Re: Some messages not being checked by spamassassin - most are but a few get through

2009-09-25 Thread John Hardin
On Fri, 25 Sep 2009, John Hardin wrote: System tasks, like automatic restart of spamd after running sa_update. If a message it receiver during the brief window spamd is down, it may be passed unscanned. Ugh. ... if a message IS RECEIVED ... -- John Hardin KA7OHZhttp://w

Re: Report in header of SPAM emails

2009-09-25 Thread Martin Gregorie
On Fri, 2009-09-25 at 19:08 +0300, Jari Fredriksson wrote: > Well. SpamAssassin does not have a Quarantine. Something in your > system has, and that is what is calling the SpamAssassin. > I already told him that simscan is doing the quarantining. Thats definite. I'm also 98% certain that simscan

RE: porn portal spammers v2

2009-09-25 Thread John Hardin
On Fri, 25 Sep 2009, Guillaume Gelle wrote: Don't know what you mean by (?:) and backtracking tho, I'll double check the wiki page about syntax ;) Try this: uri URI_GOOG_READER m;^https?://(?:www\.)?google[\.,]com/reader/;i On Fri, 2009-09-25 at 09:30 +0200, Guillaume Gelle wrote: now, I'

Re: [sa] Some messages not being checked by spamassassin - most are but a few get through

2009-09-25 Thread Charles Gregory
On Fri, 25 Sep 2009, jmunjr wrote: Thanks Charles. Rats, I meant to say that the message sizes for these are as small or smaller than other messages getting checked. In fact I don't believe procmail even has a filesize limit(something I need to change). Any other thoughts ? If procmail invoke

Re: Some messages not being checked by spamassassin - most are but a few get through

2009-09-25 Thread John Hardin
On Fri, 25 Sep 2009, jmunjr wrote: The majority of email coming into my server (Centos5.2, postfix, dovecot) gets scanned and get the "X-Spam-Status" inserted just fine by spamassassin 3.2.4 but several get through with no spam header inserted. Any reasons why? Message size. How big are the

RE: porn portal spammers v2

2009-09-25 Thread Guillaume Gelle
That's right, I should have remove the parenthese, they serve nothing here. It's more in case of something comes later and add some "|" after reader, etc. Don't know what you mean by (?:) and backtracking tho, I'll double check the wiki page about syntax ;) Thanks, Guillaume >

Re: [sa] Some messages not being checked by spamassassin - most are but a few get through

2009-09-25 Thread jmunjr
Thanks Charles. Rats, I meant to say that the message sizes for these are as small or smaller than other messages getting checked. In fact I don't believe procmail even has a filesize limit(something I need to change). Any other thoughts ? Thanks again Charles Gregory wrote: > > On Fri, 25

Re: [sa] Some messages not being checked by spamassassin - most are but a few get through

2009-09-25 Thread Charles Gregory
On Fri, 25 Sep 2009, jmunjr wrote: The majority of email coming into my server (Centos5.2, postfix, dovecot) gets scanned and get the "X-Spam-Status" inserted just fine by spamassassin 3.2.4 but several get through with no spam header inserted. The lack of header, by definition, means that spam

Some messages not being checked by spamassassin - most are but a few get through

2009-09-25 Thread jmunjr
Hi I am new here. Thanks for the site and all the contributions you have all made. Read some of the posts but can't seem to figure this out. The majority of email coming into my server (Centos5.2, postfix, dovecot) gets scanned and get the "X-Spam-Status" inserted just fine by spamassassin 3.2.4

Use message size in a rule?

2009-09-25 Thread Rich Graves
For HTML content, we can check the length with eval:html_eval('length', '< 384') but I don't see anything similar for body or rawbody. For my purposes, the Content-Length from the spamc connection would do, but it doesn't seem to be exposed. I see at least two plugins looking at length: Ima

Re: Report in header of SPAM emails

2009-09-25 Thread Jari Fredriksson
> Hello > > if I restarted the spamd > You need more words when communicating ;) Does this mean the report still does not show up, even if you restarted SA after the setting? Well. SpamAssassin does not have a Quarantine. Something in your system has, and that is what is calling the SpamAssa

Re: partial (lazy) scoring? - run a second time?

2009-09-25 Thread RW
On Fri, 25 Sep 2009 12:32:35 + (UTC) ArtemGr wrote: > Benny Pedersen junc.org> writes: > > my former own mailhost have changed from spamassassin to dspam, less > > work for him and his users, and definaly lees work for his low > > budget quad xeon intel server with 6Gb ram and alot of > > d

Re: Two more SA/MySQL questions.

2009-09-25 Thread Kris Deugau
LuKreme wrote: But that ID would simply be the vpopmail user, not the individual email addresses that are in the MySQL map, right? It maps to whatever username spamc is passed, or the *nix UID spamassassin/spamc finds automatically. (I would *hope* you're using spamd/spamc in an environment

Re: [SA] MagicSpam

2009-09-25 Thread Adam Katz
Aaron Wolfe wrote: >> Even given a server that has these things, I'm surprised they >> have invented technology that can analyze a postfix install to >> the degree needed for correct installation of their product with >> no more than a single click. With tech like that, I can't >> believe they

RE: Report in header of SPAM emails

2009-09-25 Thread Luis campo
Hello if I restarted the spamd greetings > From: ja...@iki.fi > To: users@spamassassin.apache.org > Subject: Re: Report in header of SPAM emails > Date: Thu, 24 Sep 2009 15:58:58 +0300 > > > dears Srs, > > > > > > I have added the option report_safe 1, but the mail > > deposited in

Re: Understanding SpamAssassin

2009-09-25 Thread Bowie Bailey
poifgh wrote: > Bowie Bailey wrote: > >> For auto-learning, the high and low scoring messages are fed to Bayes. >> However, for an optimal setup, you should manually train Bayes on as >> much of your (verified) ham and spam as possible. The more of your mail >> stream Bayes sees, the better th

Re: partial (lazy) scoring? - run a second time?

2009-09-25 Thread ArtemGr
Benny Pedersen junc.org> writes: > fuzzyocr stop scanning if spam score is over a limit, why scan > ocr when spamassassin can do it without ocr ? Good to know. > it could maybe be a option to make spamassassin stop scanning in > generic if spam score is high ? > > there is alot of plugins tha

Re: 3.3.0 and sa-compile

2009-09-25 Thread Matt Kettler
to...@starbridge.org wrote: > Benny Pedersen a écrit : > > On fre 25 sep 2009 13:38:19 CEST, "to...@starbridge.org" wrote > > >> I've tested with SA 3.2.5 and it's working fine with Rule2XSBody > >> active. I've tried to delete compiled rules and compile again: > >> same result. > > forget to sa-co

Re: Two more SA/MySQL questions.

2009-09-25 Thread Benny Pedersen
On fre 25 sep 2009 13:50:45 CEST, LuKreme wrote How does a shared UID separate the individual accounts in the MySQL map into individual IDs in the MySQL bayes? it can only be done with unix users so far, eg have 2 unix users share one id in spamassassin set same username in user_prefs and thi

Re: 3.3.0 and sa-compile

2009-09-25 Thread to...@starbridge.org
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Benny Pedersen a écrit : > On fre 25 sep 2009 13:38:19 CEST, "to...@starbridge.org" wrote > >> I've tested with SA 3.2.5 and it's working fine with Rule2XSBody >> active. I've tried to delete compiled rules and compile again: >> same result. > > forget

Re: 3.3.0 and sa-compile

2009-09-25 Thread Benny Pedersen
On fre 25 sep 2009 13:38:19 CEST, "to...@starbridge.org" wrote I've tested with SA 3.2.5 and it's working fine with Rule2XSBody active. I've tried to delete compiled rules and compile again: same result. forget to sa-compile in 3.3 ? -- xpoint

Re: Understanding SpamAssassin

2009-09-25 Thread LuKreme
On 25-Sep-2009, at 03:56, Mark Martinec wrote: LuKreme wrote: Other surprises are that DKIM is pretty useless and SPF_PASS is actually a slight spam indicator. Benny Pedersen wrote: so without some whitelist_from_* dkim and spf will not be helpfull Indeed. Score points should be kept close t

Re: Two more SA/MySQL questions.

2009-09-25 Thread LuKreme
On 25-Sep-2009, at 03:14, Benny Pedersen wrote: On fre 25 sep 2009 00:49:36 CEST, LuKreme wrote Where that bayes_user let me store the email address for the MySQL/ postfixadmin users individually. id is a map to bayes_vars where you find username for the id But that ID would simply be the v

3.3.0 and sa-compile

2009-09-25 Thread to...@starbridge.org
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, i'm running SA 3.3.0 (3.3.0-alpha3-r808953) and i've some problem with compiled rules. sa-compile runs without errors, and SA seems to works fine when restarted. But some body rules are now not detected. exemple of simple body rule (for testing):

Re: porn portal spammers v2

2009-09-25 Thread McDonald, Dan
On Fri, 2009-09-25 at 09:30 +0200, Guillaume Gelle wrote: > Dear all, > > As usual, spammers improved and instead of receiving profiles|groups| > personnal.yahoo.com links, now, I'm being hit with > www.google.com/reader links. > (ie : href=3D"http://www.google.com/reader/item/tag:google.com,2005

Re: Understanding SpamAssassin

2009-09-25 Thread Mark Martinec
LuKreme wrote: > Other surprises are that DKIM is pretty useless and SPF_PASS is > actually a slight spam indicator. Benny Pedersen wrote: > so without some whitelist_from_* dkim and spf will not be helpfull Indeed. Score points should be kept close to zero for rules DKIM_SIGNED, DKIM_VALID and D

Re: Understanding SpamAssassin

2009-09-25 Thread Benny Pedersen
On fre 25 sep 2009 09:58:41 CEST, LuKreme wrote Other surprises are that DKIM is pretty useless and SPF_PASS is actually a slight spam indicator. you miss the point, there is no USER_IN_* so without some whitelist_from_* dkim and spf will not be helpfull if it was so you will have gived spam

Re: Two more SA/MySQL questions.

2009-09-25 Thread Benny Pedersen
On fre 25 sep 2009 00:49:36 CEST, LuKreme wrote Where that bayes_user let me store the email address for the MySQL/postfixadmin users individually. id is a map to bayes_vars where you find username for the id that way more then one email user can share one id user in bayes So, if I have us..

Re: Two more SA/MySQL questions.

2009-09-25 Thread Benny Pedersen
On tor 24 sep 2009 23:06:56 CEST, Jari Fredriksson wrote Bayes tables do not have user id or user name,so I guess they are meant for global: no per user bayes no. CREATE TABLE `bayes_token` ( `id` int(11) NOT NULL default '0', `token` char(5) NOT NULL default '', `spam_count` int(11) N

Re: Two more SA/MySQL questions.

2009-09-25 Thread Benny Pedersen
On tor 24 sep 2009 22:57:13 CEST, LuKreme wrote Is there a write-up/how-to anyone's put together about setting up bayes with MySQL? please read some docs first Is it possible to migrate existing bayes to MySQL, this is well explained in docs how to use --backup --restore in sa-learn --he

Re: Understanding SpamAssassin

2009-09-25 Thread LuKreme
On Sep 24, 2009, at 7:44 PM, poifgh wrote: For 101st mail, if the regex MEDICINE is unable to match the obfuscated text, then the mail would have a low score, but bayesian learner would say, seeing the words surrounding obfuscated text, that this mail is spam. Essentially this is how it wor

porn portal spammers v2

2009-09-25 Thread Guillaume Gelle
Dear all, As usual, spammers improved and instead of receiving profiles|groups|personnal.yahoo.com links, now, I'm being hit with www.google.com/reader links. (ie : http://www.google.com/reader/item/tag:google.com,2005:reader/ite=m/69a282969886af5e";>Haste to come) I took the firts rule submi