Hi,
on a well-behaved mailing list sends all mails are sent by "Mr. Majordomo" or
such,
and they should work well.
Less well-behaved ones have the list server send mail as the originating user :(
I installed something on a MTA a while ago which would ask senders from a local
domain
to authenti
Hello Brian,
Monday, August 15, 2005, 1:46:09 AM, you wrote:
BM> As subject, I use a fair number of Rules Emporium rules, is there any
BM> information about on which of those rules have made it into the 3.1.0 rule
set?
As Loren suggested, my mass-check to identify any overlaps between
current S
Hello Paul,
Monday, August 15, 2005, 1:45:53 AM, you wrote:
PJS> DNS is working fine. We've been running SA for 6 months no problem,
PJS> it's only when we added the extra 10 rule sets it got bogged down. I've
PJS> just been removing them one by one at the moment and have got the timing
PJS> ba
On Mon, Aug 15, 2005 at 07:04:36PM -0700, Loren Wilton wrote:
> I just want a rule that checks the text/plain part for zero uris and the
> html part for > 0 uris. That would catch 99+% of this trash without trying
> very hard.
FWIW, I put in a test rule for this:
OVERALL% SPAM% HAM% S/
On Mon, Aug 15, 2005 at 10:23:58PM -0500, Steve Martin wrote:
> 154830 entries kept, 1714 deleted
Ok.
> [1381] dbg: bayes: token count: 154830, final goal reduction size: 42330
> [1381] dbg: bayes: 1382400_62056
>
> So, the first time it only got rid of about 2000 tokens and is stuck?
Yup.
> [
I noticed an email took over 300 seconds to process, and the reason
was apparently opportunistic bayes expiry taking to long as it ended
up aborting processing.
So, I tried sa-learn --force-expire -D and saw this in the output...
[1364] dbg: bayes: token count: 156544, final goal reduction s
Exellent. This is the information I needed! Is there any chance of getting
an updated release schedule (I checked the wiki, but the schedule info for
3.1.0 seems out of date)?
Might also be nice to see some pointers in the docs about how to reenable the
DCC and Razor plugins for those of us who
If it doesn't work you should enter a bz ticket, whether it was intentional
or not! :-)
Loren
> Should I report this as a bug or was it an intentional change?
> Would it be possible to craft a rule that roughly compares the text/plain
> and HTML-stripped text/html versions of a message and scored against them
if
> the words they contained were significantly different? Or is that
> technically infeasible?
I just want a rule that checks the text/plain par
> Hello,
>
> When I run the sa-learn --force-expire on a regular basis, I eventually
> run into this:
>
> debug: bayes: couldn't find a good delta atime, need more token
> difference, skipping expire.
>
> Once it is in this state, I never can recover and have to zap the
database.
>
> What could cau
To add to my last post on this subject, I discovered that the sa-stas.pl
that ships with SA is also coming up with zeroes. I made the following
change to the script:
next parseloop unless ($sl->{'program'} eq 'spamd');
to
next parseloop unless ($sl->{'program'} eq 'spamassassin');
a
I replied elsewhere, but I was having some strange DNS problems today
that probably caused every other lookup to fail. I THINK that was
what was causing it. I'll watch for a while...
On Aug 15, 2005, at 8:12 PM, List Mail User wrote:
...
Not for me...
* -6.0 USER_IN_WHITELIST_TO User is
>...
>Not for me...
>
>* -6.0 USER_IN_WHITELIST_TO User is listed in 'whitelist_to' * 2.4
>SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
>* [SPF failed: ] * -1.3 AWL AWL: From: address is in the auto
>white-list
>
>That is from your message...
>
>On Aug 15, 2005, at 6
On Mon, Aug 15, 2005 at 06:45:52PM +0700, Dhanny Kosasih wrote:
>I use SpamAssassin 3.0.4 with FC3, and i use script from Fedora to start
>and stop spamd. But qmailmrtg7 can't read log with standard
>SpamAssassin. The qmailmrtg can only read log with multilog format. I
>try --syslog=stderr but i
Looks like I was having a DNS problem. Not sure why it would turn
into SPF_FAIL's, though since I think it would fail to get the SPF
record and at that point shouldn't it not run SPF rules?
I reran some of the messages that had been failing and they are fine
now.
On Aug 15, 2005, at 6:1
From: "Herb Martin" <[EMAIL PROTECTED]>
-Original Message-
From: Paul J. Smith [mailto:[EMAIL PROTECTED]
DNS is working fine. We've been running SA for 6 months no
problem, it's only when we added the extra 10 rule sets it
got bogged down. I've just been removing them one by one at
How does one search there for a specific version? Just for grins and
giggles I tried to search for "Mail::SpamAssassin-3.10" and received
8140 results listings. It should either return the RC1 or it should
return nothing. Ah well. It's another Bugzilla search.
Nor do I think 2.64 will run with 5.
From: "Matt Kettler" <[EMAIL PROTECTED]>
Most people having problems with BSP are in category 2, or consider
subscriber mail to be spam. (There is a lot of spam-ish subscriber mail
out there, my users subscribe to lots of it, on purpose, it's often hard
for me to tell without asking the recipi
Not for me...
* -6.0 USER_IN_WHITELIST_TO User is listed in 'whitelist_to' * 2.4
SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
* [SPF failed: ] * -1.3 AWL AWL: From: address is in the auto
white-list
That is from your message...
On Aug 15, 2005, at 6:17 PM, List
From: "Kenneth Porter" <[EMAIL PROTECTED]>
--On Saturday, August 13, 2005 6:58 PM -0400 Theo Van Dinter
<[EMAIL PROTECTED]> wrote:
On Sat, Aug 13, 2005 at 03:07:14PM +0530, Ramprasad A Padmanabhan wrote:
When I build the rpm from the spec file ( on fedora core 3 ) the
spamassassin-tools rpm
Well, it doesn't ;-)
On Aug 15, 2005, at 6:02 PM, Matt Kettler wrote:
Return-Path: <[EMAIL PROTECTED]>
X-Original-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
Received: by cheezmo.com (Postfix, from userid 88)
id 30552EBDC5; Mon, 15 Aug 2005 18:03:32 -0500 (CDT)
X-Spam-Flag: NO
X-S
On Mon, Aug 15, 2005 at 12:33:31PM -0700, Mike Jackson wrote:
> Would it be possible to craft a rule that roughly compares the
> text/plain
> and HTML-stripped text/html versions of a message and scored against
> them
> if the words they contained were significantly different? Or is that
> tech
>...
>The first thing I've noticed after running 3.1pre1 for a few days is
>that I'm getting much less bayes auto learning of ham due to the fact
>that most of my messages from mailings lists fail SPF tests and get
>penalized 2.4-2.6 points or so for it. They still aren't marked as
>spam,
>...
>Dirk Bonengel wrote:
>> FYI:
>> rfc-ignorant.org has .de listed in whois.rfc-ignorant.com.
>
>As others pointed out, it's listed 127.0.0.7 not .5.
>
>>
>> http://www.rfc-ignorant.org/tools/detail.php?domain=de&submitted=1120996396&table=whois
>>
>> In a standard 3.0.x install, DNS_FROM_RFC_
Steve Martin wrote:
> The first thing I've noticed after running 3.1pre1 for a few days is
> that I'm getting much less bayes auto learning of ham due to the fact
> that most of my messages from mailings lists fail SPF tests and get
> penalized 2.4-2.6 points or so for it. They still aren't mar
Simon Oosthoek a écrit :
I tried this, but nothing changed, certainly not the tests with scores
as I'd like to have. I'm starting to think your suggestion #3 is maybe
the culprit, I'll see if I can ask the question on the amavis list...
amavisd regenerates SA headers. you need to "patch" am
The first thing I've noticed after running 3.1pre1 for a few days is
that I'm getting much less bayes auto learning of ham due to the fact
that most of my messages from mailings lists fail SPF tests and get
penalized 2.4-2.6 points or so for it. They still aren't marked as
spam, but with h
Dirk Bonengel wrote:
> FYI:
> rfc-ignorant.org has .de listed in whois.rfc-ignorant.com.
As others pointed out, it's listed 127.0.0.7 not .5.
>
> http://www.rfc-ignorant.org/tools/detail.php?domain=de&submitted=1120996396&table=whois
>
> In a standard 3.0.x install, DNS_FROM_RFC_WHOIS gives a s
Fettke, Dirk a écrit :
Sorry, I forgot.
I'm using postfix, amavisd, spamassassin
In my local.cf I have insert these lines like Matt Kettler told me.
header BANNED_SUB1 Subject =~ /viagra/i
score BANNED_SUB1 100
Unfortunately it doesn't work. When i write myself an email from gmx w
> -Original Message-
> From: Mike Jackson [mailto:[EMAIL PROTECTED]
> Sent: Monday, August 15, 2005 2:34 PM
> To: users@spamassassin.apache.org
> Subject: test for multipart/alternative discrepancies?
>
> I've been getting quite a few spams (which slipped past SA)
> in the last few minut
Mike Jackson wrote:
> I've been getting quite a few spams (which slipped past SA) in the last
> few minutes with subject lines like "dies in McDonalds", so I looked at
> the message source to see how they were scoring (which I've included
> below). In all the cases, the HTML content (at least as di
On Mon, Aug 15, 2005 at 12:33:31PM -0700, Mike Jackson wrote:
> Would it be possible to craft a rule that roughly compares the text/plain
> and HTML-stripped text/html versions of a message and scored against them
> if the words they contained were significantly different? Or is that
> technical
I've been getting quite a few spams (which slipped past SA) in the last few
minutes with subject lines like "dies in McDonalds", so I looked at the
message source to see how they were scoring (which I've included below). In
all the cases, the HTML content (at least as displayed in Outlook Expres
On Mon, Aug 15, 2005 at 03:03:11PM -0400, Sloan, Craig wrote:
> I've inherited a SA ver 3.0.1 box that is running great (thus my lack of
> intimacy with it). I would like to adjust some of the scoring, and I
> want to make sure that I change it in the correct location. I've seen a
> couple of locat
I've inherited a SA ver 3.0.1 box that is running great (thus my lack of
intimacy with it). I would like to adjust some of the scoring, and I
want to make sure that I change it in the correct location. I've seen a
couple of locations suggested and I not sure which would be preferred
and/or better.
On Mon, Aug 15, 2005 at 10:33:51AM -0700, Justin Mason wrote:
> None of the 2.6x series support 5.005. I don't think the 2.5x series
> did, either. 5.005 is *very* outdated by now
Actually, 2.6x does support 5.005, at least according to our documentation:
The SpamAssassin 2.6x release serie
First thing I do whenever do an upgrade of SA is to go through and zero
out any rules that suppose someone is a good player. I don't believe in
someone being able to pay to send my system spam. Any such whitelist
systems will eventually be abused IMO. Spammers look at SA rules and take
the easiest
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Chr. v. Stuckrad writes:
> On Mon, Aug 15, 2005 at 07:27:33AM -0700, Loren Wilton wrote:
> > You can stop the first two from being problems by running a manual expire
> > from a cron job every so often and disabling the auto-expire runs. You
> > shou
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Loren Wilton writes:
> > However NOW I understand that noone have old versions of
> > SpamAssassin as pablic.
>
> There should be a version of 2.64 available publicly on the net someplace.
> I would expect on the SA site someplace. It was the last v
Hello,
When I run the sa-learn --force-expire on a regular basis, I eventually
run into this:
debug: bayes: expiry check keep size, 0.75 * max: 562500
debug: bayes: token count: 675802, final goal reduction size: 113302
debug: bayes: First pass? Current: 1124120405, Last: 1124089241, atime:
> -Original Message-
> From: Paul J. Smith [mailto:[EMAIL PROTECTED]
> DNS is working fine. We've been running SA for 6 months no
> problem, it's only when we added the extra 10 rule sets it
> got bogged down. I've just been removing them one by one at
> the moment and have got the t
> >Be aware though that MANY spammers forge bonded sender tags. If you have
> >one of the older methods of checking bonded sender, it is very probable
that
> >a lot of your failures are forgeries that the newer bonded sender methods
> >should correctly detect.
>
> Erm, you're thinking of HABEAS SW
As stated at the bottom of the downloads page on spamassassin.org,
"Older, Perl-licensed versions can be found via CPAN".
http://search.cpan.org/CPAN/authors/id/J/JM/JMASON/Mail-SpamAssassin-2.64.tar.gz
Atami Org. wrote:
Dear jdow;
I am not clear your English. Because I have less knowledge
f
On Mon, Aug 15, 2005 at 07:27:33AM -0700, Loren Wilton wrote:
> You can stop the first two from being problems by running a manual expire
> from a cron job every so often and disabling the auto-expire runs. You
> should have a limit of 250K or so on the mail size to try to keep the third
> from be
At 10:18 AM 8/15/2005, Loren Wilton wrote:
My very minimal experience with Bonded Sender is that the people who
contract directly are mostly fairly legit. The people who contract through
the clever guilt-sharing arrangement at constant contact are spammers.
Agreed.
Be aware though that MANY
> -Original Message-
> From: jdow [mailto:[EMAIL PROTECTED]
> Sent: Monday, August 15, 2005 8:55 AM
> To: users@spamassassin.apache.org
> Subject: Re: filter for subjects
>
> 1) You can use SARE rules to increase scores for words like viagra.
> 2) You cannot under any circumstance have Sp
--On Saturday, August 13, 2005 6:58 PM -0400 Theo Van Dinter
<[EMAIL PROTECTED]> wrote:
On Sat, Aug 13, 2005 at 03:07:14PM +0530, Ramprasad A Padmanabhan wrote:
When I build the rpm from the spec file ( on fedora core 3 ) the
spamassassin-tools rpm is not created. Was it not a part of SA.
Th
Have you changed --max-con-per-child? Usually a sudden bloat in a single
child is due to:
aRunning a Bayes expire in that child
bRunning an Awl expire
cProcessing a message that is very large
You can stop the first two from being problems by running a manual expire
from a cron job ev
My very minimal experience with Bonded Sender is that the people who
contract directly are mostly fairly legit. The people who contract through
the clever guilt-sharing arrangement at constant contact are spammers.
Be aware though that MANY spammers forge bonded sender tags. If you have
one of t
On Mon, Aug 15, 2005 at 06:51:48AM -0700, jdow wrote:
> As soon as you touch swap space you're dead. It's not unusual to see times
> for processes increase by 10 or even 100 times. (Although about 10 is most
> common.)
Happened to us already twice. Is seems to hit 'just by chance'.
I assume it t
> I'm using postfix, amavisd, spamassassin
> In my local.cf I have insert these lines like Matt Kettler told me.
> Unfortunately it doesn't work. When i write myself an email from gmx with
the
> subject "viagra" it will be delivered to my mailbox.
> Any other ideas?
You need to do the second ha
Russ Uhte wrote:
We're moving away from our current antispam setup which uses the bonded
sender list. In doing some checking to see how I want to setup SA, I
noticed that currently many messages that look like spam are being
whitelisted by our current setup because of the bonded sender list.
On Monday 15 August 2005 14:44, Fettke, Dirk typed:
> Sorry, I forgot.
>
> I'm using postfix, amavisd, spamassassin
>
> In my local.cf I have insert these lines like Matt Kettler told me.
>
> header BANNED_SUB1 Subject =~ /viagra/i
> score BANNED_SUB1 100
>
> Unfortunately it doesn't wor
We're moving away from our current antispam setup which uses the bonded
sender list. In doing some checking to see how I want to setup SA, I
noticed that currently many messages that look like spam are being
whitelisted by our current setup because of the bonded sender list.
What is the basic
1) You can use SARE rules to increase scores for words like viagra.
2) You cannot under any circumstance have SpamAssassin not pass mail
on to the next delivery step. It is possible to have the next
delivery step drop the mail into /dev/null.
3) It is not wise to get too frantic and drop thing
As soon as you touch swap space you're dead. It's not unusual to see times
for processes increase by 10 or even 100 times. (Although about 10 is most
common.)
{^_^}
- Original Message -
From: "Paul J. Smith" <[EMAIL PROTECTED]>
Thanks all.
I did check 'top' and did increase the memor
Testing 3.1.0-rc1 on a RH 7.2 machine with sendmail, I noticed this morning
that the log entires into maillog have changed from:
Aug 7 03:48:54 yoda2 spamd[11492]: identified spam (13.0/6.9) for
spamd:1205 in 2.9 seconds, 3420 bytes.
to:
Aug 15 06:23:55 yoda2 spamassassin[10790]: spamd: ide
Sorry, I forgot.
I'm using postfix, amavisd, spamassassin
In my local.cf I have insert these lines like Matt Kettler told me.
header BANNED_SUB1 Subject =~ /viagra/i
score BANNED_SUB1 100
Unfortunately it doesn't work. When i write myself an email from gmx with the
subject "viagra"
Hi,
the simplest way to use multilog is the way its author designed it :)
Rather than the start/stop script you are familiar with, setup daemontools to
run the spamd
as a service and pass it option to NOT daemonize.
This will take care of the logging, and will also restart it should it ever die
>>
>> Hi,
>>
>> I become desperate... I want any mail with specific subject (like:
>> viagra postbank, Adobe...) mark as spam. The Mail should be dropped and
>> not delivered to
>> Mailbox.=20
>> Our Mailserver is only for relaying and filtering for spam and viruses.
>> So there are no local mail
On Mon, Aug 15, 2005 at 09:09:20AM -0400, Matt Kettler wrote:
> Perhaps you want something like:
>
> spamd -s stdout | multilog {insert multilog options here}
This should be exactly what you want.
BUT in the manual I only see 'stderr' allowed
for '... -s stderr'. If 'stdout' does not work
you mi
>...
>
>Thanks. Will have to see how to do this with postfix.
>
>Ron
>
>
>Ron Nutter [EMAIL PROTECTED]
>Network Infrastructure & Security Manager
>Information Technology Services(5
At 04:12 AM 8/15/2005, Paul J. Smith wrote:
We are currently seeing scan times of 60-90 seconds on a P4 3Ghz box
after adding some new rules emporium rules to try to increase the
effectiveness of spamassassin.
Is there a way to list the timing for each test rather that the total
scan time so I c
At 07:45 AM 8/15/2005, Dhanny Kosasih wrote:
I use SpamAssassin 3.0.4 with FC3, and i use script from Fedora to start
and stop spamd. But qmailmrtg7 can't read log with standard SpamAssassin.
The qmailmrtg can only read log with multilog format.
I try --syslog=stderr but i don't know where
At 08:19 AM 8/15/2005, Fettke, Dirk wrote:
I become desperate
I want any mail with specific subject (like: viagra
postbank, Adobe
) mark as spam.
Ok, SA can be made to do that.. it's a little less straightforward than
just saying "block subject xyz" but it's not hard.
A short rule with a hi
Title: filter for subjects
Hi,
I become desperate… I want any mail with specific subject (like: viagra postbank, Adobe…) mark as spam. The Mail should be dropped and not delivered to
Mailbox.
Our Mailserver is only for relaying and filtering for spam and viruses. So there are no local ma
Thanks. Will have to see how to do this with postfix.
Ron
Ron Nutter [EMAIL PROTECTED]
Network Infrastructure & Security Manager
Information Technology Services(502)863-7002
Geo
I use SpamAssassin 3.0.4 with FC3, and i use script from Fedora to start
and stop spamd. But qmailmrtg7 can't read log with standard
SpamAssassin. The qmailmrtg can only read log with multilog format. I
try --syslog=stderr but i don't know where is the log file ? How
SpamAssassin use multilog f
Thanks all.
I did check 'top' and did increase the memory to 512mb. It's the latest
ver of SA so I think it's running only 5 processes. It rarely seems to
dip into the swap space, though it does report all the memory as being
used so I was assuming it was merely processor time. The CPU was
cert
Hum. Interesting question. Thinking back, I don't believe that any entire
ruleset, or even any major hunk of a ruleset, moved into 3.1 that wasn't
already in 3.0. There has been some rule migration, but it has largely been
piecemeal.
We will probably have to run an overlap check with the 3.1 ru
> back down to 6 secs or so, but it would be very handy to have the actual
> times of each test logged so I can see which are the slow ones.
Check Top. This sounds a lot like you are thrashing. The rulesemporium
rules are fairly carefully written to not be processor hogs, although we
have made m
> However NOW I understand that noone have old versions of
> SpamAssassin as pablic.
There should be a version of 2.64 available publicly on the net someplace.
I would expect on the SA site someplace. It was the last version before
3.0.
However, I am not sure that 2.64 will work with 5.005. You
You can run DProf manually on SA and see what it says about rule timings.
Or at least you are supposed to be able to; the last time I tried it I
couldn't get it to work.
However, there may be a simpler answer. You didn't mention the amount of
ram you have nor the number of children you are runnin
As I replied directly, "Can't be done."
The time rule 1022 takes depends on all the other 2752 rules you are
running. Changing any one of them changes memory requirements. And if
it is not DNS then you are running into swap memory and will experience
HEAVY slow downs. Reduce the number of concurr
As subject, I use a fair number of Rules Emporium rules, is there any
information about on which of those rules have made it into the 3.1.0 rule set?
Thanks
--
Brian
Hi,
DNS is working fine. We've been running SA for 6 months no problem,
it's only when we added the extra 10 rule sets it got bogged down. I've
just been removing them one by one at the moment and have got the timing
back down to 6 secs or so, but it would be very handy to have the actual
times
Candidate rules right off the bat are DNS based if you are seeing
long delays. You probably have a half dozen or more DNS based rules
setup and DNS is not working.
{^_^}
- Original Message -
From: "Paul J. Smith" <[EMAIL PROTECTED]>
Hi,
We are currently seeing scan times of 60-90 sec
Dear jdow;
I am not clear your English. Because I have less knowledge
for both English and SpamAssassin.
However NOW I understand that noone have old versions of
SpamAssassin as pablic. And NOW I understand that I have to search it myself.
Thank you again jdow; I try to do it !
Eiji Hama
Hi,
We are currently seeing scan times of 60-90 seconds on a P4 3Ghz box
after adding some new rules emporium rules to try to increase the
effectiveness of spamassassin.
Is there a way to list the timing for each test rather that the total
scan time so I can see which parts are taking significan
Matt Kettler wrote:
Simon Oosthoek wrote:
Matt Kettler wrote:
Ok, I've put this in the /etc/spamassassin/local.cf file and it doesn't
change the appearance of the Status header at all :-(
I'm not using spamd, but amavisd-new which calls spamassassin directly I
think using the perl-libs...
Hmm
Google for it. You may have to look for the very earliest version you
can find. And you will not be able to find any help for running it.
We've all forgotten those bad old days.
You got better advice from someone else directing you to a special
interest mailing list for your machine regarding upg
81 matches
Mail list logo
