Re: SA Rules

2005-04-02 Thread Loren Wilton
> I modified chickenpox the other day so that it is scored using five meta > rules, rather than by allocating 0.6 to each rule. This means that it > can only add a maximum of 3.5 (by hitting 9 or more rules). Can't find > the e-mail address of the original author, though, as I was going to > send i

Re: SA does not check messages which have already be marked in the header

2005-04-02 Thread Loren Wilton
> But anyway, if one has good ideas how to integrate a result from a previous test into a local test, I will be happy to hear about it. In 3.0+ you can use full to find previous SA headers in the mail, and then write rules against their presence. In some rare cases this could be useful I suppose.

Re: AW: SA does not check messages which have already be marked in the header

2005-04-02 Thread Robert Menschel
Hello Thomas, Saturday, April 2, 2005, 2:43:14 AM, you wrote: TS> Two hints: one ist that the name of the host which added the SPAM info TS> to the header ist not mine but the hoster“s. The second is that I TS> rewrite the subject and put the original mail in an attachment while TS> the mails I

Re: SA Rules

2005-04-02 Thread Robert Menschel
Hello Robert, Friday, April 1, 2005, 6:05:16 AM, you wrote: RB> Trying to cleanup any rules that might be outdated or a hinderance on our RB> server, was wondering if I still needed the rules listed below: RB> chickenpox.cf RB> weeds2.cf RB> random.cf RB> 70_sare_unsub.cf RB> 70_sare_uri.cf Onl

Re: bogus-virus-warnings-cf

2005-04-02 Thread Bob McClure Jr
On Sat, Apr 02, 2005 at 05:09:40PM -0600, Chris wrote: > I use RDJ to update rule sets, I only run it once a day. On the run for the > 31st of March, RDJ reported: > > RulesDuJour Run Summary on cpollock.localdomain: > > The following rules had errors: > Tim Jackson's (et al) bogus virus warnin

bogus-virus-warnings-cf

2005-04-02 Thread Chris
I use RDJ to update rule sets, I only run it once a day. On the run for the 31st of March, RDJ reported: RulesDuJour Run Summary on cpollock.localdomain: The following rules had errors: Tim Jackson's (et al) bogus virus warnings was not retrieved because of: 403 from http://www.timj.co.uk/linu

Re: SA Rules

2005-04-02 Thread Matthew Newton
On Fri, Apr 01, 2005 at 03:35:29PM +0100, Gray, Richard wrote: > I'd noticed a number of FPs on the chickenpox ruleset from .doc, .ppt > files. Ditto that, but with Fortran and C listings. I modified chickenpox the other day so that it is scored using five meta rules, rather than by allocating 0

spam goes trough

2005-04-02 Thread kalin mintchev
hi all increasingly over the last month the filter has letting spam through. some days is ok - some like last night really bad - i got 60 spam messages. i have spamd running - nothing has changed. it does get some of the spam still but crap like this is getting through. and on top of it it au

Re: SA does not check messages which have already be marked in the header

2005-04-02 Thread Matt Kettler
At 03:34 AM 4/2/2005, [EMAIL PROTECTED] wrote: Obviously my SA skips messages wich are already marked. Can I switch this "skip" off? SA itself doesn't "skip" messages that are already marked. Period. You'll have to look at the configuration you're using to call SA, as the only way to "skip" messag

AW: SA does not check messages which have already be marked in the header

2005-04-02 Thread tschloss
Thanks! I was wrong, sorry My "spamd" was down, not checking anything. But anyway, if one has good ideas how to integrate a result from a previous test into a local test, I will be happy to hear about it. thx & cheers Thomas __ Mit WEB.

Re: SA does not check messages which have already be marked in the header

2005-04-02 Thread Loren Wilton
Is it possible you have procmail set up to check for X-Spam-Status: Yes in the incoming mail and bypass SA? Some people do this sort of thing. (But you don't want to bypass on a status of No, of course.) Loren

AW: SA does not check messages which have already be marked in the header

2005-04-02 Thread Thomas Schlosser
> > > Obviously my SA skips messages wich are already marked. > > What makes you think this? > > So far as I know, SA strips (most) previous SA headers from > the mail, then processes it. So you may or may not get the > same results the second time. > > Loren > Two hints: one ist th

Re: SA does not check messages which have already be marked in the header

2005-04-02 Thread Loren Wilton
> Obviously my SA skips messages wich are already marked. What makes you think this? So far as I know, SA strips (most) previous SA headers from the mail, then processes it. So you may or may not get the same results the second time. Loren

Re: JPEG, MIME incompaibility issue?

2005-04-02 Thread Loren Wilton
> Is there a problem with emails sent from microsoft word via eamil (and > thus with mime) and SA? Probably not, but are you sure that MIME is getting used? When I send a Word document through Exchange at work, Outlook decides to use inline hex encoding in the body of the mail. This triggers any

SA does not check messages which have already be marked in the header

2005-04-02 Thread tschloss
Hi, I am running SA 3. on Linux with Postfix and Cyrus (invoked as content_filter via PIPE in Postfix using spamd/spamc). In general SA is workig fine. Now I saw that some messages are already marked by my mailbox provider. For some reasons I want my SA to work on these messages again (one is to

Re: EFF Newsletter as SPAM

2005-04-02 Thread Jeff Chan
On Friday, April 1, 2005, 6:38:34 PM, Chris Chris wrote: > On Friday 01 April 2005 10:52 am, Matt Kettler wrote: >> Chris wrote: >> >I subscribe to the EFF Newsletter, it keeps repeatedly getting tagged as >> > spam. I've put the 'from' address in my manual whitelist which has helped >> > to lower

Re: EFF Newsletter as SPAM

2005-04-02 Thread Chris
On Friday 01 April 2005 10:52 am, Matt Kettler wrote: > Chris wrote: > >I subscribe to the EFF Newsletter, it keeps repeatedly getting tagged as > > spam. I've put the 'from' address in my manual whitelist which has helped > > to lower the score to a tad above my spam threshold of 5.0. I've saved >