Content-Length mismatch

2006-04-18 Thread George
Hello List: I'm running Exim 4.61 with SA 3.1.1 on OS X with the following start-up on spamd: /usr/bin/spamd -d -x -q -Q -L -u amavisd --socketpath=/tmp/spamd It seems like spamd won't scan anything over 8122 bytes. First I thought it was encoding or something, but shortening the same messag

problem with AWL and SQL

2006-04-18 Thread Andrew
I'm trying to set up SA to use MySQL to store the Auto WhiteList but it's just not working out for me. SA seems to be trying to create a lock file on disk. The problem is that I run spamd as a user which doesn't have a home directory. Here is what I find in my spamd log files. @40004445b03

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread John Rudd
On Apr 18, 2006, at 3:09 PM, Daryl C. W. O'Shea wrote: Richard Collyer wrote: Daryl C. W. O'Shea wrote: Richard Collyer wrote: I've changed it to a DNS server from my ISP, but so far its not making any difference. SA: finished scan in 13.719613 secs - hits=-1.0 BTW, if you watch the de

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Daryl C. W. O'Shea
Richard Collyer wrote: Daryl C. W. O'Shea wrote: Richard Collyer wrote: I've changed it to a DNS server from my ISP, but so far its not making any difference. SA: finished scan in 13.719613 secs - hits=-1.0 BTW, if you watch the debug output of a message being scanned, you'll see exactly

Re: X-Originating and X-Apparently-From

2006-04-18 Thread Andrew Doughety
Andrew Doughety wrote: Hi, We are trying to perform DNSBL checks on incoming mail and we are not seeing any actual DNS queries. When looking at the code it seems that the information on which IP(s) to check is obtained from X-Originating and X-Apparently-From headers. No, SA should be chec

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Richard Collyer
Daryl C. W. O'Shea wrote: Richard Collyer wrote: I've changed it to a DNS server from my ISP, but so far its not making any difference. SA: finished scan in 13.719613 secs - hits=-1.0 BTW, if you watch the debug output of a message being scanned, you'll see exactly where it's slow. spam

Re: X-Originating and X-Apparently-From

2006-04-18 Thread mouss
Andrew Doughety wrote: Hi, We are trying to perform DNSBL checks on incoming mail and we are not seeing any actual DNS queries. When looking at the code it seems that the information on which IP(s) to check is obtained from X-Originating and X-Apparently-From headers. my understanding is

Re: X-Originating and X-Apparently-From

2006-04-18 Thread Matt Kettler
Andrew Doughety wrote: > Hi, > We are trying to perform DNSBL checks on incoming mail and we are > not seeing any actual DNS queries. When looking at the code it seems > that the information on which IP(s) to check is obtained from > X-Originating and X-Apparently-From headers. No, SA should

Re: AWL - Where, how?

2006-04-18 Thread mouss
[EMAIL PROTECTED] wrote: Sorry if this has been asked ad-nauseum, but by default, the Mail::SpamAssassin::Plugin::AWL is enabled. From what I've been able to find on this topic, AWL is intended to be a user or system maintained database of whitelisted "from" addresses. We did nothing to crea

Re: X-Originating and X-Apparently-From

2006-04-18 Thread Daryl C. W. O'Shea
Andrew Doughety wrote: Hi, We are trying to perform DNSBL checks on incoming mail and we are not seeing any actual DNS queries. When looking at the code it seems that the information on which IP(s) to check is obtained from X-Originating and X-Apparently-From headers. Grepping through th

X-Originating and X-Apparently-From

2006-04-18 Thread Andrew Doughety
Hi, We are trying to perform DNSBL checks on incoming mail and we are not seeing any actual DNS queries. When looking at the code it seems that the information on which IP(s) to check is obtained from X-Originating and X-Apparently-From headers. Grepping through the code I do not see these

Re: How do you score your own domain(s)?

2006-04-18 Thread Daryl C. W. O'Shea
Julian Underwood wrote: Dear List, I was curious how organizations typically score mail which comes from their own domain(s). Obviously spammers will spoof the source domain in hopes that you have whitelisted your domain or give "special treatment" from mail originating from within your own org

RE: How do you score your own domain(s)?

2006-04-18 Thread Matthew.van.Eerde
Julian Underwood wrote: > I was curious how organizations typically score mail which comes from > their own domain(s). Obviously spammers will spoof the source domain > in hopes that you have whitelisted your domain or give "special > treatment" from mail originating from within your own org. We

How do you score your own domain(s)?

2006-04-18 Thread Julian Underwood
Dear List, I was curious how organizations typically score mail which comes from their own domain(s). Obviously spammers will spoof the source domain in hopes that you have whitelisted your domain or give "special treatment" from mail originating from within your own org. Mail may come in from a

Re: Bayesian learning and corrective training

2006-04-18 Thread mouss
Herb Martin wrote: Can anyone confirm that this will always be the case when dragging multiple messages into a new one? And will this be so in both outlook and outlook express? I can't confirm that it WILL always be true, but I believe that it mostly *should* a

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Daryl C. W. O'Shea
Richard Collyer wrote: I've changed it to a DNS server from my ISP, but so far its not making any difference. SA: finished scan in 13.719613 secs - hits=-1.0 BTW, if you watch the debug output of a message being scanned, you'll see exactly where it's slow. spamassassin -D < non-local-tes

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Daryl C. W. O'Shea
Richard Collyer wrote: Daryl C. W. O'Shea wrote: ... [31974] dbg: dns: name server: 192.168.1.1, family: 2, ipv6: 0 [31974] dbg: dns: testing resolver nameservers: 192.168.1.1 [31974] dbg: dns: trying (3) google.com... [31974] dbg: dns: looking up NS for 'google.com' [31974] dbg: dns: NS lookup

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Richard Collyer
Daryl C. W. O'Shea wrote: ... [31974] dbg: dns: name server: 192.168.1.1, family: 2, ipv6: 0 [31974] dbg: dns: testing resolver nameservers: 192.168.1.1 [31974] dbg: dns: trying (3) google.com... [31974] dbg: dns: looking up NS for 'google.com' [31974] dbg: dns: NS lookup of google.com using 192.

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Daryl C. W. O'Shea
Richard Collyer wrote: Hello, I am trying to track down why is is tracking so long for mails to be scanned via FreeBSD. I am scanning then using qmail-scanner (1.25). From what I can see the problem is coming from when e-mails are arriving from external sources. The top log entry shows and

Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Richard Collyer
Hello, I am trying to track down why is is tracking so long for mails to be scanned via FreeBSD. I am scanning then using qmail-scanner (1.25). From what I can see the problem is coming from when e-mails are arriving from external sources. The top log entry shows and e-mail from the lan. Th

Re: SA scores 9, 13, or 19 but places message in Inbox

2006-04-18 Thread jdow
From: "Saleem Hasan" <[EMAIL PROTECTED]> Hi, I am new at spam filtering and have recently installed SA 3.1.1 on a RedHat E L 3 mailserver. I am using a procmailrc to invoke SA and .procmailrc for individual users. There are two spam folders, one for score between 5 and 10 and the other for spa

Re: SA scores 9, 13, or 19 but places message in Inbox

2006-04-18 Thread Saleem Hasan
Thanks JamesDR, I am using POP3. The thing is that this does not happen all the time. In fact, this has happened only 3 or 4 times in the last 100-200 spams. I did not set any filters in Pine but there may be some set by default. I will also check for the Pine log and Pine filter log. Thanks.

RE: Help with Stupid Viagra/Calis spams

2006-04-18 Thread Don Levey
Let's put it this way - here are the rules your message hit on my system: Carl Chipman wrote: > > Content analysis details: (8.2 points, 5.0 required) > > 3.5 SUBJECT_DRUG_GAP_VIA > -4.9 BAYES_00 > 0.4 URIBL_AB_SURBL > 1.5 URIBL_WS_SURBL > 3.2 URIBL_OB_SU

Re: Help with Stupid Viagra/Calis spams

2006-04-18 Thread Loren Wilton
> tests=BAYES_50: > Is there a ruleset I could use add that might increase the chance of > catching theses? You can start by training Bayes that these are spam, it will help you a lot. If you don't have the SARE rules, several of the files there will also help. Loren

Re: SA scores 9, 13, or 19 but places message in Inbox

2006-04-18 Thread JamesDR
Saleem Hasan wrote: Hi, I am new at spam filtering and have recently installed SA 3.1.1 on a RedHat E L 3 mailserver. I am using a procmailrc to invoke SA and .procmailrc for individual users. There are two spam folders, one for score between 5 and 10 and the other for spam score >= 10. I read

RE: AWL - Where, how?

2006-04-18 Thread Chris Santerre
This might help:   http://mail-archives.apache.org/mod_mbox/spamassassin-users/200505.mbox/[EMAIL PROTECTED]   :) -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]Sent: Tuesday, April 18, 2006 10:33 AMTo: users@spamassassin.apache.orgSubject: AWL - Where,

SA scores 9, 13, or 19 but places message in Inbox

2006-04-18 Thread Saleem Hasan
Hi, I am new at spam filtering and have recently installed SA 3.1.1 on a RedHat E L 3 mailserver. I am using a procmailrc to invoke SA and .procmailrc for individual users. There are two spam folders, one for score between 5 and 10 and the other for spam score >= 10. I read the faq on rounding i

RE: AWL - Where, how?

2006-04-18 Thread Bowie Bailey
[EMAIL PROTECTED] wrote: > Sorry if this has been asked ad-nauseum, but by default, the > Mail::SpamAssassin::Plugin::AWL is enabled. > > From what I've been able to find on this topic, AWL is intended to be > a user or system maintained database of whitelisted "from" addresses. > > We did noth

Help with Stupid Viagra/Calis spams

2006-04-18 Thread Carl Chipman
I'm getting a bunch of these * V a l / u m $ l , 2 1* M e r / d i a X & n a x S o m & * C / a l i s $ 3 , 7 5* A m b / e n * V / a g r a $ 3 , 3 l* http://www.desirominnam.com going through my spam filters, and it's only being scored thusly: X-Spam-Status: No, hits=3.6 required=6.0

AWL - Where, how?

2006-04-18 Thread leonard . gray
Sorry if this has been asked ad-nauseum, but by default, the Mail::SpamAssassin::Plugin::AWL is enabled. From what I've been able to find on this topic, AWL is intended to be a user or system maintained database of whitelisted "from" addresses. We did nothing to create or populate this database,

Re: help required in blocking this spam

2006-04-18 Thread List Mail User
Leo's pill domains. Feed several to sa-learn (gets you a high BAYES score), make sure that net tests are enabled and do use digests (DCC, Razor and Pyzor); Then these spam will get 30+ point scores. Even with no net tests, your example scores > 4 points without BAYES, so training BAYES wi

Tamiflu

2006-04-18 Thread hamann . w
with the spread of that dangerous bird disease, online pharmacies start to add that drug to their protfolio, and to subject lines. So far all I have seen were spelled correctly Wolfgang Hamann

Re: help required in blocking this spam

2006-04-18 Thread Matt Kettler
Shantanu wrote: > Hello > I need to block this spam. > http://pastebin.com/666733 > I am getting 100s of those daily for different > accounts. *sigh*.. Looks like I'm going to have to come out of "retirement" and make a post SA 3.0 fix for the antidrug rules. (Note: do not download antidrug.cf un

RE: Bayesian learning and corrective training

2006-04-18 Thread Herb Martin
> > Can anyone confirm that this will always be the case when dragging > multiple > > messages into a new one? And will this be so in both > outlook and outlook > > express? > > I can't confirm that it WILL always be true, but I believe > that it mostly > *should* always be true. I've known Out

help required in blocking this spam

2006-04-18 Thread Shantanu
Hello I need to block this spam. http://pastebin.com/666733 I am getting 100s of those daily for different accounts. Thanks in advance. Shantanu __ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

Re: Bayesian learning and corrective training

2006-04-18 Thread Loren Wilton
> Can anyone confirm that this will always be the case when dragging multiple > messages into a new one? And will this be so in both outlook and outlook > express? I can't confirm that it WILL always be true, but I believe that it mostly *should* always be true. I've known Outlook to send attache

Bayesian learning and corrective training

2006-04-18 Thread Pieter Vanmeerbeek
Hi, I've got a question on Bayesian learning using the script explained here: http://www.jousset.org/pub/sa-postfix.en.html The plan is to let users drag multiple spam messages in a new message and sent this to a dedicated e-mail address. On the website mentioned earlier it is said that you need