Fw: Spamassassion for each site

2010-08-11 Thread nonlin
Well I am not out of the Dog House yet. So, by some miracle I was able to get yum to work and was able to use it to update Spamassassion. I was so happy because this was the safest way to do this. But yum didn't have ver 3.3 available so I was able to update to: SpamAssassin version 3.2.4 runnin

Re: AWL demoted??

2010-08-11 Thread Matt Kettler
On 8/11/2010 1:30 PM, RW wrote: On Wed, 11 Aug 2010 07:48:11 -0400 Matt Kettler wrote: 1) lack of expiry process causes unbounded database growth. There's a script to clean out single-hit entries, but multi-hit persist forever, even when stale. (there are no timestamps on entries, so expiry i

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread John Hardin
On Thu, 12 Aug 2010, Karsten Br?ckelmann wrote: On Wed, 2010-08-11 at 17:30 -0400, Bowie Bailey wrote: In case anyone else is following this... The sa-update process made things a bit more complex than simply renaming the file after updates. If that's all you do, then sa-update loses track of

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread John Hardin
On Wed, 11 Aug 2010, RW wrote: 1) Rename the .cf file back to the original name so sa-update can find it 2) Run sa-update 3) Rename the .cf file to z_sought_rules_yerp_org.cf 4) Restart spamd Would it not be simpler just to do something like this grep -E "^score" /var/db/spamassassin/*/sough

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread John Hardin
On Wed, 11 Aug 2010, Bowie Bailey wrote: In case anyone else is following this... The sa-update process made things a bit more complex than simply renaming the file after updates. If that's all you do, then sa-update loses track of the file and will download a new copy on every run. What I

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 17:30 -0400, Bowie Bailey wrote: > In case anyone else is following this... > > The sa-update process made things a bit more complex than simply > renaming the file after updates. If that's all you do, then sa-update > loses track of the file and will download a new copy on

Sought dedicated AND stock channel (was: Re: JM_SOUGHT_FRAUD)

2010-08-11 Thread Karsten Bräckelmann
> On Wed, 11 Aug 2010 17:30:40 -0400 Bowie Bailey wrote: > > On 8/11/2010 3:30 PM, John Hardin wrote: > > > The current situation is: automatic rule updates are only generated > > > when the corpa of recent messages used in the nightly masscheck is > > > sufficiently large (150k+ of both spam an

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread RW
On Wed, 11 Aug 2010 17:30:40 -0400 Bowie Bailey wrote: > On 8/11/2010 3:30 PM, John Hardin wrote: > > On Wed, 11 Aug 2010, Bowie Bailey wrote: > > > >> Right. And I'm checking for updates several times a day. If the > >> updates channel is not keeping up with sought, I need to make sure > >> I

Re: AWL demoted??

2010-08-11 Thread RW
On Wed, 11 Aug 2010 22:26:31 +0200 Benny Pedersen wrote: > On ons 11 aug 2010 19:35:35 CEST, RW wrote > > > That should be count/total-score not count/token. > > total-score/count I actually meant it in the sense of "a-stroke-b" rather than "a-divided-by-b" > will also work with mask of 0

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
On 8/11/2010 3:30 PM, John Hardin wrote: > On Wed, 11 Aug 2010, Bowie Bailey wrote: > >> Right. And I'm checking for updates several times a day. If the >> updates channel is not keeping up with sought, I need to make sure I >> am running the rules from the dedicated channel and not the updates

Re: AWL demoted??

2010-08-11 Thread Benny Pedersen
On ons 11 aug 2010 19:35:35 CEST, RW wrote That should be count/total-score not count/token. total-score/count will also work with mask of 0.0.0.0/8 ? sa below 3.3.x had it hardcoded to /16 -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread John Hardin
On Wed, 11 Aug 2010, Bowie Bailey wrote: Right. And I'm checking for updates several times a day. If the updates channel is not keeping up with sought, I need to make sure I am running the rules from the dedicated channel and not the updates channel so I have the latest. The current situat

Re: Moving from Solaris to Red Hat

2010-08-11 Thread Kris Deugau
Rosenbaum, Larry M. wrote: We are currently running SA v3.3.1 on Solaris 9 and Solaris 10 and are planning to move to Red Hat. I don’t have much experience with Red Hat (or Linux in general). Could you point me to some tips and documentation about installing and running SA on Red Hat? FY

Moving from Solaris to Red Hat

2010-08-11 Thread Rosenbaum, Larry M.
We are currently running SA v3.3.1 on Solaris 9 and Solaris 10 and are planning to move to Red Hat. I don't have much experience with Red Hat (or Linux in general). Could you point me to some tips and documentation about installing and running SA on Red Hat? FYI, on Solaris I install by downl

Re: AWL demoted??

2010-08-11 Thread RW
On Wed, 11 Aug 2010 18:30:17 +0100 RW wrote: > On Wed, 11 Aug 2010 07:48:11 -0400 > Matt Kettler wrote: > > > 1) lack of expiry process causes unbounded database growth. There's > > a script to clean out single-hit entries, but multi-hit persist > > forever, even when stale. (there are no times

Re: AWL demoted??

2010-08-11 Thread RW
On Wed, 11 Aug 2010 07:48:11 -0400 Matt Kettler wrote: > 1) lack of expiry process causes unbounded database growth. There's a > script to clean out single-hit entries, but multi-hit persist > forever, even when stale. (there are no timestamps on entries, so > expiry isn't possible at present).

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
On 8/11/2010 12:17 PM, Karsten Bräckelmann wrote: > On Wed, 2010-08-11 at 11:57 -0400, Bowie Bailey wrote: >> On 8/11/2010 11:46 AM, Karsten Bräckelmann wrote: >>> On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote: I was looking through some of the spam rules, and I noticed that the

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Noel Jones
On Wed, Aug 11, 2010 at 9:58 AM, Alex wrote: ... > I did notice this one header discrepancy: > > Received: by mail.mydomain.net (Postfix, from userid 78) > > What's with the "Postfix, from user 78)"? This should be the server's > IP address, no? That header is normal when you're using a "simple"

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 11:57 -0400, Bowie Bailey wrote: > On 8/11/2010 11:46 AM, Karsten Bräckelmann wrote: > > On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote: > > > I was looking through some of the spam rules, and I noticed that the > > > JM_SOUGHT_FRAUD rules are included in the main SA up

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Alex
Hi, >> > Forgot to mention: After running sa-update WRT 3.2. >> >> Great, thanks so much. > > Well, you *did* run sa-update since then, no? I mean, at the very least > early this year. Begs the question, why you still do have that rule. It's another system that I just adopted, and haven't finishe

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 11:51 -0400, Alex wrote: > > > Bug 6157 [1], remove open-whois.org rules since domain is cybersquatted. > > > > > > The rule has been removed a *year* ago, and is neither part of 3.3, nor > > > 3.2 stock rules. > > > > Forgot to mention: After running sa-update WRT 3.2. > >

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
On 8/11/2010 11:46 AM, Karsten Bräckelmann wrote: > On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote: >> I was looking through some of the spam rules, and I noticed that the >> JM_SOUGHT_FRAUD rules are included in the main SA updates channel for SA >> 3.3.1, but the scores are all 0. Is the

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Alex
>> Bug 6157 [1], remove open-whois.org rules since domain is cybersquatted. >> >> The rule has been removed a *year* ago, and is neither part of 3.3, nor >> 3.2 stock rules. > > Forgot to mention: After running sa-update WRT 3.2. Great, thanks so much. Best, Alex

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote: > I was looking through some of the spam rules, and I noticed that the > JM_SOUGHT_FRAUD rules are included in the main SA updates channel for SA > 3.3.1, but the scores are all 0. Is there a reason for this? Yes, an explicit request by Justi

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 17:24 +0200, Karsten Bräckelmann wrote: > On Wed, 2010-08-11 at 10:58 -0400, Alex wrote: > > How does DNS_FROM_OPENWHOIS work? I have a system where every message > > triggers on DNS_FROM_OPENWHOIS and I can't figure out why. > > Bug 6157 [1], remove open-whois.org rules sinc

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 10:58 -0400, Alex wrote: > How does DNS_FROM_OPENWHOIS work? I have a system where every message > triggers on DNS_FROM_OPENWHOIS and I can't figure out why. Bug 6157 [1], remove open-whois.org rules since domain is cybersquatted. The rule has been removed a *year* ago, and

JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
I was looking through some of the spam rules, and I noticed that the JM_SOUGHT_FRAUD rules are included in the main SA updates channel for SA 3.3.1, but the scores are all 0. Is there a reason for this? The rules from the sought channel have scores, but they are being overridden by the main upda

DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Alex
Hi, How does DNS_FROM_OPENWHOIS work? I have a system where every message triggers on DNS_FROM_OPENWHOIS and I can't figure out why. I had some problems with the headers being mangled, but I was pretty sure that was fixed. Could this be a postfix or amavisd configuration? I did notice this one h

Re: spamc REPORT/PROCESS Confusion

2010-08-11 Thread Karsten Bräckelmann
Please keep threads on-list, unless you specifically want to talk to me. Even "boring" end-of-line posts are worthwhile information to the full thread. On Tue, 2010-08-10 at 18:43 +0200, Andreas Dunkl wrote: > Am 10.08.2010 13:42, schrieb Karsten Bräckelmann: > > Well, that one paragraph isn't a g

Re: AWL demoted??

2010-08-11 Thread Matt Kettler
On 8/10/2010 7:55 PM, Dennis German wrote: On Jul 22, 2010, at 10:47 AM, Michael Scheidell wrote:... due to performance vs accuracy issues, AWL was demoted in SA 3.3x. Can you please define "demoted". Changed from enabled by default to disabled by default, larg

Re: AWL demoted??

2010-08-11 Thread RW
On Tue, 10 Aug 2010 19:55:45 -0400 Dennis German wrote: > On Jul 22, 2010, at 10:47 AM, Michael Scheidell wrote:... > due to performance vs accuracy issues, AWL was demoted in SA 3.3x. > > Can you please define "demoted". It's no longer on by default.

Fw: Spamassassion for each site

2010-08-11 Thread nonlin
Sorry about that I just simply pressed reply, I expected the reply to have sent my message back to us...@spamassassin.apache.org. So I had to use forward instead. anyway, I will start to look into it. but before I do, you said something that made me think you might have slightly miss understood m

Re: List of "banned" words/bounce to sender

2010-08-11 Thread Martin Gregorie
On Tue, 2010-08-10 at 19:24 -0700, jdow wrote: > From: "Martin Gregorie" > Sent: Monday, 2010/August/09 18:08 > > > > On Mon, 2010-08-09 at 17:42 -0700, jdow wrote: > >> From: "Martin Gregorie" > >> > Something like this will match a sequence of two capitalised name > >> > words, > >> > includ

Re: Spamassassion for each site

2010-08-11 Thread Daniel Lemke
nonlin wrote: > > I am running a Blue Quartz with spamassassin pre installed. I don't know > the version. I have run the gtube test and it works fine for my admin > email account, it is marking them as spam. but it is marking any of emails > for my clients, yet there are several files like the