Re: Using SpamAssassin to extract Received IP chain?

2014-02-17 Thread Karsten Bräckelmann
On Mon, 2014-02-17 at 17:16 -0700, Bob Proulx wrote: > I have an idea that I would like to explore. But it needs to be able > to make use of the Received: header IP chain of a message. I could do > some brute force extraction of the headers. But then I would need to > deal with trusted_networks.

Re: BAYES_999 over learn

2014-02-17 Thread Alex R
Why don´t revert to the old behavior ? And enable BAYES_999 only for SA 3.4.1 + I run SA 3.3.2 on a few servers and I don´t want patch every one. El 17/02/2014 21:04, Kevin A. McGrail escribió: On 2/17/2014 8:34 PM, Ian Zimmerman wrote: On Mon, 17 Feb 2014 20:21:47 -0500 "Kevin A. McGrail"

Re: SA 3.4.0 and Redis

2014-02-17 Thread Jason Haar
On 18/02/14 15:49, Mark Martinec wrote: > One server in each continent might be acceptable, but hasn't > been tried. Yeah, in fact I can separate into Europe and US (responsible for different domains), so two Redis makes more sense. > No corruption can happen due to network problems. Cases where

Re: BAYES_999 over learn

2014-02-17 Thread Mark Martinec
2014-02-18 02:34, Ian Zimmerman wrote: On Mon, 17 Feb 2014 20:21:47 -0500 "Kevin A. McGrail" wrote: Kevin> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7013 is Kevin> open on the issue. Should be a very small patch if you want to Kevin> update your installation. So, this means that

Re: SA 3.4.0 and Redis

2014-02-17 Thread Mark Martinec
2014-02-18, Jason Haar wrote: We have a geographically distributed edge mail relay network (some in the US and some in Europe) and I'm wondering if the new REDIS support could be used to centralize our Bayes? If you have a fast and reliable connection between the two, then in principle it could

Re: BAYES_999 over learn

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 8:34 PM, Ian Zimmerman wrote: On Mon, 17 Feb 2014 20:21:47 -0500 "Kevin A. McGrail" wrote: Kevin> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7013 is Kevin> open on the issue. Should be a very small patch if you want to Kevin> update your installation. So, this means t

SA 3.4.0 and Redis

2014-02-17 Thread Jason Haar
Hi there We have a geographically distributed edge mail relay network (some in the US and some in Europe) and I'm wondering if the new REDIS support could be used to centralize our Bayes? Is anything special required to be done to get 4-6 spamd servers to use the same REDIS backend? Will network

Re: BAYES_999 over learn

2014-02-17 Thread Ian Zimmerman
On Mon, 17 Feb 2014 20:21:47 -0500 "Kevin A. McGrail" wrote: Kevin> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7013 is Kevin> open on the issue. Should be a very small patch if you want to Kevin> update your installation. So, this means that the BAYES_999 mixup is not just a tempora

Re: BAYES_999 over learn

2014-02-17 Thread Kevin A. McGrail
Good catch. https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7013 is open on the issue. Should be a very small patch if you want to update your installation. Regards, KAM On 2/17/2014 6:45 PM, Alex R wrote: Look like BAYES_999 rules ignore the bayes_auto_learn_on_error 1 setting And

Re: BAYES_999 over learn

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 8:12 PM, Mark Martinec wrote: 2014-02-18 Alex R wrote: Look like BAYES_999 rules ignore the bayes_auto_learn_on_error 1 setting And keep learning spam. --- lib/Mail/SpamAssassin/Plugin/AutoLearnThreshold.pm (revision 1569155) +++ lib/Mail/SpamAssassin/Plugin/AutoLearnThreshold.

Re: BAYES_999 over learn

2014-02-17 Thread Mark Martinec
2014-02-18 Alex R wrote: Look like BAYES_999 rules ignore the bayes_auto_learn_on_error 1 setting And keep learning spam. --- lib/Mail/SpamAssassin/Plugin/AutoLearnThreshold.pm (revision 1569155) +++ lib/Mail/SpamAssassin/Plugin/AutoLearnThreshold.pm (working copy) @@ -241,7 +241,8 @@

Re: khop channel errors

2014-02-17 Thread Adam Katz
On 02/01/2014 09:04 PM, Glenn Sieb wrote: > Actually, now that I look at it, it appears to be a DNS issue. Hopefully > it will get fixed soon. > I noticed this a while ago, my guess is that the channel's gone. > > Are there any other channels out there at this point? What are people > using nowaday

Re: channel: could not find working mirror, channel failed

2014-02-17 Thread Alex
Hi, > Thanks for posting this. I will work on the issue and open a bug. This is > the first time we've switched the minor version (i.e. 3.3 to 3.4) and there > is likely a publishing script I have to find and update. > > NOTE: I'd highly recommend running 3.4.0 but download the rules from > spam

Using SpamAssassin to extract Received IP chain?

2014-02-17 Thread Bob Proulx
I have an idea that I would like to explore. But it needs to be able to make use of the Received: header IP chain of a message. I could do some brute force extraction of the headers. But then I would need to deal with trusted_networks. SpamAssassin already extracts that chain and handles the tr

Re: channel: could not find working mirror, channel failed

2014-02-17 Thread Bob Proulx
Kevin A. McGrail wrote: > Thanks for posting this. I will work on the issue and open a bug. Excellent! > This is the first time we've switched the minor version (i.e. 3.3 to > 3.4) and there is likely a publishing script I have to find and > update. There are bound to be some glitches along the

BAYES_999 over learn

2014-02-17 Thread Alex R
Look like BAYES_999 rules ignore the bayes_auto_learn_on_error 1 setting And keep learning spam. example spamd: result: Y 34 - AWL,AXB_XMAILER_MIMEOLE_OL_024C2,BAYES_999,DKIM_ADSP_CUSTOM_MED,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,FREEMAIL_REPLYTO,FROM_

Re: channel: could not find working mirror, channel failed

2014-02-17 Thread Kevin A. McGrail
Thanks for posting this. I will work on the issue and open a bug. This is the first time we've switched the minor version (i.e. 3.3 to 3.4) and there is likely a publishing script I have to find and update. NOTE: I'd highly recommend running 3.4.0 but download the rules from spamassassin.apa

channel: could not find working mirror, channel failed

2014-02-17 Thread Bob Proulx
After the upgrade to 3.4.0 I persistently get the following error from sa-update. channel: could not find working mirror, channel failed If I run it with --debug then it looks like it gets everything that it needs but then still fails. Here is the small snippet. Feb 17 14:56:38.859 [7333] d

Re: Spam from RCVD_IN_IADB (ISIPP/Surety Mail)

2014-02-17 Thread Axb
On 02/17/2014 09:44 PM, Kevin A. McGrail wrote: On 2/17/2014 3:30 PM, Joe Sniderman wrote: On 02/17/2014 02:35 PM, Greg Troxel wrote: I have had a number of experiences complaining about spam from whitelisted hosts, and (with the exception of hostkarma, which is not in the default ruleset) fou

Re: BAYES_999 strange behavior

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 4:12 PM, Ian Zimmerman wrote: On Mon, 17 Feb 2014 16:05:23 -0500 "Kevin A. McGrail" wrote: Kevin> BAYES_999 is just a finer gradient on BAYES_99 allowing for a Kevin> higher score on the top .001% of Bayes hits. Thanks for your reply. Could you explain in a bit more detail what "

Re: BAYES_999 strange behavior

2014-02-17 Thread Ian Zimmerman
On Mon, 17 Feb 2014 16:05:23 -0500 "Kevin A. McGrail" wrote: Kevin> BAYES_999 is just a finer gradient on BAYES_99 allowing for a Kevin> higher score on the top .001% of Bayes hits. Thanks for your reply. Could you explain in a bit more detail what "gradient on top" (of another rule) means? It

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 3:37 PM, RW wrote: On Mon, 17 Feb 2014 10:21:21 -0500 Kevin A. McGrail wrote: In the end, all we are doing is adding a gradient for 99.9 to 100%. I will change this in the base rules for better clarity instead because we already have evidence it's a good move. Score often don't

Re: BAYES_999 strange behavior

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 3:59 PM, Ian Zimmerman wrote: Hello. This is the first time SA is giving me enough trouble that I need to ask for help. I hope I get this right. I observed a marked increase in false negatives in the last few weeks. There have definitely been some increases in the past few weeks b

BAYES_999 strange behavior

2014-02-17 Thread Ian Zimmerman
Hello. This is the first time SA is giving me enough trouble that I need to ask for help. I hope I get this right. I observed a marked increase in false negatives in the last few weeks. Only today I had enough sense to look at the detailed scores. And, all the escaped spams have hit the BAYES_9

Re: Spam from RCVD_IN_IADB (ISIPP/Surety Mail)

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 3:30 PM, Joe Sniderman wrote: On 02/17/2014 02:35 PM, Greg Troxel wrote: I have had a number of experiences complaining about spam from whitelisted hosts, and (with the exception of hostkarma, which is not in the default ruleset) found many of my experiences to be unsatisfactory, t

Re: Spam from RCVD_IN_IADB (ISIPP/Surety Mail)

2014-02-17 Thread Kevin A. McGrail
Feel free to speak up with specific issues on specific DNSBLs and let's see if we can get the issues resolved. On 2/17/2014 3:10 PM, Greg Troxel wrote: "Kevin A. McGrail" writes: 1st, I would say to look at http://wiki.apache.org/spamassassin/DnsBlocklistsInclusionPolicy and see what changes

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread RW
On Mon, 17 Feb 2014 10:21:21 -0500 Kevin A. McGrail wrote: > In the end, all we are doing is adding a gradient for 99.9 to 100%. I > will change this in the base rules for better clarity instead because > we already have evidence it's a good move. Score often don't follow the strength of a rul

Re: Spam from RCVD_IN_IADB (ISIPP/Surety Mail)

2014-02-17 Thread Joe Sniderman
On 02/17/2014 02:35 PM, Greg Troxel wrote: > I have had a number of experiences complaining about spam from > whitelisted hosts, and (with the exception of hostkarma, which is not > in the default ruleset) found many of my experiences to be > unsatisfactory, to the point that they were escalated

Re: Spam from RCVD_IN_IADB (ISIPP/Surety Mail)

2014-02-17 Thread Greg Troxel
"Kevin A. McGrail" writes: > 1st, I would say to look at > http://wiki.apache.org/spamassassin/DnsBlocklistsInclusionPolicy and > see what changes you are recommending globally. What's missing is the requirement to effectively address situations, which involves publically-posted contact addr

Re: Spam from RCVD_IN_IADB (ISIPP/Surety Mail)

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 2:35 PM, Greg Troxel wrote: This subject recurs, with various whitelists. While it's true that users can disable rules, the project-specified rulesets should be chosen carefully. The basic approach is to obtain scores by analyzing ham/spam corpora. For most rules, that's entirely

Re: Spam from RCVD_IN_IADB (ISIPP/Surety Mail)

2014-02-17 Thread Greg Troxel
Axb writes: > On 02/04/2014 05:55 PM, Alessio Cecchi wrote: >> Since this whitelist does not respond to reports of abuse I think it >> should be considered whether to keep it active in spamassassin. > SpamAssassin is a framework - nothing stops you from disabling rules > locally. This subject

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 12:48 PM, Bob Proulx wrote: RW wrote: I have spam that's already hitting BAYES_999 with the default 1.0 score. I upgraded as well and am also hit by several problems causing more spam to be classified as an FN and passing a lot of spam through today. One of them is the BAYES_999 r

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Bob Proulx
RW wrote: > I have spam that's already hitting BAYES_999 with the default 1.0 score. I upgraded as well and am also hit by several problems causing more spam to be classified as an FN and passing a lot of spam through today. One of them is the BAYES_999 rule hitting with a score of 1.0. In concep

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 12:43 PM, Matus UHLAR - fantomas wrote: On 02/17/2014 02:43 PM, Matus UHLAR - fantomas wrote: seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but without score (and thus default 1.0) in 50_scores.cf. ... a mistake happened apparently? On 17.02.14 15:07,

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 12:40 PM, Daniel Staal wrote: Same here - it's causing a fair amount of FNs, as I have BAYES_99 set with a 4.7 score, so this is lowering the spam score for a lot of mail. Might want to temporarily set a score for bayes_99 of 4.7 and create a copy of bayes_999 also set to 4.7. The

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Matus UHLAR - fantomas
On 02/17/2014 02:43 PM, Matus UHLAR - fantomas wrote: seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but without score (and thus default 1.0) in 50_scores.cf. ... a mistake happened apparently? On 17.02.14 15:07, Axb wrote: BAYES_999 is *not* BAYES_99 sorry,it's B

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Daniel Staal
--As of February 17, 2014 2:54:11 PM +, RW is alleged to have said: On Mon, 17 Feb 2014 09:09:33 -0500 Kevin A. McGrail wrote: On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote: > Hello, > > seems after last rule update we've got new rule BAYES_99 in > 72_scores.cf but > without score (an

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Axb
On 02/17/2014 04:21 PM, Kevin A. McGrail wrote: On 2/17/2014 9:36 AM, Axb wrote: could we agree to set the ceilings on lower safer scores? Yes, I set the BAYES_999 to the existing score for BAYES_99 +0.2 as a minor increase. If possible use different rulenames so as not to tamper with the exis

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 9:36 AM, Axb wrote: could we agree to set the ceilings on lower safer scores? Yes, I set the BAYES_999 to the existing score for BAYES_99 +0.2 as a minor increase. If possible use different rulenames so as not to tamper with the existing BAYES_99 stuff which could cause issues on p

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread RW
On Mon, 17 Feb 2014 09:09:33 -0500 Kevin A. McGrail wrote: > On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote: > > Hello, > > > > seems after last rule update we've got new rule BAYES_99 in > > 72_scores.cf but > > without score (and thus default 1.0) in 50_scores.cf. > > > > ... a mistake happ

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Amir Caspi
On Feb 17, 2014, at 7:36 AM, Axb wrote: > > could we agree to set the ceilings on lower safer scores? > In the interest of full disclosure, these rules are being tested because of me (or at my suggestion anyway). I set them up locally based on discussion on this very list from about 2 years a

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Axb
On 02/17/2014 03:24 PM, Kevin A. McGrail wrote: On 2/17/2014 9:13 AM, Axb wrote: On 02/17/2014 03:09 PM, Kevin A. McGrail wrote: On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote: Hello, seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but without score (and thus defa

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 9:13 AM, Axb wrote: On 02/17/2014 03:09 PM, Kevin A. McGrail wrote: On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote: Hello, seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but without score (and thus default 1.0) in 50_scores.cf. ... a mistake happened

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Axb
On 02/17/2014 03:09 PM, Kevin A. McGrail wrote: On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote: Hello, seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but without score (and thus default 1.0) in 50_scores.cf. ... a mistake happened apparently? I'll look and see.

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Kevin A. McGrail
On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote: Hello, seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but without score (and thus default 1.0) in 50_scores.cf. ... a mistake happened apparently? I'll look and see. I've never tried to promote a bayes rule so it

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Axb
On 02/17/2014 02:43 PM, Matus UHLAR - fantomas wrote: Hello, seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but without score (and thus default 1.0) in 50_scores.cf. ... a mistake happened apparently? BAYES_999 is *not* BAYES_99 # Enhance Bayes scoring for super-

BAYES_999 of score 1.0 (default)

2014-02-17 Thread Matus UHLAR - fantomas
Hello, seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but without score (and thus default 1.0) in 50_scores.cf. ... a mistake happened apparently? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising t