Re: log sender IP

2012-05-17 Thread John Hardin
On Thu, 17 May 2012, Chris Hunt wrote: I'm hoping to track scores by sender IP. Do any gurus know how I can get the original sender's IP address into this log line? May 17 04:08:19 mail01 spamd[20409]: spamd: result: . 2 - AWL,BAYES_50,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_02,

Re: log sender IP

2012-05-17 Thread Brent Gardner
On 05/17/2012 04:35 PM, Chris Hunt wrote: I'm hoping to track scores by sender IP. Do any gurus know how I can get the original sender's IP address into this log line? May 17 04:08:19 mail01 spamd[20409]: spamd: result: . 2 - AWL,BAYES_50,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_02

log sender IP

2012-05-17 Thread Chris Hunt
I'm hoping to track scores by sender IP. Do any gurus know how I can get the original sender's IP address into this log line? May 17 04:08:19 mail01 spamd[20409]: spamd: result: . 2 - AWL,BAYES_50,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_02,HTML_MESSAGE,SPF_HELO_PASS,URIBL_WS_SURBL s

Re: ***Possible SPAM*** Re: regex needed for http link

2012-05-17 Thread Joseph Acquisto
>>> On 5/17/2012 at 6:16 PM, John Hardin wrote: > On Thu, 17 May 2012, Joseph Acquisto wrote: > >> I attempted to adapt something from a similar regex provided by a vendor >> of a commercial product. It was to detect country codes we do not want >> to accept mail from. No doubt my ignorance of

Re: ***Possible SPAM*** Re: regex needed for http link

2012-05-17 Thread John Hardin
On Thu, 17 May 2012, Joseph Acquisto wrote: I attempted to adapt something from a similar regex provided by a vendor of a commercial product. It was to detect country codes we do not want to accept mail from. No doubt my ignorance of SA and regex in general will be on display for the amusemen

***Possible SPAM*** Re: regex needed for http link

2012-05-17 Thread Joseph Acquisto
>>> On 5/17/2012 at 9:55 AM, John Hardin wrote: > On Wed, 16 May 2012, Joseph Acquisto wrote: > > On 5/16/2012 at 8:53 PM, "Joseph Acquisto" wrote: >> On 5/16/2012 at 5:18 PM, Brent Gardner >> wrote: How about: /\.ru\b/i >>> >>> I will give that a try. >> >> Tha

Re: __DRUG_MUSCLE1 false-positives

2012-05-17 Thread David F. Skoll
On Fri, 18 May 2012 08:37:07 +1200 Jason Haar wrote: > I'm no linguist but this is probably an extremely hard problem to > solve. An email can have mixtures of languages, so in a perfect world > we should be able to change locale per word (or per char? - eeek!). The only sane solution is to re-e

Re: __DRUG_MUSCLE1 false-positives

2012-05-17 Thread Jason Haar
On 18/05/12 07:54, dar...@chaosreigns.com wrote: > Locale handling is a known problem is SA: > https://issues.apache.org/SpamAssassin/show_bug.cgi?id=3062 bug opened in 2004 :-( I'm no linguist but this is probably an extremely hard problem to solve. An email can have mixtures of languages, so i

Re: __DRUG_MUSCLE1 false-positives

2012-05-17 Thread David F. Skoll
On Fri, 18 May 2012 07:26:56 +1200 Jason Haar wrote: > > I looked at the regex and it seems that Perl treats är as having a > > word boundary in the \b sense between the "ä" and the "r" > A bit OT, but is it because your perl is running under "C" locale > instead of se? Ah... could be. Hmm, ok.

Re: __DRUG_MUSCLE1 false-positives

2012-05-17 Thread darxus
On 05/18, Jason Haar wrote: > A bit OT, but is it because your perl is running under "C" locale > instead of se? i.e. would the word boundary definition change under > different localization contexts? Doesn't help solve the problem for you, > but it certainly flags a potential issue with a tonne of

Re: __DRUG_MUSCLE1 false-positives

2012-05-17 Thread Jason Haar
On 18/05/12 03:18, David F. Skoll wrote: > > I looked at the regex and it seems that Perl treats är as having a > word boundary in the \b sense between the "ä" and the "r" A bit OT, but is it because your perl is running under "C" locale instead of se? i.e. would the word boundary definition change

__DRUG_MUSCLE1 false-positives

2012-05-17 Thread David F. Skoll
Hi, We have a Swedish customer who is seeing lots of DRUG_MUSCLE FP's. It turns out that __DRUG_MUSCLE1 is triggering on the common Swedish phrase "som är". I looked at the regex and it seems that Perl treats är as having a word boundary in the \b sense between the "ä" and the "r" Maybe rewrite

Re: regex needed for http link

2012-05-17 Thread John Hardin
On Wed, 16 May 2012, Joseph Acquisto wrote: On 5/16/2012 at 8:53 PM, "Joseph Acquisto" wrote: On 5/16/2012 at 5:18 PM, Brent Gardner wrote: How about: /\.ru\b/i I will give that a try. That worked. But I imagine it may trigger on innocuous instances of .ru as well, so it should also