RE: [SPAM-TAG] SURBL missing this spam

I managed to write a metarule for anyone interested, to catch a URL with trailing : without a port specified, without FP on a 4 digit port. uri __SpoofPort_URL /.*\:.*|.*\...:.*/ uri __OkPort_URL /.*\:[0-9]|.*\:[0-9].+\/.*|.*\...:[0-9]|.*\...:[0-9].+\/.*/ meta Spoof_Port_URL

Re: Spam Report

At 09:53 PM 3/6/2005, Tim Edwards wrote: Here's my local.cf: use_terse_report 0 defang_mime 0 How long has it been since you ran spamassassin --lint? Those two options are long since dead. (ie: pre 2.50)

Re: sa-learn just won't learn!

At 03:57 PM 3/7/2005, Paul Waldo wrote: I am trying to get sa-learn to learn some spam. From my cyrus-imap Junk directory, I perform the following: [EMAIL PROTECTED] Junk]# sa-learn --forget ./7128. Learned from 1 message(s) (1 message(s) examined). [EMAIL PROTECTED] Junk]# sa-learn --spam ./7128.

Re: Spam Report

Thanks that did the trick Bowie Bailey wrote: From: Tim Edwards [mailto:[EMAIL PROTECTED]] Is it possible to enable the full X-Spam-Report field to be added to the message even when the message is not detected as spam. At the moment all my messages detected as spam have X-Spam-Sta

sa-learn just won't learn!

Hi all, I am trying to get sa-learn to learn some spam. From my cyrus-imap Junk directory, I perform the following: [EMAIL PROTECTED] Junk]# sa-learn --forget ./7128. Learned from 1 message(s) (1 message(s) examined). [EMAIL PROTECTED] Junk]# sa-learn --spam ./7128. Learned from 1 message(s) (1

Re: More problems was Re: DB_FILE error causes serious deep recursion/system overloading problem

Greg, How large was auto-whitelist? I just renamed mine and it was about 85Megs. Ironically, I have a VERY old one in the same directory that was about the same size. - Original Message - From: "Greg Allen" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>; Sent: Monday, March 07, 200

Re: Re[2]: learn_with_whitelist?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yes, it'd sound great! That and whitelist_from_spf entries (arriving shortly) ;) However we'd want to ensure we can get it into the main distro, btw, and I'm not sure we've figured out the ins-and-outs of putting SARE stuff into the SpamAssassin ma

FW: Problem getting SA 3.0.2 to restart

Title: FW: Problem getting SA 3.0.2 to restart Folks: Right in the spamd FM it says:     -u username...     ...    Note: If this option is set to a non-root user, and spamd is to run on a    privileged port (any < 1024, default 783 or via -p), the parent will not   

Re: Problem getting SA 3.0.2 to restart

On Mon, Mar 07, 2005 at 01:57:51PM -0500, Diffenderfer, Randy wrote: > I invoke spamd using the following command line (as root): > > /path/to/spamd -d -x -L -u sauser -s local2 -r > /var/run/spamassassin/spamd.pid > > I try to force a reload by sending a SIGHUP to the process noted in > spamd.pi

Problem getting SA 3.0.2 to restart

Title: Problem getting SA 3.0.2 to restart Folks: I invoke spamd using the following command line (as root): /path/to/spamd -d -x -L -u sauser -s local2 -r /var/run/spamassassin/spamd.pid The pid directory is accessible/writable by the sauser and the file does get created with contents a

Re: whitelist_from ignored

Hi Matt, thanks for the reply! I changed the defaults to /usr/sbin/spamd --create-prefs --max-children 5 --helper-home-dir -u spamfilter -d --pidfile=/var/run/spamd.pid (removed nouser-config option) - and now it works again. Looks like if wanting to use user whitelists, one needs to either st

Re: One single mailbox for all spam

Stephane Parenton wrote: > A mail server, serving several domains : domain_a.com, domain_b.com, > domain_c.com etc... > for the moment, domain_a and domain_b are filtered, but if everything > runs ok, all the domains should be filtered > When a mail arrives, it's controled, scored, and if it's

RE: Spamassassin Tagging

> On Mon, 7 Mar 2005, Jon Dossey wrote: > > > > Sounds like a spamass-milter bug... have you checked their site: > > > http://savannah.nongnu.org/bugs/?group=spamass-milt > > > > I don't think it's a milter problem, because the messages are being > > tagged - the subject just isn't being rewritten

Re: More problems was Re: DB_FILE error causes serious deep recursion/system overloading problem

[EMAIL PROTECTED] wrote: Well, turning off auto-whitelist does solve the system load problem. Unfortunately, it's also become clear that it turns off all spam tagging, meaning SpamAssassin is useless. Any ideas, please? Wow! I turned off AWL and sure enough, I see all the system resources free

RE: Spamassassin Tagging

On Mon, 7 Mar 2005, Jon Dossey wrote: > > Sounds like a spamass-milter bug... have you checked their site: > > http://savannah.nongnu.org/bugs/?group=spamass-milt > > I don't think it's a milter problem, because the messages are being > tagged - the subject just isn't being rewritten if the score

Re: One single mailbox for all spam

Nigel Wilkinson wrote: > Mark messages as spam by all means but if I was one of your clients I > wouldn't want you stopping me getting mail. Mmmh.. The OP is referring to more of a "Divert all spam to @domain_a.com accounts from the real destination to [EMAIL PROTECTED]" system. Mail is NOT auto

RE: Spamassassin Tagging

> Jon Dossey wrote: > >> -Original Message- > >> Jon Dossey wrote: > Still having problems. > > Redhat FC2, sendmail 8.31.1, spamassassin 3.0.1 (with > spamass-milter). > > Messages are coming in with scores > 5.0 and aren't being tagged. > >>> Ok, I changed th

Humorix: Total Destruction Of Earth Blamed On Spammers

RE: Spam Report

From: Tim Edwards [mailto:[EMAIL PROTECTED] > > Is it possible to enable the full X-Spam-Report field to be added > to the message even when the message is not detected as spam. At > the moment all my messages detected as spam have X-Spam-Status > fields like this: > X-Spam-Report: > * 0

RE: RDJ - which rules should one update ?

From: C-Store Christoph Peter [mailto:[EMAIL PROTECTED] > > by default, RDJ updates TRIPWIRE, EVILNUMBERS and SARE_RANDOM. > > Can anyone give a good advice on which rules should be included > in the update ? > > Or is the default setting sufficient ? Since we provide email service for our cust

RE: How to setup things. Novices with no or little mastery of com puters.

>David B Funk wrote: >> This particular one has been killfiled all over Usenet for over >> a decade and so has turned to mailing lists. >> >> A quick Google or Usenet search will reveal it for what it is. ;) > >Wow. I have been living a sheltered life of late and have blissfully >missed him. Go

RE: SURBL+-Checker on rulesemporium.com

>Hi all, > >I'm sure someone here can have a look at the SURBL+-Checker at >www.rulesemporium.com. >Seems to me somethings wrong with the WS-SURBL data used. I fed it two >domains that, according to my SA setup, where included in the WS >SURBL-list (MUNGEDhealtfrombirth.info and MUNGEDtukam.org )

logging options

I looked but maybee I am blind. Is there any way to change the way spamd logs? For example I do not want the timestamp in my log. Also I would like to change the verbosity level. I need this because I use multilog. Thanks

Re: learn_with_whitelist?

Jeff Chan wrote: As you suggest, even an uncomplete whitelist could be useful for whitening (improving scores (decreasing ham scores)) messages in SpamAssassin, but there are caveats and potential pitfalls. It could also be used as a FP tripwire, which is how we will soon be using ours. - Barr

SURBL+-Checker on rulesemporium.com

Hi all, I'm sure someone here can have a look at the SURBL+-Checker at www.rulesemporium.com. Seems to me somethings wrong with the WS-SURBL data used. I fed it two domains that, according to my SA setup, where included in the WS SURBL-list (MUNGEDhealtfrombirth.info and MUNGEDtukam.org ) - both s

RDJ - which rules should one update ?

Hello @all, by default, RDJ updates TRIPWIRE, EVILNUMBERS and SARE_RANDOM. Can anyone give a good advice on which rules should be included in the update ? Or is the default setting sufficient ? Thanks, C-Store Hard- und Software GmbH Christoph Peter Düstere Straße 20 37073 Göttingen http://www.c-

Re: One single mailbox for all spam

Nigel Wilkinson wrote: --On Saturday, March 05, 2005 19:53:14 +0100 Stephane Parenton <[EMAIL PROTECTED]> wrote: Hi everyone... So far, SpamAssassin is running ok... now I want to eliminate the spam from the users mailboxes. here's the deal : What I want is when a mail arrives, it's scored, and i

Bayes and msg-ids

Hi everyone, Could anyone shed some light for me on how and when (and especially why) Bayes often generates its own Message-Ids when learning, instead of using the one provided in the message? I have a lot of Message-Ids that are '@sa-generated' in my Bayes database. This also makes it a bit har

Re: learn_with_whitelist?

On Sunday, March 6, 2005, 7:04:19 PM, Robert Menschel wrote: > I've been using William Stearns' compiled blacklist available at > http://www.stearns.org/sa-blacklist/sa-blacklist.current.cf and have > contributed to it from time to time. If you're able to use network tests, using ws.surbl.org inst

Re: Quinlan interviewed about SA

On Sunday, March 6, 2005, 7:45:36 AM, Eric Hall wrote: > On 3/6/2005 3:25 AM, Matt Kettler wrote: >> These days spamming is done via botnets > That's already trapped by sbl+xbl. sbl-xbl is very good, but it has not and cannot solve the zombie problem entirely. There's always a lag between zombi

Re: 20_dnsbl_tests.cf

On Monday, March 7, 2005, 1:17:26 AM, Roel Bindels wrote: > As I can read from the output below, I see that I already have Net::DNS > installed. > Can anyone see something suspicious in my output. (this is not all of the > output) [...] > debug: diag: module installed: Net::DNS, version 0.24 I do

Re: 20_dnsbl_tests.cf

Hi, > As I can read from the output below, I see that I already have > Net::DNS installed. Can anyone see something suspicious in my output. > (this is not all of the output) > > greetings > Roel Bindels > > debug: SpamAssassin version 3.0.1 > debug: Score set 0 chosen. > debug: running in taint

Re: 20_dnsbl_tests.cf

As I can read from the output below, I see that I already have Net::DNS installed. Can anyone see something suspicious in my output. (this is not all of the output) greetings Roel Bindels debug: SpamAssassin version 3.0.1 debug: Score set 0 chosen. debug: running in taint mode? yes debug: Running

Re: 20_dnsbl_tests.cf

Hi! I want to use the dns blacklist, but I can't find out how to use it. The config file is in the /usr/share/spamassassin directory. Should I change the local.cf file or how will I get this working. If there are configfiles needed to answer this question I will post them. Install Net::DNS and you

RE: 20_dnsbl_tests.cf

They work by default but you must have DNS support installed. Find them on cpan.org Run spamassassin -D --lint and look for files that need to be installed. If you have DNS installed it should make calls assign points to spam. Once you get DNS working, you can also created custom blacklist entrie

Re: 20_dnsbl_tests.cf

Sorry, forgot to mention my SA version. Im using SA 3.0.1 and postfix and amavisd greetings Roel Bindels - Original Message - From: "Roel Bindels" <[EMAIL PROTECTED]> To: Sent: Monday, March 07, 2005 9:40 AM Subject: 20_dnsbl_tests.cf > Hello Listers, > > I want to use the dns blackli

RE: DB_FILE error causes serious deep recursion/system overloading problem

This is not good. You should make sure that you upgraded all of the supporting files including db_file to latest from cpan.org run spamassassin -D --lint to see what files it uses and upgrade those. You need to get your db working again it looks like to me. -->debug: bayes: no dbs present, canno

20_dnsbl_tests.cf

Hello Listers, I want to use the dns blacklist, but I can't find out how to use it. The config file is in the /usr/share/spamassassin directory. Should I change the local.cf file or how will I get this working. If there are configfiles needed to answer this question I will post them. greetings R

Re: SA 3.01 not adding correcly?

At 02:34 AM 3/7/2005, Philipp Snizek wrote: When adding Points I get a total score of 3.4. Why does SpamAssassin get 3.3? One word.. Rouding.. None of the rule scores are actually 2 digits, they're all 4 digit numbers.

Re: SA 3.01 not adding correcly?

Philipp Snizek wrote: > Content analysis details: (3.3 points, 3.0 required) > [...] > When adding Points I get a total score of 3.4. > Why does SpamAssassin get 3.3? Rounding errors. The numbers are really things like 1.07 and 0.06 and such. when printed in the summary only the tenths are pri

RE: More problems was Re: DB_FILE error causes serious deep recursion/system overloading problem

I had a problem with auto-whitelist. I had errors writing to it when I tested with spamassassin -D --lint I went to the auto-whitelist directory /var/spool/filter/.spamassassin and renamed the auto-whitelist file to auto-whitelist.old The system created a new auto-whitelist and so far so good.

SA 3.01 not adding correcly?

Hi Content analysis details: (3.3 points, 3.0 required) pts rule name description -- -- 0.5 NO_RDNSSending MTA has no reverse DNS (Postfix variant) 0.9 SARE_SUB_LONG_SUBJ_170 Subject is exce

More problems was Re: DB_FILE error causes serious deep recursion/system overloading problem

Well, turning off auto-whitelist does solve the system load problem. Unfortunately, it's also become clear that it turns off all spam tagging, meaning SpamAssassin is useless. Any ideas, please? I tried moving out all auto-whitelist files from home directories/.spamassassin and from /var/lib/nob

Re: learn_with_whitelist?

Robert Menschel wrote: I'm wondering whether it'd be worth while to have a similar file of contributed whitelist entries (whitelist_from_rcvd rules), contributed by the community, maintained by one or two people, and available to the community. If someone is willing to do it, why not. If someone i

Re: DB_FILE error causes serious deep recursion/system overloading problem

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 It would be worthwhile moving the AWL db files out of the way to see if that helps; run with -D to see what file might be being loaded. There certainly seem to be major (but infrequent) bugs in DB_File somewhere. :( - --j. writes: > This is int

Re: DB_FILE error causes serious deep recursion/system overloading problem

This is interesting as I am dealing with a load issue that started at 3.0.1 as well. All of a sudden, all of my RAM is being used. I added a second CPU to the box to no avail. I am using AWL as well and will try to run it without to see what happens. Unlike you, when I run it in debug mode, I do

DB_FILE error causes serious deep recursion/system overloading problem

I had a serious spamd problem this evening after we rebooted our server (running SuSE Linux 9.2). We had been running SpamAssassin 3.0.1 since last October and it had been working very well for several months. Suddenly, shortly after the upgrade, the load averages for the server shot through the r

rule for mail not to me

I can create a user rule for mail not addressed (To or Cc) to me header CF_NOT_FOR_METoCc !~ /[EMAIL PROTECTED]/ score CF_NOT_FOR_ME 4.0 describe CF_NOT_FOR_ME Neither To nor Cc me However, the still-not-addressed user scores bug prevents me from setting the

RE: Re[2]: learn_with_whitelist?

Robert Menschel said: >The purpose would be to provide reliable (non-abusable) whitelist >records for common vendors, newsletters, and other sources of email >whose content can sometimes cause false positives... Months ago, brought this issue up because I found that those discussion groups which e

Re[2]: learn_with_whitelist?

Saturday, March 5, 2005, 11:40:54 PM, Matt wrote: MK> If you really need a whitelist, use whitelist_from_rcvd entries, MK> ... I've been using William Stearns' compiled blacklist available at http://www.stearns.org/sa-blacklist/sa-blacklist.current.cf and have contributed to it from time to time.

Re: Spam Report

Here's my local.cf: ### # # rewrite_header Subject *SPAM* # report_safe 1 # trusted_networks 212.17.35. # lock_method flock required_hits 3 always_add_headers 1 always_add_report 1 use_terse_report 0 defang_mime 0 skip_

Re: Spam Report

At 06:04 PM 3/6/2005, Tim Edwards wrote: Is it possible to enable the full X-Spam-Report field to be added to the message even when the message is not detected as spam. At the moment all my messages detected as spam have X-Spam-Status fields like this: but my ham messages only have stuff like t

[SARE] Rule Updates

Just a quick note that this we I've updated the SARE specific and header rules files. Bob Menschel

Re: Something new to fool SURBL

Hello Thomas, Sunday, March 6, 2005, 11:12:57 AM, you wrote: TB> As received (relevant snippet): TB> http://Taiwanese.com href= TB> "http://pickup-card.com";>pickup-card.com SARE_HTML_A_INV in 70_sare_html0.cf will catch the first line of those. Our current score for that is 3.333 Bob Menschel

Re: Rule_Du_Jour.sh

Hello Farid, Sunday, March 6, 2005, 10:27:45 AM, you wrote: FI> This is the debug output produces by the shell : FI> ***WARNING***: spamassassin -D --lint failed. I'm not familiar with RDJ -- is the -D parameter there part of the usual script, or something you added? I was under the impression

Re: rbl checks, do in postfix or spamassassin

On Sunday, March 6, 2005, 4:33:02 PM, Bill Randle wrote: > On Sun, 2005-03-06 at 18:13 -0500, Rob Fantini wrote: >> Thank you for the reply, >> >> Can someone suggest which RBL checks should probably be result in >> rejecting mail in postfix? >> >> I'll also check in a postfix mail list, but wou

Re: rbl checks, do in postfix or spamassassin

On Sun, 2005-03-06 at 18:13 -0500, Rob Fantini wrote: > Thank you for the reply, > > Can someone suggest which RBL checks should probably be result in > rejecting mail in postfix? > > I'll also check in a postfix mail list, but would be interested in some > replies from this list.. I use sbl-x