any suspicious call to cgi scripts. We think it could be something harder to check, which is PHP. Could you perhaps grep the apache log and count eac

Re: Outgoing mail scanning

2005-02-01 Thread EB
We had secured the formmail.pl with the anti-spam version, and we had searched all httpd logs while the spamming occured, but there wasn't any suspicious call to cgi scripts. We think it could be something harder to check, which is PHP. On Tue, 1 Feb 2005 10:37:26 -0400, Michael 'Moose' Dinn <[E

Re: very slow performance with SA

2005-02-01 Thread Alan Shine
Michael Parker <[EMAIL PROTECTED]> wrote: >On Tue, Feb 01, 2005 at 10:39:14AM -0800, Alan Shine wrote:>> >>I have one spamd - with the default of 5 max children.>>>This is likely your problem, if you are truly processing at 16 a sec>then 5 children probably won't handle the load. Try upping the nu

Re: very slow performance with SA

2005-02-01 Thread Michael Parker
On Tue, Feb 01, 2005 at 10:39:14AM -0800, Alan Shine wrote: > > I have one spamd - with the default of 5 max children. > This is likely your problem, if you are truly processing at 16 a sec then 5 children probably won't handle the load. Try upping the number of children available. The optimal

Re: very slow performance with SA

2005-02-01 Thread Alan Shine
Hi, thanks a lot for your answers, I wrote my responses right after every answer. >jdow <[EMAIL PROTECTED]> wrote:>It sounds like you are trying to run DNS based rules either without a>DNS or off a test site that does not exist anymore. Some of the BLs that>used to be available are gone. >And you

Re: Bayes* permissions

2005-02-01 Thread Kris Deugau
Scott Taylor wrote: > I was running spamd but spam was being badly missed, so while reading > docs on the SA site, I ran into that new recipe and now it catches a > lot more spam. spamd is running as root, spawned from > /etc/init.d/spamassasin, 5 times, although I don't know if I need to > be doi

RE: Mailscanner

2005-02-01 Thread Kurt Buff
Sorry to reply to my own post, but here's a link for for your perusal: http://archives.neohapsis.com/archives/postfix/2003-09/1730.html > Don't use Mailscanner with Postfix. > > The author of Postfix states that it's not a good idea. I'll > take his word > for it. > > Kurt > > -Original M

RE: Mailscanner

2005-02-01 Thread Kurt Buff
Don't use Mailscanner with Postfix. The author of Postfix states that it's not a good idea. I'll take his word for it. Kurt -Original Message- From: usha chowdary [mailto:[EMAIL PROTECTED] Sent: Monday, January 31, 2005 21:18 To: users@spamassassin.apache.org Subject: Mailscanner hi Ia

Re: Outgoing mail scanning

2005-02-01 Thread Kelson
EB wrote: We also have a problem to scan outgoing mail. It seems like a user on our server is making scripts to send out spam to a large list of AOL users in the "Cc" part that we are still trying to track them down. The mail header looks as it was sent from our local 127.0.0.1 from [EMAIL PROTEC

Re: Bayes* permissions

2005-02-01 Thread Scott Taylor
Kris Deugau said: > Scott Taylor wrote: > For a global Bayes db, accessible to all users, you must either: > > -> Run spamd as a separate user, make sure the bayes_* files are owned > by that user, and process mail through SA by calling spamc instead of > spamassassin; I was running spamd but sp

Re: Outgoing mail scanning

2005-02-01 Thread Evan Platt
At 08:24 AM 2/1/2005, you wrote: We checked the maillog. But the session shows as [127.0.0.1] 127.0.0.1. What config did you put in sendmail to make it shows more? No idea. I knew about enough to grep the maillogs, modify a config file here and there, but that's it. Maybe someone else here know

Re: Bayes* permissions

2005-02-01 Thread Kris Deugau
Scott Taylor wrote: > I'm using SA 3.0.2 on RHES3 with $LANG set to en_CA invoked with > system wide configs in '/etc/mail/spamassassin/local.cf' via users > .procmailrc with this recipe: > > :0fw: spamassassin.lock > * < 256000 > | spamassassin > > I've been all over the docs, FAQs, WiKis on the

Re: question about token frequency

2005-02-01 Thread Theo Van Dinter
On Tue, Feb 01, 2005 at 11:24:53AM -0300, Matias Lopez Bergero wrote: > 256010 entries kept, 79678 deleted > token frequency: 1-occurence tokens: 62.56% > token frequency: less than 8 occurrences: 29.16% > > what are those token frequency mean to?? nothing about it on the man page. They're just i

Re: Outgoing mail scanning

2005-02-01 Thread EB
We checked the maillog. But the session shows as [127.0.0.1] 127.0.0.1. What config did you put in sendmail to make it shows more? On Tue, 01 Feb 2005 07:26:29 -0800, Evan Platt <[EMAIL PROTECTED]> wrote: > At 06:34 AM 2/1/2005, you wrote: > >We also have a problem to scan outgoing mail. It see

Bayes* permissions

2005-02-01 Thread Scott Taylor
Hello all, I'm using SA 3.0.2 on RHES3 with $LANG set to en_CA invoked with system wide configs in '/etc/mail/spamassassin/local.cf' via users .procmailrc with this recipe: :0fw: spamassassin.lock * < 256000 | spamassassin I've been all over the docs, FAQs, WiKis on the site, but I still can't

Re: Outgoing mail scanning

2005-02-01 Thread Evan Platt
At 06:34 AM 2/1/2005, you wrote: We also have a problem to scan outgoing mail. It seems like a user on our server is making scripts to send out spam to a large list of AOL users in the "Cc" part that we are still trying to track them down. The mail header looks as it was sent from our local 127.0.

Why SA is so slow with this rules?

2005-02-01 Thread Jean Deram
Hi I'm making bench with SA 3.0.2 running with perl 5.8.6 SA is launched by amavisd 2.2.1 It runs on a dual xeon 2.8 with 2GB of ram with a redhat 3 (2.4.21-15.0.4.ELsmp) I run 2 instances of Postfix with different spool directory (no local mailboxes) Making test with postal give me : Send : 920

RE: [SUMMARY] Newbie - RBL question

2005-02-01 Thread Chris Santerre
>-Original Message- >From: Dermot Paikkos [mailto:[EMAIL PROTECTED] >Sent: Tuesday, February 01, 2005 9:58 AM >To: Rakesh >Cc: users@spamassassin.apache.org >Subject: [SUMMARY] Newbie - RBL question > > >Thanx to Rakesh and Kristopher for their replies which lead to >the solution: > >I d

[SUMMARY] Newbie - RBL question

2005-02-01 Thread Dermot Paikkos
Thanx to Rakesh and Kristopher for their replies which lead to the solution: I did a spamassassin -D Dermot Paikkos wrote: > > > Hi > > > > Spamd v3.0 with Exim v4.43 using exiscan patch on SlackWare. > > > > /usr/bin/perl5.8.0 -T -w /usr/bin/spamd -d -s /var/log/spamd.log > > > > I am testi

Re: very slow performance with SA

2005-02-01 Thread Matt Kettler
At 08:28 AM 2/1/2005, [EMAIL PROTECTED] wrote: know issue with sa 3.0x and spamc/spamd. Will ne Fixed with 3.10 work around is lower number of children allowed or apply following patches.. http://bugzilla.spamassassin.org/show_bug.cgi?id=3983 That really should only be an issue if you are running m

Re: very slow performance with SA

2005-02-01 Thread Matt Kettler
At 06:27 AM 2/1/2005, Alan Shine wrote: I'm new to SA, and currently testing it in order to integrate it with our systems. The performance appears to be very bad - 6 messages per second. I'm running SA 3.0.1 on DL380 - dual CPU, hyper thread, 4G RAM, with Redhat 8. spamd is running with the rules

RE: Scalar modifiers

2005-02-01 Thread Matt Kettler
At 04:05 AM 2/1/2005, Gray, Richard wrote: So it seems resonable for me to write a meta rule for each rule that checks if a DUL list has been hit and adds a small extra score on? I assume from what you say that evaluating meta rules is very cheap, so they shouldn't impact performance by much. Corre

Re: very slow performance with SA

2005-02-01 Thread jdow
It sounds like you are trying to run DNS based rules either without a DNS or off a test site that does not exist anymore. Some of the BLs that used to be available are gone. And you should upgrade to 3.0.2 for some stability reasons. {^_^} - Original Message - From: "Alan Shine" <[EMAIL

Re: Outgoing mail scanning

2005-02-01 Thread EB
We also have a problem to scan outgoing mail. It seems like a user on our server is making scripts to send out spam to a large list of AOL users in the "Cc" part that we are still trying to track them down. The mail header looks as it was sent from our local 127.0.0.1 from [EMAIL PROTECTED] user,

RE: Newbie - RBL question

2005-02-01 Thread Kristopher Austin
Dermot, The easiest way to get the information you are looking for is to run spamassassin -D --lint. This should give you a debug output, you can then look through and find out if something isn't running as expected. You can also start spamd with -D and it will constantly print out debug output

question about token frequency

2005-02-01 Thread Matias Lopez Bergero
Hello, just run sa-learn --sync after training the bayes and got this messages. expired old Bayes database entries in 75 seconds 256010 entries kept, 79678 deleted token frequency: 1-occurence tokens: 62.56% token frequency: less than 8 occurrences: 29.16% what are those token frequency mean to?? n

Re: Mailscanner

2005-02-01 Thread Rakesh
Usha fix the following ... Feb 1 10:33:33 ethnic postfix: succeeded Feb 1 10:33:33 ethnic postfix/postsuper[2615]: warning: bogus file name: hold/razor-agent.log Feb 1 10:33:33 ethnic postfix/postfix-script: starting the Postfix mail system Feb 1 10:33:33 ethnic postfix: succeeded Feb 1

Re: very slow performance with SA

2005-02-01 Thread leonard . gray
Hi Alan, I found out the hard way about this problem as well.  Here's the response I got previously on this issue: Martin Hepworth <[EMAIL PROTECTED]> 01/19/2005 01:02 PM To [EMAIL PROTECTED] cc users@spamassassin.apache.org Subject Re: New to SA, problems with production speed

Problem with rules to catch inline images

2005-02-01 Thread Kevin Peuhkurinen
Hey folks. I'm seeing a fair bit of spam getting through with embedded GIF images, a slightly redacted version being pasted into the bottom of this email. I'm trying to write a rule to catch embedded GIFs, but it just doesn't seem to work. I've tried the following: fullKP_GIF

Re: Outgoing mail scanning

2005-02-01 Thread Tom Gwilt
Well, for the past year or so I've been using a FreeBSD box running postfix/amavisd/spamassassin. All outbound mail from our mx goes to this server and is scanned. Anything scoring 14 or more is sent to a quarantine mailbox. This has saved my butt many, many times. Just yesterday, one of our ca

very slow performance with SA

2005-02-01 Thread Alan Shine
Hi, I'm new to SA, and currently testing it in order to integrate it with our systems.   The performance appears to be very bad - 6 messages per second.   I'm running SA 3.0.1 on DL380 - dual CPU, hyper thread, 4G RAM, with Redhat 8. spamd is running with the rules engine only, and with most of the

Re: Mailscanner

2005-02-01 Thread Martin Hepworth
Usha quite a few things to correct on the install. Did you follow the postfix how-to on the MS site? It looks like for a start you've changed the "Run as User =" seting in MailScanner.conf (http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml) Ask on the MS list, its a little off t

RE: Scalar modifiers

2005-02-01 Thread Gray, Richard
So it seems resonable for me to write a meta rule for each rule that checks if a DUL list has been hit and adds a small extra score on? I assume from what you say that evaluating meta rules is very cheap, so they shouldn't impact performance by much. Richard -Original Message- From: Mat

Mailscanner

2005-02-01 Thread usha chowdary
hi Iam using postfix with ldap and courier-imap.now I configured mailscanner with spamassasin,razor and dcc.After restarting the postfix and Mailscanner I am getting errormessages continuosly.my os is mandrake 10.0 My error messages are Feb 1 10:33:33 ethnic postfix: succeeded Feb 1 10:33:33

Problems upgrading to 3.0.2

2005-02-01 Thread Bill Shupp
All, When trying to upgrade from 2.52 to 3.0.2 via CPAN, I get this during make test: t/spamc_B...ok 7/8 Not found: spamflag = X-Spam-Flag: YES t/spamc_B...NOK 8# Failed test 8 in t/SATest.pm at line 530 t/spamc_B...FAILED test 8

Re: Outgoing mail scanning

2005-02-01 Thread Evan Platt
At 02:42 PM 1/31/2005, you wrote: Hello all, I am looking for a way to spam-check outgoing mail, so the users registered with my server cannot send out spam (or viruses). My server is using squirrelmail for sending e-mail, so the mail is generated on the server and sent directly using SMTP (in squi

Re: [3.0.2] RulesDuJour --lint problem

2005-02-01 Thread Robert Menschel
Hello Martin, Monday, January 31, 2005, 2:50:39 AM, you wrote: MS> Hi, MS> since lately rulesdujour has stopped updating the rules; instead MS> it complains that spamassassin --lint fails (which prints a lot MS> of warnings). I've tried using sa30-check but it doesn't help. Judging from warning:

Re: Odd error

2005-02-01 Thread Chris
On Monday 31 January 2005 09:47 am, Martin Schröder wrote: > On 2005-01-31 15:41:13 +, Ron McKeating wrote: > > Shutting down spamd: [ OK ] > > Starting spamd: Could not create INET socket on 127.0.0.1:783: Address > > already in use (IO::Socket::INET: Address already in use) > > [FAILED] > >

tnef formatted messages

2005-02-01 Thread Ron E.
Just wondering if anyone knows whether or not spamassassin can or does scan tnef encoded message bodies? ie - decode tnef content before doing the various spam checks...