I hadn't paid attention for awhile, and now I'm noticing that SA-Update exited
with code 1 every time it ran (daily) for the last several weeks at least that
I've been paying attention again. Normal? Is there a list of when updates
have come out?
Thanks - John
On Tue, August 28, 2007 5:28 am, Daryl C. W. O'Shea wrote:
> Justin Mason wrote:
>> John Fleming writes:
>>> When I run sa-update, I have recently started to get this error
>>> which
>>> terminates the update run:
>>>
>>> [17894] dbg: chan
When I run sa-update, I have recently started to get this error which
terminates the update run:
[17894] dbg: channel: attempting channel updates.spamassassin.org
[17894] dbg: channel: update directory
/var/lib/spamassassin/3.001007/updates_spamassassin_org
[17894] dbg: channel: channel cf file
2-28 01:44:27 1HMDi7-0004Gt-Qt <[EMAIL PROTECTED]>: sa_spamcheck
transport output: An error was detected while processing a file of
BSMTP input.
2007-02-28 01:44:28 1HMDi7-0004Gt-Qt ** [EMAIL PROTECTED]
<[EMAIL PROTECTED]> F=<[EMAIL PROTECTED]> P=<[EMAIL PROTECTED]>
R=sa_
- Original Message -
There shouldn't be, from what I recall its as simple as that. The only
other thing you'll want to do is run sa-update and then restart spamd!
Consider:
1) Run sa-update -D so you can see what it does or tries to do and what
modules you might be missing and wan
- Original Message -
From: "Richard Hobbs" <[EMAIL PROTECTED]>
To:
Sent: Monday, February 26, 2007 4:54 AM
Subject: sa-update doesn't exist on my system
Hello,
I run a mail server which is using the latest stable spamassassin
available through the standard debian repositories - "sp
I'd suggest addign soemthing like:
After running sa-update for the first time old rules which are provided
through one of sa-update's channels should be removed from
/etc/mail/spamassassin (or whichever is our local rules directory) because
the rules in this directory will take precedence over
If I run sa-update via a cron job, is there a way to know what it did other
than emailing the output to myself? RDJ used to send me a nice email
telling me what rules had changed. I don't find any notification options
with sa-update.
- John
- Original Message -
From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]>
To: "John Fleming" <[EMAIL PROTECTED]>
Cc:
Sent: Sunday, February 25, 2007 5:41 PM
Subject: Re: how to start using sa-update
On 2/25/2007 5:31 PM, John Fleming wrote:
-
- Original Message -
From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]>
To:
Sent: Sunday, February 25, 2007 5:21 PM
Subject: Re: how to start using sa-update
On 2/25/2007 5:13 PM, John Fleming wrote:
The sa-update channels allow you to check for new rulesets more o
The sa-update channels allow you to check for new rulesets more often than
once a day, so you can get newly released rulesets a little faster. Of
course the SARE rules aren't really updated that often so this may not be
a big advantage for you.
So the signature is good but it's not trusted? O
- Original Message -
From: "David Goldsmith" <[EMAIL PROTECTED]>
To: "Bram Mertens" <[EMAIL PROTECTED]>
Cc:
Sent: Sunday, February 25, 2007 2:10 PM
Subject: Re: how to start using sa-update
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Bram Mertens wrote:
Hi
I unsubscribed from
- Original Message -
From: "Nathan" <[EMAIL PROTECTED]>
To:
Sent: Sunday, February 25, 2007 6:46 AM
Subject: 3.0.2 rules
Hi
I am running an old version on debian.
server:/usr/doc/spamassassin# spamassassin -V
SpamAssassin version 3.0.2
running on Perl version 5.6.1
server:/usr/d
- Original Message -
From: "David Morton" <[EMAIL PROTECTED]>
To: "Jim Knuth" <[EMAIL PROTECTED]>
Cc: "John Fleming" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>
Sent: Thursday, February 22, 2007 2:03 AM
Subject: Re: tie failed
Could
Feb 21 22:26:10 Luke spamd[5590]: spamd: setuid to elizabeth succeeded
Feb 21 22:26:10 Luke spamd[5590]: bayes: cannot open bayes databases
/var/.spamassassin/bayes_* R/O: tie failed: Permission denied
1) are you using bayes_path ?
2) have you set bayes_file_mode 0777 in your local.cf?
YES YES
Could someone please translate this to n00bese with helpful
suggestions/comments? It doesn't happen with all messages. I just noticed
this while tailing the mail log. THANKS - John
Feb 21 22:26:10 Luke spamd[5590]: spamd: setuid to elizabeth succeeded
Feb 21 22:26:10 Luke spamd[5590]: bayes:
Please give me some simple advice - I've upgraded 3.0.3 to 3.1.7 from
backports.org for my Debian Sarge (stable) installation. I'm still using my
former local.cf.
I've noticed that my ham is no longer being tagged with X-Spam headers, but
the spam is getting these headers - at the top of the
SA 3.0.3 - Does this log entry just mean Pyzor isn't available, or something
more serious? - John
Jan 20 08:40:51 Luke spamd[18328]: Pyzor -> check failed: Can't fork at
/usr/share/perl5/Mail/SpamAssassin/Util.pm line 1017.
Jan 20 08:40:51 Luke spamd[18829]: Pyzor -> check failed: Can't fork a
Newbie - The last several days I get emails that 3 rulesets have changed,
and finally another that says lint failed. Any idea what's up with the RDJ
rulesets recently. A couple of weeks ago I didn't have the problem.
***WARNING***: spamassassin --lint failed.
Rolling configuration files back,
Real novice here - Would someone please explain how a stock spam was
able to use my whitelist to get a huge negative score? I do have a
whitelist, but the user shown below is not in it. I do have one
Italian (.it) domain in the whitelist, but it is a different/address
domain. How did this msg ge
- Original Message -
From: "jdow" <[EMAIL PROTECTED]>
To:
Sent: Saturday, August 26, 2006 9:51 PM
Subject: Re: Pse help stock spam
From: "John Fleming" <[EMAIL PROTECTED]>
My server is getting more and more "stock spam" with an image and a
My server is getting more and more "stock spam" with an image and a few
paragraphs of bayes-obfuscating text. I've been chasing them by either
learning them or increasing the score of SARE or other rules that hit.
Today I got several that didn't hit anything useful and were learned as ham:
X-
- Original Message -
From: "Chris Purves" <[EMAIL PROTECTED]>
To:
Sent: Thursday, February 02, 2006 9:00 PM
Subject: Re: Post your top 10 from sa-stats
John Fleming wrote:
Wrong tool. Visit http://www.rulesemporium.com/ and find the
sa-stats.pl on their site. It is
Wrong tool. Visit http://www.rulesemporium.com/ and find the
sa-stats.pl on their site. It is the one most of us are using. It
gives individual score breakdowns. The name coincidence is
regrettable.
I have the "other sa-stats.pl" working well on my system. But I'm
apparently not pointing the "
- Original Message -
From: "mouss" <[EMAIL PROTECTED]>
To: "jdow" <[EMAIL PROTECTED]>
Cc:
Sent: Monday, January 30, 2006 2:01 PM
Subject: Re: hey john spam
jdow a écrit :
I'm watching them still roll in
seems they switched to "News for john".
Interesting - I'm -not- getting t
This is a new one for me. Today I've received some mail with "hey john" in
the subject, and the mail otherwise appears blank. It didn't contain a
virus, or it would've been discarded by ClamAV.
Are these familiar to you guys? What's the point of them? Headers of one
below: Thanks! - John
- Original Message -
From: "Chris Thielen" <[EMAIL PROTECTED]>
To: "John Fleming" <[EMAIL PROTECTED]>
Cc: "Spamassassin"
Sent: Tuesday, September 27, 2005 11:23 AM
Subject: Re: RDJ newbie prob
John Fleming wrote:
Thanks, Chris. I'
Thanks, Chris. I'm sure this is something trivial - I've had it working in
the past!
Here's my /etc/rulesdujour/config
TRUSTED_RULESETS=
"TRIPWIRE
ANTIDRUG
SARE_EVILNUMBERS0
SARE_EVILNUMBERS1
SARE_EVILNUMBERS2
BLACKLIST
BLACKLIST_URI
RANDOMVAL
BOGUSVIRUS
SARE_ADULT
SARE_FRAUD
SARE_BML
SARE_RATW
I've had such good results with SA that I haven't worried about rulesets,
updating rulesets etc. Lately I've had a few getting through and decided it
must be time to update my rulesets. I've decided to use RDJ, but below is
what I get when I run the bash script. Would someone kindly tell me w
- Original Message -
From: "Loren Wilton" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, July 13, 2005 6:32 AM
Subject: Re: HELP bv lottery spam
Norton AV makes wait headers similar (but not identical) to what you see
when it is scanning outbound mail for a virus, as I recall. I suspect
Would someone shed some light on why this message wasn't scanned/tagged and
some info about the headers?
1. I don't remember ever seeing the "wait" headers that appear at the top
of this message - what are they? I did notice a delay in receiving this
message as if receiving a large file. Ho
- Original Message -
From: "Kai Schaetzl" <[EMAIL PROTECTED]>
To:
Sent: Thursday, June 16, 2005 8:07 AM
Subject: Re: Bayes? (MORE)
John Fleming wrote on Wed, 15 Jun 2005 18:25:28 -0500:
Note that there -is- a BAYES_ entry! I have some modified Bayes scores
in
- Original Message -
From: "Kai Schaetzl" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, June 15, 2005 4:32 PM
Subject: Re: Bayes? (MORE)
John Fleming wrote on Tue, 14 Jun 2005 15:56:02 -0500:
Running spamassassin NOW results in ONLY the following, and then it
hangs:
- Original Message -
From: "Matt Kettler" <[EMAIL PROTECTED]>
To: "John Fleming" <[EMAIL PROTECTED]>
Cc:
Sent: Tuesday, June 14, 2005 2:48 PM
Subject: Re: Bayes?
John Fleming wrote:
Not sure what I'm doing wrong, but noone has responded
- Original Message -
From: "Matt Kettler" <[EMAIL PROTECTED]>
To: "John Fleming" <[EMAIL PROTECTED]>
Cc:
Sent: Tuesday, June 14, 2005 2:48 PM
Subject: Re: Bayes?
John Fleming wrote:
Not sure what I'm doing wrong, but noone has responded
Not sure what I'm doing wrong, but noone has responded to my question -
If Bayes is working properly, am I supposed to have a Bayes_ entry in the
X-Spam_Status header info for every email? I think that's the way it used
to be - Bayes_00 - Bayes_99 etc. Lately it seems that only the spam emails
If working properly, shouldn't every email have a BAYES_nn entry?
My spam has a high Bayes entry, I have a few ham that have a BAYES_50 entry,
but most of the ham has NO BAYES entry. Is this normal?? I thought I used
to get a BAYES_nn on every one. When I don't see the BAYES_nn entry, I
wor
X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=ham
version=3.0.3
Shouldn't I have a Bayes entry for every mail? I've never really had any
issues with Bayes - It's always worked, and worked well for me. I use
Postfix and call spamc using procmail, so the setup is very simple.
On Sun, 2005-05-15 at 22:34 -0500, John Fleming wrote:
I run a very simple Postfix - Procmail - SpamAssassin - CLamAV setup that
has been working great, but tonight I see something I don't understand.
I suspect that your procmail recipe doesn't scan files over a certain
size. What
I run a very simple Postfix - Procmail - SpamAssassin - CLamAV setup that
has been working great, but tonight I see something I don't understand.
Look at the 2 examples below please. Both messages got virus-scanned.
However, the message that includes an mp3 audio attachment, appears that it
di
This will be boring for many of you, but I need some advice. I run a
low-volume mail server for friends/family/church and have had a very good
experience with SA and site-wide Bayes. I know that email addys can be
spoofed, but I know nothing about the details of that.
I just got my first spam
Would someone please help me understand the problem indicated by the
following:
WARNING: ignoring future date in syslog line: Dec 13 14:45:53 Luke
postfix/pickup[18676]: warning: 1EDE133E6BF: message has been queued for 0
days
WARNING: ignoring future date in syslog line: Dec 13 14:45:53 Luke
I got 4-5 spams overnight that scored very low, and one didn't hit a single
rule.
2 of them hit either SARE_MSGID_D10D4 or SARE_MSGID_IP, but one didn't hit
anything. They are just a mixture of nonsense and misspelled words, with a
single URL.
They all came through the Debian mailing list, so
Newbie question - Saw the following in log - Does
this represent a temporary inability to connect or a more basic configuration
problem on my end? Thanks
Mar 30 10:01:28 Luke spamd[27283]: razor2 check
skipped: Transport endpoint is not connected Died at
/usr/share/perl5/Mail/SpamAssassin/D
- Original Message -
From: "Matt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, March 23, 2005 8:45 PM
Subject: Restarting SPAMD
I start SPAMD like so in rc.local.
/usr/bin/spamd -d -c -m 5
I imagine it must be restarted to pick up any changes in the rule sets?
Now how do
On Friday 18 February 2005 12:53 pm, Tracey Gates wrote:
> I downloaded the .cf files from the rulesemporium.com site but I don't
> know what to do with them. Do I just place them in the same folder as
> my local.cf and SpamAssassin will automatically use them or do I need to
> place something in
I got one I hadn't seen before - It used characters like _-/\ to spell out
the v-word and other drugs in giant letters on the screen. It looks like
learning should help. Tnx
X-Spam-Status: No, score=3.6 required=5.0 tests=BAYES_50,HTML_80_90,
HTML_FONT_BIG,HTML_MESSAGE,MIME_QP_LONG_LINE,MPART_
> I am running spamassassin as root (for now...), globally. Spam should be
> getting marked and deleted or moved to a generic spambox on the
> spamassassin server with no individual user spamboxes.
This works:
:0fw
| /usr/bin/spamc
#
:0:
* ^X-Spam-Flag: Yes
/home/john/Spam
If I substitute /dev/
Since upgrading v2.64 to 3.0.2, I have a much higher false negative rate. I
posted one a couple of days ago that involved a "trusted" issue. I just got
a medication-spam this morning that ONLY triggered bayes_99, although it
mentioned sexual health, anxiety and others I would've thought would've
On Wed, Jan 19, 2005 at 09:04:06PM -0500, John Fleming wrote:
UGH! On looking at the default scores, I see it got -4 something from
being RCVD_IN_BSP_TRUSTED! Could someone elaborate on the utility of
BSP_TRUSTED? So much for "trust". I guess when I get [just a little]
older, maybe
See attached--- Begin Message ---
Online pharmacy - Visit our online store and save.
Save up to 80% compared to normal rates.
All popular drugs are available, including Vicodin and
Hydrocodone!
- World wide shipping
- No Doctor Visits
- No Prescriptions
- Next Day Priority Shipping
- Discreet Pa
I just got an email VERY obvious about selling drugs. Aren't these headers
and score a little surprising? It even contained a URL with the v-word
misspelled by only one letter.
X-Spam-Status: No, score=1.6 required=5.0 tests=BAYES_99,DRUGS_PAIN,
RCVD_IN_BSP_TRUSTED,RCVD_IN_NJABL_SPAM,RCVD_IN_S
> The Bayes_9x scores were a bit low for our needs. So we bumped them
> up. That is one of the great things I like about SA. You can customize
> it to meet your needs.
>
> Shane
My part of the thread was that the scores don't consistently go -up- with
increased percentage - see previous. t
> 1.9 BAYES_99 BODY: Bayesian spam probability is 99 to
100%
[score: 1.]
And what's the rationale for 95% scoring lower than 80%?? Sorry if this has
been previously mentioned.
score BAYES_00 0 0 -1.665 -2.599
score BAYES_05 0 0 -0.925 -0.
Bayes in the current version will not autolearn against itself (will
not auto-learn as ham something it thought was spam, or v.v.) -- it
might be a good enhancement to also have bayes look at AWL if active,
and if AWL disagrees with the auto-learn judgment, then do not
auto-learn.
Looking at http:/
- Original Message -
From: "Martin Hepworth" <[EMAIL PROTECTED]>
To: "John Fleming" <[EMAIL PROTECTED]>
Cc: "Spamassassin"
Sent: Wednesday, January 12, 2005 7:58 AM
Subject: Re: AWL problem??
John Fleming wrote:
I've never seen this be
I've never seen this before - I don't know squat about AWL, but I sure need
help understanding the following headers!
X-Spam-Status: Yes, hits=26.1 required=5.0
tests=AWL,BAYES_00,SARE_HEAD_XBEEN
autolearn=ham version=2.64
X-Spam-Report:
* -4.9 BAYES_00 BODY: Bayesian spam probability is 0
> > What am I missing? - John
>
> OK, from the "spamd --help" output:
> -m num, --max-children num Allow maximum num children
>
> So that option is positively "a spamd thing." So how does one get that
> option into spamd? On the Mandrake test machine I have the init script
> in /etc/i
> SpamAssassin: Processing program. It loads, processes, and unloads.
> SpamD: It is SpamAssassin, but doesn't unload, so it is always ready. It
> listens for a communication from SpamC (on same or different computer).
> SpamC: It passes a message to be processed to SpamD (on same or different
>
- Original Message -
From: "jdow" <[EMAIL PROTECTED]>
To:
Sent: Saturday, October 30, 2004 10:41 PM
Subject: Re: Load Average Problems
> From: "John Fleming" <[EMAIL PROTECTED]>
>
> > jdow said:
> > > On another paw I note that most
jdow said:
> On another paw I note that most family tools are not left running
> 24x7. If this is his case then a large portion of his 250 messages
> may be coming in right after he boots. If he is setup to spawn
> too many spamds then he could experience a memory crisis.
That's not it. It's most
I've followed the "memory-hog" threads of late, but as a rather
inexperienced Linux person, some of it is over my head. I'm using SA v2.64
with network tests and bayes. Everything is fine except that several times
a day the server seems overwhelmed with load averages 4-12. Here is a minor
exampl
> What in the world is going on? Isn't it true that spamd (beside DCC) does
> its thing w/out disk I/O? If so, what else could be chewing up so much
CPU?
I don't know - The same thing happens to me a couple of times a day, and I
only get about 350 messages per day. Today it was at 12:25p:
11:3
> Currently I use a maildrop script that checks the score given to the email
> by SA and if it reaches a certain number or greater it gets sent to a
> different mailbox.
>
> My question is could you do that instead in SA local.cf and if so which
> one would be better in doing this? Should I keep t
- Original Message -
From: "Ronan" <[EMAIL PROTECTED]>
To: "spam"
Sent: Friday, October 22, 2004 5:31 AM
Subject: can sa-learn read mbx format mailboxes
> as per subject title or do they have to be standard unix format
Yep - Just use the --mbox option. - John
- Original Message -
From: "Potato Chip" <[EMAIL PROTECTED]>
To:
Sent: Sunday, October 03, 2004 2:00 PM
Subject: RE: Memory usage spikes ...
> I've been calling this the Email Scud problem. I've been hoping for a
> patriot missle for a long time. I have noticed the same problem with
>
- Original Message -
From: "Ed Kasky" <[EMAIL PROTECTED]>
To:
Sent: Monday, September 27, 2004 2:49 PM
Subject: Re: Preferred DNSBL
> Rejects Since Sunday 4:00 am via rbls:
>
> spamcop: 65
> maps rbl+: 154
> dsbl.org: 9
> njabl.org: 18
> spamhaus: 18
What/how are you guys gathering t
All of a sudden my sa-stats program thinks it's tomorrow and thus showing no
ham and spam found.
The dates in the mail log are correct; the system date is correct; the date
returned by sar is correct. For the default 24-hr report, why would
sa-stats suddenly think it should look from 9/15 - 9/16
> > another machine. Everything installs fine (make tests=100%) and seem to
> run
> > but in /var/log/maillog, I get these entries:
> >
> > info: setuid to root succeeded
> > spamd[15901]: Still running as root: user not specified with -u, not
> found,
> > or set to root. Fall back to nobody.
I
ules_du_jour
> On 8 Sep 2004 at 20:55, John Fleming wrote:
>
> > > > P.S. If you know how to get my mail command back, I obviously would
> > like to
> > > > know that too! It used to be there, and I have no idea why it
> > disappeared!
> > > >
> > >
> What do you get when you run
> locate mail ?
OK, I seem to have SpamCopURI working:
* 2.1 WS_URI_RBL URI's domain appears in ws database at ws.surbl.org
* [mail-svcs.com is blacklisted in URI RBL at]
[multi.surbl.org]
* 2.1 OB_URI_RBL URI's domain appears in ws database at ob.surbl.org
* [mail-svcs.com is blacklisted in URI RB
Matt Kettler said:
> At 07:02 PM 9/9/2004 -0500, John Fleming wrote:
>>I got a spam that scored 100 for this:
>>
>>* 100 USER_IN_BLACKLIST From: address is in the user's black-list
>>
>>But I don't have any blacklist to my knowledge. I do site-w
- Original Message -
From: "Chris Santerre" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>; "Spamassassin users"
Sent: Thursday, September 09, 2004 2:07 PM
Subject: RE: rules_du_jour
>
>
> >-Original Message-
> >From: John F
I got a spam that scored 100 for this:
* 100 USER_IN_BLACKLIST From: address is in the user's black-list
But I don't have any blacklist to my knowledge. I do site-wide filtering,
and the mail was for me. Explanations? Tnx - John
Chris Thielen said:
> Hi John
>
> On Wed, 2004-09-08 at 19:10 -0500, John Fleming wrote:
>> I've been manually updating 8-9 rulesets every couple of months and,
>> with
>> Bayes, get great results. Now I'd like to use rules_du_jour.
>> rules_du_jour
- Original Message -
From: "Jim Sabatke" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, September 08, 2004 8:12 PM
Subject: Re: rules_du_jour
> John Fleming wrote:
> > - Original Message -
> > From: "Jim Sabatke" <[EMAIL PROTECTED]>
- Original Message -
From: "Jim Sabatke" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, September 08, 2004 8:16 PM
Subject: Re: rules_du_jour
> John Fleming wrote:
> > P.S. If you know how to get my mail command back, I obviously would
like to
> > know that t
- Original Message -
From: "Jim Sabatke" <[EMAIL PROTECTED]>
To: "Spamassassin"
Sent: Wednesday, September 08, 2004 7:21 PM
Subject: Re: rules_du_jour
> John Fleming wrote:
> > I've been manually updating 8-9 rulesets every couple of months and,
I've been manually updating 8-9 rulesets every couple of months and, with
Bayes, get great results. Now I'd like to use rules_du_jour. rules_du_jour
is in /root/bin, and perms executable as suggested. I've also made the
appropriate /etc/rulesdujour/config file.
However, when I try to run it, I
- Original Message -
From: "JP" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, September 07, 2004 11:51 AM
Subject: Re: Bayes Perms
>
> > No, you shouldn't need to re-build them, but try manually changing their
> > permissions to 666 and see if that corrects the problem.
> > --
>
> Well that w
I have three questions regarding mail log excerpt at end of post.
1. Can't write to bayes_journal, Bayes db update ignored - My Bayes stuff
is in /var/.spamassassin as shown below. Here's the pertinent portion of
local.cf:
use_bayes 1
bayes_path /var/.spamassassin/bayes
bayes_file_mode 0777
bay
81 matches
Mail list logo
