Trevor Dodds wrote:
> Hi,
>
> I've attached a few spam emails which I receive. I'm using latest
> sa-update channel rules, SARE, DCC, RAZOR2, Pyzor, Bayes, Fred's
> collection. Yet these SPAM emails always seem to get past. I use
> sa-learn on these emails everyday yet Bayes still allocated 0
On Tue, Jan 23, 2007 at 07:40:34AM +0200, Trevor Dodds wrote:
> Can someone run these emails through your filter and let me know the
> score.
Sure. The three mails were destroyed.
Just scoreset 2 (ie: no network tests):
[23912] dbg: check: is spam? score=18.42 required=5
[23912] dbg: check:
te
Rolf wrote:
Hello
Using sa-update successfully. I'd like however to be able to exclude
some of the rules it retrieves. Is there a configurable way to do
this? I suppose after it runs I could manually remove the fie of the
ruleset in question, but if the programme takes an option somehow, th
I then spend the better part of the day looking for a nice graphing
utility that works. I'd like it to show total messages, spam/blocked
messages, and virus emails in a clean graph.
Does anyone know of any or have recommendations?
Possibly mailgraph
http://people.ee.ethz.ch/~dws/software/
Nathan Zabaldo wrote:
I am getting pounded by "increase your size", "your sausage is small" for
your darling emails. The subject is always different and the body, but the
common words. Is there a ruleset out there? I am running sa 3.1.7 with
all
the latest sa-updates, but these just come rig
> -Original Message-
> From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
> Sent: Monday, January 22, 2007 10:02 PM
> To: Michael Scheidell
> Cc: users@spamassassin.apache.org
> Subject: Re: scan internal email? SA and exchange server?
>
>
> Since you were talking about your server, I'm no
On Mon, Jan 22, 2007 at 09:01:28PM -0500, Michael Scheidell wrote:
> Imagine all the trouble I have been going through just trying to block
> incoming spam when all I needed to do was get some laws passed, or get
> ISP's to enforce their AUP.
Since you were talking about your server, I'm not sure
I am getting pounded by "increase your size", "your sausage is small" for
your darling emails. The subject is always different and the body, but the
common words. Is there a ruleset out there? I am running sa 3.1.7 with all
the latest sa-updates, but these just come right on through.
Johnson, S wrote:
Howdy,
I've been using amavis-stats for around a couple of years and recently
went on a rampage to stop spam. I was concerned that the graph was
showing that I was catching about 30% spam on average which I thought
was rather low. Over the weekend I spent a lot of time
Howdy,
I've been using amavis-stats for around a couple of years and recently
went on a rampage to stop spam. I was concerned that the graph was
showing that I was catching about 30% spam on average which I thought
was rather low. Over the weekend I spent a lot of time tuning rules and
addi
Well its back. I thought my bayes files had finally caught up to it, or
maybe one of the sa-update downloads did the trick, but now it returns like bad
meatloaf.
It astounds me how this slips under the Bayes radar.
> -Original Message-
> From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
> Sent: Monday, January 22, 2007 12:03 AM
> To: users@spamassassin.apache.org
> Subject: Re: scan internal email? SA and exchange server?
>
>
> My question is: why would you want to scan internal-only
> email? Are
On Mon, Jan 22, 2007 at 06:11:20AM -0500, Tom Allison wrote:
> So far, much of the website seems geared towards the end-use of
> spamassassin.
> Besides cpan is there someplace that can help me navigate through
> Mail::SpamAssassin? I'm kind of awash and could use a small bucket.
Not sure about
On Tue, Jan 23, 2007 at 01:16:33AM +0100, Florent Gilain wrote:
> SpamAssassin seems to work; but few tools not (sa-update for example).
>
> [EMAIL PROTECTED] spamassassin]# sa-update
>
> Can't locate Archive/Tar.pm in @INC (@INC contains:
You need to install the modules listed in the INSTALL do
Hello all,
I have a Plesk Server running RHEL3 ES with SA 3.0.4.
This evening, I have upgraded to SA 3.1.7 using rpm found on
http://dag.wieers.com/packages/nagios/
Here are commands I had to run :
1) Removing old packages
[EMAIL PROTECTED] spamassassin]# rpm -e
psa-spamassassin-8.
On Tue, Jan 23, 2007 at 10:53:23AM +1100, Rolf wrote:
> Using sa-update successfully. I'd like however to be able to exclude
> some of the rules it retrieves. Is there a configurable way to do
> this?
There's no way to do this from the receiver side. You can ask the
people publishing the cha
On Tue, Jan 23, 2007 at 10:53:23AM +1100, Rolf wrote:
> Hello
>
> Using sa-update successfully. I'd like however to be able to exclude
> some of the rules it retrieves. Is there a configurable way to do
> this? I suppose after it runs I could manually remove the fie of the
> ruleset in que
Hello
Using sa-update successfully. I'd like however to be able to exclude
some of the rules it retrieves. Is there a configurable way to do
this? I suppose after it runs I could manually remove the fie of the
ruleset in question, but if the programme takes an option somehow,
that would
Robert Fitzpatrick wrote:
I get the following lint errors:
esmtp# spamassassin --lint
Subroutine FuzzyOcr::O_NONBLOCK redefined at
/usr/local/lib/perl5/5.8.6/Exporter.pm line 65.
at /usr/local/lib/perl5/5.8.6/mach/POSIX.pm line 19
[98248] warn: FuzzyOcr: Cannot find executable for pamthreshold
On Mon, 2007-01-22 at 17:31 -0500, Robert Fitzpatrick wrote:
> I get the following lint errors:
>
> esmtp# spamassassin --lint
> Subroutine FuzzyOcr::O_NONBLOCK redefined at
> /usr/local/lib/perl5/5.8.6/Exporter.pm line 65.
> at /usr/local/lib/perl5/5.8.6/mach/POSIX.pm line 19
> [98248] warn: Fu
I only found one reference to this error searching the net
Use of uninitialized value in string eq at /etc/mail/spamassassin/Botnet.pm
line 564, line 7
This appears to be the line of code in Botnet.pm although I could be wrong
Mail::SpamAssassin::Plugin::dbg("Botnet: miss (" . $tests . "
I get the following lint errors:
esmtp# spamassassin --lint
Subroutine FuzzyOcr::O_NONBLOCK redefined at
/usr/local/lib/perl5/5.8.6/Exporter.pm line 65.
at /usr/local/lib/perl5/5.8.6/mach/POSIX.pm line 19
[98248] warn: FuzzyOcr: Cannot find executable for pamthreshold
[98248] warn: FuzzyOcr: Can
Sherman Lilly wrote:
[snip]
> I was looking on the net and I came across a plugin on spamassassin I don't
> think i have loaded. Will the SPF plugin help with this problem?
No, I think the default score is 0.0, and it's only for positive id (thus I add
points, not subtract).
Botnet plugin probab
It looks like 7.0 is enough to get them tagged as spam. If you want
to get them higher (e.g., so that Amavis or something will discard
them), crank up the scores on RAZOR2_CHECK and URIBL_*. I've found
both to be very reliable with exceedingly few FPs.
Chris St. Pierre
Unix Systems Administrato
Any rules to get those (I call them) bad spelling spams to score higher?
An example of one is at http://www.espphotography.com/spellingspam.txt .
Basically, you have to read every other letter in the subject for it
to make sense, ie
TELENS Tfeen Gdives
They score a 7.0 on my system:
Co
On Monday 22 January 2007 12:51, Jonas Eckerman wrote:
> > that is getting through. It should have failed.
>
> Why should it have failed?
>
> > WHITELIST_FROM [EMAIL PROTECTED]
>
> [...]
>
> > Return-Path: <[EMAIL PROTECTED]>
>
> * You have whitelisted all mail from "[EMAIL PROTECTED]".
> * The mai
On Mon, Jan 22, 2007 at 02:42:24PM -0500, Robert Fitzpatrick wrote:
> I use SA 3.1.7 using rules du jour with the recipes below and FuzzyOcr
> 3.5.1, but still some consistent spam getting through. I also use razor2
> and bayes learning with these score increases:
You should use sa-update.
--
Ra
I use SA 3.1.7 using rules du jour with the recipes below and FuzzyOcr
3.5.1, but still some consistent spam getting through. I also use razor2
and bayes learning with these score increases:
## Optional Score Increases
score RAZOR2_CHECK 2.500
score BAYES_99 4.300
score BAYES_80 3.000
The two mai
On Mon, Jan 22, 2007 at 09:32:26AM -0800, R Lists06 wrote:
> We have 3.17 and we do not use DCC right now
Ok.
> Also, I know what stderr is, yet stderr method?
> Jan 22 09:41:25 srv spamd[4100]: logger: removing stderr method
Logger will stop sending messages to stderr, such as debug, informatio
> that is getting through. It should have failed.
Why should it have failed?
> WHITELIST_FROM [EMAIL PROTECTED]
[...]
> Return-Path: <[EMAIL PROTECTED]>
* You have whitelisted all mail from "[EMAIL PROTECTED]".
* The mail is from "[EMAIL PROTECTED]" according to the SMTP envelope.
= You have whi
Drew Burchett wrote:
Do you have some example headers?
This is a legitimate email, but it got flagged as USER_IN_WHITELIST
while CNN is not listed in my whitelist:
You didn't include the envelope from address in any of your examples.
Daryl
>From maillog
I am not so concerned about 1 and 3 yet 2 looks interesting
How should these be dealt with.
We have 3.17 and we do not use DCC right now
Also, I know what stderr is, yet stderr method?
Jan 22 09:41:25 srv spamd[4100]: logger: removing stderr method
Jan 22 09:41:27 srv spamd[4102]
>Do you have some example headers?
This is a legitimate email, but it got flagged as USER_IN_WHITELIST
while CNN is not listed in my whitelist:
Received: from cnnimail33.turner.com (cnnimail33.turner.com
[64.236.25.90])
by spamfilter.onlineky.net (Postfix) with ESMTP id 2FB331757E
On Mon, Jan 22, 2007 at 01:29:22PM +0100, J. W. Andersen wrote:
> which did not hit the spam score. In either case the header is somewhat
> modified by amavis,
> but they still look OK to me, as far as I understand RFC2822.
As long as it's still in the proper rfc-related format it's fine.
> Is t
On Mon, Jan 22, 2007 at 08:34:40AM -0800, RobertH wrote:
> In reading the docs on autowhitelist it told me about v310.pre and this
> setting
>
> loadplugin Mail::SpamAssassin::Plugin::AWL
>
> do I need to comment out this below in the v310.pre or leave it alone and
> add the below setting
>
> us
On Monday 22 January 2007 11:39, you wrote:
> Sherman Lilly wrote:
> > I have spam getting through that would get filtered if they were not
> > getting -100 because of the USER_IN_WHITELIST rule. I do have a whitelist
> > but no of these spam email have anything close to my whitelist.
>
> Yes they
Drew Burchett wrote:
Well, I certainly don't mean to be argumentative about this, but over
the weekend, I had to set USER_IN_WHITELIST score to 0 due to the number
of false hits it was receiving. Seeing as I am the only one here who
has the ability to add and remove from whitelists or blacklists
Well, I certainly don't mean to be argumentative about this, but over
the weekend, I had to set USER_IN_WHITELIST score to 0 due to the number
of false hits it was receiving. Seeing as I am the only one here who
has the ability to add and remove from whitelists or blacklists, I have
a pretty good
Sherman Lilly wrote:
I have spam getting through that would get filtered if they were not
getting -100 because of the USER_IN_WHITELIST rule. I do have a whitelist but
no of these spam email have anything close to my whitelist.
Yes they do, otherwise you wouldn't see USER_IN_WHITELIST hitting.
We are using 3.17 on this particular server
In reading the docs on autowhitelist it told me about v310.pre and this
setting
# AWL - do auto-whitelist checks
#
loadplugin Mail::SpamAssassin::Plugin::AWL
do I need to comment out this below in the v310.pre or leave it alone and
add the below settin
We are using 3.17 on this particular server
In reading the docs on autowhitelist it told me about v310.pre and this
setting
# AWL - do auto-whitelist checks
#
loadplugin Mail::SpamAssassin::Plugin::AWL
do I need to comment out this below in the v310.pre or leave it alone and
add the below settin
Sherman Lilly wrote:
I have spam getting through that would get filtered if they were not
getting -100 because of the USER_IN_WHITELIST rule. I do have a whitelist but
no of these spam email have anything close to my whitelist.
I am using the latest version of spamassassin and update my rules
R Lists06 wrote:
>
> It resolves, just remember to do this to test
>
> dig pbl.spamhaus.org any
>
> Or
>
> dig pbl.spamhaus.org ns
>
> - rh
>
> --
> Robert - Abba Communications
>Computer & Internet Services
> (509) 624-7159 - www.abbacomm.net
>
>
Yes, stupid me didn't read the FAQ
> From: Dave Koontz [mailto:[EMAIL PROTECTED]
> Not neccessarily. Put your awl on a sql database and add a timestamp
> column
> to the awl table, which gets automagically a new timestamp by the dbms
> each
> time a record is updated. The "timestamp" column type in Mysql is such
a
> type.
>
> show
Hmm that looks very wrong..
Should be /var/lib if not blank nowaways..
I wonder if you're confusing the User State dir with the spamassassin
cache dir in MailScanner..
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
> -Original Message-
> From: The
On Mon, Jan 22, 2007 at 01:50:02AM -0800, nigel wrote:
> is this the line in MailScanner.conf that changes the location of the DB?
> SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin
It looks possible. I have no idea about MailScanner.
--
Randomly Selected Tagline:
"The best thi
See the thread SA/Perl question that I asked on Saturday. It should be
in the archives. I did just what you are trying to do now (though I was
trying to do something different).
> -Original Message-
> From: Tom Allison [mailto:[EMAIL PROTECTED]
> Sent: Monday, January 22, 2007 3:11 AM
>
> Maybe interesting for those that use dynablock.njabl.org (as I do at the
> MTA-level).
> Got an email last friday from njabl about dynablock.njabl.org, it's no
> longer maintained by njabl but is now only a copy of the pbl.spamhaus.org
> list. Eventually the dynablock.njabl.org zone will be em
Maybe interesting for those that use dynablock.njabl.org (as I do at the
MTA-level).
Got an email last friday from njabl about dynablock.njabl.org, it's no
longer maintained by njabl but is now only a copy of the pbl.spamhaus.org
list. Eventually the dynablock.njabl.org zone will be emptied.
By t
This version is now on Debian Sid.
Do I go over to the newer function calls for FuzzyOcr or is they still not
available (or does this matter)?
>>> Do spammers try to guess mx servers which look similar to the one (or two
>>> or... :-) published in the DNS?
They don't guess. They intentionally hit your secondary and tertiary, in the
expectation that it has a lesser level of spam protection.
Confidentiality Notice
This e-mail message,
I have spam getting through that would get filtered if they were not
getting -100 because of the USER_IN_WHITELIST rule. I do have a whitelist but
no of these spam email have anything close to my whitelist.
I am using the latest version of spamassassin and update my rules daily. I
have also add
Florent Gilain wrote:
> Hello all,
>
> I'm new to SpamAssassin; I'm using : RHEL3 ES with SA 3.0.4 (it comes from a
> SW-Soft Plesk 8.1.0 installation, www.sw-soft.com) and qmail.
>
>
> I have 2 questions :
>
> 1) When i received a spam, its subject is tagged with [SPAM] and the
> original mail con
Andy Figueroa wrote:
> What is the evolving conventional wisdom regarding using AWL?
I have no idea, but I do know what *my* "wisdom" regarding the AWL is.
We don't use the AWL because it gave us problems. I have no idea wether others
have had the same problems.
1: Some ham was given very high
Theo, thanks a lot for explaining this to me. I have tried the mentioned
test with the spamassassin script,
but I am still unable to make the header tests work.
One problem is, that I do not know how to capture the message file in
the moment when SA gets it
I have tested with 2 different messag
Hello all,
I'm new to SpamAssassin; I'm using : RHEL3 ES with SA 3.0.4 (it comes from a
SW-Soft Plesk 8.1.0 installation, www.sw-soft.com) and qmail.
I have 2 questions :
1) When i received a spam, its subject is tagged with [SPAM] and the
original mail content is included in an attachment (i a
Hello, please help to understand why sometimes message body consist of body+few
string from header like:
HEADER
.
.
Content-type
I'm actually trying to write a perl script to use Mail::SpamAssassin rather than
the spamassassin or spamc scripts that are already available.
So far, much of the website seems geared towards the end-use of spamassassin.
Besides cpan is there someplace that can help me navigate through
Mail::Sp
is this the line in MailScanner.conf that changes the location of the DB?
SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin
its the only thing in that file that seems to point to that location where i
have all those token files (unless i missed it )
Nigel
Theo Van Dinter-2 wro
Hello, please help to understand why sometimes message body consist of body+few
string from header like:
HEADER
.
.
Content-type:
Hi,
I have two mailservers, mail.domain.tld and mail-1.domain.tld. The host
different domains and don't relay to each other like a backup-scenario.
But somehow I receive mails for domains at mail-1.domain.tld which
belong to mail.domain.tld even though the mx record says
mail.domain.tld.
Do spam
61 matches
Mail list logo
