what are the rules directories

I have been using SA for more than 3 years now and I have a dumb question I am using SA 3.1.5 on Centos AFAIK By default Spamassassin reads from /usr/share/spamassassin and /etc/mail/spamassassin But If I have /var/lib/spamassassin with some files in it SA is apparently ignoring /usr/share/s

Re: Perl Help With FuzzyOCR Needed

Rich Shepard wrote: > I'm trying to set up FuzzyOCR as a plug-in to SpamAssassin. Wrote to the > author several days ago but have not received a response. There's a user list, subscribers only: http://lists.own-hero.net/mailman/listinfo/devel-spam > The errors I'm > seeing appear to b

RE: Perl Help With FuzzyOCR Needed

I'm trying to set up FuzzyOCR as a plug-in to SpamAssassin. Wrote to the author several days ago but have not received a response. The errors I'm seeing appear to be perl issues or OS issues, not specifically related to the application. Here is the error message I see: plugin: failed to pars

Perl Help With FuzzyOCR Needed

I'm trying to set up FuzzyOCR as a plug-in to SpamAssassin. Wrote to the author several days ago but have not received a response. The errors I'm seeing appear to be perl issues or OS issues, not specifically related to the application. Here is the error message I see: plugin: failed to pars

Re: whitelist_from_rcvd

Matt Kettler wrote: Robert Fitzpatrick wrote: I have the following in my local.cf file, but some messages get blocked still, see my log entries below. I use amavisd-new and it seems those in the log that show localhost as the client pass through and those directly from the blackberry get bloc

Re: sa-learn --sync importance ???

R Lists06 wrote: > Can anyone comment on the true importance of this command and option below? > > sa-learn --sync > Only when upgrading is this option *truly* important. > my simple research is telling me that if you don't do this at some regular > interval, that your training isn't fully put i

Re: sa-learn --sync importance ???

On Tue, Jan 23, 2007 at 05:16:00PM -0800, R Lists06 wrote: > sa-learn --sync Puts the journal information into the DB. > my simple research is telling me that if you don't do this at some regular > interval, that your training isn't fully put into action when journaling > starts. I didn't quite

sa-learn --sync importance ???

Can anyone comment on the true importance of this command and option below? sa-learn --sync my simple research is telling me that if you don't do this at some regular interval, that your training isn't fully put into action when journaling starts. I haven't found much mention of it on the www y

Re: Spamassassin Integrating first step problems

Tom wrote: Hi there followed the steps layed out on the wiki.apache.org/spamassassin/IntegratingSA First Step page followed the link http://onetforum.com/fourm/viewtopic.php?p=27 Now when I check my email the new messages are now in the postfix mail que When I check the /var/log/maillog I

Re: whitelist_from_rcvd

Robert Fitzpatrick wrote: > I have the following in my local.cf file, but some messages get blocked > still, see my log entries below. I use amavisd-new and it seems those in > the log that show localhost as the client pass through and those > directly from the blackberry get blocked. Not sure why

spamdoptions ???

Apologies for not finding it in my searching yet... I think it is my "sometimers" kickin' in... ;-> I am looking for info on the granularity knob control for number of extra spamd daemons on startup. ...AND if one has enough processors and ram memory, how to know how many "extra" to have avai

whitelist_from_rcvd

I have the following in my local.cf file, but some messages get blocked still, see my log entries below. I use amavisd-new and it seems those in the log that show localhost as the client pass through and those directly from the blackberry get blocked. Not sure why all would not be coming from the a

Spamassassin Integrating first step problems

Hi there followed the steps layed out on the wiki.apache.org/spamassassin/IntegratingSA First Step page followed the link http://onetforum.com/fourm/viewtopic.php?p=27 Now when I check my email the new messages are now in the postfix mail que When I check the /var/log/maillog I find the erro

Re: Pipe errors attempting to run SA

On Tue, Jan 23, 2007 at 02:10:22PM -0800, Tom wrote: > Now when I check my email the new messages are now in the postfix mail que > When I check the /var/log/maillog I find the error listed below: > Eserver pipe[3691]: fatal: pipe_command: execvp > /usr/local/bin/spamfilter: Permission denied Si

Re: FuzzyOcr Hash Error - Fixed

At 12:54 PM Tuesday, 1/23/2007, René Berber wrote -=> Ed Kasky wrote: > At 10:23 AM Tuesday, 1/23/2007, René Berber wrote -=> >> Ed Kasky wrote: >> >> > With FuzzyOcr 3.5.1 and SA 3.1.7, I noticed this in the log while >> > debugging my setup: >> > >> > 2007-01-23 01:39:23 [16842] Processing Mes

Pipe errors attempting to run SA

Hi there followed the steps layed out Postfix First Step - Basic Integrating - at http://onetforum.com/fourm/viewtopic.php?p=27 from the http://wiki.apache.org/spamassassin/IntegratingSA Now when I check my email the new messages are now in the postfix mail que When I

Re: INVALID_TZ_EST flagged in all emails

Brian C. Huffman wrote: Looking through /usr/sbin/amavisd, it appears that it *does not* add the Received header if it is called via a milter (which it is). So, this wouldn't seem to be the issue. New versions do. The old versions that don't are broken and have greater issues (most DNSBL

Re: Some tests not being run during relay

On Tue, 23 Jan 2007, David Reta wrote: hI, > I am looking for some help with an issue I am having. Some spam has been > getting through and it looks like when it comes through a bunch of rules > are not getting hit, but when I run it manually as the same user that my > mimedefang runs as it score

RE: INVALID_TZ_EST flagged in all emails

- Original Message - From: Daryl C. W. O'Shea <[EMAIL PROTECTED]> Sent: Tue, 1/23/2007 4:11pm To: Brian C. Huffman <[EMAIL PROTECTED]> Cc: users@spamassassin.apache.org Subject: Re: INVALID_TZ_EST flagged in all emails > > It sounds like it may be an issue with the received header that amav

Re: INVALID_TZ_EST flagged in all emails

Brian C. Huffman wrote: All, I've searched but can not find the answer to this. I'm running RedHat Enterprise Linux v4 with all latest updates and am using the amavisd-milter to call amavisd-new (v2.4.4) which in turn is using spamd (spamassassin v3.1.7). It appears that every single email

RE: Re[2]: market buy with image

> > My rules are very aggressive, but they can and possibly will cause > FP's!! As soon as 3.2 is released, those rules of mine that survive > the rescoring and mass-check runs will be included in the stock rules! > > Frederic Tarasevicius Good lookin' out Frederic Will you please keep us po

Re: FuzzyOcr Hash Error

Ed Kasky wrote: > At 10:23 AM Tuesday, 1/23/2007, René Berber wrote -=> >> Ed Kasky wrote: >> >> > With FuzzyOcr 3.5.1 and SA 3.1.7, I noticed this in the log while >> > debugging my setup: >> > >> > 2007-01-23 01:39:23 [16842] Processing Message with ID >> > "<[EMAIL PROTECTED]>" ("Lacy Silva" >>

amavistat-new

Is anyone using amavistat-new (not amavis-stats) to graph spam/virus statistics? I'm looking for a graphing utility that counts RBL rejected messages as part of the spam rejected messages. Does this package do that?

Re: Looking to get a rule checked against the SVN corpus

On Tue, Jan 23, 2007 at 01:54:27PM -0500, Michael Cocke wrote: > Can someone point me to a sa developer? We've been doing some hacking For things like rule suggestions, we generally like people to goto http://issues.apache.org/SpamAssassin/ and open a ticket about it. That way there's tracking a

Looking to get a rule checked against the SVN corpus

Can someone point me to a sa developer? We've been doing some hacking on SA at work (guardiandigital.com) and have a rule that we'd like to get run against the corpus. It's not worth getting all set up as real submitters, so maybe someone could just toss it in with their next run..? The susp

Re: FuzzyOcr Hash Error

At 10:23 AM Tuesday, 1/23/2007, René Berber wrote -=> Ed Kasky wrote: > With FuzzyOcr 3.5.1 and SA 3.1.7, I noticed this in the log while > debugging my setup: > > 2007-01-23 01:39:23 [16842] Processing Message with ID > "<[EMAIL PROTECTED]>" ("Lacy Silva" > <[EMAIL PROTECTED]> -> "ed" <[EMAIL P

Re[2]: market buy with image

Hello R, Tuesday, January 23, 2007, 12:53:00 PM, you wrote: > Thanks, if anyone out there running some or a lot of the FRED rules with a > lot of success or should we only run certain ones in general > Bottom line is, I don't know how aggressive or not the rulesets are etc > Please advise and t

Re: Rules_du_jour question...

For the SARE rules you only need to use ONE of sa-update or rules_du_jour. Either works fine. sa-update has the potential to get you newer rules faster without any significant additional load on the servers serving the channels. Assuming you want to use sa-update for everything... - remove

Re: FuzzyOcr Hash Error

Ed Kasky wrote: > With FuzzyOcr 3.5.1 and SA 3.1.7, I noticed this in the log while > debugging my setup: > > 2007-01-23 01:39:23 [16842] Processing Message with ID > "<[EMAIL PROTECTED]>" ("Lacy Silva" > <[EMAIL PROTECTED]> -> "ed" <[EMAIL PROTECTED]>) > 2007-01-23 01:39:23 [16842] GIF: [248x442

Re: Header processsing not working.

On Tue, Jan 23, 2007 at 06:37:46PM +0100, J. W. Andersen wrote: > The only problem remaining now is, that if the same pattern is specified > for a header/subject test and for a body test, I get hits for both > test, even though > the pattern tested for only appears in the subject line and not i

Re: INVALID_TZ_EST flagged in all emails

On Tue, Jan 23, 2007 at 01:04:24PM -0500, Brian C. Huffman wrote: > I'm running RedHat Enterprise Linux v4 with all latest updates and am using > the amavisd-milter to call amavisd-new (v2.4.4) which in turn is using spamd > (spamassassin v3.1.7).  It appears that every single email that's gettin

Re: auto_learn

On Tue, Jan 23, 2007 at 01:06:43PM -0500, [EMAIL PROTECTED] wrote: > I have set bayes_autolearn 1 in my spampd configuration. That enables autolearning, but doesn't guarantee that it'll happen. Enabled (1) is also the default, so there's no real point in specifying it in the config fwiw. > But I

Re: USER_IN_WHITELIST problem

Will Nordmeyer wrote: > > René Berber wrote: >> Sherman Lilly wrote: > [snip] >>> I get why they are getting through. They are spoofing the Return-Path. >>> Is there any way to remedy this problem? >> Depends on your server. For sendmail there is: >> >> http://ultra.ap.krakow.pl/~raj/sendmai

Re: USER_IN_WHITELIST problem

Ok I have an update. I picked a message that was getting marked USER_IN_WHITELIST once every 5 or so messages. I took the from address and added this code to Perl..Mail\SpamAssassin\EvalTests.pm if ($addr =~ qr/$regexp/i) { dbg("rules: address $addr matches whitelist or blacklist rege

auto_learn

I have set bayes_autolearn 1 in my spampd configuration. But I keep getting headers that autolern=no. Is there something else I need to do? bayes_tok and bayes_seen are working and getting updated.

Re: SA --lint help 3.1.7

On Tue, Jan 23, 2007 at 09:51:56AM -0800, Tom wrote: > [11180] warn: config: failed to parse line, skipping: rewrite_subject 1 > [11180] warn: config: failed to parse line, skipping: report_header 1 > [11180] warn: config: failed to parse line, skipping: use_terse_report 1 > [11180] warn: config: f

Some tests not being run during relay

hello, I am looking for some help with an issue I am having. Some spam has been getting through and it looks like when it comes through a bunch of rules are not getting hit, but when I run it manually as the same user that my mimedefang runs as it scores well above the threshold. I am running

INVALID_TZ_EST flagged in all emails

All, I've searched but can not find the answer to this.  I'm running RedHat Enterprise Linux v4 with all latest updates and am using the amavisd-milter to call amavisd-new (v2.4.4) which in turn is using spamd (spamassassin v3.1.7).  It appears that every single email that's getting filtered is

Re: a few string of header in message body

On Mon, Jan 22, 2007 at 12:47:29PM +0300, S R wrote: > Hello, please help to understand why sometimes message body consist of > body+few string from header like: Do you by chance run spamass-milter? This problem usually comes up when third party code doesn't correctly handle line endings. --

Re: market buy with image

R Lists06 wrote: I'd use 00_FVGT_File001.cf which is a new file Fred. This combines a lot of his older 88_FVGT* cf files into one. -- -Doc Thanks, if anyone out there running some or a lot of the FRED rules with a lot of success or should we only run certain ones in general Bottom line

RE: market buy with image

> > I'd use 00_FVGT_File001.cf which is a new file Fred. This combines a > lot of his older 88_FVGT* cf files into one. > > > -- > > -Doc > Thanks, if anyone out there running some or a lot of the FRED rules with a lot of success or should we only run certain ones in general Bottom line i

Re: train forwarded messages on local SA server

R Lists06 wrote: Is it ok to sa-learn train forwarded messages that end up in my local account mailboxes from accounts on remote servers (out of my admin control) that are spam? - rh -- Robert - Abba Communications Computer & Internet Services (509) 624-7159 - www.abbacomm.net I woul

SA --lint help 3.1.7

I have installed Spamassassin 3.1.7 on a Fedora Core 6 box when I run spamassassin --lint I get the following warnings [11180] warn: config: failed to parse line, skipping: rewrite_subject 1 [11180] warn: config: failed to parse line, skipping: report_header 1 [11180] warn: config: failed to pars

Re: Header processsing not working.

Hmm - presently I feel rather stupid... I found a tip about starting SA in debug-mode from amavis: amavisd debug-sa which revealed a few syntax errors in my local.cf, and these caused header checks to break off prematurely. So now all my header checks work fine, and the MISSING_SUBJECT hit vani

RE: Minor FPs on Wii emails (apologies to Dan)

Coffey, Neal wrote: > Dan Barker wrote: >> Do real wii addresses end in 16 Hex digits? > > And yes, as explained in my email, real Wii addresses do end in 16 hex > digits. Just realized that I did *not* actually explain that...I had a first draft where I did, but I must've cut that out. Sorry!

RE: Minor FPs on Wii emails

(Bringing this back to the list...) Dan Barker wrote: > The largest score was FROM_ENDS_IN_NUMS and FROM_LOCAL_HEX, both of > which you made up. Do real wii addresses end in 16 Hex digits? This is my webhost's SA installation, not my own (which is unfortunate, since it means I can't tweak it). T

Rules_du_jour question...

Hi all, I followed the 2 docs here : http://www.rulesemporium.com/rules.htm and http://daryl.dostech.ca/sa-update/sare/sare-sa-update-howto.txt But i'm not sure all is ok because link for "more info" is broken..and i'm really a newbie ;-(( My /etc/mail/spamassassin/sare-sa-update-channels.txt :

Re: USER_IN_WHITELIST problem

Sherman Lilly wrote: I was looking on the net and I came across a plugin on spamassassin I don't think i have loaded. Will the SPF plugin help with this problem? Yes... *if* you replace whitelist_from with whitelist_from_spf Alternatively you can try something like this: whitelist_from_rcvd

Re: market buy with image

R Lists06 wrote: By fred rules, do you mean by Fred Tarasevicius Which specific fred rules are the best by experience? Thanks! I'd use 00_FVGT_File001.cf which is a new file Fred. This combines a lot of his older 88_FVGT* cf files into one. -- -Doc SA/SARE/URIBL/SURBL -- Ninja 11:08

RE: market buy with image

By fred rules, do you mean by Fred Tarasevicius Which specific fred rules are the best by experience? Thanks! - rh -- Robert - Abba Communications Computer & Internet Services (509) 624-7159 - www.abbacomm.net

RE: market buy with image

Hi The sare and fred rules from www.rulesemporium.com are useful here. Also DCC pyzor and razor2 can help. Also make sure you've sa-updated the latest 3.1.7 core rules as these have some tuning to help.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 >

market buy with image

I've got a particular type of spam that is driving me nuts here. It's the same type of message coming from many different servers (I'm not sure how many yet, but the first 8 messages of this type I've looked at are all different). Basically, each message has a random subject followed by a small j

Minor FPs on Wii emails

So I got myself a Nintendo Wii, and decided to check out its email capabilities. It hit a few rules that weren't enough to push it over the default limit, but it was close (my test scored 4.3). I figured I'd share the results with the list to see if this is something worth pursuing in the base ru

Re: spamassassin -D --lint gives me warnings...but what does that mean ?

On Tue, Jan 23, 2007 at 05:00:35PM +0100, Florent Gilain wrote: > If i have good understood all the manual/wiki i actually read, the > "spamassassin -D --lint" command is used to test SA configuration before > reloading it ? --lint is, yes. People often run with -D so they can see the debug outpu

train forwarded messages on local SA server

Is it ok to sa-learn train forwarded messages that end up in my local account mailboxes from accounts on remote servers (out of my admin control) that are spam? - rh -- Robert - Abba Communications Computer & Internet Services (509) 624-7159 - www.abbacomm.net

Re: relay

Terry Soucy wrote: You might want to try asking that question in a mailing list specific for qmail. Check www.qmail.org for access to support and forums. Also check the Life with qmail book, available for download at http://www.lifewithqmail.org, which addresses this question. Terry Terry Sou

spamassassin -D --lint gives me warnings...but what does that mean ?

If i have good understood all the manual/wiki i actually read, the "spamassassin -D --lint" command is used to test SA configuration before reloading it ? My problem is that it seems to give me errors...but i'm unable to resolve it. Yesterday, i upgraded my SA 3.0.4 to 3.1.7 and had to update CPA

Whitelist file to large?

My whitelist file currently has 13,500 lines and is 503K. spamd is about 58-59M. Is there a point when the whitelist file becomes to large? Is there a better performance method to handle whitelist entries than the .cf file? Thanks --Bryan --

RE: sa-learn and qmail Maildir

> From: Theo > (note: I don't use qmail) > > maildir is typically one file per message in a directory. In that > situation, > just pointing at the directory would be appropriate, sa-learn will use all > messages in the directory. > Yup. That's why I figure that going to the appropriate dire

Re: relay

You might want to try asking that question in a mailing list specific for qmail. Check www.qmail.org for access to support and forums. Also check the Life with qmail book, available for download at http://www.lifewithqmail.org, which addresses this question. Terry Terry Soucy, Systems Analyst

Re: sa-learn and qmail Maildir

On Tue, Jan 23, 2007 at 07:34:17AM -0800, R Lists06 wrote: > --mboxInput sources are in mbox format > --mbx Input sources are in mbx format (note: I don't use qmail) maildir is typically one file per message in a directory. In that situatio

sa-learn and qmail Maildir

I guess the bottom line is what are qmail folks doing for training? I had never thought about it before yet I haven't had the need to sa-learn anything until recently When processing using sa-learn in a qmail Maildir should one use an "options" below --mboxInput sourc

RE: spamassassin with qmail

_ From: night duke Hi i'm trying to use spamassassin with qmail but i was unable to use them together. Anyone can help me?. Thanks. Until you get to know it well this can and will help http://www.qmailrocks.org http://qmail.

RE: Spam graphing

> -Original Message- > From: Gary V [mailto:[EMAIL PROTECTED] > Sent: Tuesday, January 23, 2007 6:20 AM > To: users@spamassassin.apache.org > Subject: Re: Spam graphing > > >> I then spend the better part of the day looking for a nice graphing > >>utility that works. I'd like it to s

Re: spamassassin with qmail

night duke wrote: > Hi i'm trying to use spamassassin with qmail but i was unable to use > them together. > > Anyone can help me?. See the qmail section of: http://wiki.apache.org/spamassassin/IntegratedInMta

FuzzyOcr Hash Error

With FuzzyOcr 3.5.1 and SA 3.1.7, I noticed this in the log while debugging my setup: 2007-01-23 01:39:23 [16842] Processing Message with ID "<[EMAIL PROTECTED]>" ("Lacy Silva" <[EMAIL PROTECTED]> -> "ed" <[EMAIL PROTECTED]>) 2007-01-23 01:39:23 [16842] GIF: [248x442] submersible.gif (5458) 2

relay

i have at my qmail server :allow,relayclient="" But i receive a lot of connections anyone knows how i limit those connections thanks. - LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por

spamassassin with qmail

Hi i'm trying to use spamassassin with qmail but i was unable to use them together. Anyone can help me?. Thanks. - LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

RE: netpbm 2.10

> -Original Message- > From: David Baron [mailto:[EMAIL PROTECTED] > Sent: Monday, January 22, 2007 4:38 PM > To: users@spamassassin.apache.org > Subject: netpbm 2.10 > > This version is now on Debian Sid. > > Do I go over to the newer function calls for FuzzyOcr or is they still not >

Re: USER_IN_WHITELIST problem

As of last Wednesday I am having this problem. In fact it's more then just USER_IN_WHITELIST, I am getting many reports of incorrect USER_IN_BLACKLIST. No I don't whitelist my domain. Yes I checked the To/From/ReplyTo/EnvelopeFrom/etc. No the users don't have whitelist/blacklist entries anywhe

RE: USER_IN_WHITELIST problem

René Berber wrote: > Sherman Lilly wrote: [snip] > > I get why they are getting through. They are spoofing the Return-Path. > > Is there any way to remedy this problem? > > Depends on your server. For sendmail there is: > > http://ultra.ap.krakow.pl/~raj/sendmail/english.html > > the FE

MMS False Positives

Hi, I've just been writing a negative scoring meta-rule to offset the points added by FROM_ALL_NUMS to many MMS messages sent via email. E.g. if it matches FROM_ALL_NUMS and is from @mms.vodafone.co.uk then subtract the 2.5 points added by FROM_ALL_NUMS. The FROM_ALL_NUMS rule itself hits too much

RE: sa-update problem after upgrading from Plesk Spamassassin 3.0.4 to SA 3.1.7....

Thanks a lot, it now works. Florent -Message d'origine- De : Theo Van Dinter [mailto:[EMAIL PROTECTED] Envoyé : mardi 23 janvier 2007 01:27 À : users@spamassassin.apache.org Objet : Re: sa-update problem after upgrading from Plesk Spamassassin 3.0.4 to SA 3.1.7 On Tue, Jan 23, 2007