At 05:44 PM 2/2/2005, Alan Munday wrote:
Matt Kettler wrote the following on 02/02/2005 22:02:
> Actually, it's limit in SA's header generation that I forgot about. I
forgot that it forces X-Spam as a prefix.
>
Does that mean I can have the bonus point after all?
Sure.
I'd offer you a cookie too,
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Matt Kettler writes:
> At 04:40 PM 2/2/2005, Alan Munday wrote:
> >Yep, been there read that.
> >
> >and that produces X-Spam-Myserver-Status etc... which was easy.
> >
> >But you originally specified X-Server1-Spam-Status which seems a little
>
Matt Kettler wrote the following on 02/02/2005 22:02:
Actually, it's limit in SA's header generation that I forgot about. I
forgot that it forces X-Spam as a prefix.
Does that mean I can have the bonus point after all?
RH 9.0 perl 5.8.0 SA 3.02
When I run "sa-learn --spam -D /folder*"
it stops at Syncing Complete. then after I do a CTRL+C I get Learned from 0
messages 0 messages examined interrupted at line 412.
Can anyone give me a clue on what may be
wrong?
Chris V.
[EMAIL PROTECTED]
Clearly something is broken, but I'm not sure what.
I am using SpamAssassin 2.64 on SuSE Linux 9.0. My problems started when I
upgraded from the original SA that shipped with the system (2.55, I believe)
and the bayes path specification changed in the local.cf file.
Once that was rectified and t
At 04:40 PM 2/2/2005, Alan Munday wrote:
Yep, been there read that.
and that produces X-Spam-Myserver-Status etc... which was easy.
But you originally specified X-Server1-Spam-Status which seems a little
harder.
I'm suspecting a wordo, like a typo, but bigger :-)
Actually, it's limit in SA's
Matt Kettler wrote the following on 02/02/2005 21:18:
At 04:09 PM 2/2/2005, Alan Munday wrote:
Matt Kettler wrote the following on 02/02/2005 17:12:
> Bonus points if you use the add_header feature to create a secondary
X-Spam-Status header that is X-Server1-Spam-Status:
>
OK Matt
I liked the ide
I have my servers (RH9) calling ClamAV from SA (as per the wiki).
Looking at clamav.pm ($header = "Yes ($virus)";) I thought I would get the name
of the detected virus reported back to SA for the header, which I'm not.
On the few occasions there has been a virus get this far I'm seeing is
X-Spam-
I'm not sure if that is local rules messed up or if he installed
3.0.2 over 2.63 or something like that without properly massaging
the Bayes database first.
Of course some rule sets need to he eliminated or changed when
going to 3.x from 2.x. He'd probably be best off going to the
Wiki pages and l
From: <[EMAIL PROTECTED]>
> Which of these is correct in my procmailrc if I use spamc?
>
>
>
> :0fw: spamassassin.lock
> * < 256000
> | spamc
>
>
> or
>
>
> :0fw: spamc.lock
> * < 256000
> | spamc
Both.
{^_^}
From: "Mark T. Valites" <[EMAIL PROTECTED]>
> I recently installed spamassassin-3.0.2-1 from Debian testing. I've been
> running it for myself and a couple other folks who are testing for me. For
> the most part, I've got it working exactly like our 2.6.x scanners, except
> sometimes, it seems lik
I must admit I do not like formmail at all.
At one side I try to get rid of spam (and help others to get rid of their spam)
At the other side I help people creating their mail forms - and formmail can be
quite an
obstacle:
- many versions include a referer check which would not really prevent a s
At 04:09 PM 2/2/2005, Alan Munday wrote:
Matt Kettler wrote the following on 02/02/2005 17:12:
> Bonus points if you use the add_header feature to create a secondary
X-Spam-Status header that is X-Server1-Spam-Status:
>
OK Matt
I liked the idea of this so have been looking through the config docs
Matt Kettler wrote:
At 03:45 PM 2/2/2005, Jim Maul wrote:
> If your localhost can be a spam relay, disable the ALL_TRUSTED rule
by setting it's score to 0.
>
If your localhost can be a spam relay, fix the problem.
I assumed that the above was obvious.
Setting ALL_TRUSTED to 0 (while fixing the n
Matt Kettler wrote the following on 02/02/2005 17:12:
Bonus points if you use the add_header feature to create a secondary
X-Spam-Status header that is X-Server1-Spam-Status:
OK Matt
I liked the idea of this so have been looking through the config docs to find
the answer.
But I've failed to
At 03:45 PM 2/2/2005, Jim Maul wrote:
> If your localhost can be a spam relay, disable the ALL_TRUSTED rule by
setting it's score to 0.
>
If your localhost can be a spam relay, fix the problem.
I assumed that the above was obvious.
Setting ALL_TRUSTED to 0 (while fixing the negative score for spa
Matt Kettler wrote:
At 03:00 PM 2/2/2005, EB wrote:
I'm afraid these email might be internal. Is there a way to "un"
trust even if internal network? The user guide said trusted_networks
should be "none" by default, but I think it is not. Is there a way to
"un" trust 127.0.0.1?
If you cant trust
At 03:00 PM 2/2/2005, EB wrote:
I'm afraid these email might be internal. Is there a way to "un"
trust even if internal network? The user guide said trusted_networks
should be "none" by default, but I think it is not. Is there a way to
"un" trust 127.0.0.1?
Heh, what user guide said it was set t
I'm afraid these email might be internal. Is there a way to "un"
trust even if internal network? The user guide said trusted_networks
should be "none" by default, but I think it is not. Is there a way to
"un" trust 127.0.0.1?
Thanks again.
On Wed, 02 Feb 2005 14:43:31 -0500, Matt Kettler <[E
At 02:36 PM 2/2/2005, EB wrote:
There are quite a large amount of spam which result in negative score.
Sorry, I'm new to SpamAssassin. Does the following make sense to
receive negative score? I'm afraid we are calling SpamAssassin twice
so it got wrong score. We have SpamAssassin + milter + sen
Hi:
There are quite a large amount of spam which result in negative score.
Sorry, I'm new to SpamAssassin. Does the following make sense to
receive negative score? I'm afraid we are calling SpamAssassin twice
so it got wrong score. We have SpamAssassin + milter + sendmail on
Fedora 3
X-Spam-S
At 11:50 AM 2/2/2005, Mark T. Valites wrote:
> Using scoreset 1 I get I get 2.12.
This still begs the question of why the subject is being re-written for
some messages if the score is below my threshold.
It may have been scanned twice, and got marked the first time (perhaps even
by a different sys
On Wed, Feb 02, 2005 at 10:59:43AM -0600, [EMAIL PROTECTED] wrote:
> Which of these is correct in my procmailrc if I use spamc?
> :0fw: spamassassin.lock
> or
> :0fw: spamc.lock
>
> I have seen it done both ways in examples.
Yeah, it doesn't matter as long as you're consistent.
--
Randomly Gene
Which of these is correct in my procmailrc if I use spamc?
:0fw: spamassassin.lock
* < 256000
| spamc
or
:0fw: spamc.lock
* < 256000
| spamc
I have seen it done both ways in examples.
Thanks,
Kyle Reynolds
972-731-4731
[EMAIL PROTECTED]
On Wed, 2 Feb 2005, Matt Kettler wrote:
> At 11:04 AM 2/2/2005, Mark T. Valites wrote:
> >X-Spam-Status: No, score=2.2 required=3.0 tests=DATE_IN_FUTURE_03_06,
> > EXTRA_MPART_TYPE,HELO_DYNAMIC_HCC,HTML_40_50,HTML_MESSAGE,
> > HTML_TAG_EXIST_TBODY autolearn=disabled version=3.0.2
>
At 11:04 AM 2/2/2005, Mark T. Valites wrote:
X-Spam-Status: No, score=2.2 required=3.0 tests=DATE_IN_FUTURE_03_06,
EXTRA_MPART_TYPE,HELO_DYNAMIC_HCC,HTML_40_50,HTML_MESSAGE,
HTML_TAG_EXIST_TBODY autolearn=disabled version=3.0.2
In this case, my threshold is 3. The subject for this m
>-Original Message-
>From: Loren Wilton [mailto:[EMAIL PROTECTED]
>Sent: Tuesday, February 01, 2005 10:11 PM
>To: users@spamassassin.apache.org
>Subject: Re: very slow performance with SA
>
>
>> 3) As a test, you might want to back out all of SARE's rules
>and check
>your
>> message proc
We had downloaded the latest anti-spam formmail.pl that has
allowedReceipients. However, I think the spammer is violating it by
putting the right receipient in the "To" field and then add a lot of
Bcc receipients. Anyone knows if there's a formmail version that
disallow any Bcc and Cc or at least
I recently installed spamassassin-3.0.2-1 from Debian testing. I've been
running it for myself and a couple other folks who are testing for me. For
the most part, I've got it working exactly like our 2.6.x scanners, except
sometimes, it seems like it just can't add.
What happens is that for some m
On Wed, Feb 02, 2005 at 07:19:46AM -0800, Robert Menschel wrote:
> I can't answer that rate question (is it normal?), since I don't run a
> server, but my mass-check runs process a corpus of 114241 emails
> against all distribution and SARE rules in 10 hours, giving me a rate
> slightly over 3 emai
Hello Alan,
Wednesday, February 2, 2005, 6:04:56 AM, you wrote:
AS> Hi all,
AS> First of all, thanks for the fast replies.
AS> I'll start with the following question:
AS> 1. Is rate of 16 messages/second normal while running with only rules
engine,
AS>and only installation rules. (DL 380,
Robert Menschel wrote :
Hello Jean,
Tuesday, February 1, 2005, 7:11:50 AM, you wrote:
JD> Hi
JD> I'm making bench with SA 3.0.2 running with perl 5.8.6
JD> SA is launched by amavisd 2.2.1
JD> It runs on a dual xeon 2.8 with 2GB of ram with a redhat 3
JD> (2.4.21-15.0.4.ELsmp)
JD> I run 2 instances
On Wed, 2 Feb 2005, Matthew Newton wrote:
>
> I have been asked why this message got such a "high" score. It seems to
> mainly be because of the
>
> 3.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
http://bugzilla.spamassassin.org/show_bug.cgi?id=4065
Tony.
--
f.a.n.
Hi,
I have been asked why this message got such a "high" score. It seems to
mainly be because of the
3.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
rule. On first inspection I thought that the message was forged (see the
phx.gbl domain), but after creating a test
Jim Maul wrote:
Matias Lopez Bergero wrote:
Theo Van Dinter wrote:
On Tue, Feb 01, 2005 at 06:20:17PM -0300, Matias Lopez Bergero wrote:
I'm not very sure if the autolearn is working. How can I check that?
The default headers will include a "autolearn=" snippet which will
let you
know if autolearn
Hi all,
First of all, thanks for the fast replies.
I'll start with the following question:
1. Is rate of 16 messages/second normal while running with only rules engine,
and only installation rules. (DL 380, dual CPU - 2.4GHz, hyper thread, 4G ram, radhat 8, 10
spamd children).
and th
Never mind. It looks like SA 2.64 ignores the entirety of inline binary
components such that "full" does not even expose them. As it turns
out, the spammer has made a number of other errors that I have been
able to draft rules for.
Kevin Peuhkurinen wrote:
Hey folks. I'm seeing a fair bit
Hello,
The local.cf wasn't affected at all. Even the writingdate was from the 16th
Jan.
What I did was recompile SA and install it agein. Now it works.
Don't know what has happend.
But thx at all,
Alexander
-Original Message-
From: Martin Hepworth [mailto:[EMAIL PROTECTED]
Alexander
check your local.cf etc for syntax errors...you'll prob have to do this
by hand as the spamassassin --lint will probably fail with the same
error as well.
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
alexander hachmann wrote:
Hello,
Yesterday
Hello,
Yesterday i mad a total update of Suse 9.0. I
Downloaded all Security updates.
Since then No mail gets any hit.
When running SA i get these failures.
Use of uninitialized value in numeric eq (==) at
lib/Mail/SpamAssassin/BayesStore.pm line 1445.Use of uninitialized value in
concaten
EB wrote:
We also have a problem to scan outgoing mail. It seems like a user on
our server is making scripts to send out spam to a large list of AOL
users in the "Cc" part that we are still trying to track them down.
The mail header looks as it was sent from our local 127.0.0.1 from
[EMAIL PROTEC
Kurt Buff wrote:
Sorry to reply to my own post, but here's a link for for your perusal:
http://archives.neohapsis.com/archives/postfix/2003-09/1730.html
Don't use Mailscanner with Postfix.
The author of Postfix states that it's not a good idea. I'll
take his word
for it.
Kurt
Agreed on th
Invalid wrote:
> Time error started Jan 30 19:15:04
Jan 30 19:15:04 addr3ss MailScanner[11506]: MailScanner E-Mail Virus
Scanner version 4.38.9 starting... Jan 30 19:15:04 addr3ss
update.virus.scanners: Delaying cron job up to 600 seconds Jan 30
19:15:04 addr3ss MailScanner[11506]: Could not r
Greetings,
I'm still using SA 2.64. How do I write a rule to combat spam with the
Subject: header spanning multiple lines, eg.
Subject: No Dodge - True Abil
ity! Enlarge your p
hallus.
Thanks,
Damon
On Tue, Feb 01, 2005 at 10:45:59PM -0500, Pedro Sam wrote:
> :0fw: spamassassin.lock
> * < 256000
> | /usr/bin/spamc
>
> I noticed that although I have 5 spamd children, only one of them was
> getting called at the time. Does anyone know how to process incoming mail
> in parallel using procmail
Hi all,
Currently, I use a procmail script to process incoming messages like so:
:0fw: spamassassin.lock
* < 256000
| /usr/bin/spamc
I noticed that although I have 5 spamd children, only one of them was getting
called at the time. Does anyone know how to process incoming mail in parallel
using p
Hey folks,
I'm running SpamAssassin 3.0.2 on an OpenBSD 3.6-STABLE machine,
on an AMD64 3000+ with 2GB of RAM. I have yet to see this machine
even touch the second gig of RAM, and it's never been into swap.
This is a new server, so I'm trying to train Bayes using a corpus
I've been saving
> EF> header MIME_VER_RATTY Mime-Version =~ /^1\.0 \(produced
by [a-z]{1,20}
>
> I suspect it ovelaps significantly a SARE rule or two, but I'll be
> running that check this weekend.
It actually overlaps a rule that is almost identical that is targeted at
exactly the same pattern.
> 3) As a test, you might want to back out all of SARE's rules and check
your
> message processing speed with stock-rules only. That should be very fast.
Or more to the point, get rid of BigEvil. That has been known to cause
exactly this problem.
Loren
Now that I've got a version of hostname with the --fqdn option that spf
requires...
I have already installed Mail-SPF-Query-1.997 and it passed all of
its "make tests". Now I'm compiling/testing Mail-SpamAssassin-3.0.2
and a bit puzzled by the fact that it doesn't pass its spf tests.
t/spamd_unix.
Hello Eric,
Friday, December 17, 2004, 11:00:12 AM, you wrote:
EF> I've noticed an interesting ratware pattern in the Mime-Version field
EF> that uses "produced by" and then a combination of two random words and a
EF> random version number. ...
EF> header MIME_VER_RATTY Mime-Versi
On Feb 1, 2005, at 5:29 PM, Matt Kettler wrote:
Well there's your problem.. .cshrc and bashrc only apply to those
shell interpreters. They don't get called when procmail runs.
Try setting PERL5LIB in your procmailrc and you should be ok.
Sadly, that doesn't do it either (in fact, it was already s
At 07:16 PM 2/1/2005, Sean Harding wrote:
I've set PERL5LIB in both .cshrc (I use tcsh as my login shell) and
.bashrc, and when I run perl from the command line, it finds the version
of Net::DNS in my home
I'm using SA 3.0.2 called from procmail with Perl 5.6.1.
Well there's your problem.. .cshr
Hello Jean,
Tuesday, February 1, 2005, 7:11:50 AM, you wrote:
JD> Hi
JD> I'm making bench with SA 3.0.2 running with perl 5.8.6
JD> SA is launched by amavisd 2.2.1
JD> It runs on a dual xeon 2.8 with 2GB of ram with a redhat 3
JD> (2.4.21-15.0.4.ELsmp)
JD> I run 2 instances of Postfix with diff
Hello Alan,
Tuesday, February 1, 2005, 10:59:02 AM, you wrote:
AS> Michael Parker <[EMAIL PROTECTED]> wrote:
>>On Tue, Feb 01, 2005 at 10:39:14AM -0800, Alan Shine wrote:
>>>I have one spamd - with the default of 5 max children.
>>This is likely your problem, if you are truly processing at 16 a
On Tue, Feb 01, 2005 at 04:16:24PM -0800, Sean Harding wrote:
> Net::DNS version is 0.19, but need 0.34dnsavailable-1 at
> /home/sharding//local/share/perl/5.6.1/Mail/SpamAssassin/Dns.pm line
> 1230.
>
> It's true that the systemwide version of Net::DNS is 0.19, but I've
> installed 0.48 in my
Hello EB,
Tuesday, February 1, 2005, 8:22:15 AM, you wrote:
E> We had secured the formmail.pl with the anti-spam version, and we had
E> searched all httpd logs while the spamming occured, but there wasn't
E> any suspicious call to cgi scripts. We think it could be something
E> harder to check, w
Hello EB,
Tuesday, February 1, 2005, 6:34:25 AM, you wrote:
E> Is there a way in spamassassin that we can set a rule to reject
E> mail that contains a large list of "Cc" ?
SA doesn't reject anything, but if you want a rule that will catch a
large list of Cc entries, you can adapt this new rule f
From: "Matt Kettler" <[EMAIL PROTECTED]>
> At 01:39 PM 2/1/2005, Alan Shine wrote:
>
> >when I'm running SA with the default ruleset (the one that comes
> >with the installation), it proccesses 16 messages per second.
> >I don't know if it is the avarage amount of messages that SA can
proccess.
>
I'm having trouble getting SA to use the DNS tests. It complains that
Net::DNS is too old:
Net::DNS version is 0.19, but need 0.34dnsavailable-1 at
/home/sharding//local/share/perl/5.6.1/Mail/SpamAssassin/Dns.pm line
1230.
It's true that the systemwide version of Net::DNS is 0.19, but I've
in
60 matches
Mail list logo
