Re: URI Basics

2006-04-25 Thread Ramprasad
> There is definitely a VERY significant performance penalty to using > rawbody over URI, for any rule. > > Consider the size of input. A rawbody regex must be run against the > entire text of the body after QP decoding. A uri regex must be run > against all the text of the URIs that SA found. Th

Re: Messages Not detected as Spam

2006-04-25 Thread Vincent Li
On 24-Apr-06, at 9:25 PM, Paul Wetter wrote: Here is what I get when I reproduce the email: X-Spam-Status: No, hits=0.002 tagged_above=-1 required=1.5 tests=[BAYES_50=0.001, HTML_MESSAGE=0.001] spamassassin -t gives me this: Content analysis details: (9.1 points, 2.5 required) pts rule name

Re: having trouble with SA

2006-04-25 Thread Matt Kettler
Bill Landry wrote: > > So, Matt, are you doing something like: > >bayes_ignore_from [EMAIL PROTECTED] I can check the exact syntax, but yes. > > How does this compare to: > >bayes_ignore_to users@spamassassin.apache.org > > Is one way preferable to the other? The bayes_ignore_to will fail f

RE: more questions on training spamassassin

2006-04-25 Thread Webmaster
> -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: April 25, 2006 11:30 AM > To: [EMAIL PROTECTED] > Cc: users@spamassassin.apache.org > Subject: Re: more questions on training spamassassin > > Webmaster wrote: > > In my setup, the server running spamassassin i

RE: more questions on training spamassassin

2006-04-25 Thread Webmaster
> -Original Message- > From: Theo Van Dinter [mailto:[EMAIL PROTECTED] > Sent: April 25, 2006 10:36 AM > To: Spamassassin Users List > Subject: Re: more questions on training spamassassin > > On Tue, Apr 25, 2006 at 10:30:47AM -0700, Webmaster wrote: > > In my setup, the server running

Re: having trouble with SA

2006-04-25 Thread Bill Landry
- Original Message - From: "Matt Kettler" <[EMAIL PROTECTED]> No.. the only thing I generally whitelist is spam discussion lists like this one (and I do bayes_ignore_from for them as well). It would be better to bypass SA entirely, but I don't have that option in my setup. Matt, just

Re: having trouble with SA

2006-04-25 Thread Matt Kettler
Bill Landry wrote: > - Original Message - From: "Matt Kettler" <[EMAIL PROTECTED]> > >>> Final question for the moment... our old local.cf file had a lengthy >>> whitelist included. Is there any reason necessarily to have a >>> whitelist? >> >> No.. the only thing I generally whitelist i

Re: having trouble with SA

2006-04-25 Thread Bill Landry
- Original Message - From: "Matt Kettler" <[EMAIL PROTECTED]> Final question for the moment... our old local.cf file had a lengthy whitelist included. Is there any reason necessarily to have a whitelist? No.. the only thing I generally whitelist is spam discussion lists like this o

Re: Bayeys: auto-learn vs. manual training

2006-04-25 Thread Michael Monnerie
On Sonntag, 23. April 2006 04:02 Gaute Lund wrote: > So, I was hoping to get a different opinion here. I use bayes per server, not per user or domain. I've set autolearn, with everything 8+ points as spam, below +1 as ham. bayes_auto_learn_threshold_spam 8.00 bayes_auto_learn_threshold_nonspa

Re: having trouble with SA

2006-04-25 Thread Matt Kettler
Jeff Portwine wrote: > Is there any good method > for users to submit email as spam when spam gets through to help SA > learn it as spam? Yes, that can be a tough one. If you have a standardized mail client, you might look and see if it has a reasonable "redirect" or "bounce" feature that preser

Re: having trouble with SA

2006-04-25 Thread Jeff Portwine
- Original Message - From: "Matt Kettler" <[EMAIL PROTECTED]> To: "Jeff Portwine" <[EMAIL PROTECTED]> Cc: Sent: Tuesday, April 25, 2006 3:38 PM Subject: Re: having trouble with SA Jeff Portwine wrote: The spam levels are getting high again, users are complaining, and so today I di

Re: having trouble with SA

2006-04-25 Thread Stuart Johnston
Matt Kettler wrote: Jeff Portwine wrote: The spam levels are getting high again, users are complaining, and so today I did an apt-get spamassassin to upgrade to version 3.1.0. I then used the configuration tool at http://www.yrex.com/spam/spamconfig.php to create a new local.cf and replace

Re: having trouble with SA

2006-04-25 Thread Matt Kettler
Jeff Portwine wrote: > The spam levels are getting high again, users are complaining, and so > today I did an apt-get spamassassin to upgrade to version 3.1.0. I > then used the configuration tool at > http://www.yrex.com/spam/spamconfig.php to create a new local.cf and > replaced the old one

having trouble with SA

2006-04-25 Thread Jeff Portwine
I am running exim 3.35 in debian.We were using spamassassin 3.0, but we have been having a lot of trouble with spam getting through.Some gets caught but a lot doesn't and over time it gets worse and worse. The person who originally set up our mailserver and spamassassin left the com

Re: Messages Not detected as Spam

2006-04-25 Thread Matt Kettler
Paul Wetter wrote: >> >> >> > To answer your questions: > 1. I ran spamassassin -t as root. > amavis runs as a different user. > I do have bayes_path in the local.cf file. The line should read as > follows correct? > bayes_path /firstpartofpath/.spamassassin/bayes Yes. If /firstpartofpath/ doesn

Re: Messages Not detected as Spam

2006-04-25 Thread Paul Wetter
> Paul Wetter wrote: >> Here is what I get when I reproduce the email: >> X-Spam-Status: No, hits=0.002 tagged_above=-1 required=1.5 >> tests=[BAYES_50=0.001, HTML_MESSAGE=0.001] >> >> >> spamassassin -t gives me this: >> >> Content analysis details: (9.1 points, 2.5 required) >> >> pts rule name

Re: more questions on training spamassassin

2006-04-25 Thread Matt Kettler
Webmaster wrote: > In my setup, the server running spamassassin is different than the server > delivering the final e-mail. This means a few extra headers will be added > by the time the clients see the e-mail. If I were to take this e-mail and > train spamassassin, it is no longer in the form th

Re: more questions on training spamassassin

2006-04-25 Thread Theo Van Dinter
On Tue, Apr 25, 2006 at 10:30:47AM -0700, Webmaster wrote: > In my setup, the server running spamassassin is different than the server > delivering the final e-mail. This means a few extra headers will be added > by the time the clients see the e-mail. > So my question is, is it even worthwhile to

more questions on training spamassassin

2006-04-25 Thread Webmaster
In my setup, the server running spamassassin is different than the server delivering the final e-mail. This means a few extra headers will be added by the time the clients see the e-mail. If I were to take this e-mail and train spamassassin, it is no longer in the form that spamassassin sees orig

Re: Cleaning up spamd's syslog output

2006-04-25 Thread Matt Kettler
Bowie Bailey wrote: > Matt Kettler wrote: >> The "processing message" bit concerns me, because that message was >> only in the code for SA 2.40-2.44. > > I can verify that it still shows up in the current SA 3.1.1 code. > Interesting.. I see they changed how the message is built.. In 2.4x it had

Re: Cleaning up spamd's syslog output

2006-04-25 Thread Igor Chudov
On Tue, Apr 25, 2006 at 10:59:07AM -0400, Matt Kettler wrote: > Igor Chudov wrote: > > Spamd outputs the following into syslog: > > > > Apr 25 09:42:30 ak74 spamd[1703]: spamd: connection from > > localhost.localdomain [127.0.0.1] at port 60902 > > Apr 25 09:42:30 ak74 spamd[1703]: spamd: process

Re: Cleaning up spamd's syslog output

2006-04-25 Thread Theo Van Dinter
On Tue, Apr 25, 2006 at 09:44:51AM -0500, Igor Chudov wrote: > I know that the flag is -D and that I have to pick the "channels" that > I am interested in, but the spamd man page does not explain which > ones stand for what. Anyone knows? Thanks!!! -D will add debug output, but has nothing to do w

RE: Cleaning up spamd's syslog output

2006-04-25 Thread Bowie Bailey
Matt Kettler wrote: > Igor Chudov wrote: > > Spamd outputs the following into syslog: > > > > Apr 25 09:42:30 ak74 spamd[1703]: spamd: connection from > > localhost.localdomain [127.0.0.1] at port 60902 > > Apr 25 09:42:30 ak74 spamd[1703]: spamd: processing message > > <[EMAIL PROTECTED]> for ro

Re: Cleaning up spamd's syslog output

2006-04-25 Thread Matt Kettler
Igor Chudov wrote: > Spamd outputs the following into syslog: > > Apr 25 09:42:30 ak74 spamd[1703]: spamd: connection from > localhost.localdomain [127.0.0.1] at port 60902 > Apr 25 09:42:30 ak74 spamd[1703]: spamd: processing message <[EMAIL > PROTECTED]> for root:500 > Apr 25 09:42:30 ak74 spa

Cleaning up spamd's syslog output

2006-04-25 Thread Igor Chudov
Spamd outputs the following into syslog: Apr 25 09:42:30 ak74 spamd[1703]: spamd: connection from localhost.localdomain [127.0.0.1] at port 60902 Apr 25 09:42:30 ak74 spamd[1703]: spamd: processing message <[EMAIL PROTECTED]> for root:500 Apr 25 09:42:30 ak74 spamd[1703]: spamd: clean message (-

Re: Messages Not detected as Spam

2006-04-25 Thread Matt Kettler
Paul Wetter wrote: > Here is what I get when I reproduce the email: > X-Spam-Status: No, hits=0.002 tagged_above=-1 required=1.5 > tests=[BAYES_50=0.001, HTML_MESSAGE=0.001] > > > spamassassin -t gives me this: > > Content analysis details: (9.1 points, 2.5 required) > > pts rule name

Re: Advanced regex question - backtracking vs. negative lookaheads

2006-04-25 Thread John Rudd
On Apr 25, 2006, at 6:33 AM, Jeremy Fairbrass wrote: /style="[^>]+color:blue/ Just a small note, which may be mostly a digression but: I don't think the above regex will match that string at all. The regex, because it has a + instead of a *, requires at least one character b

Postfix LDAP and eDirectory

2006-04-25 Thread Spam Admin
Does anyone here have experience with using Postfix for LDAP lookups to eDirectory (GroupWise system)? Primarily I'm looking for attribute mapping info. Our directory does not have a "mailacceptinggeneralid" attribute, but I do have a "nGWObjectID" that correlates to the GroupWise user ID. I'm g

Re: Advanced regex question - backtracking vs. negative lookaheads

2006-04-25 Thread Jeremy Fairbrass
Thanks guys for the clarifications! My understanding of how regex worked was the same as Bowie's, ie: - > My understanding is that with [^"]+ the engine will scan from left to > right until it finds a quote. Then, in the context of the previous > regex, it will start backtracking to find a mat

Re: Permission errors

2006-04-25 Thread Jim Maul
Igor Chudov wrote: Doing some housecleaning... I am running spamd as root, at which point it reverts to 'nobody'. It then proceeds to complain, understandably, that it does not have permission to write to users' directories. Apr 24 23:56:57 manifold spamd[21442]: spamd: still running as roo

Re: How to update filters

2006-04-25 Thread Matt Kettler
Peter Marshall wrote: > Hi, > > I have not updated my filters in a bit, and I getting a load of spam > through all of the sudden. > Can someone tell me how I can update my filters ?? Step 1.. tell us what you have.. what SA version, are you using any SARE rules, etc.

How to update filters

2006-04-25 Thread Peter Marshall
Hi, I have not updated my filters in a bit, and I getting a load of spam through all of the sudden. Can someone tell me how I can update my filters ?? Thanks Peter