Re: Particular subject blacklist seems not to work

2008-01-24 Thread Matt Kettler
[EMAIL PROTECTED] wrote: I am running SpamAssassin version 3.1.7 with Postfix via amavisd on a FreeBSD machine. In the last few weeks, all of a sudden messages with the same 4 or 5 subject lines started coming through undetected for some reason. So I decided to add patterns matching those

Re: Feeding SA-learn

2008-01-24 Thread Mark Johnson
John Thompson wrote: No. I use Thunderbird and just set the Junk filter controls to expire junk messages after a couple weeks. Interesting idea! Thanks for the tips! You have no idea how much time and how many steps this is going to save me. -- Mark Johnson http://www.astroshapes.com/i

Re: whois plugin .. where to get it

2008-01-24 Thread Matt Kettler
Matt Kettler wrote: Giampaolo Tomassoni wrote: It doesn't use whois *instead of* dns. It uses both and attempts even to detect any discrepancy between their responses. How are these going to be different?? The information published to whois has to match the information published to the auth

Re: Feeding SA-learn

2008-01-24 Thread John Thompson
On 2008-01-24, Anthony Peacock <[EMAIL PROTECTED]> wrote: > John Thompson wrote: >> >> Isn't that what "cron" is for? :-) >> >> I have a cron job on my imap server to regularly feed ham and spam >> through sa-learn. > I have a cron job that runs the learning process nightly. I was > refering

Re: Feeding SA-learn

2008-01-24 Thread John Thompson
On 2008-01-24, Mark Johnson <[EMAIL PROTECTED]> wrote: > John Thompson wrote: > >> Isn't that what "cron" is for? :-) >> >> I have a cron job on my imap server to regularly feed ham and spam >> through sa-learn. > Do you delete the messages from the IMAP folder after you learn them? > If so, h

Re: whois plugin .. where to get it

2008-01-24 Thread Matt Kettler
Giampaolo Tomassoni wrote: -Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Thursday, January 24, 2008 6:38 AM Giampaolo Tomassoni wrote: Right, it is. The URIWhois does not detect the registrar. It detects the name and the address of the DNS- an

Re: whois plugin .. where to get it

2008-01-24 Thread Matt Kettler
John D. Hardin wrote: On Thu, 24 Jan 2008, Jeff Chan wrote: Quoting Matt Kettler <[EMAIL PROTECTED]>: The only big difference I see at face value is it uses whois instead of DNS to find the NS records.. that hardly seems efficient.. Whois is definitely the wrong protocol to us

Re: Particular subject blacklist seems not to work

2008-01-24 Thread John D. Hardin
On Thu, 24 Jan 2008 [EMAIL PROTECTED] wrote: > I am fairly sure. The other subject lines started getting flagged > when I added entries for them. And I sent emails from an outside > account with a subject that matched one of the other patterns and > it got flagged. > > Is there a more concrete wa

Re: Particular subject blacklist seems not to work

2008-01-24 Thread spamassassin
I am fairly sure. The other subject lines started getting flagged when I added entries for them. And I sent emails from an outside account with a subject that matched one of the other patterns and it got flagged. Is there a more concrete way to determine whether 60_whitelist_subject.cf is ac

Re: Particular subject blacklist seems not to work

2008-01-24 Thread John D. Hardin
On Thu, 24 Jan 2008 [EMAIL PROTECTED] wrote: > In the last few weeks, all of a sudden messages with the same 4 or 5 > subject lines started coming through undetected for some reason. > > So I decided to add patterns matching those to > /usr/local/share/spamassassin/60_whitelist_subject.cf Sill

Re: Enable Spamcop only

2008-01-24 Thread John D. Hardin
On Thu, 24 Jan 2008, Mofo_Jones wrote: > > spamassassin -D > > > Where message.txt is containing the message to test. > > Sorry, What I meant was how do I send a email to the SA server > that will be tagged so I can see it in the message. If your SA is configured to add status headers, the comm

Particular subject blacklist seems not to work

2008-01-24 Thread spamassassin
I am running SpamAssassin version 3.1.7 with Postfix via amavisd on a FreeBSD machine. In the last few weeks, all of a sudden messages with the same 4 or 5 subject lines started coming through undetected for some reason. So I decided to add patterns matching those to /usr/local/share/spama

Re: Enable Spamcop only

2008-01-24 Thread Mofo_Jones
Sorry, What I meant was how do I send a email to the SA server that will be tagged so I can see it in the message. Jari Fredriksson wrote: > >> John, I have been looking everywhere for how to send a >> test message that will show up as an RBL. Do you know hot >> to test this? I have Googled my

Re: Enable Spamcop only

2008-01-24 Thread Jari Fredriksson
> John, I have been looking everywhere for how to send a > test message that will show up as an RBL. Do you know hot > to test this? I have Googled my self to almost death. > > John D. Hardin wrote: >> >> On Thu, 24 Jan 2008, Mofo_Jones wrote: >> >>> I am trying to setup my first SA and I can't

Re: Enable Spamcop only

2008-01-24 Thread Mofo_Jones
John, I have been looking everywhere for how to send a test message that will show up as an RBL. Do you know hot to test this? I have Googled my self to almost death. John D. Hardin wrote: > > On Thu, 24 Jan 2008, Mofo_Jones wrote: > >> I am trying to setup my first SA and I can't seem to get

Re: Enable Spamcop only

2008-01-24 Thread John D. Hardin
On Thu, 24 Jan 2008, Mofo_Jones wrote: > I am trying to setup my first SA and I can't seem to get the SA to do a check > on Spamcop. The following are my cf files and debug information. Can someone > please tell me what I am doing wrong? > [11631] dbg: plugin: loading Mail::SpamAssassin::Plugin::

Enable Spamcop only

2008-01-24 Thread Mofo_Jones
I am trying to setup my first SA and I can't seem to get the SA to do a check on Spamcop. The following are my cf files and debug information. Can someone please tell me what I am doing wrong? Sorry for all the information given below. Not sure what to do. --Local.c

Re: Expiry problem

2008-01-24 Thread Steven Stern
Michael Parker wrote: On Jan 23, 2008, at 9:54 PM, Steven Stern wrote: It's finally started to remove tokens, so I think I'm OK. We use SQL bayes, so it was an easy matter to use ~ delete from bayes_token where atime > UNIX_TIMESTAMP(); to clean up the stuff from the future. But now yo

Re: whois plugin .. where to get it

2008-01-24 Thread John D. Hardin
On Thu, 24 Jan 2008, Jeff Chan wrote: > Quoting Matt Kettler <[EMAIL PROTECTED]>: > > > The only big difference I see at face value is it uses whois instead of > > DNS to find the NS records.. that hardly seems efficient.. > > Whois is definitely the wrong protocol to use for automated > testing

Re: Upgrade 3.2.3->3.2.4 breaks rule override

2008-01-24 Thread Kris Deugau
Karl Boyken wrote: We're running SpamAssassin from MIMEDefang 2.63 on RedHat Linux Enterprise Server 5. We recently upgraded SpamAssassin from 3.2.3 to 3.2.4. We'd configured sa-mimedefang.cf to use a local Spamhaus mirror for __RCVD_IN_ZEN, RCVD_IN_XBL and RCVD_IN_PBL. I just copied over th

p0f-analyzer.pm

2008-01-24 Thread Yet Another Ninja
Guys - Centos 5.0 - Perl 5.8.8 - SA 3.2.4 + sa-updates p0f-analyzer.pm from http://bl0g.blogdns.com/spamassassin/p0f-analyzer.pm p0f-analyzer.pm is spitting: Jan 24 16:49:18 inet3 spamd[11516]: Use of uninitialized value in concatenation (.) or string at /etc/mail/spamassassin/p0f-analyzer.pm

Re: Upgrade 3.2.3->3.2.4 breaks rule override

2008-01-24 Thread Matus UHLAR - fantomas
On 24.01.08 09:22, Karl Boyken wrote: > We're running SpamAssassin from MIMEDefang 2.63 on RedHat Linux > Enterprise Server 5. We recently upgraded SpamAssassin from 3.2.3 to > 3.2.4. We'd configured sa-mimedefang.cf to use a local Spamhaus mirror > for __RCVD_IN_ZEN, RCVD_IN_XBL and RCVD_IN_P

Upgrade 3.2.3->3.2.4 breaks rule override

2008-01-24 Thread Karl Boyken
We're running SpamAssassin from MIMEDefang 2.63 on RedHat Linux Enterprise Server 5. We recently upgraded SpamAssassin from 3.2.3 to 3.2.4. We'd configured sa-mimedefang.cf to use a local Spamhaus mirror for __RCVD_IN_ZEN, RCVD_IN_XBL and RCVD_IN_PBL. I just copied over the "header" lines fr

Re: Expiry problem

2008-01-24 Thread Michael Parker
On Jan 23, 2008, at 9:54 PM, Steven Stern wrote: It's finally started to remove tokens, so I think I'm OK. We use SQL bayes, so it was an easy matter to use ~ delete from bayes_token where atime > UNIX_TIMESTAMP(); to clean up the stuff from the future. But now your bayes_vars table is

Re: Fired rules stats understanding

2008-01-24 Thread Sébastien AVELINE
Matt Kettler a écrit : Sébastien AVELINE wrote: Hello, You will find my top rules fired with spamassassin. I have spamassassin on several boxes, each have his own bayes_db files, I use razor, dcc_check, uribl, bayes We have hundreds of thousand messages per day. In my top rules for spam

Re: Feeding SA-learn

2008-01-24 Thread Anthony Peacock
Diego Pomatta wrote: John Thompson escribió: On 2008-01-23, Diego Pomatta <[EMAIL PROTECTED]> wrote: I use Thunderbird. There are two files for that folder: Junk.msf (7k) and Junk (53.172k). The msf file must be some kind of index. I just feed the biggest one to sa-learn? Yup. Use "s

RE: whois plugin .. where to get it

2008-01-24 Thread Giampaolo Tomassoni
> -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: Thursday, January 24, 2008 6:38 AM > > Giampaolo Tomassoni wrote: > > > > Right, it is. > > > > The URIWhois does not detect the registrar. It detects the name and > the > > address of the DNS- and whois-defined NS

Re: Feeding SA-learn

2008-01-24 Thread Diego Pomatta
John Thompson escribió: On 2008-01-23, Diego Pomatta <[EMAIL PROTECTED]> wrote: I use Thunderbird. There are two files for that folder: Junk.msf (7k) and Junk (53.172k). The msf file must be some kind of index. I just feed the biggest one to sa-learn? Yup. Use "sa-learn --spam --mbox

Re: Fired rules stats understanding

2008-01-24 Thread Matt Kettler
Sébastien AVELINE wrote: Hello, You will find my top rules fired with spamassassin. I have spamassassin on several boxes, each have his own bayes_db files, I use razor, dcc_check, uribl, bayes We have hundreds of thousand messages per day. In my top rules for spam you will see a lot of "c

Re: Feeding SA-learn

2008-01-24 Thread Anthony Peacock
John Thompson wrote: On 2008-01-23, Anthony Peacock <[EMAIL PROTECTED]> wrote: My intention was to manually feed the few spam messages that slip thru undetected. By the time I get a hold of those, they are in the recipient's mail client inbox, not in the server. I was thinking, if I save the m

Fired rules stats understanding

2008-01-24 Thread Sébastien AVELINE
Hello, You will find my top rules fired with spamassassin. I have spamassassin on several boxes, each have his own bayes_db files, I use razor, dcc_check, uribl, bayes We have hundreds of thousand messages per day. In my top rules for spam you will see a lot of "collaborative rules" like