Saw this in my logcheck:
Jul 18 22:28:55 ip6-localhost spamd[10008]: spamd: copy_config timeout,
respawning child process after 114 messages at /usr/sbin/spamd line 1130.
Latest and greatest from Debian Sid. What's happening?
I mean the obvious stuff like "viagra" and such. Usually the spam is caught
but sporadically it does get through.
What is happening.
Hi Jari,
Thanks for your response.
The scenario is like this: when my user received email A, at the same time
another same email A will be received by the user . The only differrent
between this email is the 1st email will be the original email and the 2nd
email will the 1st email (jumbled up/enc
Tammy George wrote:
> Hello.
>
> Our Linux server is running SpamAssassin version 3.1.5.
>
> Backups started dying with 'inactivity timeout'. Dug around & found
> the following:
>
> drwx-- 3 vscan vscan512 Jul 18 16:28 .
> -rw--- 1 vscan vscan 1099983372288 Jul 18
On Wed, Jul 18, 2007 at 09:30:25PM -0300, Tammy George wrote:
> -rw--- 1 vscan vscan 1099983372288 Jul 18 16:28 auto-whitelist
> A du -k shows auto-whitelist as being 1747968.
Ah, the magic of sparse files. :)
> After I send this email, I'm going to look into check_whitelist and
> trim_wh
Hello.
Our Linux server is running SpamAssassin version 3.1.5.
Backups started dying with 'inactivity timeout'. Dug around & found the
following:
drwx-- 3 vscan vscan512 Jul 18 16:28 .
-rw--- 1 vscan vscan 1099983372288 Jul 18 16:28 auto-whitelist
-rw--- 1 vsca
On Wed, Jul 18, 2007 at 04:34:02PM -0400, Michael Scheidell wrote:
> But, aren't the scores a little high for a valid date? (rfc compliant)
> Ps, I berated the program manager, letting hm know that y2k issues
> should have been solved 8 years ago ;-)
>
> INVALID_DATE 2.303 1.651 1.329 1.245
Not r
Kevin Plested wrote:
*I'm trying to add a new plugin to Spamassassin, I located my plugin
directory on my server:*
/usr/local/lib/perl5/site_perl/5.8.4/Mail/SpamAssassin/Plugin/
*by searching on my server for URIDNSBL.pm.*
*When I put my new plugin into that directory, and call it from
ini
> -Original Message-
> From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, July 18, 2007 4:22 PM
> To: users@spamassassin.apache.org
> Subject: Re: Whats wrong with dateformat?
>
> On Wed, Jul 18, 2007 at 03:30:29PM -0400, Michael Scheidell wrote:
> > INVALID_DATE=1.
On Wed, Jul 18, 2007 at 03:30:29PM -0400, Michael Scheidell wrote:
> INVALID_DATE=1.245]
>
> Date: 18 Jul 07 11:01:52 -0700
>
> I THINK day is optional:
Ok ... ? It's optional in the rule too.
The rule does, however, wants a 4-digit year. Rules such as this one,
fwiw, aren't meant to be
X-Spam-Status: No, score=-1.19 tagged_above=-999 required=5
tests=[AWL=0.164,
BAYES_00=-2.599, DKIM_POLICY_SIGNSOME=0, DK_POLICY_SIGNSOME=0,
INVALID_DATE=1.245]
Date: 18 Jul 07 11:01:52 -0700
I THINK day is optional:
>From rfc:
3.6.1: The origination date field
The originati
Theo Van Dinter-2 wrote:
>
> On Wed, Jul 18, 2007 at 11:17:03AM -0700, nws.charlie wrote:
>> automatically twice a day. The updates are happening as scheduled, and
>> being
>> placed in var/lib/spamassassin/3.001001/..., however, spamassassin seems
>> to
>> be ignoring the rules there.
>
> Why
It is not all that unusual to see differences in SA when run from the
command line. Have you looked at what scores are being hit on the
actual incoming message (amavisd-new log level to 2)?
Robert Fitzpatrick wrote:
On Wed, 2007-07-18 at 10:12 -0500, Craig Carriere wrote:
I use 2
On Wed, Jul 18, 2007 at 01:15:16PM -0500, Skip Brott wrote:
> I haven't yet had to implement any pdf plugins, but I am looking to do so.
> I am running SA 3.1.9 and perl 5.8.8. From what I can see, my plugins are
> here:
>
> /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/
>
> Is that the locat
On Monday 16 July 2007 9:47 pm, Dallas Engelken wrote:
>
>
> I havent touched them for a while and havent checked if v1.03 even works
> with SA 3.2. If something needs to be done, let me know.
1.03 is working just fine here Dallas w/SA3.2.1
--
Chris
KeyID 0xE372A7DA98E6705C
pgpcaCcsXAAu1.pg
On Wed, 2007-07-18 at 10:12 -0500, Craig Carriere wrote:
> I use 256K, but I have a small volume (about a thousand emails a day)
> server load. We are also experimenting with the SaneSecurity
> definitions for clam which catch a lot of this rodent mail as well and
> should lower the SA load.
>
>
Skip Brott wrote:
> I haven't yet had to implement any pdf plugins, but I am looking to do so.
> I am running SA 3.1.9 and perl 5.8.8. From what I can see, my plugins are
> here:
>
> /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/
>
> And there is no related folder for 5.8.8
>
> Is that the l
On Wed, Jul 18, 2007 at 11:17:03AM -0700, nws.charlie wrote:
> automatically twice a day. The updates are happening as scheduled, and being
> placed in var/lib/spamassassin/3.001001/..., however, spamassassin seems to
> be ignoring the rules there.
Why do you say that? Does "spamassassin --lint -
I took over this project (dealing w/spam) with very little instruction or
experience, so My Apologies if my questions are ignorant...
I had previously run sa-update manually, and we also have it scheduled
automatically twice a day. The updates are happening as scheduled, and being
placed in var/li
Igor Chudov wrote:
Bayes, applied to pdf spams, always classifies the message as ham and
increases the score. It is not reliable for PDF messages where the
content is in PDF.
Sounds like you need to train Bayes on those messages. Over here, Bayes
is misclassifying less than 15% of PDF spams,
I haven't yet had to implement any pdf plugins, but I am looking to do so.
I am running SA 3.1.9 and perl 5.8.8. From what I can see, my plugins are
here:
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/
And there is no related folder for 5.8.8
Is that the location where I want to install the
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Billy Huddleston wrote:
> Malformed UTF-8 character (unexpected non-cont
> inuation byte 0x00, immediately after start byte 0xd5) in pattern match
> (m//) at
> /etc/mail/spamassassin/70_sare_obfu1.cf, rule __SARE_OBFU_VISIT1, line
> 1, 2> line 64.
>
On Wed, Jul 18, 2007 at 01:17:45PM -0400, Theo Van Dinter wrote:
> On Wed, Jul 18, 2007 at 10:22:49AM -0500, Igor Chudov wrote:
> > I would like to disable Bayes analysis entirely if an email has a PDF
> > attachment.
> >
> > How can I do it?
>
> You could theoretically write a plugin that looks
Malformed UTF-8 character (unexpected non-cont
inuation byte 0x00, immediately after start byte 0xd5) in pattern match
(m//) at
/etc/mail/spamassassin/70_sare_obfu1.cf, rule __SARE_OBFU_VISIT1, line
1,
2> line 64.
Malformed UTF-8 character (unexpected non-cont
inuation byte 0x00, immediately a
On Jul 19, 2007, at 1:33 AM, Meng Weng Wong wrote:
the following RHSWL is alpha only and not ready for production. in
production the name will change.
% dig +short prudential.com.mengwong.manywl-
v1.dnswl.karmasphere.com @query.karmasphere.com
127.0.0.2
oops, I forgot the url that desc
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Billy Huddleston wrote:
> I upgraded from 3.1.7 to 3.2.1 and started getting errors from
> 70_sare_obfu.cf rules set.. any one got any ideas on this?
>
> Thanks, Billy
>
> **
What are the errors?
- --
-Doc
Penguins: Do it on the ice.
8:44am
I upgraded from 3.1.7 to 3.2.1 and started getting errors from
70_sare_obfu.cf rules set.. any one got any ideas on this?
Thanks, Billy
**
i'm working on the rules you described, and will upload working
versions soon.
i posted about this a few days ago, with a prototype ruleset.
http://www.gossamer-threads.com/lists/spf/discuss/32160
they will be integrated with SPF and DKIM in the appropriate manner.
the following RHSWL is alp
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
[Disclosure: I'm involved with dnswl.org]
ram wrote:
>> http://www.dnswl.org/
>> http://wiki.ctyme.com/index.php/Spam_DNS_Lists
>>
>> Both work well IMHO
>>
> These are ip lists.
> I think there would be some spamassassin rule already
> ( RCVD_IN_D
On Wed, Jul 18, 2007 at 10:22:49AM -0500, Igor Chudov wrote:
> I would like to disable Bayes analysis entirely if an email has a PDF
> attachment.
>
> How can I do it?
You could theoretically write a plugin that looks for an attachment and
changes the config and score set if it finds one.
Other
On Wed, 2007-07-18 at 12:25 -0400, Kevin Plested wrote:
> I'm trying to add a new plugin to Spamassassin, I located my plugin
> directory on my server:
>
> /usr/local/lib/perl5/site_perl/5.8.4/Mail/SpamAssassin/Plugin/
>
> by searching on my server for URIDNSBL.pm.
>
> When I put my new plugi
I'm trying to add a new plugin to Spamassassin, I located my plugin
directory on my server:
/usr/local/lib/perl5/site_perl/5.8.4/Mail/SpamAssassin/Plugin/
by searching on my server for URIDNSBL.pm.
When I put my new plugin into that directory, and call it from init.pre, and
run a --lint, I ge
On Wed, 18 Jul 2007 11:17:16 -0400, SM <[EMAIL PROTECTED]> wrote:
At 05:39 18-07-2007, Paul Griffith wrote:
See this link:
http://www.cse.yorku.ca/~paulg/missed-spam.html
Both messages scored 13.9 and hits FH_FROMEML_NOTLD,RDNS_NONE,
URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SC_SURBL,
From: "SM" <[EMAIL PROTECTED]>
At 07:41 18-07-2007, Helmut Schneider wrote:
sorry if I missed something but is there also a digest version of
the mailing list? I searched
http://wiki.apache.org/spamassassin/MailingLists but only found
subscribe and unsubscribe.
Send an email to [EMAIL PROTEC
nws.charlie wrote:
I am catching most of the spam with this. Does
anyone see anything negative about a rule like this?
header __LOCAL_HEADER_THUNDERBIRD User-Agent =~ /\bthunderbird\b/i
full__LOCAL_HAS_PDF /\b\S*\.pdf\b/i
metaLOCAL_PDF_VIA_THUNDERBIRD (__LOCAL_HEADER_TH
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, July 17, 2007 5:32 PM
> To: users@spamassassin.apache.org; [EMAIL PROTECTED]
> Subject: How to get Spam report in header?
>
> We use MailScanner and Spamassassin.
>
> Our email has a header line as follows:
>
> X-BakerBotts-M
> On Jul 17, 2007, at 10:30 AM, Evan Platt wrote:
> >Just posted to the list, and got a bounce from Charles Mount. Not
> >100% sure it's from this list though.
On 17.07.07 11:27, Vivek Khera wrote:
> there are gazillions of b0rked autoresponders in the world. you just
> stumbled upon one of t
On 17.07.07 10:40, Anthony Kamau wrote:
> I'm faced with a dilemma on how to use sa-learn with mail forwarded from
> a user's inbox on Exchange to the sendmail server. Since we just
> recently started using sendmail as a front end server, our bayes system
> is still in its infancy and spam is gett
At 07:41 18-07-2007, Helmut Schneider wrote:
sorry if I missed something but is there also a digest version of
the mailing list? I searched
http://wiki.apache.org/spamassassin/MailingLists but only found
subscribe and unsubscribe.
Send an email to [EMAIL PROTECTED]
Regards,
-sm
I would like to disable Bayes analysis entirely if an email has a PDF
attachment.
How can I do it?
i
At 05:39 18-07-2007, Paul Griffith wrote:
See this link:
http://www.cse.yorku.ca/~paulg/missed-spam.html
Both messages scored 13.9 and hits
FH_FROMEML_NOTLD,RDNS_NONE,
URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SC_SURBL,URIBL_WS_SURBL.
This was tested on a system without any additional
I use 256K, but I have a small volume (about a thousand emails a day)
server load. We are also experimenting with the SaneSecurity
definitions for clam which catch a lot of this rodent mail as well and
should lower the SA load.
Glad it helped.
Robert Fitzpatrick wrote:
On Wed, 2007-07-18
On Wed, 2007-07-18 at 09:57 -0500, Administrator wrote:
> A rough guess and probably wrong as usual, but could the message size be
> larger than what you have set in amavisd-new? If so then SA would be
> bypassed but not when you manually test the message.
>
Ding! Thanks! It is set at 64*1024 fa
We use SA 3.1.7 with Postfix and amavisd-new 2.4.4 and clamav. I
received several PDF's this morning even though we have updated
protection. They all came from one server, so I did a lookup in the mail
logs to find 'Hits: -', that's it. After some more searching on
different servers, I see this fr
On 07/18/07 01:21, René Berber wrote:
Wolfgang Zeikat wrote:
In an older episode (Tuesday, 17. July 2007 21:43), René Berber wrote:
Wolfgang Zeikat wrote:
You can add a line to FuzzyOcr.pm :
use POSIX;
That line is already there.
Sorry, I should have said:
use POSIX qw(SIGTERM);
yes,
A rough guess and probably wrong as usual, but could the message size be
larger than what you have set in amavisd-new? If so then SA would be
bypassed but not when you manually test the message.
Robert Fitzpatrick wrote:
> We use SA 3.1.7 with Postfix and amavisd-new 2.4.4 and clamav. I
> recei
We use SA 3.1.7 with Postfix and amavisd-new 2.4.4 and clamav. I
received several PDF's this morning even though we have updated
protection. They all came from one server, so I did a lookup in the mail
logs to find 'Hits: -', that's it. After some more searching on
different servers, I see this fre
Hi,
sorry if I missed something but is there also a digest version of the
mailing list? I searched http://wiki.apache.org/spamassassin/MailingLists
but only found subscribe and unsubscribe.
Thanks, Helmut
Given the numerous, ongoing discussions about the various anti-pdf-spam
tools, /does/ a quantitative comparison of their relative efficacies (I
suppose, measured by SA scores?) exist somewhere?
If not (yet), /is/ there a reference collection (in parlance, "corpus"?) of
pdf spam that could be used
On Wed, 2007-07-18 at 06:24 -0700, OliverScott wrote:
> http://www.dnswl.org/
> http://wiki.ctyme.com/index.php/Spam_DNS_Lists
>
> Both work well IMHO
>
These are ip lists.
I think there would be some spamassassin rule already
( RCVD_IN_DNSWL ???) . Need to google again :-)
On the other hand
On Wed, 18 Jul 2007, nws.charlie wrote:
> I have noticed that 98% of the spam with pdf attachments is
> being sent from Thunderbird. I wrote a few rules and added them to
> my local.cf. Here is the main one that is working. I am catching
> most of the spam with this. Does anyone see anything neg
On Wed, 18 Jul 2007, Jean-Paul Natola wrote:
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> 1.8 MISSING_SUBJECTMissing Subject: header
> 2.3 EMPTY_MESSAGE Message appears to have no textual parts and
> no
> Subject: text
>
On Wed, 18 Jul 2007, Jean-Paul Natola wrote:
> I'm getting creamed with these spams but they are getting through
> due to;
>
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0005]
>
> Why is this happening?
Well, most likely two causes: (1) your bayes
On Wed, Jul 18, 2007 at 06:52:40AM -0700, nws.charlie wrote:
> more as spam). Can anyone tell me if there is already a ruleset that I
> should be using?
Run sa-update, there's a rule already in there.
--
Randomly Selected Tagline:
Human female: "All in all. This is one day that mitten the kitte
On Wed, 2007-07-18 at 09:41 -0400, Jean-Paul Natola wrote:
> Hi all,
>
> I'm getting creamed with these spams but they are getting through due to;
>
>
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0005]
>
> Why is this happening?
>
I think that is
Jean-Paul Natola wrote:
> Hi all,
>
> I'm getting creamed with these spams but they are getting
> through due to;
>
>
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0005]
>
> Why is this happening?
This only says that Bayes doesn't think the email looks like s
Jean-Paul Natola wrote:
> Hi all,
>
> I'm getting creamed with these spams but they are getting
> through due to;
>
>
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0005]
>
> Why is this happening?
This only says that Bayes doesn't think the email looks like spam
Like many of you, we have been receiving a lot of spam with .pdf
attachments. Perhaps I am missing a rule set, but almost none seemed to be
getting a high enough score to be marked spam. (We mark a score of 3.00 or
more as spam). Can anyone tell me if there is already a ruleset that I
should be
Hi all,
I'm getting creamed with these spams but they are getting through due to;
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0005]
Why is this happening?
Jean-Paul Natola
Network Administrator
Information Technology
Family Care Internati
http://www.dnswl.org/
http://wiki.ctyme.com/index.php/Spam_DNS_Lists
Both work well IMHO
Ramprasad wrote:
>
> There are quite a few domain you can trust not to send spam.
> For example the airlines, the banks , and a lot others like
> spamassassin.apache.org :-)
>
> If mails from these dom
What you create by having a catch-all address domain, is an EXCELLENT
resource for spammers. They will use your domain as a FROM in their
spoofing spew. Any [misguided but popular] email software doing the [DDoS
enabling] "sender address verification" will pass the sender as legit, when
indeed it
On Wed, 18 Jul 2007 05:30:38 -0400, SM <[EMAIL PROTECTED]> wrote:
At 21:31 17-07-2007, Debbie D wrote:
But I am still getting way to many spams.. more than I did before the
update -- cialis, viagra, all kinds of meds, all scoring between 0.6
and 3.5
Post a link to some of these emails incl
On Wed, 18 Jul 2007 00:31:44 -0400, Debbie D <[EMAIL PROTECTED]>
wrote:
I am so frustrated.. updated cpanel the other day to
WHM 11.2.0 cPanel 11.6.0-C15032
FEDORA 4 i686 - WHM X v3.1.0
Exim 4.66 on a Linux box
But I am still getting way to many spams.. more than I did before the
update --
Michael Scheidell wrote:
Don't know if anyone has mentioned this, if so, I missed it.
Potential DOS in spamassassin if perl-Net-DNS < .60. (previously
recommended version was .58)
Freebsd ports has .60, for the last two weeks.
Thanks for the FYI.
MrC
-Original Message-
From: rPath U
There are quite a few domain you can trust not to send spam.
For example the airlines, the banks , and a lot others like
spamassassin.apache.org :-)
If mails from these domains gets an SPF/DK pass we can simply pass the
mails. Today I manually maintain a list of whitelist_from_auth
Is there a
It does not seem like being sent by SpamAssassin to me. SA does not send
messages or reports, it just filters them. It has added the X-Spam* headers,
but everything else comes from elsewhere.
X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on
mail2.singapore-daiichi.com.sg
X-Spa
66 matches
Mail list logo
