Re: A few basic questions about custom rules

I received answers to my questions off-list, so I'll reply to myself and share them with the rest of everyone. :) > describe CJB_ESHOP_GR Contains reference to e-shop.gr > header CJB_ESHOP_GR ALL =~ /e-shop\.gr/i > score CJB_ESHOP_GR 0.01 > >The efficiency and wisdom of matching against any

Re: Relay Country on SA 3.3.1

- Original Message - From: "Daniel Lemke" To: Sent: Friday, 2010/March/26 06:59 Subject: Re: Relay Country on SA 3.3.1 Kaleb Hosie wrote: Before I upgraded to 3.3.1 I had the relay country ruleset installed and enabled. In my local.cf file, here's a few lines I have: header REL

A few basic questions about custom rules

Hey folks, I'm playing around with writing some rules, something I've never done before. I'm not looking to do anything fancy, I just wanted to learn how to do it. So, I picked one of my spams at total random, and wanted to match on "e-shop.gr" in any of the headers. The rule, I believe,

Re: SA rules don't seem to be getting hit

On 27.3.2010 0:44, Brody wrote: > Hi, > > I've got a linux box running sa 3.2.5 > > normally sa is invoked via amavis, however for this test I'm running it > via spamassassin -D > It seems that sa isn't hitting any of the more useful rules i.e. ones > that should cause it to increase the score.

Re: KHOP_RCVD_TRUST

On Fri, 2010-03-26 at 11:35 -0400, Michael Scheidell wrote: > so, who is KHOP? I looked in rule sets and don't know them. were these > rules inherited form some outside trusted source? grep -lr KHOP trunk/rules* -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";

Re: KHOP_RCVD_TRUST

On Fri, 2010-03-26 at 11:35 -0400, Michael Scheidell wrote: > > On 3/26/10 10:41 AM, Dennis B. Hopp wrote: > > I received the following e-mail > > > > http://pastebin.com/JXr9buxi > > > > It had a total score of 4.973 (blocked at 5). Among other rules it hit: > > > > KHOP_RCVD_TRUST=-1.75,RCVD_I

Re: dumb question, opinion about KHOP_SC_TOP200 and 5.3 point score?

On 3/26/10 7:39 AM, Michael Scheidell wrote: OnI can't think of a way for the GA to know that the rule contains the same info as a DNSBL test. There are rule overlap stats, but I don't think that would be enough with only a small number of ham occurrences. https://issues.apache.org/SpamAssa

Re: KHOP_RCVD_TRUST

On 3/26/10 10:41 AM, Dennis B. Hopp wrote: I received the following e-mail http://pastebin.com/JXr9buxi It had a total score of 4.973 (blocked at 5). Among other rules it hit: KHOP_RCVD_TRUST=-1.75,RCVD_IN_DNSWL_MED=-0.5,SPF_PASS=-0.001 is that an old rule? i just checked SA updates, a

Re: KHOP_RCVD_TRUST

"Dennis B. Hopp" writes: > I received the following e-mail > > http://pastebin.com/JXr9buxi > > It had a total score of 4.973 (blocked at 5). Among other rules it hit: > > KHOP_RCVD_TRUST=-1.75,RCVD_IN_DNSWL_MED=-0.5,SPF_PASS=-0.001 > > So is the KHOP_RCVD_TRUST score too low? Should I possibl

KHOP_RCVD_TRUST

I received the following e-mail http://pastebin.com/JXr9buxi It had a total score of 4.973 (blocked at 5). Among other rules it hit: KHOP_RCVD_TRUST=-1.75,RCVD_IN_DNSWL_MED=-0.5,SPF_PASS=-0.001 So is the KHOP_RCVD_TRUST score too low? Should I possibly consider making that -0.75 or something?

Re: has SA 3.3.1 been recalled?

On Fri, 26 Mar 2010, Daniel Lemke wrote: Mathias Homann wrote: I'm trying to get the 3.3.1 source frm the website, but so far all mirrors replied "file not found"... what's up with that? Hm for me too... But you can still get it from CPAN: http://search.cpan.org/~jmason/Mail-SpamAssassin-3

Re: The Impossible Rule??? Bug???

On Fri, 2010-03-26 at 14:37 +0100, Jonas Eckerman wrote: > On 2010-03-24 14:34, Martin Gregorie wrote: > > >> It's named MimeMagic and is available at > >> > >> > > Thanks, Jonas. That looks very useful. I've replaced my old > > IMAGE_MISMATCH ru

Re: Relay Country on SA 3.3.1

Kaleb Hosie wrote: > > Before I upgraded to 3.3.1 I had the relay country ruleset installed and > enabled. In my local.cf file, here's a few lines I have: > > header RELAYCOUNTRY_CN X-relay-countries =~ /CN/ > describe RELAYCOUNTRY_CN Relayed through China > score RELAYCOUNTRY_CN 5 > > add_hea

Relay Country on SA 3.3.1

Before I upgraded to 3.3.1 I had the relay country ruleset installed and enabled. In my local.cf file, here's a few lines I have: header RELAYCOUNTRY_CN X-relay-countries =~ /CN/ describe RELAYCOUNTRY_CN Relayed through China score RELAYCOUNTRY_CN 5 add_header all Relay-Country _RELAYCOUNTRY_

Re: The Impossible Rule??? Bug???

On 2010-03-24 14:34, Martin Gregorie wrote: It's named MimeMagic and is available at Thanks, Jonas. That looks very useful. I've replaced my old IMAGE_MISMATCH rule with an equivalent based on MimeMagic that uses: Please make sure to evalua

FP on FH_HAS_XID

I just had one of the very rare FPs, partly because of FH_HAS_XID (score of 1.78). >From the message it looks like this is either inserted by Microsoft Outlook 11 or by T-Online. I think the latter is the case. Maybe some T- Online user here could shed light on this? If I'm right that means that

Re: Bayes is causing MySQL performance issues

On Fri, 26 Mar 2010, Martin Svensson wrote: As I mentioned in my first email the total number of email/day hasn't changed and the config is the same. We even wiped the whole bayes database and within 12 hours the I/O wait and average load on the database server were much higher than usual - an

Re: dumb question, opinion about KHOP_SC_TOP200 and 5.3 point score?

On 3/25/10 5:30 PM, Daryl C. W. O'Shea wrote: On 25/03/2010 2:26 PM, Michael Scheidell wrote: score KHOP_SC_TOP2003.999 2.65 3.999 2.65 I can't think of a way for the GA to know that the rule contains the same info as a DNSBL test. There are rule overlap sta

Re: has SA 3.3.1 been recalled?

oh, and no -- SA 3.3.1 has not been recalled! On Fri, Mar 26, 2010 at 10:20, Justin Mason wrote: > all active mirrors should be updated by now.  if anyone runs into this, just > save yourself the bother and immediately switch to > http://www.apache.org/dist/spamassassin/source/ and download direc

Re: has SA 3.3.1 been recalled?

all active mirrors should be updated by now. if anyone runs into this, just save yourself the bother and immediately switch to http://www.apache.org/dist/spamassassin/source/ and download directly from the source. Then, please reply with the URL of the broken mirror and we'll ask infra to remove

Re: has SA 3.3.1 been recalled?

Mathias Homann wrote: > > now i get this: > > NOTE: the optional Mail::DKIM module is installed (0.36), > but is below the recommended version 0.37, > some functionality may not be available, > and some of the tests in the SpamAssassin test suite may fail. > > > ... 0.36 is the latest release

Re: Bayes is causing MySQL performance issues

Hi, We are still facing these issues and I've received a few emails from other people experiencing the same problem. Can it be a bug in bayes causing the number of queries/email to be 3 times as high as usual? As I mentioned in my first email the total number of email/day hasn't changed and the

Re: has SA 3.3.1 been recalled?

Am Freitag, 26. März 2010 10:27:41 schrieb Daniel Lemke: > Mathias Homann wrote: > > I'm trying to get the 3.3.1 source frm the website, but so far all > > mirrors replied "file not found"... > > > > > > what's up with that? > > > > > > bye, > > MH > > Hm for me too... > > But you can still g

Re: has SA 3.3.1 been recalled?

Mathias Homann wrote: > > I'm trying to get the 3.3.1 source frm the website, but so far all mirrors > replied "file not found"... > > > what's up with that? > > > bye, > MH > > Hm for me too... But you can still get it from CPAN: http://search.cpan.org/~jmason/Mail-SpamAssassin-3.3.1/

has SA 3.3.1 been recalled?

I'm trying to get the 3.3.1 source frm the website, but so far all mirrors replied "file not found"... what's up with that? bye, MH