[OT] Wrote a cool script to give cron seconds resolution

2014-01-08 Thread Marc Perkel
Short bash script to run a program 30 20 15 12 10 6 5 4 3 2 executions per minute. http://wiki.junkemailfilter.com/index.php/How_to_run_a_Linux_script_every_few_seconds_under_cron -- Marc Perkel - Sales/Support supp...@junkemailfilter.com http://www.junkemailfilter.com Junk Email Filter dot

Re: Proposing a new rule ("Lic. " sender plus .info domain)

2014-01-08 Thread RW
On Wed, 08 Jan 2014 15:12:43 +0100 Axb wrote: > On 01/08/2014 02:34 PM, Martin Gregorie wrote: > > SPAMES describe Spanish info spam > > SPAMES header From =~ /Lic\..*\.info/ > > SPAMES score5 > > > > I'd do: > > header FROM_NAME_LICFrom:name =~ /^Lic\./ > > as Lic. is in the n

Re: add_header format

2014-01-08 Thread Mark Chaney
Thanks everyone for the ideas, two things though: 1) I am not doing any type of custom filter on the relay server that SA is running on, I was just more hoping for that particular format as I think it has the best information without a mess. I honestly dont know the first thing about creating

Re: Proposing a new rule ("Lic. " sender plus .info domain)

2014-01-08 Thread John Hardin
On Wed, 8 Jan 2014, Christopher Culver wrote: For the last year or so, I’ve been deluged with Spanish-language spam with a very predictable format: the sender name begins with "Lic. " and the sender address is at an .info domain. I've been having good results with such a rule in my local insta

statistics/trending for SA?

2014-01-08 Thread Mark Chaney
Is anyone using any type of statistics/trending software for keeping track of spam/ham and also false positive/negative rates (Not really sure how to track that one besides maybe manual bayes training)? I currently use check_mk (nagios) and observium for my monitoring/trending in general, but I

Re: Proposing a new rule ("Lic. " sender plus .info domain)

2014-01-08 Thread Benny Pedersen
Axb skrev den 2014-01-08 15:12: header FROM_NAME_LIC From:name =~ /^Lic\./ header __FROM_INFO From:addr =~ /\.info/ more correct imho :=)

Re: Proposing a new rule ("Lic. " sender plus .info domain)

2014-01-08 Thread Axb
On 01/08/2014 02:34 PM, Martin Gregorie wrote: On Wed, 2014-01-08 at 10:45 +0300, Christopher Culver wrote: For the last year or so, I’ve been deluged with Spanish-language spam with a very predictable format: the sender name begins with "Lic. " and the sender address is at an .info domain. EXA

Re: Proposing a new rule ("Lic. " sender plus .info domain)

2014-01-08 Thread Martin Gregorie
On Wed, 2014-01-08 at 10:45 +0300, Christopher Culver wrote: > For the last year or so, I’ve been deluged with Spanish-language spam > with a very predictable format: the sender name begins with "Lic. " and > the sender address is at an .info domain. > > EXAMPLE SENDERS: > > Lic. Mayra Miranda

Proposing a new rule ("Lic. " sender plus .info domain)

2014-01-08 Thread Christopher Culver
For the last year or so, I’ve been deluged with Spanish-language spam with a very predictable format: the sender name begins with "Lic. " and the sender address is at an .info domain. EXAMPLE SENDERS: Lic. Mayra Miranda Lic. Toledano Lic. Carmen Quintanar Lic. Lizárraga Mena Lic. Lizárrag