Re: SA doesn't respect my user_prefs

On Wed, 9 Sep 2015 14:48:14 -0700 jdow wrote: > On 2015-09-09 13:51, RW wrote: > > On Wed, 9 Sep 2015 17:27:54 +0200 > > Marc Richter wrote: > > > >> Hi RW, > >> > >>> Do you mean that ww is a unix user? The normal way to do this is > >>> to run spamd as root and run spamc as the unix user. Passin

Re: SA doesn't respect my user_prefs

On 2015-09-09 13:51, RW wrote: On Wed, 9 Sep 2015 17:27:54 +0200 Marc Richter wrote: Hi RW, Do you mean that ww is a unix user? The normal way to do this is to run spamd as root and run spamc as the unix user. Passing -u to spamc is really intended for virtual users, I'm not sure whether it w

Re: SA doesn't respect my user_prefs

On Wed, 9 Sep 2015 17:27:54 +0200 Marc Richter wrote: > Hi RW, > > > Do you mean that ww is a unix user? The normal way to do this is to > > run spamd as root and run spamc as the unix user. Passing -u to > > spamc is really intended for virtual users, I'm not sure whether it > > works for unix u

Re: SA doesn't respect my user_prefs

Is this line in your "local.cf" file? (And is it in the correct place?) allow_user_rules 1 {^_^} On 2015-09-09 04:47, Marc Richter wrote: Hi jdow, hi Matus, thanks for your replies. Regardless if it's necessary or not, I have done so. It also happens regularly by cron (all 3 hours), along wi

Re: Resume / Doc Spam

Dianne Skoll skrev den 2015-09-09 16:44: ClamAV is totally useless. why ? Here's a trick: Macro viruses must define a subroutine called "Document_Open" thanks for that note i will keep in mind So finding the string "Document_Open" case-insensitively in an MS Office file is a red flag.

Re: SA doesn't respect my user_prefs

Hi RW, Do you mean that ww is a unix user? The normal way to do this is to run spamd as root and run spamc as the unix user. Passing -u to spamc is really intended for virtual users, I'm not sure whether it works for unix users. Are you sure it worked before? ww is a unix user, yes. And it wo

Re: Problem with Bayes

Hi Here is an explanation of how exim is talking to Spamassassin in my setup http://www.exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html I suspect that as we have spam = nobody, SA was running the queries as nobody and as such not correctly using the right s

Re: Problem with Bayes

On 09/09/2015 04:55 PM, Matus UHLAR - fantomas wrote: On 09.09.15 15:21, Ben Whyall wrote: I didnt have that option but I did have bayes_sql_username set I have added the sql_override as well. I don't think you should set such options without understsanding what it may cause. it may work, but

Re: Resume / Doc Spam

On Wed, 9 Sep 2015 16:51:11 +0200 Matus UHLAR - fantomas wrote: > On 09.09.15 10:44, Dianne Skoll wrote: > >ClamAV is totally useless. > Do you mean generally, or in this case? Generally, at least if you use the official signatures. And the unofficial ones have unacceptably high FP rates. > >

Re: Problem with Bayes

On 09/09/2015 04:55 PM, Matus UHLAR - fantomas wrote: On 09.09.15 15:21, Ben Whyall wrote: I didnt have that option but I did have bayes_sql_username set I have added the sql_override as well. I don't think you should set such options without understsanding what it may cause. it may work, but

Re: Problem with Bayes

Ben Whyall 09 September 2015 15:03via Postbox When spamassassin is run from exim, it is always returning a hit on rule Bayes_00 with a score of 0., however if you run s

Re: Resume / Doc Spam

On Wed, 09 Sep 2015 09:23:44 +0200 Benny Pedersen wrote: i would run "strings vbaProject.bin" and make clamav signature based on it On 09.09.15 10:44, Dianne Skoll wrote: ClamAV is totally useless. Do you mean generally, or in this case? Here's a trick: Macro viruses must define a subrout

Re: Resume / Doc Spam

On Wed, 09 Sep 2015 09:23:44 +0200 Benny Pedersen wrote: > i would run "strings vbaProject.bin" and make clamav signature based > on it ClamAV is totally useless. Here's a trick: Macro viruses must define a subroutine called "Document_Open" So finding the string "Document_Open" case-insensitive

Re: Problem with Bayes

Hi I didnt have that option but I did have bayes_sql_username set I have added the sql_override as well. I have restarted and will see what happens. I am using the ubuntu exim-daemon heavy and it calls spamd directly. Ben Axb 09 September 2015 15:10via Postbox

Re: Problem with Bayes

Am 09.09.2015 um 16:03 schrieb Ben Whyall: I have a mail setup serving multiple domains that is running on ubuntu lts 14.04.03 lts. Spamassassin 3.4.0 Perl 5.18.2 Exim 4.82 We have bayes stored in a mysql database When spamassassin is run from exim, it is always returning a hit on rule Bayes

Re: SA doesn't respect my user_prefs

Hi Matus, Am 09.09.2015 um 15:01 schrieb Matus UHLAR - fantomas: On 09.09.15 13:47, Marc Richter wrote: Regardless if it's necessary or not, I have done so. It also happens regularly by cron (all 3 hours), along with other jobs like sa-learn, sa-update and sa-compile. reload should be enough,

Re: Problem with Bayes

On 09/09/2015 04:03 PM, Ben Whyall wrote: Hi I have a mail setup serving multiple domains that is running on ubuntu lts 14.04.03 lts. Spamassassin 3.4.0 Perl 5.18.2 Exim 4.82 We have bayes stored in a mysql database When spamassassin is run from exim, it is always returning a hit on rule Baye

Problem with Bayes

Hi I have a mail setup serving multiple domains that is running on ubuntu lts 14.04.03 lts. Spamassassin 3.4.0 Perl 5.18.2 Exim 4.82 We have bayes stored in a mysql database When spamassassin is run from exim, it is always returning a hit on rule Bayes_00 with a score of 0., however if

Re: Resume / Doc Spam

On 8 Sep 2015, at 17:38, Kevin A. McGrail wrote: Overall, the default SA is designed for a 5.0 threshold. You have raised it to 10.0. That's largely the source of the issue. +1 5.0 is a very safe threshold, and I've found that once the Bayes and AWL DBs are reasonably trained, 4.5 or even

Re: SA gone mad

sorry, I did not know that, I thought it is disabled by default 2015.09.09. 14:12 keltezéssel, Antony Stone írta: On Wednesday 09 September 2015 at 13:54:44, Farkas Zsolt wrote: you made a point, but /etc/spamassassin/local.cf looks like: ... # Use Bayesian classifier (default: 1) # #use_b

Re: SA doesn't respect my user_prefs

On 09.09.15 13:47, Marc Richter wrote: Regardless if it's necessary or not, I have done so. It also happens regularly by cron (all 3 hours), along with other jobs like sa-learn, sa-update and sa-compile. reload should be enough, restart is rarely necessary. Also, why do you check oftern than o

Re: Repository of rules

On 9/9/2015 5:43 AM, Sujit Acharyya-choudhury wrote: Hi Joe, I looked at the rule set and it was very interesting and I intend to use it. However, I did not see any *.pm file attached to it. Is there any need for this? Do you suggest, I increase the default score from 5.0 to 6.0 if I inclu

Re: SA gone mad

On 9/9/2015 8:18 AM, Reindl Harald wrote: Am 09.09.2015 um 14:08 schrieb Farkas Zsolt: please find the original incoming email saved by SA: http://pastebin.com/mszg5nJe the email notification received back from SA on spamadmin account http://pastebin.com/0UTvT9tQ i would say this is the wron

Re: SA doesn't respect my user_prefs

On Wed, 9 Sep 2015 13:47:01 +0200 Marc Richter wrote: > > On 09.09.2015 11:12 Matus wrote: > > > > have you tried running spamassassin -D ? maybe there's somethign > > invalid in SA's configuration or your user_prefs > > When I issue "spamassassin --test-mode -D" as the user the filter.sh >

Re: SA gone mad

Am 09.09.2015 um 14:08 schrieb Farkas Zsolt: please find the original incoming email saved by SA: http://pastebin.com/mszg5nJe the email notification received back from SA on spamadmin account http://pastebin.com/0UTvT9tQ i would say this is the wrong mailing-list since you are running amavis

Re: SA gone mad

On Wednesday 09 September 2015 at 13:52:31, RW wrote: > On Wed, 9 Sep 2015 13:14:04 +0200 > > Antony Stone wrote: > > On Wednesday 09 September 2015 at 13:08:45, Farkas Zsolt wrote: > > > Content analysis details: (13.1 points, 15.0 required) > > > > You said earlier "it gave 10 point for badw

Re: SA gone mad

On Wednesday 09 September 2015 at 13:54:44, Farkas Zsolt wrote: > you made a point, but /etc/spamassassin/local.cf looks like: > > ... > # Use Bayesian classifier (default: 1) > # > #use_bayes 1 So, you have not set it to 0, to disable Bayes; you have left it at the default, which is 1, there

Re: SA doesn't respect my user_prefs

PS: I just did the following test: As the user, filter.sh is executed as, I did test the following: 1. /usr/bin/vendor_perl/spamc -x -E -u ww < /tmp/spam As the user, who owns the user_prefs, I did test the following: 2. /usr/bin/vendor_perl/spamc -x -E < /tmp/spam 3. spamassassin --test-mode

Re: SA gone mad

Hello, please find the original incoming email saved by SA: http://pastebin.com/mszg5nJe the email notification received back from SA on spamadmin account http://pastebin.com/0UTvT9tQ KR, Zsolt 2015.09.09. 13:42 keltezéssel, Matus UHLAR - fantomas írta: Hello, what about starting with the lo

Re: SA gone mad

you made a point, but /etc/spamassassin/local.cf looks like: ... # Use Bayesian classifier (default: 1) # #use_bayes 1 # Bayesian classifier auto-learning (default: 1) # #bayes_auto_learn 1 ... KR, Zsolt 2015.09.09. 13:49 keltezéssel, Antony Stone írta: On Wednesday 09 September 2015 at

Re: SA gone mad

On Wed, 9 Sep 2015 13:14:04 +0200 Antony Stone wrote: > On Wednesday 09 September 2015 at 13:08:45, Farkas Zsolt wrote: > > > Content analysis details: (13.1 points, 15.0 required) > > > You said earlier "it gave 10 point for badword rule but there was no > match". > > I see no badword rule

Re: SA gone mad

This was the email what i receive from SA for spamadmin email account I am sending the links in few minutes 2015.09.09. 13:42 keltezéssel, Matus UHLAR - fantomas írta: Hello, what about starting with the log-entries showing the matched rules from some of that messages from the very first star

Re: SA gone mad

On Wednesday 09 September 2015 at 13:42:31, Farkas Zsolt wrote: > badword rule is now disabled, SA running with limited functionality, > higher limit (15 insted of 4.9), bayes disabled How have you disabled Bayes? The message below has 3.5 points for Bayes_99 Antony. > there are two problems

Re: SA doesn't respect my user_prefs

Hi jdow, hi Matus, thanks for your replies. Regardless if it's necessary or not, I have done so. It also happens regularly by cron (all 3 hours), along with other jobs like sa-learn, sa-update and sa-compile. > On 09.09.2015 11:12 Matus wrote: > > have you tried running spamassassin -D ? may

Re: SA gone mad

badword rule is now disabled, SA running with limited functionality, higher limit (15 insted of 4.9), bayes disabled there are two problems now: -messages marked as SPAM but they are below limit (limit at 15 but at 13.1 marked as spam) this has no connection with disabled or enabled badword -

Re: SA gone mad

Hello, what about starting with the log-entries showing the matched rules from some of that messages from the very first start? "it don't work as i expect" is not enough and the only correct answer would be "i am sorry for you" On 09.09.15 13:08, Farkas Zsolt wrote: it has been done at the s

Re: SA gone mad

On Wednesday 09 September 2015 at 13:08:45, Farkas Zsolt wrote: > Content analysis details: (13.1 points, 15.0 required) > > pts rule name description > -- > -- 3.5 BAYES_99 >BODY: Bayes spam

Re: SA gone mad

what about starting with the log-entries showing the matched rules from some of that messages from the very first start? "it don't work as i expect" is not enough and the only correct answer would be "i am sorry for you" it has been done at the start, but there is no visible reason for the

Re: SA gone mad

Am 09.09.2015 um 12:15 schrieb Farkas Zsolt: your first post sounded like spam is coming through and not FP's I mean: lot of emails were marked as SPAM when the limit was at 4.9, and it started from one day to another without config or system change now the limit is at 15 but it sill filte

Re: SA gone mad

your first post sounded like spam is coming through and not FP's I mean: lot of emails were marked as SPAM when the limit was at 4.9, and it started from one day to another without config or system change now the limit is at 15 but it sill filters mais below 15 without a reason so arte they

Re: SA gone mad

Am 09.09.2015 um 11:20 schrieb Farkas Zsolt: 2015.09.09. 11:02 keltezéssel, Reindl Harald írta: Am 09.09.2015 um 10:56 schrieb Farkas Zsolt: Can you help me with please? One of our SA installation has gone mad since a few days: -it is filtering mails below required points: Content analysis

Re: SA gone mad

Am 09.09.2015 um 10:56 schrieb Farkas Zsolt: One of our SA installation has gone mad since a few days: Content analysis details: (12.5 points, 15.0 required) Content analysis details: (10.7 points, 15.0 required) 2015.09.09. 11:02 keltezéssel, Reindl Harald írta: 15.0 required - seriously?

Re: SA gone mad

2015.09.09. 11:02 keltezéssel, Reindl Harald írta: Am 09.09.2015 um 10:56 schrieb Farkas Zsolt: Can you help me with please? One of our SA installation has gone mad since a few days: -it is filtering mails below required points: Content analysis details: (12.5 points, 15.0 required) Content a

Re: SA doesn't respect my user_prefs

On 09.09.15 01:16, jdow wrote: I presume you restarted spamd, right? restarting spamd should not be needed for changes in user_prefs, should it? On 2015-09-08 23:46, Marc Richter wrote: I'm running SA 3.4.1 with Perl 5.22.0 . It works quite well, but since a few weeks, it looks like my user_

Re: SA gone mad

Am 09.09.2015 um 10:56 schrieb Farkas Zsolt: Can you help me with please? One of our SA installation has gone mad since a few days: -it is filtering mails below required points: Content analysis details: (12.5 points, 15.0 required) Content analysis details: (10.7 points, 15.0 required) 15.0

SA gone mad

Hello, Can you help me with please? One of our SA installation has gone mad since a few days: -it is filtering mails below required points: Content analysis details: (12.5 points, 15.0 required) Content analysis details: (10.7 points, 15.0 required) ... -it has been filtering bad words but wit

Re: SA doesn't respect my user_prefs

I presume you restarted spamd, right? {^_^} On 2015-09-08 23:46, Marc Richter wrote: Hi everyone, I'm running SA 3.4.1 with Perl 5.22.0 . It works quite well, but since a few weeks, it looks like my user_prefs isn't taken into account by SA anymore. Let's show this by example: There are *lots

Re: Resume / Doc Spam

John Schmerold skrev den 2015-09-08 23:27: Content analysis details: (6.1 points, 10.0 required) why not 5.0 required ? pts rule name description -- -- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender list

Re: Resume / Doc Spam

John Schmerold skrev den 2015-09-08 23:26: 01/01/1980 12:00 AM33,280 vbaProject.bin i would run "strings vbaProject.bin" and make clamav signature based on it if you then are happy with amavisd-new this clamav signatures can be mapped from virus to spam score in amavisd but