Logging with SA/procmail standalone (no spamd)

2008-01-28 Thread Jason Antman
Hi, I'm a student at Rutgers University. I've been running SA on my own mailserver (handling 3 users) for a few years now. I recently came into some new hardware, and replaced the old mailserver with a new one running Solaris 10. I'm using SpamAssassin 3.02 in the blastwave.org package. I'm using

Re: What's with the many nnnn.com domains in this spam?

2008-01-28 Thread Jeff Chan
Quoting Justin Mason <[EMAIL PROTECTED]>: Per Jessen writes: Check this out http://jessen.ch/files/spam55.txt It's a typical spam-email with a single gif advertising drugs. The gif is loaded from a website which is listed by uribl.com. The emails has hrefs to the following '.com' domai

Re: One SPAM that got through

2008-01-28 Thread Matt Kettler
--[ UxBoD ]-- wrote: Hi, I just had this message get through :- and it only scored 5.6. These are the rules it hit :- 1.23 ADVANCE_FEE_2 0.00 BAYES_50 0.72 SARE_URGBIZ Contains urgent matter -0.00 SPF_PASS 2.08 SUBJ_ALL_CAPS 1.58 URG_BIZ Looks like you might want to do some

Re: No Bayes Headers (no errors in debug/logs)

2008-01-28 Thread Matt Kettler
Mitchell Hudson wrote: I did actually pull out the number of tokens and I have quite a few in there: 0.000 0 3 0 non-token data: bayes db version 0.000 0 23930 0 non-token data: nspam 0.000 0 8304 0 non-token data: nha

Re: Tweaking Rules

2008-01-28 Thread Theo Van Dinter
On Mon, Jan 28, 2008 at 04:10:39PM -0600, Matt wrote: > Does anyone see anything wrong with these scores? The RDNS_DYNAMIC > worries me a bit since I know a few email servers hosted on dynamic > looking reverse DNS's. Well, first, the scores are really aggressive. Generally speaking, you don't w

Tweaking Rules

2008-01-28 Thread Matt
I have added the following to the local.cf to decrease the spam that gets through. score RCVD_IN_PBL 3 score RCVD_IN_XBL 5 score RDNS_NONE 5 score RCVD_IN_SORBS_DUL 3 score SPF_FAIL 10 score SPF_SOFTFAIL 5 score SPF_NEUTRAL 2 score RDNS_DYNAMIC 3 Does anyone see anything wrong with these scores?

Re: is DOS_OUTLOOK_TO_MX too low?

2008-01-28 Thread Jason Haar
Joseph Brennan wrote: I looked at our spam reports (spam that was not rejected). It looks to me like the biggest target to go for is mail supposedly from The Bat! direct to your MX. Most of the supposed The Bat! spam matches, and it is very low scoring. Yes - I just saw that too - like Outl

One SPAM that got through

2008-01-28 Thread --[ UxBoD ]--
Hi, I just had this message get through :- Subject: CONTACT GLOBAL COMPANY FOR YOUR $950,000.00 My Dear Good Friend, I have Paid the fee for your Cheque Draft. But the manager of Eko Bank Benin told me that before the check will get to you that it will expire. So I told him to cash the $950,

Re: No Bayes Headers (no errors in debug/logs)

2008-01-28 Thread Theo Van Dinter
On Mon, Jan 28, 2008 at 10:53:50AM -0600, Mitchell Hudson wrote: > So I'm not worried about not having any training. And the spamassassin > -D bayes > message.txt, but in any case I let it run for about 30 minutes and it > didn't return any data, which seemed very strange. Of course, it was wa

Re: No Bayes Headers (no errors in debug/logs)

2008-01-28 Thread Mitchell Hudson
I did actually pull out the number of tokens and I have quite a few in there: 0.000 0 3 0 non-token data: bayes db version 0.000 0 23930 0 non-token data: nspam 0.000 0 8304 0 non-token data: nham 0.000 0 2

Re: What's with the many nnnn.com domains in this spam?

2008-01-28 Thread Justin Mason
Per Jessen writes: > Check this out > > http://jessen.ch/files/spam55.txt > > It's a typical spam-email with a single gif advertising drugs. The gif > is loaded from a website which is listed by uribl.com. > > The emails has hrefs to the following '.com' domains: > > MUNGEDjuxl.com - cont

What's with the many nnnn.com domains in this spam?

2008-01-28 Thread Per Jessen
Check this out http://jessen.ch/files/spam55.txt It's a typical spam-email with a single gif advertising drugs. The gif is loaded from a website which is listed by uribl.com. The emails has hrefs to the following '.com' domains: juxl.com - contents named 'NAMESRENTER.COM' nkhs.com - some o

Re: Spamd uses over 1 gigabyte of memory in one child

2008-01-28 Thread Sevrin Robstad
Matus UHLAR - fantomas wrote: > > On 27.01.08 15:06, Sevrin Robstad wrote: >> I have used spamassassin over a year on my mail server, using James as >> pop/smtp and a homewritten mailet to connect to spamd through tcp. >> Yesterday I suddenly discovered load average peaks over 100 (!!!) on the

Re: spamassassin accuracy test

2008-01-28 Thread Matt Kettler
Hard Coder wrote: Hello, I decided to benchmark the accuracy of spamassassin. Is there anything special I should take into consideration before I start to flood with both ham and spam? It's probably easiest if you have them on disk and use the mass-check utility.

Re: is DOS_OUTLOOK_TO_MX too low?

2008-01-28 Thread Joseph Brennan
> For those that don't know it means "Delivered direct to MX with Outlook > headers". Sounds like a good rule: Outlook isn't a MTA so shouldn't be > able to connect directly to MX records - except for it's configured > SMTP server. I looked at our spam reports (spam that was not rejected).

Re: Spamd uses over 1 gigabyte of memory in one child

2008-01-28 Thread Matus UHLAR - fantomas
On 27.01.08 15:06, Sevrin Robstad wrote: > I have used spamassassin over a year on my mail server, using James as > pop/smtp and a homewritten mailet to connect to spamd through tcp. > Yesterday I suddenly discovered load average peaks over 100 (!!!) on the > server, and soon found this : > > 2261

spamassassin accuracy test

2008-01-28 Thread Hard Coder
Hello, I decided to benchmark the accuracy of spamassassin. Is there anything special I should take into consideration before I start to flood with both ham and spam? TIA, hc Never miss a thing. Make

Re: 'mx' appearing in the host portion of the return address

2008-01-28 Thread Matt Kettler
Arlyle Consulting wrote: Hi, I have a question, and possible feature request. I just installed SpamAssassin on my mail server a couple of days ago. I've been closely studying the messages that get by SA and are spam, and I've noticed something. Many of the messages that are spam that SA mi

RE: sa-update error wrong gpg key...

2008-01-28 Thread Steve Monkhouse
Hey guys.. We're seeing the same thing.. although slightly different.. this error has only been happening for a week or so now.. everything's been fine before that.. it seems to be with the RSA key generated on 15Jan.. An sa-update -D shows : [/usr/local/etc/mail/spamassassin]# sa-update -D [5

'mx' appearing in the host portion of the return address

2008-01-28 Thread Arlyle Consulting
Hi, I have a question, and possible feature request. I just installed SpamAssassin on my mail server a couple of days ago. I've been closely studying the messages that get by SA and are spam, and I've noticed something. Many of the messages that are spam that SA misses has return addresse