Re: I'm doing it wrong.

2014-05-22 Thread Kai Meyer
On Fri, 23 May 2014 05:33:31 +0200, Karsten Bräckelmann wrote: On Thu, 2014-05-22 at 20:14 -0600, Kai Meyer wrote: I have a CentOS 6 postfix + dovecot + mysql (for vmail) + spamassassin (user prefs via mysql) server that I've been running for a few years The configuration you pasted below doe

Re: I'm doing it wrong.

2014-05-22 Thread Karsten Bräckelmann
On Thu, 2014-05-22 at 20:14 -0600, Kai Meyer wrote: > I have a CentOS 6 postfix + dovecot + mysql (for vmail) + spamassassin > (user prefs via mysql) server that I've been running for a few years The configuration you pasted below does not show any user_* options. Unless there are more cf files

Re: I'm doing it wrong.

2014-05-22 Thread David B Funk
On Thu, 22 May 2014, Kai Meyer wrote: I have a CentOS 6 postfix + dovecot + mysql (for vmail) + spamassassin (user prefs via mysql) server that I've been running for a few years now. It's just a few of my private domains, not a lot of traffic. In the last 6 months, the amount of spam getting t

I'm doing it wrong.

2014-05-22 Thread Kai Meyer
I have a CentOS 6 postfix + dovecot + mysql (for vmail) + spamassassin (user prefs via mysql) server that I've been running for a few years now. It's just a few of my private domains, not a lot of traffic. In the last 6 months, the amount of spam getting through has gone from one or two a week

OFF-TOPIC: The Brilliance of PootieTang was Re: Blank line rules

2014-05-22 Thread Kevin A. McGrail
On 5/22/2014 9:17 PM, Karsten Bräckelmann wrote: On Thu, 2014-05-22 at 20:56 -0400, Kevin A. McGrail wrote: On 5/22/2014 5:50 PM, Karsten Bräckelmann wrote: Why is everyone trying to match empty lines these days? Must be spam I'm missing out on. ;) Who here has seen Pootietang and is laughing

Re: Blank line rules

2014-05-22 Thread Karsten Bräckelmann
On Thu, 2014-05-22 at 20:56 -0400, Kevin A. McGrail wrote: > On 5/22/2014 5:50 PM, Karsten Bräckelmann wrote: > > Why is everyone trying to match empty lines these days? Must be spam > > I'm missing out on. ;) > > Who here has seen Pootietang and is laughing about this? Just me, likely... The f

Re: Mystery SpamWare

2014-05-22 Thread jdebert
On Thu, 22 May 2014 18:23:48 +0100 hospice admin wrote: > Hi Team, > > All of a sudden I've started noticing a lot of spam coming in with > some fairly unique headers like this: > > x-track-version: 4 > x-track-source: notifire_XXX > x-track-spooler-id: > x-track-spooler-split-id: > x

Re: Blank line rules

2014-05-22 Thread Kevin A. McGrail
On 5/22/2014 5:50 PM, Karsten Bräckelmann wrote: Why is everyone trying to match empty lines these days? Must be spam I'm missing out on. ;) Who here has seen Pootietang and is laughing about this? Just me, likely...

Re: Blank line rules

2014-05-22 Thread Amir Caspi
On May 22, 2014, at 6:44 PM, John Hardin wrote: > > You might want to do this: > > rawbody MANY_BLANK_LINES /(?:(?:)?\r?\n){9}/mi AC_BR_BONANZA should cover the HTML case. It could be easily extended to match standard LF or CR per above. (In my case I am matching something like 20 newlines

Re: Blank line rules

2014-05-22 Thread John Hardin
On Thu, 22 May 2014, Karsten Bräckelmann wrote: On Thu, 2014-05-22 at 15:49 -0400, James B. Byrne wrote: I am clearly missing something with these rules but I lack the experience to see what it is: score RAW_BLANK_LINES_05 0.5 rawbody RAW_BLANK_LINES_05 /(\r?\n){5,9}/i Why is everyone trying

Re: Consecutive Newlines in Rawbody Rules (was: Re: Bayes refinement)

2014-05-22 Thread Karsten Bräckelmann
On Thu, 2014-05-22 at 18:34 -0500, David B Funk wrote: > After doing some experimenting with that code I came up with something that > I'd argue is more semantically correct: > > # if we've got a long series of blank lines, limit them > if (defined $start) { >my $max_blank_lines

Re: Consecutive Newlines in Rawbody Rules

2014-05-22 Thread Karsten Bräckelmann
On Thu, 2014-05-22 at 17:43 -0500, David B Funk wrote: > On Thu, 22 May 2014, Karsten Bräckelmann wrote: > > Any number up to 11 of consecutive newlines can be matched with rawbody > > rules. However, 12 or more consecutive newlines will be squeezed and > > replaced by exactly two newlines. > > I

Re: Consecutive Newlines in Rawbody Rules (was: Re: Bayes refinement)

2014-05-22 Thread David B Funk
On Thu, 22 May 2014, David B Funk wrote: On Thu, 22 May 2014, Karsten Bräckelmann wrote: On Thu, 2014-05-22 at 03:12 +0200, Karsten Bräckelmann wrote: [snip..] The number of continuation lines equals the number of newlines in the test-case. Well, up until 12, that is. :-/ Any number up to

Re: Consecutive Newlines in Rawbody Rules (was: Re: Bayes refinement)

2014-05-22 Thread David B Funk
On Thu, 22 May 2014, Karsten Bräckelmann wrote: On Thu, 2014-05-22 at 03:12 +0200, Karsten Bräckelmann wrote: [snip..] The number of continuation lines equals the number of newlines in the test-case. Well, up until 12, that is. :-/ Any number up to 11 of consecutive newlines can be matched w

Re: Blank line rules

2014-05-22 Thread Karsten Bräckelmann
On Thu, 2014-05-22 at 13:47 -0700, John Hardin wrote: > On Thu, 22 May 2014, James B. Byrne wrote: > > rawbody RAW_BLANK_LINES_05 /(\r?\n){5,9}/i > Regular expressions by default only consider a single line of text. You Nope. You're thinking about ^ and $ by default only matching the beginning

Re: Blank line rules

2014-05-22 Thread Karsten Bräckelmann
On Thu, 2014-05-22 at 15:49 -0400, James B. Byrne wrote: > I am clearly missing something with these rules but I lack the experience to > see what it is: > > score RAW_BLANK_LINES_05 0.5 > rawbody RAW_BLANK_LINES_05 /(\r?\n){5,9}/i Why is everyone trying to match empty lines these days? Must be s

Consecutive Newlines in Rawbody Rules (was: Re: Bayes refinement)

2014-05-22 Thread Karsten Bräckelmann
On Thu, 2014-05-22 at 03:12 +0200, Karsten Bräckelmann wrote: > In either case, having a sample would speed up this ping-pong style > debugging. And I am curious. ;) Mind putting your sample up a pastebin? Ian sent me the original message off-list. It indeed contains about 16 consecutive newlines

Re: Blank line rules

2014-05-22 Thread Ian Zimmerman
On Thu, 22 May 2014 13:47:04 -0700 (PDT) John Hardin wrote: John> Regular expressions by default only consider a single line of John> text. You need to provide an option to say "treat multiple lines John> as a single line". Try this: >rawbody RAW_BLANK_LINES_05 /(?:\r?\n){5,9}/m >rawbod

Re: Blank line rules

2014-05-22 Thread John Hardin
On Thu, 22 May 2014, James B. Byrne wrote: I am clearly missing something with these rules but I lack the experience to see what it is: score RAW_BLANK_LINES_05 0.5 rawbody RAW_BLANK_LINES_05 /(\r?\n){5,9}/i describe RAW_BLANK_LINES_05 Raw body contains 5 or more consecutive empty lines score R

Re: 20_sought_fraud.cf

2014-05-22 Thread psychobyte
Great! Will do and Thx. On 05/22/2014 12:13 PM, Kevin A. McGrail wrote: On 5/20/2014 3:03 PM, psychobyte wrote: Hi, Has there been any progress on this? We are looking to integrate these rules but, won't bother if the project is abandoned. Thanks, There has been some progress, yes but it's

Blank line rules

2014-05-22 Thread James B. Byrne
I am clearly missing something with these rules but I lack the experience to see what it is: score RAW_BLANK_LINES_05 0.5 rawbody RAW_BLANK_LINES_05 /(\r?\n){5,9}/i describe RAW_BLANK_LINES_05 Raw body contains 5 or more consecutive empty lines score RAW_BLANK_LINES_10 1.0 rawbody RAW_BLANK_LINES_

Re: 20_sought_fraud.cf

2014-05-22 Thread Kevin A. McGrail
On 5/20/2014 3:03 PM, psychobyte wrote: Hi, Has there been any progress on this? We are looking to integrate these rules but, won't bother if the project is abandoned. Thanks, There has been some progress, yes but it's taken a back seat a bit. It's not abandoned. Ping the list in 2 weeks.

Re: Mystery SpamWare

2014-05-22 Thread Axb
On 05/22/2014 07:23 PM, hospice admin wrote: Hi Team, All of a sudden I've started noticing a lot of spam coming in with some fairly unique headers like this: x-track-version: 4 x-track-source: notifire_XXX x-track-spooler-id: x-track-spooler-split-id: x-track-spooler-segment-id: 999

Mystery SpamWare

2014-05-22 Thread hospice admin
Hi Team, All of a sudden I've started noticing a lot of spam coming in with some fairly unique headers like this: x-track-version: 4 x-track-source: notifire_XXX x-track-spooler-id: x-track-spooler-split-id: x-track-spooler-segment-id: x-render: render- Precedence: bulk x-trac

Re: autolearn_force

2014-05-22 Thread Ian Zimmerman
On Thu, 22 May 2014 15:54:42 +0100 RW wrote: Ian> I don't understand this setting, and reading the documentation Ian> doesn't help. Ian> It seems it should make Bayes learn spam whenever the total score Ian> surpasses the value of bayes_auto_learn_threshold_spam, and not Ian> require 3 points fr

Re: autolearn_force

2014-05-22 Thread RW
On Wed, 21 May 2014 21:34:23 -0700 Ian Zimmerman wrote: > I don't understand this setting, and reading the documentation doesn't > help. > > It seems it sould make bayes learn spam whenever the total score > surpasses the value of bayes_auto_learn_threshold_spam, and not > require 3 points from h

Re: Rule updates?

2014-05-22 Thread Tom Hendrikx
On 05/22/2014 03:36 PM, Kevin A. McGrail wrote: > On 5/22/2014 9:04 AM, Tom Hendrikx wrote: >> After checking the results of sa-update and doing some manual dns >> queries, it seems that last rule updates were done more than a month >> ago. This used to be an almost daily process, even when there w

Re: spamassassin (cmd line) connection to Redis

2014-05-22 Thread Axb
On 05/22/2014 03:27 PM, Matteo Dessalvi wrote: Yes, you are definitely right: with the latest stable Redis version (2.8.9 indeed) everything works smoothly with the authentication. Thanks for pointing me in the right direction! Best regards, Matteo On 22.05.2014 14:10, Axb wrote: You're usi

Re: Rule updates?

2014-05-22 Thread Kevin A. McGrail
On 5/22/2014 9:04 AM, Tom Hendrikx wrote: After checking the results of sa-update and doing some manual dns queries, it seems that last rule updates were done more than a month ago. This used to be an almost daily process, even when there were only score changes due to masschecks. Any specific r

Re: spamassassin (cmd line) connection to Redis

2014-05-22 Thread Matteo Dessalvi
Yes, you are definitely right: with the latest stable Redis version (2.8.9 indeed) everything works smoothly with the authentication. Thanks for pointing me in the right direction! Best regards, Matteo On 22.05.2014 14:10, Axb wrote: You're using an ancient Redis version with no LUA support.

Rule updates?

2014-05-22 Thread Tom Hendrikx
Hi, After checking the results of sa-update and doing some manual dns queries, it seems that last rule updates were done more than a month ago. This used to be an almost daily process, even when there were only score changes due to masschecks. Any specific reason for no new updates? Something we

Re: spamassassin (cmd line) connection to Redis

2014-05-22 Thread Axb
On 05/22/2014 02:06 PM, Matteo Dessalvi wrote: dbg: bayes: redis server version 2.4.14, memory used 6.8 MiB, Lua is not available You're using an ancient Redis version with no LUA support. Redis 2.8.9 is the latest stable version. I'd suggest you update Redis before you go on chasing windmil

Re: spamassassin (cmd line) connection to Redis

2014-05-22 Thread Matteo Dessalvi
On 22.05.2014 13:10, Axb wrote: have you included this in your local.cf ? bayes_store_module Mail::SpamAssassin::BayesStore::Redis These are the relevant configuration lines for the Redis SA module: bayes_store_module Mail::SpamAssassin::BayesStore::Redis bayes_sql_dsn server=10.1.1.1

Re: spamassassin (cmd line) connection to Redis

2014-05-22 Thread Axb
On 05/22/2014 12:56 PM, Matteo Dessalvi wrote: Hi all. As stated in the subject I am just trying to test my SpamAssassin 3.4.0 installation (I am using the Debian Jessie package), with the usual method described here: http://wiki.apache.org/spamassassin/TestingInstallation In the output of the

Re: spamassassin (cmd line) connection to Redis

2014-05-22 Thread Axb
On 05/22/2014 12:56 PM, Matteo Dessalvi wrote: Hi all. As stated in the subject I am just trying to test my SpamAssassin 3.4.0 installation (I am using the Debian Jessie package), with the usual method described here: http://wiki.apache.org/spamassassin/TestingInstallation In the output of the

spamassassin (cmd line) connection to Redis

2014-05-22 Thread Matteo Dessalvi
Hi all. As stated in the subject I am just trying to test my SpamAssassin 3.4.0 installation (I am using the Debian Jessie package), with the usual method described here: http://wiki.apache.org/spamassassin/TestingInstallation In the output of the command: spamassassin -D < gTube_spam.txt I hav