Re: Custom rule in local.cf

2011-09-06 Thread J4K
On 09/06/2011 12:07 PM, Axb wrote: > On 2011-09-06 12:03, J4K wrote: >> On 09/06/2011 10:58 AM, Axb wrote: >>> On 2011-09-06 10:43, J4K wrote: >>>> Hi, >>>> >>>> I know that this is probably the hundredth time I have >>>>

Re: Custom rule in local.cf

2011-09-06 Thread J4K
On 09/06/2011 10:58 AM, Axb wrote: > On 2011-09-06 10:43, J4K wrote: >> Hi, >> >> I know that this is probably the hundredth time I have emailed to >> the list about my custom rules. Usually, someone points out the >> blindingly obvious when I fail to no

Re: Quicky custom rule in local.cf question - dbg: rules: PRIVATE_PHONICA2 merged duplicates: PRIVATE_RULE1

2011-09-01 Thread J4K
On 09/01/2011 04:33 PM, John Wilcock wrote: > Le 01/09/2011 16:23, J4K a écrit : >> meta PRIVATE_RULE1 (__PR1&& __PR2) > ... >> meta PRIVATE_PHONICA2 (__PR1&& __PR2) >> >> Spamassassin -D -lint records this: >> Sep 1 15:45:56.313 [1148

Quicky custom rule in local.cf question - dbg: rules: PRIVATE_PHONICA2 merged duplicates: PRIVATE_RULE1

2011-09-01 Thread J4K
Hi there, I've got these two rules in the local.cf. describe PRIVATE_RULE1 English language job opportunity body __PR1/(Employment opportunity|Job offer match, respond to apply|Employment you've been searching|Job opportunity|Career opportunity inside|Position opening in your are

[Q] Bayes dB: ratio of spam and ham heavily in favour of ham

2011-08-22 Thread J4K
Afternoon gentlemen, Seems the Bayes dB has become lop-sided in favour of ham. SA is doing its job as there is little spam coming through these recently. I had hoped we could keep it one third spam and two thirds spam. Does the slant shown below (nspam verses nham) cause any problems w

Re: Self addressed spam

2011-08-10 Thread J4K
On 08/10/2011 12:08 PM, Marcin Mirosław wrote: > W dniu 10.08.2011 12:00, akrohnke pisze: >> >> Hello, >> >> Currently one of our clients are getting spam that looks like it >> comes from >> the sender itself. Spamassassin only occasionally catches it. > > Hello! > It should be done at smtp level.

SOLVED Re: malware.blocklist.cf : www.malware.com.br unavailable

2011-08-09 Thread J4K
On 08/09/2011 10:50 AM, J4K wrote: > Hi, > > I noticed that the site that provided the malware.blocklist.cf has > been unavailable since at least the 8th of August. > > URL for the file was on http://www.malware.com.br/cgi/submit?action=list_sa > > The FQDN no longe

malware.blocklist.cf : www.malware.com.br unavailable

2011-08-09 Thread J4K
Hi, I noticed that the site that provided the malware.blocklist.cf has been unavailable since at least the 8th of August. URL for the file was on http://www.malware.com.br/cgi/submit?action=list_sa The FQDN no longer resolves to an address. I have tried our local DNS, Level3 4.2.2.2 and Go

[Q] Skip Bayes classification of emails with a certain From: address

2011-07-20 Thread J4K
Morning all, I had a route around in the SA dox, and in /usr/share/spamassassin/*.cf, to try and find out how to disable Bayes classification for particular From: address. In particular, I don't want Bayes to classify, or put into the database, messages from this mailing list. You can see th

Re: improving the score for specific types of spam

2011-07-13 Thread J4K
On 07/13/2011 02:43 PM, Martin Gregorie wrote: > On Wed, 2011-07-13 at 14:06 +0200, J4K wrote: > > I assume you tested it as well as running it through lint ("spamassassin > > Comments: As written the rule won't work because __PR2 assumes that the > domain name starts

Re: improving the score for specific types of spam

2011-07-13 Thread J4K
On 07/13/2011 01:23 PM, Martin Gregorie wrote: > On Wed, 2011-07-13 at 09:44 +0200, Geert Mak wrote: >> recently we had two specific types of spam getting very low score >> (about 3) and going through - >> >> a) one was about Armbanduhren (wrist watches in German) or >> Edelarmbanduhren (luxury wri

60_whitelist_spf.cf - whitelist SPF

2011-07-01 Thread J4K
Hi everyone, Is 60_whitelist_spf.cf the correct place to whitelist SPF for a sender? def_whitelist_from_spf *.junkemailfilter.com It looks correct as per http://spamassassin.apache.org/full/3.3.x/doc/Mail_SpamAssassin_Plugin_SPF.txt Also, I have added their delivery servers to the l

Re: Bayes and mysql Was: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 06:02 PM, Axb wrote: > Please only reply to the list... > > On 2011-06-30 18:00, J4K wrote: >> >> # sa-learn --username=spamd --ham .HAM/cur/ >> Learned tokens from 717 message(s) (764 message(s) examined) >> # sa-learn --username=spamd --spam .Ju

Re: Bayes and mysql Was: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 05:54 PM, Axb wrote: > > ok.. you said "Spamd runs as root." > > in that case: > > bayes_sql_override_username spamd > > then as per Bowie: > > sa-learn --username=spamd --ham /path/to/ham > sa-learn --username=spamd --spam /path/to/spam > > then > sa-learn --dump magic > > Ahh, I m

Re: Bayes and mysql Was: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 05:27 PM, Axb wrote: > spamassassin --lint -D bayes Hi Axb, Spamd runs as root. # spamassassin --lint -D bayes Jun 30 17:32:10.858 [2775] dbg: FuzzyOcr: focr_bin_helper: 'pnmnorm,pnminvert,ppmtopgm' Jun 30 17:32:10.858 [2775] info: FuzzyOcr: Adding <3> new helper apps Jun 30 17

Re: Bayes and mysql Was: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
[SNIP] Hi there, This is the table I have in mysql, and the one I intend to populate with data:- mysql> describe bayes_vars; ++--+--+-+++ | Field | Type | Null | Key

Re: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 01:45 PM, J4K wrote: > On 06/30/2011 11:37 AM, J4K wrote: >> On 06/30/2011 11:09 AM, J4K wrote: >>> On 06/29/2011 09:55 PM, Lawrence @ Rogers wrote: >>>> On 29/06/2011 4:58 PM, JKL wrote: >>>>> select count(spam_count) from bayes_vars

Now: Bayes with mysql Was: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 01:45 PM, J4K wrote: > On 06/30/2011 11:37 AM, J4K wrote: >> On 06/30/2011 11:09 AM, J4K wrote: >>> On 06/29/2011 09:55 PM, Lawrence @ Rogers wrote: >>>> On 29/06/2011 4:58 PM, JKL wrote: >>>>> select count(spam_count) from bayes_vars

Re: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 11:37 AM, J4K wrote: > On 06/30/2011 11:09 AM, J4K wrote: >> On 06/29/2011 09:55 PM, Lawrence @ Rogers wrote: >>> On 29/06/2011 4:58 PM, JKL wrote: >>>> select count(spam_count) from bayes_vars >>> Run this query >>> >>

Re: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 11:38 AM, Benny Pedersen wrote: > On Thu, 30 Jun 2011 11:09:18 +0200, J4K wrote: > >> loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody > > should not be in a cf file but in a pre file, check other pre files to > enable it Thank-you. Moved this into v320.pre

Re: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 11:09 AM, J4K wrote: > On 06/29/2011 09:55 PM, Lawrence @ Rogers wrote: >> On 29/06/2011 4:58 PM, JKL wrote: >>> select count(spam_count) from bayes_vars >> Run this query >> >> SELECT username,spam_count,ham_count FROM bayes_vars >> >&

Re: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/29/2011 09:55 PM, Lawrence @ Rogers wrote: > On 29/06/2011 4:58 PM, JKL wrote: >> select count(spam_count) from bayes_vars > Run this query > > SELECT username,spam_count,ham_count FROM bayes_vars > > This will give a list of usernames that have been used to learn ham > and spam into SpamAssa

[Q] Writing rule for career opportunity type messages

2011-06-29 Thread J4K
Dear all, Over the past few months I noticed an increase in 'Start New Employment Today | Career Opportunity' style email. The rules I use, that are pretty much stock rules, correctly tag the email as spam. Usually the Spam score hovers between 5.5 and 6.9. I would like to add a rule that adds mo

[Q] SA mis-configuration question: Empty dirs username being created in /var/mail

2011-03-11 Thread J4K
Dear everyone, I wonder if I have some misconfiguration in my SA set-up, and if someone would be able to send me off in the right direction, or has seen it before. As shown below, some messages are scanned by SA with just the user name, while others are scanned using the full login. Fri Mar

Re: Should Emails Have An Expiration Date

2011-03-01 Thread J4K
On 03/01/2011 04:13 PM, Jari Fredriksson wrote: > On 1.3.2011 0:06, Matt wrote: >>> Looking at top 8 newest messages from my personnel email account: >>> >>> [Spammy subjects deleted] >> None of them are SPAM. If I wanted to unsubscribe from them I would. >> Its just if I do not read them within 3

Re: [Q] Adjusting Rule Scores - Which file?

2011-02-17 Thread J4K
On 02/17/2011 05:33 PM, Bowie Bailey wrote: > On 2/17/2011 10:51 AM, J4K wrote: >> On 02/17/2011 04:45 PM, John Hardin wrote: >>> On Thu, 17 Feb 2011, J4K wrote: >>> >>> You do not want to alter the distributed files, as any alterations >>> would b

Re: [Q] Adjusting Rule Scores - Which file?

2011-02-17 Thread J4K
On 02/17/2011 04:45 PM, John Hardin wrote: > On Thu, 17 Feb 2011, J4K wrote: > > You do not want to alter the distributed files, as any alterations > would be lost on the next upgrade. > > That rule doesn't appear in any of your local customization files > (under /etc/sp

[Q] Adjusting Rule Scores - Which file?

2011-02-17 Thread J4K
Hi, I am interested in raising the score for the rule RDNS_DYNAMIC. However, I cannot find it in any of the files under /etc/spamassassin. I thought that it would be listed somewhere in this directory. In which file is this located? * Why do I want to raise the bar for RDNS_DYNAMIC? I

Re: [Q] sa-compile: not compiling; 'spamassassin --lint' check failed!

2011-02-15 Thread J4K
On 02/15/2011 03:21 PM, Michael Scheidell wrote: > On 2/15/11 8:46 AM, J4K wrote: >> use_dcc 1 >> dcc_path /usr/local/bin/dccproc >> dcc_home /var/dcc >> dcc_add_header 1 >> > just like lint says, dcc_add_header is NOT valid. > > locate DCC.pm &g

Re: [Q] sa-compile: not compiling; 'spamassassin --lint' check failed!

2011-02-15 Thread J4K
On 02/15/2011 02:43 PM, Lawrence @ Rogers wrote: > On 15/02/2011 10:07 AM, J4K wrote: >> >> Its pretty moot any way, because now after running spamassassin >> -lint, sa-compile still fails with the same error. > Hi, > > Just because DCC is running doesn't mean

Re: [Q] sa-compile: not compiling; 'spamassassin --lint' check failed!

2011-02-15 Thread J4K
On 02/15/2011 02:19 PM, Lawrence @ Rogers wrote: > On 15/02/2011 9:27 AM, J4K wrote: >> spamassassin --lint > This may seem obvious, but did you run "spamassassin --lint" like > sa-compile suggested? > > I assume DCC is probably not loaded, or disabled in your setup

[Q] sa-compile: not compiling; 'spamassassin --lint' check failed!

2011-02-15 Thread J4K
Hi chaps, I added the FuzzyOCR (via Debian repos) into sa a few days ago, and finally got around to running sa-compile which looks like it fails. I tried with the -D option, but the verbosity was too great for me to make head nor tail of it. I don't know if this is FuzzyOCR or Where could

Re: Irony

2011-02-15 Thread J4K
Not a chance. Philip Prindeville wrote: On 2/7/11 1:28 AM, Matus UHLAR - fantomas wrote: >> On Tue, 1 Feb 2011 09:49:36 -0500 >> Michael Scheidell wrote: >> >>> because HELO doesn't match RDNS. > On 01.02.11 09:54, David F. Skoll wrote: >> Rejecting on that basis would also cause tons of fal

Re: FYI: IPv6 Update: IANA IPv4 Exhaustion, World IPv6 Day

2011-02-04 Thread J4K
On 02/04/2011 12:13 PM, Michael Scheidell wrote: > On 2/4/11 5:42 AM, Mark Martinec wrote: >> On June 8, 2011, dubbed World IPv6 Day, participants will enable >> IPv6 on their main services for 24 hours. > fug! > > anyone remember when you were only allowed one domain per company? > > No, but I rem

Re: X-IronPort-AV: E=Sophos;i="4.60,386,1291590000"; d="scan'208";a="41500553"

2011-01-28 Thread J4K
On 01/28/2011 10:13 AM, Giles Coochey wrote: > On 28/01/2011 10:11, Giles Coochey wrote: >> On 28/01/2011 10:02, J4K wrote: >>> Good morning everyone (almost the week-end), >>> >>> Is X-IronPort-AV added by SA, or from something else (DCC >>> Cla

X-IronPort-AV: E=Sophos;i="4.60,386,1291590000"; d="scan'208";a="41500553"

2011-01-28 Thread J4K
Good morning everyone (almost the week-end), Is X-IronPort-AV added by SA, or from something else (DCC Clamav ? ) I just noticed that all email from a certain company was flagged with X-IronPort-AV, and I wonder why this is so. I have searched on the usual engine, and saw refereces

Re: score=100.0 required=3.0 tests=SHORTCIRCUIT,,USER_IN_BLACKLIST

2011-01-27 Thread J4K
On 01/27/2011 01:55 PM, Florescu, Dan Alexandru wrote: > Fire up what? > Correct me if I'm wrong, but as far as I know SA does not reject at SMTP > session level. > I myself am using it with amavis and I have: > $sa_quarantine_cutoff_level = 12.0; > which will drop any spammy message with that sco

Re: spamhaus dbl considered safe for mta blocking?

2011-01-27 Thread J4K
On 01/27/2011 05:58 AM, Sahil Tandon wrote: > On Sat, 2011-01-22 at 12:43:55 -0500, Michael Scheidell wrote: > >> oh, and to be safe: >> >> reject_rhsbl_helo dbl.spamhaus.org=127.0.1.2, >> reject_rhsbl_client dbl.spamhaus.org=127.0.1,2, >> reject_rhsbl_sender dbl.spamhaus.org=127.0.1,2, > Sound adv