Re: Any other tuning tricks or is this it?

2008-10-16 Thread Dirk Bonengel
Len Conrad schrieb: FreeBSD 6.2 2 GHz 1 GB RAM More RAM won't hurt Amavisd-new 400 KB max msg size to scan 10 servers TIMING shows sa-check taking 85% - 90% How many concurrent processes have you set in your postfix's master.cf to forward messages to? Your setting for the amavisd-vs

RE: Any other tuning tricks or is this it?

2008-10-16 Thread Len Conrad
>Are you using your provider's DNS server? no, BIND on the local machine, no forwarding. As I mentioned, we are doing RBL check in a policy service also, so RBL checks in SA will be answered from local cache. Len __ IMGate OpenSource Mail Firewal

Re: Any other tuning tricks or is this it?

2008-10-16 Thread Len Conrad
>On 16/10/2008 8:57 PM, Len Conrad wrote: >> FreeBSD 6.2 >> 2 GHz >> 1 GB RAM > >> In business hours (08:00-17:00), traffic inbound is about 400 msgs/hour > >400 msgs/hr for a 2GHz processor shouldn't really even show up as >noticible load. glad to hear it. >You haven't really said what in par

RE: Any other tuning tricks or is this it?

2008-10-16 Thread Jason J. Ellingson
Are you using your provider's DNS server? I noticed that for many of my clients, if I ran my own DNS server (that went out to root instead of falling forward to ISP's DNS server), my scan times went DRASTICALLY down. It is pretty trivial to set up a DNS server (don't do just DNSmasq, or other sim

Re: Any other tuning tricks or is this it?

2008-10-16 Thread Daryl C. W. O'Shea
On 16/10/2008 8:57 PM, Len Conrad wrote: > FreeBSD 6.2 > 2 GHz > 1 GB RAM > In business hours (08:00-17:00), traffic inbound is about 400 msgs/hour 400 msgs/hr for a 2GHz processor shouldn't really even show up as noticible load. You haven't really said what in particular is taking long or how

Re: Any other tuning tricks or is this it?

2008-10-16 Thread Len Conrad
> >Are you using shortcircuit? no. I'll look into it >Also you might graylisting with a very short retry time. That can >reduce incoming spam 20+% or so. We already run greylisting and envelope policies before amavis content-filter, so our content-scanning is see only about 10% of the raw MX t

Re: German for the backscatter-plagued

2008-10-16 Thread Matt Kettler
+1 for dropping this thread. However, as a SpamAssassin Project Management Committee (PMC) member I do feel a short statement about the policies of this list is needed here. CC + post is the normal commonly accepted format for this list, and is the manner in which most members of the SpamAssassin

Re: URIBL_BLACK

2008-10-16 Thread Matt Kettler
Kris Deugau wrote: > Matt Kettler wrote: >> I just tested this, and it works perfectly on my system. I added this >> line to my local.cf: >>score URIBL_SC_SURBL (1.5) >> >> And that rule jumped from 0.5 to 2.0 in a test message. > > Yes, that works fine. What doesn't work is where the "sco

RE: Any other tuning tricks or is this it?

2008-10-16 Thread Michael Hutchinson
> -Original Message- > From: Len Conrad [mailto:[EMAIL PROTECTED] > Sent: 17 October 2008 1:58 p.m. > To: users@spamassassin.apache.org > Subject: Any other tuning tricks or is this it? > > > FreeBSD 6.2 > 2 GHz > 1 GB RAM > > Amavisd-new > 400 KB max msg size to scan > 10 servers > TIMI

Any other tuning tricks or is this it?

2008-10-16 Thread Len Conrad
FreeBSD 6.2 2 GHz 1 GB RAM Amavisd-new 400 KB max msg size to scan 10 servers TIMING shows sa-check taking 85% - 90% spamassassin: rulesets: updates.spamassassin.org saupdates.openprotect.com sought.rules.yerp.org We run sa-compile. external checks: pyzor, razor, dcc bayes uses Berkeley

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread John Hardin
On Thu, 16 Oct 2008, Eric Foster wrote: i understand it works with a normal email : ) but the thing is, it didn't work when the email body was an attachment : ) i'll send you the original email tomorrow that made it's way through and you see if you get it. If the attachment was small it wou

Re: URIBL_BLACK

2008-10-16 Thread Kris Deugau
Karsten Bräckelmann wrote: Unlike regular score lines for non-existent rules (which are kind of ignored), the relative score adjustment depends on the rule to be defined before. Given your demo rule above, Nominally live, actually. I've had perfectly legitimate staff email hitting FORGED_MUA

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread John Hardin
On Thu, 16 Oct 2008, Eric Foster wrote: hehe, yes indeed i'm putting the proper domain in : ) in fact here's the actual rule: uri spam_domains_22 /contendosystems\.com\.ar|fincharacter\.net|efficientx\.info| gr8rliving\.com|thebuysell\.com|hottomorrow\.com|vrolone\.com| eastbayventure\.com|b

Re: URIBL_BLACK

2008-10-16 Thread Karsten Bräckelmann
On Thu, 2008-10-16 at 17:10 -0400, Kris Deugau wrote: > Yes, that works fine. What doesn't work is where the "score RULE (adj)" > entry is in a channel ruleset, and the original rule is in a different > channel or the stock ruleset. > > At least, as of last time I tried that was the case. And

Re: URIBL_BLACK

2008-10-16 Thread Kris Deugau
Matt Kettler wrote: I just tested this, and it works perfectly on my system. I added this line to my local.cf: score URIBL_SC_SURBL (1.5) And that rule jumped from 0.5 to 2.0 in a test message. Yes, that works fine. What doesn't work is where the "score RULE (adj)" entry is in a cha

Re: Deadlink

2008-10-16 Thread SM
Hi Martin, At 15:01 14-10-2008, [EMAIL PROTECTED] wrote: on this page -> http://wiki.apache.org/spamassassin/ReportingSpam is this link -> http://gtmp.org/pub/sa-postfix.en.html dead. It's a Wiki. You can edit that page and remove the link. http://wiki.apache.org/spamassassin/CollaborativeMan

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread McDonald, Dan
On Thu, 2008-10-16 at 13:02 -0700, linuxbox wrote: > are you saying that uri will work if the message is an attachment? What attachment? The example you showed had multipart/alternative. The only attachment was a small image. > because i tried this: > > uri spam_domains_22 /baddomain\.com/i >

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread John Hardin
On Thu, 16 Oct 2008, linuxbox wrote: because i tried this: uri spam_domains_22 /baddomain\.com/i score spam_domains_22 20 and that did not work... That surely should work. Silly question, forgive me, but... you _are_ putting your chosen evil domain name in place of "baddomain" for testing

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread linuxbox
are you saying that uri will work if the message is an attachment? because i tried this: uri spam_domains_22 /baddomain\.com/i score spam_domains_22 20 and that did not work. McDonald, Dan wrote: > > On Thu, 2008-10-16 at 08:02 -0700, linuxbox wrote: >> Hello there.

Re: PSBL rsync server is Down ?

2008-10-16 Thread Ned Slider
mouss wrote: ram a écrit : I dont seem to get any updates from PSBL rsync site. I have tried rsyncing from different servers by I get no results The rsync server mentioned provides no updates at all http://psbl.surriel.com/howto/ Is this the sign of yet another dead DNSBL ? works fro

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread John Hardin
On Thu, 16 Oct 2008, Randy wrote: John Hardin wrote: How does the MTA block on a domain name _in the message body_ without passing it to a filtering application? Postfix can do this so my suggestion stands. Look for body_checks in Postfix. I wasn't aware postfix had that as a builtin. I

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread John Hardin
On Thu, 16 Oct 2008, mouss wrote: John Hardin a écrit : On Thu, 16 Oct 2008, Randy wrote: McDonald, Dan wrote: On Thu, 2008-10-16 at 08:02 -0700, linuxbox wrote: rawbody spam_domains /blockeddomain\.com/i uri spam_domains /blockeddoamin\.com/i If you need to block a domain from send

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread Randy
John Hardin wrote: On Thu, 16 Oct 2008, Randy wrote: McDonald, Dan wrote: On Thu, 2008-10-16 at 08:02 -0700, linuxbox wrote: > rawbody spam_domains /blockeddomain\.com/i uri spam_domains /blockeddoamin\.com/i If you need to block a domain from sending e-mail, then use the mail server to h

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread mouss
John Hardin a écrit : > On Thu, 16 Oct 2008, Randy wrote: > >> McDonald, Dan wrote: >>> On Thu, 2008-10-16 at 08:02 -0700, linuxbox wrote: >>> >>> > rawbody spam_domains /blockeddomain\.com/i >>> >>> uri spam_domains /blockeddoamin\.com/i >> >> If you need to block a domain from sending e-mail,

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread John Hardin
On Thu, 16 Oct 2008, Randy wrote: McDonald, Dan wrote: On Thu, 2008-10-16 at 08:02 -0700, linuxbox wrote: > rawbody spam_domains /blockeddomain\.com/i uri spam_domains /blockeddoamin\.com/i If you need to block a domain from sending e-mail, then use the mail server to handle it. It is b

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread Jeff Mincy
From: linuxbox <[EMAIL PROTECTED]> Date: Thu, 16 Oct 2008 08:02:23 -0700 (PDT) Hello there. I have a problem with blocking an email with spamassassin. normally when i want to block a domain in an email, be it html or plain text i would have a rule such as this, and this works p

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread Randy
McDonald, Dan wrote: On Thu, 2008-10-16 at 08:02 -0700, linuxbox wrote: Hello there. I have a problem with blocking an email with spamassassin. normally when i want to block a domain in an email, be it html or plain text i would have a rule such as this, and this works perfectly: rawbody s

Re: How do i block email with a domain in a message like this?

2008-10-16 Thread McDonald, Dan
On Thu, 2008-10-16 at 08:02 -0700, linuxbox wrote: > Hello there. I have a problem with blocking an email with spamassassin. > normally when i want to block a domain in an email, be it html or plain text > i would have a rule such as this, and this works perfectly: > > rawbody spam_domains /bloc

Re: German for the backscatter-plagued

2008-10-16 Thread Benny Pedersen
On Thu, October 16, 2008 11:16, Justin Mason wrote: > +1. This is not a useful topic for this forum. Please drop it. drop sending cc when you olso post on maillist -- Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: PSBL rsync server is Down ?

2008-10-16 Thread mouss
ram a écrit : > I dont seem to get any updates from PSBL rsync site. > I have tried rsyncing from different servers by I get no results > > The rsync server mentioned provides no updates at all > > http://psbl.surriel.com/howto/ > > > Is this the sign of yet another dead DNSBL ? > works f

RE: PSBL rsync server is Down ?

2008-10-16 Thread Rasmus Haslund
>From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] >Sent: 16. oktober 2008 15:22 >To: Rasmus Haslund >Cc: users@spamassassin.apache.org >Subject: Re: PSBL rsync server is Down ? > >PSBL is run by Rik Van Riel, not Al Iverson. Thanks for pointing that out - I was not aware of that, but perha

Re: PSBL rsync server is Down ?

2008-10-16 Thread Justin Mason
Rasmus Haslund writes: > >From: ram [mailto:[EMAIL PROTECTED] > >Sent: 16. oktober 2008 13:15 > >To: users@spamassassin.apache.org > >Subject: PSBL rsync server is Down ? > > > >I dont seem to get any updates from PSBL rsync site. > >I have tried rsyncing from different servers by I get no result

RE: PSBL rsync server is Down ?

2008-10-16 Thread Rasmus Haslund
>From: ram [mailto:[EMAIL PROTECTED] >Sent: 16. oktober 2008 13:15 >To: users@spamassassin.apache.org >Subject: PSBL rsync server is Down ? > >I dont seem to get any updates from PSBL rsync site. >I have tried rsyncing from different servers by I get no results We are experiencing exactly the sa

PSBL rsync server is Down ?

2008-10-16 Thread ram
I dont seem to get any updates from PSBL rsync site. I have tried rsyncing from different servers by I get no results The rsync server mentioned provides no updates at all http://psbl.surriel.com/howto/ Is this the sign of yet another dead DNSBL ? Thanks Ram

Deadlink

2008-10-16 Thread martin
Hey, on this page -> http://wiki.apache.org/spamassassin/ReportingSpam is this link -> http://gtmp.org/pub/sa-postfix.en.html dead. Kind regards, Martin. -- Lust auf Oldtimer? Dann --> http://www.oldtimerszene-brandenburg.de Dort gibt es ein Register mit Händler- und Herstelleradressen, Clubs,

since restart: identified spam doesn't get X-Spam-Headerfields

2008-10-16 Thread Gregor Dschung
Hi all, My mails are piped by postfix to maildrop which forwards the mail to spamc. The relevant part of /etc/maildroprc is appended. Spamassassin uses the "report_safe 1" option. Now since I restarted my server, I've the following issue: Many mails are scanned and handled as usual. When spamd sa

Re: German for the backscatter-plagued

2008-10-16 Thread Justin Mason
mouss writes: > Benny Pedersen a écrit : > > On Wed, October 15, 2008 17:03, mouss wrote: > >> you'll find that knowledgeable members do Cc. > > lies > > Don't trust my words. check the archives: > > - SA: Justin Mason, Matt Kettler, John Hardin, ... > - postfix: Wietse (yes, the author of postf

Re: spam score not counted correctly

2008-10-16 Thread Benedict Verheyen
Mark Martinec wrote: > The updated patch is now attached to > https://issues.apache.org/SpamAssassin/show_bug.cgi?id=3364 > (replaces my previous two). > > In addition to previous tests, it now also resets corrupted AWL > record when it sees one. > >> I don't know if it's an option but i could