Re: How to disable URI-A and URI-NS lookups?

2013-09-16 Thread Abhijeet Rastogi
HI Axb, But, we don't require A and NS lookups for a domain to query for it's existence in URIBL, right? I don't see the point of doing the NS lookups in URIBL module. On Tue, Sep 17, 2013 at 11:08 AM, Axb wrote: > On 09/17/2013 06:59 AM, Abhijeet Rastogi wrote: >> >> Hi all, >> >> Short Version

Re: How to disable URI-A and URI-NS lookups?

2013-09-16 Thread Axb
On 09/17/2013 06:59 AM, Abhijeet Rastogi wrote: Hi all, Short Version: See subject. Long Version: Read below. So far, I've got a nice feedback from the community, thanks for that. I want to know why are DNS queries like URI-A and URI-NS done? For a specific case that I'm trying to use, I want s

How to disable URI-A and URI-NS lookups?

2013-09-16 Thread Abhijeet Rastogi
Hi all, Short Version: See subject. Long Version: Read below. So far, I've got a nice feedback from the community, thanks for that. I want to know why are DNS queries like URI-A and URI-NS done? For a specific case that I'm trying to use, I want spamassassin to use just DNSBL and nothing else. I

Re: Image spam help

2013-09-16 Thread John Hardin
On Tue, 17 Sep 2013, Olivier Nicole wrote: (I am not sure if it would increase the spamines to have several instances of the same bad word in a message). It might. There are rules that consider more than N instances of a given phrase (like you'd see on a pharma spam where there are per-pill p

Re: Image spam help

2013-09-16 Thread Olivier Nicole
> > My only restriction is that FuzzyOCR uses it's own list of spam words > > instead of pushing back the decoded text to SA for SA to analyze. > This is necessary because of the poor quality of the OCR. It's only going to > be useful if the number of words you try to match against is very small.

Re: Image spam help

2013-09-16 Thread Ian Turner
On Tuesday, September 17, 2013 09:44:21 AM Olivier Nicole wrote: > My only restriction is that FuzzyOCR uses it's own list of spam words > instead of pushing back the decoded text to SA for SA to analyze. This is necessary because of the poor quality of the OCR. It's only going to be useful if th

Re: Image spam help

2013-09-16 Thread Olivier Nicole
Hi Alex, > I'm hoping someone can help me with an image spam. I haven't seen one > of these in a while, and I can't figure out how to catch them > effectively. > > This one is probably now being caught by the RBLs, but I'm hoping > there's some other characteristic within the email that can be us

Re: POP3/IMAP Anti Spam - A basic question though

2013-09-16 Thread Martin Gregorie
On Mon, 2013-09-16 at 15:40 -0700, Ted Mittelstaedt wrote: > On 9/15/2013 11:24 AM, Martin Gregorie wrote: > > On Sun, 2013-09-15 at 23:27 +0530, Blason rock wrote: > >> I agree an wouldnt harm if I disable it as my smtp scanning is definitely > >> running fine. What I was thinking about is does im

Re: POP3/IMAP Anti Spam - A basic question though

2013-09-16 Thread Ted Mittelstaedt
On 9/15/2013 11:24 AM, Martin Gregorie wrote: On Sun, 2013-09-15 at 23:27 +0530, Blason rock wrote: I agree an wouldnt harm if I disable it as my smtp scanning is definitely running fine. What I was thinking about is does imap and pop3 AS scanning only needed for ISP kindaa environment? Since I

Re: How do I find a parent rule for a test?

2013-09-16 Thread Kris Deugau
John Hardin wrote: > If you want to override the default behavior of SA to that degree, it's > easier to change the config directory that SpamAssassin and spamd use > with the -c option, You mean -C (note capital). -c (lower-case) is to autocreate userprefs files. > so that none of the base r

Re: How do I find a parent rule for a test?

2013-09-16 Thread Abhijeet Rastogi
> If you don't want to use the rules in the updates directory, why would you > even need to run sa-update? I wish I could. SpamAssassin dies with the message as below if I don't run sa-update or move the directory '/var/lib/spamassassin'. die "config: no rules were found! Do you need to run 'sa-

Re: How do I find a parent rule for a test?

2013-09-16 Thread Axb
http://spamassassin.apache.org/full/3.3.x/doc/ All spamd options documented in: http://spamassassin.apache.org/full/3.3.x/doc/spamd.txt You'll have to go thru your .pre files to disable a bunch of plugins Those rule hits your seeing now are very cheap and low scored. On 09/16/2013 11:14 PM,

Re: How do I find a parent rule for a test?

2013-09-16 Thread Abhijeet Rastogi
On Tue, Sep 17, 2013 at 1:58 AM, Kris Deugau wrote: > John Hardin wrote: > > > Key arguments for spamd are -C (to specify the "default" rules path > (overrides and combines DEF_RULES_DIR and LOCAL_STATE_DIR) and > --siteconfig for your "site" config (could probably be pointed somewhere > empty but

Re: How do I find a parent rule for a test?

2013-09-16 Thread Axb
On 09/16/2013 10:55 PM, Abhijeet Rastogi wrote: If you don't want to use the rules in the updates directory, why would you even need to run sa-update? I wish I could. SpamAssassin dies with the message as below if I don't run sa-update or move the directory '/var/lib/spamassassin'. die "config

Re: Really getting discouraged... when does the learning happen?

2013-09-16 Thread Harry Putnam
Bart Schaefer writes: > On Sun, Sep 15, 2013 at 7:53 PM, Harry Putnam wrote: >> I've been trying to `teach' SA to spam from ham in my mail system. >> >> I've made it thru two main learning sessions where I ran around 450 >> msgs (each time) thru sa-learn spam/ham and yet SA is still incapable >>

Re: How do I find a parent rule for a test?

2013-09-16 Thread Dave Funk
That's because SA no longer ships with rules in the source kit. First thing you do after a new install is run sa-update to download a set of rules and those go into a seperate directory. Do this: spamassassin --lint -D 2>&1 | grep dir And you should see things like: Sep 16 14:21:39.457 [27354

Re: How do I find a parent rule for a test?

2013-09-16 Thread John Hardin
On Tue, 17 Sep 2013, Abhijeet Rastogi wrote: If you don't want to use the rules in the updates directory, why would you even need to run sa-update? I wish I could. SpamAssassin dies with the message as below if I don't run sa-update or move the directory '/var/lib/spamassassin'. die "config:

Image spam help

2013-09-16 Thread Alex
Hi guys, I'm hoping someone can help me with an image spam. I haven't seen one of these in a while, and I can't figure out how to catch them effectively. This one is probably now being caught by the RBLs, but I'm hoping there's some other characteristic within the email that can be used to block

Re: How do I find a parent rule for a test?

2013-09-16 Thread Bowie Bailey
On 9/16/2013 4:55 PM, Abhijeet Rastogi wrote: If you don't want to use the rules in the updates directory, why would you even need to run sa-update? I wish I could. SpamAssassin dies with the message as below if I don't run sa-update or move the directory '/var/lib/spamassassin'. die "config: n

Re: How do I find a parent rule for a test?

2013-09-16 Thread Bowie Bailey
On 9/16/2013 4:19 PM, Abhijeet Rastogi wrote: Hi Dave, Thanks for the revelation. This clears a lot of things now. After I disabled all the tests in 50_scores.cf, I was still seeing a lot of CPU (a very heavily loaded server). This pretty much clears everything. You guys have been of commendabl

Re: How do I find a parent rule for a test?

2013-09-16 Thread Abhijeet Rastogi
Hi Dave, Thanks for the revelation. This clears a lot of things now. After I disabled all the tests in 50_scores.cf, I was still seeing a lot of CPU (a very heavily loaded server). This pretty much clears everything. You guys have been of commendable help. One last thing, so is there a way or a h

Re: How do I find a parent rule for a test?

2013-09-16 Thread Abhijeet Rastogi
Hi John, I'm sure you're pretty clear on explaining it but as a newbie I'm facing issues. My concern still exists. I could see loglines like: Sep 16 14:41:51.607 [3999] dbg: rules: ran header rule __HAS_SENDER ==> got hit: "" Sep 16 14:41:51.606 [3999] dbg: rules: ran header rule __HAS_TO ===

Re: How do I find a parent rule for a test?

2013-09-16 Thread Martin Gregorie
On Mon, 2013-09-16 at 23:50 +0530, Abhijeet Rastogi wrote: > Hi John, > > Did a > > $grep -inr __HAS_SENDER ./ > > in the source. No hits, what-so-ever. > In my installation its in: /var/lib/spamassassin/3.003002/updates_spamassassin_org/10_hasbase.cf Martin

Re: How do I find a parent rule for a test?

2013-09-16 Thread John Hardin
On Mon, 16 Sep 2013, Abhijeet Rastogi wrote: Problem is, how do I know that a certain rule like __RCVD_IN_NJABL is a base rule for others? The two leading underscores in the rule name indicate that the rule, by itself, is not assigned a score, thus, by itself, does not affect the overall sco

Re: How do I find a parent rule for a test?

2013-09-16 Thread Abhijeet Rastogi
Hi John, Did a $grep -inr __HAS_SENDER ./ in the source. No hits, what-so-ever. On Mon, Sep 16, 2013 at 11:37 PM, John Hardin wrote: > On Mon, 16 Sep 2013, Abhijeet Rastogi wrote: > >> Hi John, >> >> I'm sure you're pretty clear on explaining it but as a newbie I'm >> facing issues. My concern

Re: How do I find a parent rule for a test?

2013-09-16 Thread John Hardin
On Mon, 16 Sep 2013, Abhijeet Rastogi wrote: Hi John, I'm sure you're pretty clear on explaining it but as a newbie I'm facing issues. My concern still exists. I could see loglines like: Sep 16 14:41:51.607 [3999] dbg: rules: ran header rule __HAS_SENDER ==> got hit: "" Sep 16 14:41:51.606

Re: How do I find a parent rule for a test?

2013-09-16 Thread Abhijeet Rastogi
Hi John, Thanks for the reply. I could get the above said rule as a "meta" one. Thanks for that. One more thing I was hoping you could help me with. Can you explain as to what's the difference between rules under "./rules" and under "./rulesrc/sandbox/" directory? The reason I want to know this i

Re: How do I find a parent rule for a test?

2013-09-16 Thread John Hardin
On Mon, 16 Sep 2013, Abhijeet Rastogi wrote: Hi John, Thanks for the reply. I could get the above said rule as a "meta" one. Thanks for that. Apologies if that came across as condescending, I was just trying to be thorough. One more thing I was hoping you could help me with. Can you expl

UTF-8 Spam rules

2013-09-16 Thread Kevin A. McGrail
Anyone have some examples of rules designed to catch words by content in UTF-8 encoded messages? I'm doing some work on improving this. Regards, KAM

Re: How do I find a parent rule for a test?

2013-09-16 Thread Abhijeet Rastogi
Hi guys, I've already gone though the link http://spamassassin.1065346.n5.nabble.com/Obvious-Disabling-some-RBL-URIBL-checks-td57047.html which talks briefly about it. Problem is, how do I know that a certain rule like __RCVD_IN_NJABL is a base rule for others? On Mon, Sep 16, 2013 at 10:53 AM,