Re: Is Bayes actually working?

2005-06-22 Thread Graham Murray
Matt Kettler <[EMAIL PROTECTED]> writes: > My guess is that your cron job is running as a different user than is used to > scan your mail. So you're training into one database, but scanning using a > different database. Or the cron job is only learning spam and the auto-learn has not yet learnt e

Re: Is Bayes actually working?

2005-06-22 Thread Matt Kettler
Charles Read wrote: > Hey everybody! > > I am using Spamassassin with Bayes with Postfix via procmail. I use the > sa-learn script nightly on a folder where my users put their spam, when > cron sends me the email telling me the results it does say X messages > examined X messages learned from. B

Re: auto-whitelist is making spams sneak through

2005-06-22 Thread Matt Kettler
Mike Pepe wrote: > I'm getting more and more spams sneaking through lately. > > I'm running SA 3.0.4 on Fedora Core 3. > > In analyzing the ones that make it through, I see that other users in my > domain are CC, which causes the auto-whitelist to score the spam lower > than if I run it through m

Re: auto-whitelist is making spams sneak through

2005-06-22 Thread Steven Dickenson
On Jun 22, 2005, at 9:36 PM, Mike Pepe wrote: In analyzing the ones that make it through, I see that other users in my domain are CC, which causes the auto-whitelist to score the spam lower than if I run it through manually without that test. I'm sure others may chime in to say that auto-whi

Is Bayes actually working?

2005-06-22 Thread Charles Read
Hey everybody! I am using Spamassassin with Bayes with Postfix via procmail. I use the sa-learn script nightly on a folder where my users put their spam, when cron sends me the email telling me the results it does say X messages examined X messages learned from. But when an email IS labeled

auto-whitelist is making spams sneak through

2005-06-22 Thread Mike Pepe
I'm getting more and more spams sneaking through lately. I'm running SA 3.0.4 on Fedora Core 3. In analyzing the ones that make it through, I see that other users in my domain are CC, which causes the auto-whitelist to score the spam lower than if I run it through manually without that test.

rule-dev source material from SpamBouncer (fwd)

2005-06-22 Thread jm
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Catherine Hampton of SpamBouncer got in touch with something that might be useful for rule developers: > Check out the "Standalone Recipes' page for some stuff that SA users > might want to use after SpamAssassin: > > http://www.spambouncer.org/down

Re: {SPAM} .cf files in /etc/mail/spamassassin apparentely are not being used....

2005-06-22 Thread Helio Nunes
On Wednesday 22 June 2005 19:42, Matt Kettler wrote: Thanks I understood (from docs) that I should copy .cf files from /usr/share/sspamassassin to /etc/mail where local.cf is. That is probably why received emails with drugs ( cialis, viagra, etc ) are not being tagged. If SA parses both direc

Re: question

2005-06-22 Thread Matt Kettler
Daniel Geldres wrote: > hello to all, it is the first time that I subscribe to the list and I > have the following question. > > As I can filter subject VIAGRA. it is the first time that I install > spamassassing and single I have managed to filter encoding. Thanks and > good luck This would be a

Re: {SPAM} .cf files in /etc/mail/spamassassin apparentely are not being used....

2005-06-22 Thread Matt Kettler
Helio Nunes wrote: > I have installed the last version 3.04 using Linux Qmail Toaster (Bill Shupp) > version 0.7.12 together clamav, ripmime, and simscan 1.1. Linux distr. is > Suse 9.2. > > > > Actually I expected these filterings being done through 20_drugs.cf and > 20_porn.cf that I have p

question

2005-06-22 Thread Daniel Geldres
hello to all, it is the first time that I subscribe to the list and I have the following question. As I can filter subject VIAGRA. it is the first time that I install spamassassing and single I have managed to filter encoding. Thanks and good luck my ingles is not very good, is translated ;) --

.cf files in /etc/mail/spamassassin apparentely are not being used....

2005-06-22 Thread Helio Nunes
I have installed the last version 3.04 using Linux Qmail Toaster (Bill Shupp) version 0.7.12 together clamav, ripmime, and simscan 1.1. Linux distr. is Suse 9.2. simscancontrol file is as follow: :clam=yes,spam=yes,spam_hits=20.0,regex=levitra:penis:.*viagra.*:VIAGRA:cialis:.*c.i.a.l.i.s\..*,att

Re: Exchange/Outlook - how do you learn spam?

2005-06-22 Thread E. Falk
> Hi Joe, I have seen this problem on Ex2K and Ex2K3, I don't remember if it was an issue under 5.5 or not. I have a copy of a test-imap-header.pl script written by Nick Burch that can be used to see what the headers look like after you pull a message from an IMAP folder... let me know if you w

Re: 25_uribl.cf

2005-06-22 Thread Fred
You need to set the option in MIMEDefang to allow network tests to run in SpamAssassin. I'm fairly sure it's in your mimedefang-filter file. Check with the MIMEDefang folks if you need more help. Montse Seisdedos wrote: > Hello: > > I use mimedefang+spamassassin+clanv kit. > > I can't get these

RE: Exchange/Outlook - how do you learn spam?

2005-06-22 Thread Matt Yackley
Kang, Joseph S. said: > [snip] > >> From what I've seen the raw headers are not changed with the >> exception of the MailScanner spamassassin score which may be >> different because of RBL-SURBL's that have picked up on it. >> This doesn't appear to be a problem because sa-learn ignores >> the spam

Re: Why do I get different scores from "spamd" than manually?

2005-06-22 Thread Kai Schaetzl
Greg Earle wrote on Wed, 22 Jun 2005 11:24:44 -0700: > Why do I only get one SPAMCOP_URI_RBL_* hit when it's fed to "spamd" > as it comes in, yet I get 5 of them when I run it manually? Your spamd either uses different rules or gets a different message (from whatever feeds the message to it).

Re: Why do I get different scores from "spamd" than manually?

2005-06-22 Thread Matt Kettler
Greg Earle wrote: > (I'm still using 2.63 on my production mail server, btw. Please don't > shoot > me.) I'll avoid shooting you, but I will warn you that you have a DoS vulnerability. 2.64 and higher are immune to this particular DoS. 3.0.1-3.0.3 are also subject to a separate DoS that's fixe

RE: Why do I get different scores from "spamd" than manually?

2005-06-22 Thread Matthew.van.Eerde
Greg Earle wrote: > it finds > "Display:" and "none" just fine when it's in the body as Plain Text > ... so why doesn't it find them when they're inside HTML?) "body" rules don't look at HTML tags, they look at an html-to-text'ified version. You can look at the raw HTML by using "rawbody" r

Why do I get different scores from "spamd" than manually?

2005-06-22 Thread Greg Earle
I keep getting these Via*/Cial*/Val* "and many other" SPAMs (you know the ones, they start with "Hello, Welcome to " and have all those obfuscating "DISPLAY:" "none"s embedded in them). (I'm still using 2.63 on my production mail server, btw. Please don't shoot me.) What I don't understand

RE: Exchange/Outlook - how do you learn spam?

2005-06-22 Thread Kang, Joseph S.
> -Original Message- > From: Ken Goods [mailto:[EMAIL PROTECTED] > Sent: Wednesday, June 22, 2005 11:58 AM > To: users@spamassassin.apache.org > Subject: RE: Exchange/Outlook - how do you learn spam? > [snip] > From what I've seen the raw headers are not changed with the > exception of

RE: Exchange/Outlook - how do you learn spam?

2005-06-22 Thread Ken Goods
Steven Dickenson wrote: > Matt Yackley wrote: >> 1. Email that has only been stored in user mailbox and then pulled >> from a mailbox via IMAP/POP3 will retain the full headers of the >> email. > > What happens if a user moves the mail item to another folder in their > mailbox, and is then extrac

Re: Exchange/Outlook - how do you learn spam?

2005-06-22 Thread John Hall
"Matt Yackley" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] >> What I've resorted to doing is to archive all incoming e-mail in my >> front-end MTA (exim on linux). I have a script that extracts the >> message-ids of the spam in the Exchange public mail box and then >> extracts the

RE: Net::DNS problem?

2005-06-22 Thread Matthew.van.Eerde
Rosenbaum, Larry M. wrote: > According to Camel book 2nd edition page 39, > > "The underscore only works within literal numbers specified in your > program, not for strings functioning as numbers or data read from > somewhere else." > > I suspect that when Perl processes rule files, the scores ar

RE: Net::DNS problem?

2005-06-22 Thread Rosenbaum, Larry M.
According to Camel book 2nd edition page 39, "The underscore only works within literal numbers specified in your program, not for strings functioning as numbers or data read from somewhere else." I suspect that when Perl processes rule files, the scores are not processed like "literal numbers".

Re: PRIORITY_NO_NAME

2005-06-22 Thread Jim Knuth
Hallo und guten Tag Matt, Heute (am 22.06.2005 - 16:21 Uhr) schriebst Du: >>what means "tests=[PRIORITY_NO_NAME=X]" (X as example) in the >>header exactly? > First, it means that SA matched the message against the PRIORITY_NO_NAME > rule, and gave it x points as a result. > As for what PRIO

Re: SpamAssassin accuracy

2005-06-22 Thread Matt Kettler
At 05:31 AM 6/22/2005, Adrian Cooper wrote: Hi, I have been using Spamassassin for over a year now, until recently with great success in blocking almost all spam. For the last few weeks however a large amount of spam has been arriving even though I set to filter on a score of -2. Previously

Re: PRIORITY_NO_NAME

2005-06-22 Thread Matt Kettler
At 10:10 AM 6/22/2005, Jim Knuth wrote: Hello @all , what means "tests=[PRIORITY_NO_NAME=X]" (X as example) in the header exactly? First, it means that SA matched the message against the PRIORITY_NO_NAME rule, and gave it x points as a result. As for what PRIORITY_NON_NAME does, the describ

Older milter-spamc for RH Linux 6.2 anyone?

2005-06-22 Thread Dr Robert Young
Does anyone have an old copy of milter-spamc ( the 0.25 or higher "free" versions" ) lying about they could email as a zipped attachment along with its associated files? I was looking to "try it out" w/ spamassassin, but the latest version from snertsoft must be licensed and costs $$$. I woul

PRIORITY_NO_NAME

2005-06-22 Thread Jim Knuth
Hello @all , what means "tests=[PRIORITY_NO_NAME=X]" (X as example) in the header exactly? -- Viele Grüße, Kind regards, Jim Knuth [EMAIL PROTECTED] ICQ #277289867 PGP Fingerprint: 54C9 1A46 D3B2 95B6 454D 74FA AC73 773E 1F78 066F -- Zufalls-Zitat -- Gary Lineker: "Fußba

Whitelist users that use relays

2005-06-22 Thread Joao Gazzoni
Title: Mensagem Hi, I have these headers: - Received: from qmail.domain3.com Received: from phpmailer  by srv01.dinamize.com with local (PHPMailer);To: [EMAIL PROTECTED]From:

Re: sa-stats

2005-06-22 Thread Ben Hanson
I've been running it with -s 'midnight' -e 'now'(At 11:59 - I'm aware that I might lose a minute each day, but...) Tried -s today-24 -e today and still get lots of zeros. Ben (Hanson) Ben O'Hara wrote: On 6/22/05, Ben O'Hara <[EMAIL PROTECTED]> wrote: Just realised its defaulting

RE: Per-domain Spam Statistics

2005-06-22 Thread Matthew Yette
Anyone have any insight on this? Sa-stats.pl seems to be the only SA stats script I can find - I would think there has to be more out there... -- Matthew Yette Senior Engineer - NOC/Operations MA Polce Consulting, Inc. [EMAIL PROTECTED] 315-838-1644 (w) 315-356-0597 (f) AIM/Yahoo: MAPolceNOC MSN:

Re: sa-stats

2005-06-22 Thread Ben O'Hara
On 6/22/05, Ben O'Hara <[EMAIL PROTECTED]> wrote: > > Just realised its defaulting to running 24 hours into the future > rather than the past. Is this normal behaviour? should i be passing a > -s of 24 hours ago to it? > Seems " -s today-24 -e today" does the trick! Ben -- "The Edge ... ther

Re: sa-stats

2005-06-22 Thread Ben O'Hara
On 6/22/05, Ben O'Hara <[EMAIL PROTECTED]> wrote: > On 6/22/05, Ben Hanson <[EMAIL PROTECTED]> wrote: > > Timing: > start = 1119444953 Wed Jun 22 13:55:53 +0100 2005 > end = 1119531353 Thu Jun 23 13:55:53 +0100 2005 > > Report Title : SpamAssassin - Spam Statistics > Report Date : 20

Re: sa-stats

2005-06-22 Thread Ben O'Hara
On 6/22/05, Ben Hanson <[EMAIL PROTECTED]> wrote: > Got my first nightly stats breakdown email this morning after starting > testing the 3.10pre1 version. The report states zero spam, which is > true (allright devs!) but then, zero mail as well. Did any log format > change that I need to be aware

Re: Exchange/Outlook - how do you learn spam?

2005-06-22 Thread Matt Yackley
Steven Dickenson said: comments inline > Matt Yackley wrote: >> 1. Email that has only been stored in user mailbox and then pulled from a >> mailbox >> via IMAP/POP3 will retain the full headers of the email. > > What happens if a user moves the mail item to another folder in their > mailbox, an

Re: Exchange/Outlook - how do you learn spam?

2005-06-22 Thread Matt Yackley
John Hall said: > "Matt Yackley" <[EMAIL PROTECTED]> wrote in message >> MS is trying to come up with a work-around for the problem, also in >> his spare time our developer at work is looking to see if he can come >> up with a work-around. If I find a better way to pull messages out of >> Exchang

sa-stats

2005-06-22 Thread Ben Hanson
Got my first nightly stats breakdown email this morning after starting testing the 3.10pre1 version. The report states zero spam, which is true (allright devs!) but then, zero mail as well. Did any log format change that I need to be aware of? I didn't see any notes. I copied over the sa-st

25_uribl.cf

2005-06-22 Thread Montse Seisdedos
Hello:   I use mimedefang+spamassassin+clanv kit.   I can't get these rules (25_uribl.cf) to work properly.   In the command line it works ok, this is the output:   [EMAIL PROTECTED] root]# spamassassin < mail_test X-Spam-Report:    *  0.2 HTML_TEXT_AFTER_HTML BODY: HTML contains text

Re: Exchange/Outlook - how do you learn spam?

2005-06-22 Thread Steven Dickenson
Matt Yackley wrote: 1. Email that has only been stored in user mailbox and then pulled from a mailbox via IMAP/POP3 will retain the full headers of the email. What happens if a user moves the mail item to another folder in their mailbox, and is then extracted via imap? MS is trying to come

Re: bayes db from SA 3.0.2 to 3.0.4

2005-06-22 Thread Kai Schaetzl
Roman Serbski wrote on Mon, 20 Jun 2005 14:55:56 +0600: > 1. sa-learn --backup > db.txt (on old server) since you transferred the complete db I don't see a reason to import and export the data. This is like backing up your notebook at home, take the notebook and backup with you in the car to wo

Re: Phishing: My rule and thoughts

2005-06-22 Thread Kai Schaetzl
Murty Rompalli wrote on Tue, 21 Jun 2005 06:59:27 -0400 (EDT): > So ebay,paypal, > amazon are not safe and not suitable for most ordinary people, only > advanced users. Well, I think, if one doesn't read email in HTML format those phish are pretty safe to digest. Kai -- Kai Schätzl, Berlin,

Re: SpamAssassin 3.1.0pre1 PRERELEASE available!

2005-06-22 Thread Kai Schaetzl
Theo Van Dinter wrote on Tue, 21 Jun 2005 10:55:58 -0400: > Can you open a ticket about this? We'll need to fix it before release. following the conversation here and in "Subject: Problems after update SA 2.64 => 3.0.4" shall I still open a ticket on this or are you going to fix/solve it anoth

Re: SpamAssassin accuracy

2005-06-22 Thread Kai Schaetzl
Adrian Cooper wrote on Wed, 22 Jun 2005 10:31:13 +0100: > For the last few weeks however a large amount of spam has been arriving even > though I set to filter on a score of -2. Previously I was blocking most spam > on a score of 1.0 > > This is a very aggressive setting Indeed, *both* setti

SpamAssassin accuracy

2005-06-22 Thread Adrian Cooper
Hi, I have been using Spamassassin for over a year now, until recently with great success in blocking almost all spam. For the last few weeks however a large amount of spam has been arriving even though I set to filter on a score of -2. Previously I was blocking most spam on a score of 1.0

Re: Exchange/Outlook - how do you learn spam?

2005-06-22 Thread John Hall
"Matt Yackley" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > Here is what I know of the issue. > 1. Email that has only been stored in user mailbox and then pulled > from a mailbox via IMAP/POP3 will retain the full headers of the > email. > 2. Email that is moved into a public fo

Re: Bayes database under MySQL

2005-06-22 Thread Arvinn Løkkebakken
Mike Jackson wrote: I have SA 3.0.2 set up with vpopmail, using MySQL for user preferences, auto whitelisting and bayesian storage. It seems that with auto_learn turned on, SA is keeping a per-user bayes DB in MySQL, which is great. However, I can't figure out how I can teach SA about spam

Re: problem with SURBL checks

2005-06-22 Thread Jeff Chan
It would be useful if you could run spamassassin -D --lint as Kevin suggested. See also: http://www.surbl.org/faq.html#nettest http://www.surbl.org/faq.html#test-uris etc. Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/