Re: SA 3.10 skipping some emails or errors in log??

2006-01-09 Thread George R . Kasica
>Please see, and comment on, bug 4696: > >http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4696 > Not sure if my comments made it to that so here they are: Similar problem here with it dying at random during the day. No recycling of logs or anything here. Linux kernel 2.6.12.2 with SA 3.1 an

Re: How SpamAssassin recognize chinese character?

2006-01-09 Thread Jeff Peng
If you are using the perl of 5.8.0 or higher,it process the unicode characters well.So you should not worry about that Perl how to interpret the Chinese character.Just use the rules as normally as english language. From: Vincent Li <[EMAIL PROTECTED]> To: users@spamassassin.apache.org Subject

Re: inconsistent --lint fails w/ SA r366568 & RDJ

2006-01-09 Thread OpenMacNews
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 hi daryl, > I'd open a bug on this, or at least bring it up on the dev list. It > looks like this was just overlooked during the (ongoing) sa-update > implementation. per a comment *from* the sare list, it seems that -- though it wasn't in the

Re: SA 3.10 skipping some emails or errors in log??

2006-01-09 Thread Daryl C. W. O'Shea
On 09/01/2006 7:36 PM, George R. Kasica wrote: Jan 9 15:31:07 eagle spamd[8420]: spamd: processing message <[EMAIL PROTECTED]> for mail:561 Jan 9 15:34:55 eagle spamd[8715]: __alarm__ Jan 9 15:35:01 eagle spamd[8715]: __alarm__ Jan 9 15:35:01 eagle spamd[8311]: prefork: child states: BBBI

Re: inconsistent --lint fails w/ SA r366568 & RDJ

2006-01-09 Thread Daryl C. W. O'Shea
On 06/01/2006 6:22 PM, OpenMacNews wrote: In theory SA should check your build-time specified directory first, unless something got screwed up in the build process and SpamAssassin.pm is looking in the wrong places. that's what i'd presumed, if not legitimately understood. i'm not yet certai

Re: URI's and geocities subwebs..

2006-01-09 Thread Daryl C. W. O'Shea
On 05/01/2006 11:23 AM, Matt Kettler wrote: Billy Huddleston wrote: Is their a way to get the URI's to look at stuff like this?? I'm seeing more and more spam with these kinds of things in them to get by URI detection.. http://asia.geocities.com/april19781matt1487 Do you mean URIBL's? Not

Re: dealing with SPF and external authenticated users

2006-01-09 Thread Daryl C. W. O'Shea
On 05/01/2006 1:56 PM, Jason Haar wrote: Leonardo Rodrigues Magalhães wrote: Hello Guys, I have SA running with amavisd/postfix. I also have several external users with dinamic IP addresses which are allowed to relay using my server because they authenticate, i have SASL running. The pr

Re: dealing with SPF and external authenticated users

2006-01-09 Thread Daryl C. W. O'Shea
On 05/01/2006 7:27 AM, Leonardo Rodrigues Magalhães wrote: Hello Guys, I have SA running with amavisd/postfix. I also have several external users with dinamic IP addresses which are allowed to relay using my server because they authenticate, i have SASL running. The problem is that

Re: correct way of whitelisting mailing lists

2006-01-09 Thread Daryl C. W. O'Shea
On 04/01/2006 5:39 PM, Matt Kettler wrote: mouss wrote: What happens with the _spf version if - the domain allows any client to send ? Thus, don't use the SPF whitelist form domains you don't trust to be non-malicious. Then again, if you don't trust them to be non-malicious, you probably

Re: spamd: pyzor: check failed: internal error

2006-01-09 Thread Daryl C. W. O'Shea
On 03/01/2006 5:19 AM, Chris Purves wrote: [EMAIL PROTECTED] wrote: I'm getting the errormessage below; Who can help ? Wolfgang Jan 2 09:25:58 saxophon spamd[13330]: spamd: connection from localhost [127.0.0.1] at port 40156 Jan 2 09:25:58 saxophon spamd[13330]: spamd: checking message <[

Re: Spamd (3.1.0) fails to terminate -- suggested patch

2006-01-09 Thread Daryl C. W. O'Shea
On 30/12/2005 1:33 PM, Mabry Tyson wrote: We keep occasionally (once a day or two) hitting an infinite loop in spamd 3.1.0 where the process fails to terminate. We find that after a while some resource is used up and the system stops accepting new spamd connections. The process accumulates

Re: koko petrol spams

2006-01-09 Thread Daryl C. W. O'Shea
On 30/12/2005 9:45 AM, Jeff Chan wrote: On Wednesday, December 28, 2005, 9:15:02 AM, Obantec Support wrote: if i enable spamcop i find a lot of my ADSL customers (not on my IP's) are blocked. i use sbl-xbl but the IP's so far seem to have gotten thru. You could use something like smtp authen

SA 3.10 skipping some emails or errors in log??

2006-01-09 Thread George R . Kasica
First thanks for helping get the logging corrected and the daeomizing set with -d. Working on getting SA 3.1 working effectively here and I think I may have some issues with it at this time in terms of it scanning all incoming mail. I'm running exim 3.36 here and have 4.60 ready to go if I can g

Re: How SpamAssassin recognize chinese character?

2006-01-09 Thread Vincent Li
On 9-Jan-06, at 2:16 PM, Matt Kettler wrote: Jon Armitage wrote: Vincent Li wrote: I have been using SpamAssassin for quite a while, and used SARE rules and other custom rules. I am interested in writing my own chinese spam rules to block chinese spam email. I cheat and use an Exim acl s

Re: How SpamAssassin recognize chinese character?

2006-01-09 Thread Vincent Li
On 9 Jan 2006, at 10:08 PM, Jon Armitage wrote: Vincent Li wrote: I have been using SpamAssassin for quite a while, and used SARE rules and other custom rules. I am interested in writing my own chinese spam rules to block chinese spam email. I cheat and use an Exim acl statement to reject m

Re: How SpamAssassin recognize chinese character?

2006-01-09 Thread Matt Kettler
Jon Armitage wrote: > Vincent Li wrote: > >> I have been using SpamAssassin for quite a while, and used SARE rules >> and other custom rules. I am interested in writing my own chinese spam >> rules to block chinese spam email. >> > I cheat and use an Exim acl statement to reject messages composed

Re: How SpamAssassin recognize chinese character?

2006-01-09 Thread Jon Armitage
Vincent Li wrote: I have been using SpamAssassin for quite a while, and used SARE rules and other custom rules. I am interested in writing my own chinese spam rules to block chinese spam email. I cheat and use an Exim acl statement to reject messages composed in unwanted character sets. Howev

How SpamAssassin recognize chinese character?

2006-01-09 Thread Vincent Li
Hi list: I have been using SpamAssassin for quite a while, and used SARE rules and other custom rules. I am interested in writing my own chinese spam rules to block chinese spam email. I found chinese rules at http://www.ccert.edu.cn/spam/sa/Chinese_rules.cf and http://www.geewhiz.ca/images/b/

Re: rules better than bayes?

2006-01-09 Thread Dhawal Doshy
Robert Bartlett writes: Ok I confused myself. Im sorry for being an idiot. I get it now. Everytime an email comes in it tries to access it as the user, since bayes is being feed to just the root account it doesn't see anything for the users in bayes. With the override I force it to use the root

RE: rules better than bayes?

2006-01-09 Thread Dallas L. Engelken
> -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: Monday, January 09, 2006 2:05 PM > To: Matthew Yette > Cc: users@spamassassin.apache.org > Subject: Re: rules better than bayes? > > [snip] > > I also strongly recommend enabling SA's URIBL support, and > addin

RE: rules better than bayes?

2006-01-09 Thread Robert Bartlett
Ok I confused myself. Im sorry for being an idiot. I get it now. Everytime an email comes in it tries to access it as the user, since bayes is being feed to just the root account it doesn't see anything for the users in bayes. With the override I force it to use the root account for all emails comi

suggest for changing

2006-01-09 Thread Leonardo Rodrigues Magalhães
Hello Guys, I have installed SA 3.1.0 and, after some tweaking on rules, I noticed that i had SEVERAL warning on --lint tests. After some researching, I discovered that i had several FUZZY and SUBJECT_FUZZY rules giving errors, something like score for rule that doesnt exists. Some mor

RE: rules better than bayes?

2006-01-09 Thread Robert Bartlett
Sorry for the confusion, I do use a site wide bayes database, I thought the information I sent below was the site wide information the system uses to access the bayes database. Thanks Robert -Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Monday, January 09, 2006 1

Re: rules better than bayes?

2006-01-09 Thread Matt Kettler
Robert Bartlett wrote: > This is what I have in my local.cf file: > > bayes_store_module Mail::SpamAssassin::BayesStore::SQL > bayes_sql_dsnDBI:mysql:**:localhost:3306 > bayes_sql_username > bayes_sql_password

RE: rules better than bayes?

2006-01-09 Thread Robert Bartlett
This is what I have in my local.cf file: bayes_store_module Mail::SpamAssassin::BayesStore::SQL bayes_sql_dsnDBI:mysql:**:localhost:3306 bayes_sql_username bayes_sql_password Obviously I hid the d

Re: rules better than bayes?

2006-01-09 Thread Matt Kettler
Robert Bartlett wrote: > Interesting, I did that just to see how mine were doing and the BAYES one > returned 0? Does that mean bayes is not being used? I have been feeding > emails to bayes and in debug mode it shows bayes being used. I am using > bayes in a mysql. Just weird that its showing 0. >

RE: rules better than bayes?

2006-01-09 Thread Bowie Bailey
wrote: > I have since taken bayes out as I get WAY better results without it. If it doesn't work for you, don't use it. The rules and network tests work pretty well. Especially if you add some SARE rules into the mix. However... > The reason this happens to me is that I get to many spam

RE: rules better than bayes?

2006-01-09 Thread Robert Bartlett
Interesting, I did that just to see how mine were doing and the BAYES one returned 0? Does that mean bayes is not being used? I have been feeding emails to bayes and in debug mode it shows bayes being used. I am using bayes in a mysql. Just weird that its showing 0. Robert -Original Message--

Re: rules better than bayes?

2006-01-09 Thread Matt Kettler
Matthew Yette wrote: > > Do you recommend running airmax as a supplementary ruleset with 3.1.0? I personally have no recommendations on it.. I've never run it. I personally like SARE's specific, evilnumbers, random and adult rulesets. Here's some quick grep's for hit-rates on some SARE rules I

Re: rules better than bayes?

2006-01-09 Thread Mike Jackson
Do you recommend running airmax as a supplementary ruleset with 3.1.0? This is just my humble opinion, but I don't know if that's a ruleset I would use in production for a multi-user server. A few of the rules use the "f-word" in the rule description line, so it would go out in a verbose repo

Re: rules better than bayes?

2006-01-09 Thread M. Lewis
Matthew Yette wrote: Correction, airmax.cf is not one single rule, it's one single FILE containing 211 rules. That's a significant difference, given that the stock spamassassin 3.1.0 has about 723 rules. Airmax has increased the number of rules in your system by 29.1% Do you recommend

Re: rules better than bayes?

2006-01-09 Thread mouss
Matt Kettler a écrit : > > > Realistically, I don't know why your hit rates are so low. They shouldn't be > so > bad that you're only detecting 2 or 3 out of every hundred. > > You could have some configuration problems, but I can't tell as you've not > told > us anything about your system, ju

Re: rules better than bayes?

2006-01-09 Thread qqqq
I have since taken bayes out as I get WAY better results without it. The reason this happens to me is that I get to many spam mailings that poison the db and I end up with allot of spam that shows up as a Bayes_00. I use all the Network tests but I get allot of spam that has not been added yet.

Re: rules better than bayes?

2006-01-09 Thread Matthew Yette
On 1/9/06 2:43 PM, "Matt Kettler" <[EMAIL PROTECTED]> wrote: > jo3 wrote: >> Hi, >> >> This is an observation, please take it in the spirit in which it is >> intended, it is not meant to be flame bait. >> >> After using spamassassin for six solid months, it seems to me that the >> bayes proce

Re: rules better than bayes?

2006-01-09 Thread Matt Kettler
jo3 wrote: > Hi, > > This is an observation, please take it in the spirit in which it is > intended, it is not meant to be flame bait. > > After using spamassassin for six solid months, it seems to me that the > bayes process (sa-learn [--spam | --ham]) has only very limited success > in learning

RE: Ohya

2006-01-09 Thread Kristopher Austin
Well, scratch that on IE 6.0, but it definitely happens in Firefox 1.5 with no extensions installed. I can watch Firefox try .com for any unknown URL before returning an error. I've tested this on 4 machines to be sure. We do not use any proxies. Either way, as you said lots of people will ty

rules better than bayes?

2006-01-09 Thread jo3
Hi, This is an observation, please take it in the spirit in which it is intended, it is not meant to be flame bait. After using spamassassin for six solid months, it seems to me that the bayes process (sa-learn [--spam | --ham]) has only very limited success in learning about new spam. Rega

Re: Ohya

2006-01-09 Thread mouss
Kristopher Austin a écrit : > Well, to make matters interesting, Outlook makes www.rektoky a > hyperlink. Click on it and IE and Firefox will both add the .com. > Voila! You have a spam address that makes it through every time. > not here. what versions of IE and firefox are you using? Both ret

Re: Ohya

2006-01-09 Thread mouss
Nix a écrit : > One of the goals in _A Plan for Spam_ has certainly been achieved: the > spammers are having to obfuscate their dubious `messages' so much that > they no longer make any great degree of sense. > actually, most (naive) users will add .com either because they "understood" (the messa

Re: Stock Spam

2006-01-09 Thread Loren Wilton
I keep receiving stock spam that looks like the one below. I was sure I had same SARE rules that were supposed to catch this, but maybe not. Any suggestions? We're working on a set of stock rules. RSN, I hope. Loren

RE: Feeding Bayes Forwarded Emails

2006-01-09 Thread Bowie Bailey
Robert Bartlett wrote: > -Original Message- > From: Bowie Bailey [mailto:[EMAIL PROTECTED] > > Robert Bartlett wrote: > > > > > > The problem is the original email is not attached, they just forward > > > it to me. Is there a way to just feed the body of the message > > > instead of the he

RE: Feeding Bayes Forwarded Emails

2006-01-09 Thread Robert Bartlett
-Original Message- From: Bowie Bailey [mailto:[EMAIL PROTECTED] Sent: Monday, January 09, 2006 10:48 AM To: users@spamassassin.apache.org Subject: RE: Feeding Bayes Forwarded Emails Robert Bartlett wrote: > From: Bowie Bailey [mailto:[EMAIL PROTECTED] > > Robert Bartlett wrote: > > > I

Re: updating WIKI -- InstallingOnWindows

2006-01-09 Thread Magnus Holmgren
Steven Manross skrev: > 90% of the way down... (the following command throws errors -- %%f was > unexpected at this time) > > for %%f in (*.*) do call pod2html %%f --outfile > \perl\html\site\lib\mail\spamassassin\plugins\%%f.html --quiet > > s/b > > for %f in (*.*) do call pod2html %f --outfi

RE: Feeding Bayes Forwarded Emails

2006-01-09 Thread Bowie Bailey
Robert Bartlett wrote: > From: Bowie Bailey [mailto:[EMAIL PROTECTED] > > Robert Bartlett wrote: > > > If someone forwards me email as a regular forward and not as an > > > attachment, could I still feed it to bayes as the user who forwarded > > > it to me and still be effective? Or will that cause

Re: Syslog setting help needed

2006-01-09 Thread George R . Kasica
>On Mon, 09 Jan 2006 09:36:04 -0500, you wrote: >At 07:33 AM 1/9/2006, George R. Kasica wrote: > >>Here you go: >> >>/usr/local/bin/spamd --local -u spamd -m 5 --max-conn-per-child=50 & > > >Ditch the &, and add a -d instead. > >spamd will start logging to syslog if you tell it to daemonize, inste

RE: updating WIKI -- InstallingOnWindows

2006-01-09 Thread Steven Manross
This was apready pointed out to me.. And I'll be re-editing the page to reflect this part I did not know until 2 people pointed it out to me. Thanks. Steven

RE: updating WIKI -- InstallingOnWindows

2006-01-09 Thread Bret Miller
> Would anyone with access update the WIKI for Windows, please? As noted before, ANYONE can sign up and update the wiki. It's community documentation and being part of the community helps it to stay accurate. But... > > Namely, > > http://wiki.apache.org/spamassassin/InstallingOnWindows > > 90%

RE: updating WIKI -- InstallingOnWindows

2006-01-09 Thread Herb Martin
> Would anyone with access update the WIKI for Windows, please? > Namely, > http://wiki.apache.org/spamassassin/InstallingOnWindows > 90% of the way down... (the following command throws errors > -- %%f was > unexpected at this time) > > for %%f in (*.*) do call pod2html %%f --outfile > \perl\

RE: updating WIKI -- InstallingOnWindows

2006-01-09 Thread Kristopher Austin
Steven, anyone can update the wiki, you just have to have an account. Just create an account and click edit. At least that seems to have worked for me. Kris -Original Message- From: Steven Manross [mailto:[EMAIL PROTECTED] Sent: Monday, January 09, 2006 10:10 AM To: spamassassin-users S

RE: Ohya

2006-01-09 Thread Kristopher Austin
Well, to make matters interesting, Outlook makes www.rektoky a hyperlink. Click on it and IE and Firefox will both add the .com. Voila! You have a spam address that makes it through every time. Kris Sent to Nix only previously, meant to send this to the list. -Original Message- From: N

updating WIKI -- InstallingOnWindows

2006-01-09 Thread Steven Manross
Would anyone with access update the WIKI for Windows, please? Namely, http://wiki.apache.org/spamassassin/InstallingOnWindows 90% of the way down... (the following command throws errors -- %%f was unexpected at this time) for %%f in (*.*) do call pod2html %%f --outfile \perl\html\site\lib\ma

Re: Ohya

2006-01-09 Thread Nix
On Sun, 8 Jan 2006, [EMAIL PROTECTED] announced authoritatively: > From: <[EMAIL PROTECTED]> ===8<--- Make it happen! Here : www.rektoky ,ohya add .com ^_^ ===8<--- [...] > Well Raymond. it's no good if it's listed in uribl if the url does not > parse as a url. That's the poi

RE: Feeding Bayes Forwarded Emails

2006-01-09 Thread Robert Bartlett
-Original Message- From: Bowie Bailey [mailto:[EMAIL PROTECTED] Sent: Monday, January 09, 2006 8:30 AM To: users@spamassassin.apache.org Subject: RE: Feeding Bayes Forwarded Emails Robert Bartlett wrote: > If someone forwards me email as a regular forward and not as an > attachment, c

RE: Feeding Bayes Forwarded Emails

2006-01-09 Thread Bowie Bailey
Robert Bartlett wrote: > If someone forwards me email as a regular forward and not as an > attachment, could I still feed it to bayes as the user who forwarded > it to me and still be effective? Or will that cause problems because > the headers show as the person forwarding the email and not the >

Feeding Bayes Forwarded Emails

2006-01-09 Thread Robert Bartlett
If someone forwards me email as a regular forward and not as an attachment, could I still feed it to bayes as the user who forwarded it to me and still be effective? Or will that cause problems because the headers show as the person forwarding the email and not the original headers? What I mean ab

running as root!

2006-01-09 Thread Sean .
Hello all, To start off, I'm running FreeBSD 4.7, SpamAssassin 3.1.0_5 all on a default install (only args are -d -r /var/run/spamd/spamd.pid). After I start spamd (via /usr/local/etc/rc.d/sa-spam.sh start), I did a ps -aux and saw the following; root 91555 1.9 0.6 22628 22140 ?? Ss

Re: Syslog setting help needed

2006-01-09 Thread Matt Kettler
At 07:33 AM 1/9/2006, George R. Kasica wrote: Here you go: /usr/local/bin/spamd --local -u spamd -m 5 --max-conn-per-child=50 & Ditch the &, and add a -d instead. spamd will start logging to syslog if you tell it to daemonize, instead of starting it in console mode and forcing it to the ba

Re: Syslog setting help needed

2006-01-09 Thread George R . Kasica
FYI, This doesn't happen with SA 3.0.4 George >On Mon, 09 Jan 2006 06:33:00 -0600, you wrote: >>On Sun, 08 Jan 2006 21:10:48 -0500, you wrote: > >>At 02:45 PM 1/8/2006, George R. Kasica wrote: >>>I've noticed that since going to exim 4.60 and SA 3.1 that I'm getting >>>alot of logging to my scr

Re: Syslog setting help needed

2006-01-09 Thread George R . Kasica
>On Sun, 08 Jan 2006 21:10:48 -0500, you wrote: >At 02:45 PM 1/8/2006, George R. Kasica wrote: >>I've noticed that since going to exim 4.60 and SA 3.1 that I'm getting >>alot of logging to my screen rather than into log files on the server >>from either spamd or exim (I'm thinking spamd) and I'm w