Re: sa-learn question

2008-03-12 Thread Hungry Snail
Site-wide is what i'm trying to setup, I guess i need to do some more googling :) -- View this message in context: http://www.nabble.com/sa-learn-question-tp16019261p16020836.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: sa-learn question

2008-03-12 Thread Matt Kettler
Hungry Snail wrote: Matt Kettler-3 wrote: Did you run it as the same user as the sa-learn? You might want to try the sa-learn again with -D to see what the debugging has to say. Bah, it works fine if I issue the command via the ssh. sa-learn --spam --configpath=/etc/mail/spamassa

Re: sa-learn question

2008-03-12 Thread Hungry Snail
Matt Kettler-3 wrote: > > Did you run it as the same user as the sa-learn? > You might want to try the sa-learn again with -D to see what the > debugging has to say. > Bah, it works fine if I issue the command via the ssh. sa-learn --spam --configpath=/etc/mail/spamassassin --showdots htt

Re: sa-learn question

2008-03-12 Thread Matt Kettler
Hungry Snail wrote: Hungry Snail wrote: Hi Guys, I am using spam/notspam via Squirrelmail If I mark an email as spam squirrelmail send this command. COMMAND USED TO REPORT: /usr/bin/sa-learn --spam --configpath=/etc/mail/spamassassin --showdots < /var/spool/squirrelmail/attach//sb_tmp_174_

Re: sa-learn question

2008-03-12 Thread Hungry Snail
Hungry Snail wrote: > > Hi Guys, > > I am using spam/notspam via Squirrelmail > > If I mark an email as spam squirrelmail send this command. > COMMAND USED TO REPORT: /usr/bin/sa-learn --spam > --configpath=/etc/mail/spamassassin --showdots < > /var/spool/squirrelmail/attach//sb_tmp_174_12053

Re: sa-learn question

2008-03-12 Thread Matt Kettler
Hungry Snail wrote: Hi Guys, I am using spam/notspam via Squirrelmail If I mark an email as spam squirrelmail send this command. COMMAND USED TO REPORT: /usr/bin/sa-learn --spam --configpath=/etc/mail/spamassassin --showdots < /var/spool/squirrelmail/attach//sb_tmp_174_1205370641 The result I

sa-learn question

2008-03-12 Thread Hungry Snail
Hi Guys, I am using spam/notspam via Squirrelmail If I mark an email as spam squirrelmail send this command. COMMAND USED TO REPORT: /usr/bin/sa-learn --spam --configpath=/etc/mail/spamassassin --showdots < /var/spool/squirrelmail/attach//sb_tmp_174_1205370641 The result I get is.. [0] => Learn

Warning messages on running sa-update

2008-03-12 Thread Chris Hoogendyk
Quick question, I hope. I just got things set up on one of my servers to run sa-update. I'm using the channelfile: updates.spamassassin.org 72_sare_redirect_post3.0.0.cf.sare.sa-update.dostech.net 70_sare_evilnum0.cf.sare.sa-update.dostech.net 70_sare_bayes_poison_nxm.cf.sare.sa-update.dostech.n

RE: "Nice girl like to chat" spam

2008-03-12 Thread Savoy, Jim
ItsMikeE wrote: > I have been running this rule for a day now, and am trapping > the spams with rules 1 and 2. I too just started running these rules, but noticed there were a lot more NICE_GIRL_02's than NICE_GIRL_01's being hit (about twice as many of the former). I think you need to change:

Re: Scanning without attachments

2008-03-12 Thread Randy Ramsdell
Henrik K wrote: On Wed, Mar 12, 2008 at 11:16:32AM -0400, Randy Ramsdell wrote: Henrik K wrote: On Wed, Mar 12, 2008 at 10:23:14AM -0400, Randy Ramsdell wrote: You can use spamassassin and clamav with or without Amavis, but to check the message, you must make a system wide c

Re: new version always trusts 127.0.0.1

2008-03-12 Thread Doug Poulin
Well here is the actual headers: Mar 11 13:48:20 x1mail spamd[6116]: spamd: result: Y 22 - DATE_IN_FUTURE_12_24, FORGED_MUA_OUTLOOK,HTML_MESSAGE,URIBL_AB_SURBL,URIBL_JP_SURBL,URIBL_OB_SURBL, URIBL_SC_SURBL scantime=17.6,size=3023,user=root,uid=501,required_score=3.0, rhost=localhost,raddr=127.0.0.

Re: new version always trusts 127.0.0.1

2008-03-12 Thread Matt Kettler
Doug Poulin wrote: Well here is the actual headers: Mar 11 13:48:20 x1mail spamd[6116]: spamd: result: Y 22 - DATE_IN_FUTURE_12_24, FORGED_MUA_OUTLOOK,HTML_MESSAGE,URIBL_AB_SURBL,URIBL_JP_SURBL,URIBL_OB_SURBL, URIBL_SC_SURBL scantime=17.6,size=3023,user=root,uid=501,required_score=3.0, rhost

RE: new version always trusts 127.0.0.1

2008-03-12 Thread James E. Pratt
> -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: Wednesday, March 12, 2008 11:14 AM > To: dougp23 > Cc: users@spamassassin.apache.org > Subject: Re: new version always trusts 127.0.0.1 > > dougp23 wrote: > > Hi. Running SA 3.1.8 > > > > Would like to move to a n

Re: Pyzor and cloudmark

2008-03-12 Thread Matus UHLAR - fantomas
On 12.03.08 16:30, R.Smits wrote: > Forget it > > I have just discovered DCC . > Looks a lot better :-) they are very different things. I advise using both (or, all three) > > Has anyone got experience with the spamassasin plugin from cloudmark ? > > > > Is anyone using pyzor ? -- Matus U

Re: Whitelist Question

2008-03-12 Thread Matus UHLAR - fantomas
On 12.03.08 10:41, [EMAIL PROTECTED] wrote: > Even though it did not meet SA's threshold, the e-mails are still going to > users Spam Box instead of their inbox. Maybe I should have made that more > clear , sorry for the confusion. it's not SA issue then. SA only classifies mail, it's something

Re: Pyzor and cloudmark

2008-03-12 Thread R.Smits
Forget it I have just discovered DCC . Looks a lot better :-) Sorry i've asked. Greetings... R.Smits wrote: > Hello, > > Has anyone got experience with the spamassasin plugin from cloudmark ? > > Is anyone using pyzor ? > > We are looking at these add-ons for spamasssassin. Pyzor looks o

Pyzor and cloudmark

2008-03-12 Thread R.Smits
Hello, Has anyone got experience with the spamassasin plugin from cloudmark ? Is anyone using pyzor ? We are looking at these add-ons for spamasssassin. Pyzor looks old... (last version from 2002) Greetings... Richard Smits Technical University Delft

RE: spam increase

2008-03-12 Thread Jason Bertoch
-Original Message- From: Mike Fahey [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 12, 2008 11:14 AM To: users@spamassassin.apache.org Subject: spam increase Has anyone else noticed a major increase in spam over the past two days? I'm seen a 40% increase. I've gone from blocking 60

Re: new version always trusts 127.0.0.1

2008-03-12 Thread Matt Kettler
dougp23 wrote: Hi. Running SA 3.1.8 Would like to move to a newer version for a few reasons... Anyways the 3.2.3 version looks compelling, but I use a mailserver called Scalix. It uses Sendmail as its engine. But each X-Spam header shows this: rhost=localhost,raddr=127.0.0.1,rport=34757,

Re: Scanning without attachments

2008-03-12 Thread Randy Ramsdell
Henrik K wrote: On Wed, Mar 12, 2008 at 10:23:14AM -0400, Randy Ramsdell wrote: You can use spamassassin and clamav with or without Amavis, but to check the message, you must make a system wide change that will affect every message. Bypassing file size limits with any of those setups might

RE: spam increase

2008-03-12 Thread Jason Staudenmayer
I have, most of from countries I block to a spam trap folder for bayes. > -Original Message- > From: Mike Fahey [mailto:[EMAIL PROTECTED] > Sent: Wednesday, March 12, 2008 11:14 AM > To: users@spamassassin.apache.org > Subject: spam increase > > > Has anyone else noticed a major increase i

spam increase

2008-03-12 Thread Mike Fahey
Has anyone else noticed a major increase in spam over the past two days? I'm seen a 40% increase.

Re: SA UNPARSEABLE_RELAY when host name in ( ) causes whitelist_from_rcvd to be ignored

2008-03-12 Thread SM
At 03:57 12-03-2008, Steve Radich wrote: I'm unclear if this is RFC compliant or not, the specs DO say in Section 3.8.2 "environments may not conform eactly to this specification" - see other RFC references.. SpamAssassin doesn't verify RFC compliance. The following line causes UNPARSEABLE_RE

Re: Scanning without attachments

2008-03-12 Thread Justin Mason
Drew Burchett writes: > I've noticed a new trend in spam on my mail server that is getting by > SpamAssassin. The spammer is creating his message and then attach a > couple of garbage PDFs to the email. These PDFs make it too large for > SpamAssassin to scan the message, so it gets by the system

Re: Milter (spamassassin): timeout before data read

2008-03-12 Thread Sebastian Hoffmann
YES MAN! Thanks a lot!!! That was my mistake. I'm wondering why I haven't found that comment on that page... But... ymmd! Thank you :-) am 12.03.2008 15:32 schrieb Jared Hall: Sebastian Hoffmann wrote: Hi! I'm using the spamass-milter 0.3.1. I searched in the milter's man-page for a command

Re: Whitelist Question

2008-03-12 Thread JDavila
John , Even though it did not meet SA's threshold, the e-mails are still going to users Spam Box instead of their inbox. Maybe I should have made that more clear , sorry for the confusion. Jeremy Davila Systems Administrator Direct: 646-205-2136 The LanguageWorks, Inc. 1123 Broadway, Suite

Re: Milter (spamassassin): timeout before data read

2008-03-12 Thread Jared Hall
Sebastian Hoffmann wrote: Hi! I'm using the spamass-milter 0.3.1. I searched in the milter's man-page for a command to specify the timeout but didn't find anything. I also had a look at the options that are possible to set when executing the ./configure.sh before starting "make" and "make in

Re: Scanning without attachments

2008-03-12 Thread Randy Ramsdell
Henrik K wrote: On Wed, Mar 12, 2008 at 09:48:37AM -0400, Randy Ramsdell wrote: Drew Burchett wrote: I've noticed a new trend in spam on my mail server that is getting by SpamAssassin. The spammer is creating his message and then attach a couple of garbage PDFs to the email. These PDF

Re: dcc SA problem

2008-03-12 Thread Benny Pedersen
On Mon, March 10, 2008 14:11, Anatoly Pugachev wrote: > /etc/mail/spamassassin/local.cf have following directives: > loadplugin Mail::SpamAssassin::Plugin::DCC remove this line in local.cf find the plugin in one of the *.pre files and enable the plugin from there should fix the problem Benny

Re: SpamAssassin GUI

2008-03-12 Thread Randy Ramsdell
Peter Kingsbury wrote: Hello, Since installing SpamAssassin on my company’s Exchange server, I wanted to make kludging through potential spam/ham messages faster than using the slow remote desktop interface that is in place. I wrote a program which allows an admin to quickly scan SA-filtere

Re: [spamassassin] Re: [spamassassin] Re: How to report 120, 000 spams a day

2008-03-12 Thread Benny Pedersen
On Sun, March 9, 2008 19:01, Tuc at T-B-O-H.NET wrote: > I guess I'm still not being clear. There are 120K emails a day coming > to INVALID EMAIL ADDRESSES THAT NEVER EXISTED. this is a ERROR IN YOUR DUMP SENDMAIL :=) > [EMAIL PROTECTED] nobody FIX IT ! Benny Pede

Re: Scanning without attachments

2008-03-12 Thread Randy Ramsdell
Drew Burchett wrote: I've noticed a new trend in spam on my mail server that is getting by SpamAssassin. The spammer is creating his message and then attach a couple of garbage PDFs to the email. These PDFs make it too large for SpamAssassin to scan the message, so it gets by the system. I hav

Scanning without attachments

2008-03-12 Thread Drew Burchett
I've noticed a new trend in spam on my mail server that is getting by SpamAssassin. The spammer is creating his message and then attach a couple of garbage PDFs to the email. These PDFs make it too large for SpamAssassin to scan the message, so it gets by the system. I have tried turning up the

new version always trusts 127.0.0.1

2008-03-12 Thread dougp23
Hi. Running SA 3.1.8 Would like to move to a newer version for a few reasons... Anyways the 3.2.3 version looks compelling, but I use a mailserver called Scalix. It uses Sendmail as its engine. But each X-Spam header shows this: rhost=localhost,raddr=127.0.0.1,rport=34757, Which makes me th

Re: Improving a spam report?

2008-03-12 Thread Randy Ramsdell
mouss wrote: Matus UHLAR - fantomas wrote: On 11.03.08 12:16, Jay Langley wrote: Below I have offered the content of my spam score report generated by Spam Assassin. We are Kintera subscribers. Problem is I don't know how to make changes in the text that will result in a better score.

Re: Milter (spamassassin): timeout before data read

2008-03-12 Thread Sebastian Hoffmann
Hi! I'm using the spamass-milter 0.3.1. I searched in the milter's man-page for a command to specify the timeout but didn't find anything. I also had a look at the options that are possible to set when executing the ./configure.sh before starting "make" and "make install" but... nothing to se

Re: Improving a spam report?

2008-03-12 Thread mouss
Matus UHLAR - fantomas wrote: On 11.03.08 12:16, Jay Langley wrote: Below I have offered the content of my spam score report generated by Spam Assassin. We are Kintera subscribers. Problem is I don't know how to make changes in the text that will result in a better score. you shoul

Re: Multiple Images spam

2008-03-12 Thread --[ UxBoD ]--
Botnet just pushed it over for is :- Content analysis details: (8.3 points, 5.0 required) pts rule name description -- -- 3.0 URIBL_BLACKContains an URL listed in the URIBL blacklist

SA UNPARSEABLE_RELAY when host name in ( ) causes whitelist_from_rcvd to be ignored

2008-03-12 Thread Steve Radich
I'm unclear if this is RFC compliant or not, the specs DO say in Section 3.8.2 "environments may not conform eactly to this specification" - see other RFC references.. The following line causes UNPARSEABLE_RELAY: Received: from host1.internal (host1.internal) by host2.internal (63.218.155.52) wit

Re: Improving a spam report?

2008-03-12 Thread Matus UHLAR - fantomas
On 11.03.08 12:16, Jay Langley wrote: > Below I have offered the content of my spam score report generated by > Spam Assassin. We are Kintera subscribers. Problem is I don't know > how to make changes in the text that will result in a better score. you should turn on network rules, allow plugi

Multiple Images spam

2008-03-12 Thread Dan Barker
I'm seeing a lot of image spam, but the images are not individually spammy. There are 5 tall, skinny images that together sell colon cleansing, or some such. Any ideas? Spam scores quite low, so far. Dan Sample: http://www.visioncomm.net/5image.txt Report: X-Spam-Level: *** X-Spam-Status: No,

Re: SpamAssassin hogs the CPU

2008-03-12 Thread FC Mario Patty
Well Justin, actually I have. I just don't understand the sa-compile thing or where to replace spamassassin with spamc, since I cannot find the phrase 'spamassassin' in my /etc/init.d/spamassassin or in /etc/sysconfig/mail/spamassassin (also in the qmail/smtpd's run file). I do have used dnscache

Re: SA Windows Version stable? (was: How to update 3.1.7 to new version)

2008-03-12 Thread Matthias Haegele
Sg schrieb: Hi I am using SA 3.1.7 in MS Exchange Server. Yesterday 80,000 spam messages cloggin the system. Can anyone tell me, why suddenly getting lot of spam mails. we need to update the SA or update the rules.. Please tell me how to update SA in windows? btw: What are your experiences

Improving a spam report?

2008-03-12 Thread Jay Langley
Greetings, Below I have offered the content of my spam score report generated by Spam Assassin. We are Kintera subscribers. Problem is I don't know how to make changes in the text that will result in a better score. Could you send me someplace to learn what different scores mean and how to

Re: SpamAssassin hogs the CPU

2008-03-12 Thread Justin Mason
have you read the FAQ? http://wiki.apache.org/spamassassin/FasterPerformance --j. FC Mario Patty writes: > Guys, > > I updated my spamassassin to SpamAssassin version 3.2.4 that running on > Perl version 5.8.5 in a hope that spamd wouldn't kill my CPU again. Once > in less-or-more an hour user

error: syswrite() to parent failed: Broken pipe ... ( i have not understood )

2008-03-12 Thread Agnello George
On my spamassissin server i got the following error what is actually went wrong here !! Wed Mar 12 14:58:28 2008 [3130] error: syswrite() to parent failed: Broken pipe at /usr/lib/perl5/site_perl/5.8.8/Mail/

Re: Whitelist Question

2008-03-12 Thread Matus UHLAR - fantomas
On 11.03.08 17:26, [EMAIL PROTECTED] wrote: > Here is the full header. But also the local.cf has around 12000 entries, > is that a problem. WHAT? 12000 entries? What the hell are you doing with that? > Received: from smtp1.citigroup.com ([199.67.179.116] > helo=mail.citigroup.com) >

Re: DCC

2008-03-12 Thread Anatoly Pugachev
you should also local DCC plugin before this directives, try to place loadplugin Mail::SpamAssassin::Plugin::DCC before any dcc commands in local.cf file On Wed, Mar 12, 2008 at 11:40:19AM +0530, Tarak Ranjan wrote: > Hi All, > I have installed dcc-1.3.85 , and my local.cf file is > use_dcc 1

Re: DCC

2008-03-12 Thread FC Mario Patty
Have you unchecked the line below in your /etc/mail/spamassassin/v310.pre? I don't use DCC so I don't bother change mine, but I've read somewhere in the mlist repository saying that. :) # DCC - perform DCC message checks. # # DCC is disabled here because it is not open source. See the DCC # licen

Re: SpamAssassin GUI

2008-03-12 Thread Matthias Haegele
Peter Kingsbury schrieb: Hello, Since installing SpamAssassin on my company's Exchange server, I wanted to make kludging through potential spam/ham messages faster than using the slow remote desktop interface that is in place. I wrote a program which allows an admin to quickly scan SA-

Re: How to update 3.1.7 to new version

2008-03-12 Thread Matthias Haegele
Sg schrieb: Hi I am using SA 3.1.7 in MS Exchange Server. Yesterday 80,000 spam messages cloggin the system. Can anyone tell me, why suddenly getting lot of spam mails. we need to update the SA or update the rules.. Please tell me how to update SA in windows? http://wiki.apache.org/spamass