Updating SpamAssassin on production servers

2010-10-26 Thread Sharma, Ashish
Hi, I have SpamAssassin(3.3.1) deployed on production servers. The automatic update is disabled there. I want to know what is the best approach for ruleset updates: 1. sa-update 2. Manual update I favor manual update as I want to keep a local list of rule set updates going to my production an

Re: Error Running 'sa-update'

2010-10-26 Thread Mark Martinec
On Tuesday October 26 2010 19:30:55 Daniel McDonald wrote: > On 10/26/10 12:18 PM, "Carlos Mennens" wrote: > > Today for the 1st time on my mail server I attempted to manually run > > the 'sa-update' command in the shell and got the following: > > > > > > [r...@mail ~]# sa-update > > defined(%ha

Re: List of urls

2010-10-26 Thread Martin Gregorie
On Tue, 2010-10-26 at 23:59 +0200, Karsten Bräckelmann wrote: > The safest approach for tflags multiple rules is to trigger other rules > based on the number of hits. meta rules explicitly support this. > > meta FOO_4 __TFLAGS_MULTIPLE_SUB >= 4 > Yes, I agree. Equally importantly, is to avoid

Re: List of urls

2010-10-26 Thread Karsten Bräckelmann
On Tue, 2010-10-26 at 20:10 +0100, Martin Gregorie wrote: > On Tue, 2010-10-26 at 10:37 -0700, John Hardin wrote: > > The OP wasn't clear whether he wanted ten points _per URI hit_. If that's > > the case, the regex alternatives and meta solutions aren't appropriate and > > there's no way to avo

Re: List of urls

2010-10-26 Thread John Hardin
On Tue, 26 Oct 2010, Martin Gregorie wrote: On Tue, 2010-10-26 at 10:37 -0700, John Hardin wrote: The OP wasn't clear whether he wanted ten points _per URI hit_. If that's the case, the regex alternatives and meta solutions aren't appropriate and there's no way to avoid one score line per URI

Re: List of urls

2010-10-26 Thread Martin Gregorie
On Tue, 2010-10-26 at 10:37 -0700, John Hardin wrote: > On Tue, 26 Oct 2010, Karsten Brckelmann wrote: > > > On Tue, 2010-10-26 at 10:53 +0200, Raymond Dijkxhoorn wrote: > >> For your question, why dont you regexp it? > >> > >> uri url_1 /www.domain(1|2|3|4).com/ > > > > The other technique you ca

Re: List of urls

2010-10-26 Thread John Hardin
On Tue, 26 Oct 2010, Richard Smits wrote: Does anyone know if it's possible to have a list of url's, and define a score for all of them in one line ? Now i do like this : uri url_1 /www.domain1.com/ uri url_2 /www.domain2.com/ uri url_3 /www.domain3.com/ uri url_4 /www.domain4.com/

Re: List of urls

2010-10-26 Thread John Hardin
On Tue, 26 Oct 2010, Karsten Br?ckelmann wrote: On Tue, 2010-10-26 at 10:53 +0200, Raymond Dijkxhoorn wrote: For your question, why dont you regexp it? uri url_1 /www.domain(1|2|3|4).com/ The other technique you can use are meta rules uri __MY_BL_001 /example.(com|net)/ uri __MY_BL_002 /e

Re: Error Running 'sa-update'

2010-10-26 Thread Daniel McDonald
On 10/26/10 12:18 PM, "Carlos Mennens" wrote: > Today for the 1st time on my mail server I attempted to manually run > the 'sa-update' command in the shell and got the following: > > > [r...@mail ~]# sa-update > defined(%hash) is deprecated at > /usr/share/perl5/vendor_perl/Mail/SpamAssassin

Error Running 'sa-update'

2010-10-26 Thread Carlos Mennens
Today for the 1st time on my mail server I attempted to manually run the 'sa-update' command in the shell and got the following: [r...@mail ~]# sa-update defined(%hash) is deprecated at /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Dns.pm line 757. (Maybe you should just omit the defined

Re: List of urls

2010-10-26 Thread Karsten Bräckelmann
On Tue, 2010-10-26 at 10:53 +0200, Raymond Dijkxhoorn wrote: > For your question, why dont you regexp it? > > uri url_1 /www.domain(1|2|3|4).com/ > > The exact regexp is naturally depending on the domains but you dont need a > seperate check for all. One way to consolidate them, yes -- dependin

Re: Bayes timeouts and database handle being DESTROY'd without explicit disconnect

2010-10-26 Thread Dominic Benson
On 26/10/10 15:38, Micah Anderson wrote: The databsae size is 2.74gig. top - 07:26:39 up 10 days, 20:37, 1 user, load average: 9.24, 6.80, 6.15 Tasks: 24 total, 2 running, 22 sleeping, 0 stopped, 0 zombie Cpu(s): 83.3%us, 16.2%sy, 0.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 0.5%si, 0.0%st M

Re: Bayes timeouts and database handle being DESTROY'd without explicit disconnect

2010-10-26 Thread Micah Anderson
Dominic Benson writes: > On 19 Oct 2010, at 17:05, Micah Anderson wrote: > >> >> Hello, >> >> I'm running a busy mail server. We've got a bayes database on its own >> server, with InnoDB tables. > > What is your total DB size / server RAM? Could you include a snapshot of the > output of top f

sa-learn --force-expire taking hours

2010-10-26 Thread Micah Anderson
I was investigating this morning why a number of spam messages were coming through and found that they weren't scoring on bayes, because it was unavailable. The database connection was working fine, but I noticed that the nightly sa-learn --sync --force-expire had been running since 3am, which was

Re: Mails received with same message id every 15 - 20 seconds

2010-10-26 Thread Martin Gregorie
On Tue, 2010-10-26 at 11:40 +, Sharma, Ashish wrote: > Hi, > > I have SpamAssassin integrated on my postfix mail server via 'Amavisd-new'. > I would have simply written a rule: header BAD_PETER From =~ /pet...@warwick.net/ and given it a high score as a temporary measure while I contacted

Re: Mails received with same message id every 15 - 20 seconds

2010-10-26 Thread Dominic Benson
Hi, On 26/10/10 12:40, Sharma, Ashish wrote: Hi, I have SpamAssassin integrated on my postfix mail server via 'Amavisd-new'. The problem that I am facing is that I am receiving same email every 15 second from same sender with same message-ID on my production mail servers, following are my po

Mails received with same message id every 15 - 20 seconds

2010-10-26 Thread Sharma, Ashish
Hi, I have SpamAssassin integrated on my postfix mail server via 'Amavisd-new'. The problem that I am facing is that I am receiving same email every 15 second from same sender with same message-ID on my production mail servers, following are my postfix logs: "Oct 25 01:11:02 g2t0433g postfix/

Re: List of urls

2010-10-26 Thread Raymond Dijkxhoorn
Hi! Now i do like this : uri url_1 /www.domain1.com/ uri url_2 /www.domain2.com/ uri url_3 /www.domain3.com/ uri url_4 /www.domain4.com/ score url_1 10 score url_2 10 score url_3 10 score url_4 10 Isnt this a bit expensive? Report to SURBL or something and you get them added ;) (send a

Re: List of urls

2010-10-26 Thread Martin Gregorie
On Tue, 2010-10-26 at 08:07 +0200, Richard Smits wrote: > Hello, > > Does anyone know if it's possible to have a list of url's, and define a > score for all of them in one line ? > I developed a similar system for my own purposes that you might want to look at. The idea is that you define this