Re: sa-learn weirdness...

2008-02-08 Thread Paolo Cravero
Arthur Dent wrote: Hmmm... Not delete exactly, but the sa-learn job take so long that the archivemail job has kicked off and finds the "TempSpam" and "TempHam" mboxes in the Mail directory and dutifully chops out anything older than 180 days. I didn't think that that would be a problem, but mayb

Re: sa-learn weirdness...

2008-02-06 Thread Paolo Cravero
Arthur Dent wrote: Learned tokens from 8 message(s) (3165 message(s) examined) Learned tokens from 4628 message(s) (8703 message(s) examined) Learned tokens from 3890 message(s) (8634 message(s) examined) Learned tokens from 2264 message(s) (8671 message(s) examined) Learned tokens from 2303 mes

Re: Spam Assassin Load Balancing

2008-01-08 Thread Paolo Cravero
Thomas Ledbetter wrote: First of all: we're running amavisd-new, not plain spamc/spamd anymore. We used to have N servers each running its own spamd deamons, so with separate Bayes/AWL DB. I have not understood how many machines run spamc and how many spamd. With a rounb robin policy on a ha

Re: OT - massive newsletter

2007-09-19 Thread Paolo Cravero
mizzio wrote: I'm setting up an SMTP server (centos + qmail) on a dell quad core machine for sending out a periodic newsletter (10 millions a month). In order to avoid any possible blacklisting problem, I'm looking for all the best practices. Right now I've set up: You need EXPLICIT authoriza

Re: Blocking MMS messages?

2007-02-13 Thread Paolo Cravero
Steve Monkhouse wrote: Yeah that works for that one.. but with multiple originating sources and multiple carriers etc I thought there must be a better way than manually enetering every mms provider... ?? I'm old fashioned and don't own an MMS-enabled phone, but phone numbers are generally 12 n

spamd errors... SpamdForkScaling.pm

2006-12-18 Thread Paolo Cravero
Got these errors in maillog on a postfix+spamc/spamd Linux RedHat ES3 installation. Looks like this issue has not been fixed in 3.1.7, targeted for 3.1.9? Could it be that the system runs out of file descriptors? Don't think so... [EMAIL PROTECTED] cat /proc/sys/fs/file-nr 843140303145

Re: bayes_seen on MySQL, growing and growing

2006-11-17 Thread Paolo Cravero
Jim Maul wrote: I dont use mysql with SA, but you should be able to use truncate instead of delete. It may very well be faster with all those rows. From MySQL 4.x manual: "For InnoDB, TRUNCATE TABLE is mapped to DELETE, so there is no difference." We're using InnoDB rather than MyISAM, s

bayes_seen on MySQL, growing and growing

2006-11-13 Thread Paolo Cravero
Hi, while doing some checkup on production servers, I noticed that the bayes_seen table on MySQL is rather big: row: 15'814'021 (15.8Mr) size: 1'853'882'368 bytes ( 1.8GB) I've understood SA doesn't clean-up that table, so it has to be done manually. Can I simply do a "DELETE

Bypassing SURBLs using end user brain cells

2006-10-19 Thread Paolo Cravero
Spam message without any link, and instructions inside an image: http://i11.tinypic.com/2pqtaba.gif First time I've seen this. Funny, but other RBLs (RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_SORBS_WEB, RCVD_IN_XBL) caught it. Paolo

Re: FP with Outook SMTPing to Lotus Domino

2006-08-25 Thread Paolo Cravero as2594
Randal, Phil wrote: You might wish to look at tweaking your BAYES_xx scores to reduce false positives. I guess that depends on how healthy your Bayes database is, though. Can't really say how healthy it is. 99% of spam (guessing, but pretty close) is in English language, 99% of our ham is in

FP with Outook SMTPing to Lotus Domino

2006-08-25 Thread Paolo Cravero as2594
Hi, I just spotted this FP in our SA 3.1.4 quarantine... I have no means to contact the sender, but I guess he used an Outlook (Express?) client to SMTP a Domino server. Even if we had the threshold at the default 5 it would have been stopped. Is there a workaround on the rules or should I de

Re: Idea for new SA Rule

2006-04-05 Thread Paolo Cravero as2594
Gustafson, Tim wrote: Could SpamAssassin benefit from a filter that would actually check the spelling of the text parts of the message, and if misspelled words exceeds, for example, 50%, then we can add a few points to the SPAM score? I'm not sure how to begin coding this, but I think it should

Re: sa-learn & Lotus Notes

2006-04-05 Thread Paolo Cravero as2594
Andy Jezierski wrote: There have been numerous threads on how to have end users drop misclassified mail to spam/ham folders in Exchange, but I don't recall seeing any mention of a way of doing this with Notes. Although we don't let users train Bayes, Lotus client and server from version 5 an

Re: false positive on FORGED_MUA_OUTLOOK (v.3.1)

2006-04-05 Thread Paolo Cravero as2594
Tony Finch wrote: The following headers come from a legitimate message - I have obscured the sender's name, but that's all. The "SlipStream SP Server" seems to have appended the client username and IP address to the message-ID, causing the FP. See also: http://mail-archives.apache.org/mod_mbox/sp

Re: Best Practices: SpamAssassin

2006-03-31 Thread Paolo Cravero as2594
ithout breaking-up lines! Luckily Thunderbird has a rewrap function! Have a nice weekend! Paolo Cravero -- |QRPp-I #707 + www.paolocravero.tk + I QRP #476 | | SpamAssassin-based email antispam/antivirus solutions | \Italian/English-to/from-Croatian translations/ \ Skype: pcravero /

Re: Spamassassin Appliances?

2006-03-24 Thread Paolo Cravero as2594
Hi, this is a copy'n'paste from a message I wrote in December 2005 to the AMaViS list. Hi, I thought you might like to know how much a commercial solution _very_ similar to amavisd-new+ClamAV+SA+MySQL+mailzu costs. Something with AV+AS and webQuarantine to be instal

Forged Outlook false positive

2006-01-31 Thread Paolo Cravero as2594
Hi, these headers trigger the FORGED_MUA_OUTLOOK check on 2.64 and 3.1.0: X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) X-Spam-Level: * X-Spam-Status: No, score=1.6 required=5.0 tests=BAYES_00,FORGED_MUA_OUTLOOK, FORGED_RCVD_HELO autolearn=no version=3.1.0 Received: from xx.yy.y

A self-declared Bulk message

2006-01-02 Thread Paolo Cravero as2594
Just reviewed the spam that passed through our amavisd-new + SA3.1.0 barrier and noticed something funny at the bottom of a message: This email has been sent with an unregistered version of MaxBulk Mailer. MaxBulk Mailer is a new easy-to-use mail merge software for Macintosh. This message cam

Re: I need help with false spam (ham flagged as spam)

2005-12-19 Thread Paolo Cravero as2594
Liviu Lalescu wrote: Spamassassin is reporting it as spam, with a score of 5.6, but it is surely not spam. I have also used a "sa-learn --ham" on it, but even after that the message is still flagged as spam. I have done "sa-learn --ham timetabling" and after that "spamassassin -t < timetablin

Re: Load ldap prefs

2005-12-19 Thread Paolo Cravero as2594
Philip S. Hempel wrote: Did you copy'n'paste this or retype? user_scores_dsn ldap://locahost/dc=qmailldap,dc=lh,dc=com?spamassassin?sub?uid=__USERNAME__ locaLhost, perhaps? Let us know... pc

Re: f-secure messaging security gateway x-series??

2005-11-23 Thread Paolo Cravero as2594
Mathias Homann wrote: So, has anyone here seen/touched this thing before? Not that one, but touched two other vendors' appliances. For me, the only strong point with it seems to be the combined firewall/AV/spam scanner thing (waitaminute... single point of failure??), and the web admin fron

Re: Using sa-learn with Notes/Domino Servers via agents

2005-11-23 Thread Paolo Cravero as2594
Not a solution but a few thoughts since we have LN here as well. Domino servers add a hell of headers to email messages that might confuse the Bayesian engine. Forwarding internet mail from one LN account to another DESTROYS RFC2822 headers. Copying preserves. LN clients can access IMAP mai

POP3 proxy with SA 3.x?

2005-10-25 Thread Paolo Cravero as2594
Hi, I have successfully used a Perl POP3proxy on a Linux box with SA 2.6.x . I have now migrated to 3.x, and some internal functions have been dropped or renamed, so that Perl program doesn't work anymore. Does anyone know of a (Linux) POP3 proxy that supports SA 3.x? TIA, Paolo

Re: SA 3.1 false positive on FORGED_MUA_OUTLOOK

2005-09-20 Thread Paolo Cravero as2594
Michael Monnerie wrote: X-Spam-Status: Yes, hits=4.924 tag=-999 tag2=3.5 kill=3.5 tests=[BAYES_00=-2.599, DNS_FROM_RFC_ABUSE=0.2, NS_FROM_RFC_POST=1.708, FORGED_MUA_OUTLOOK=4.056, HTML_MESSAGE=0.001, RCVD_IN_BL_SPAMCOP_NET=1.558] X-Spam-Score: 4.924 Yes, increase the level at which an e-mail

SA 3.1 false positive on FORGED_MUA_OUTLOOK

2005-09-20 Thread Paolo Cravero as2594
Hi, just incurred in a false positive with SA 3.1 (through amavisd-new). The message comes from a friend, and he uses a real Outlook Express client, perhaps the Italian version. libero.it is one of the biggest Italian (free) ISPs. Any hint on fixing this? Paolo .

(OT) SURBL local-DNS sample file?

2005-07-19 Thread Paolo Cravero as2594
Hi, what follows is certainly OT for SpamAssassin. I am setting up SA3 with SURBL support, and I am configuring RBLDNSD in order to run a local SURBL copy. Before asking for rsync permission, I'd like to test the configuration on a non-production system (with a non-production IP address). I

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-07 Thread Paolo Cravero as2594
Jesse Shumaker wrote: Let me try and summarize what I have recieved from all these e-mails as [...] use and am trying to piece it all together. Correct, except that the remote POP3 server is specified on client configuration and not wired statically on the pop3 proxy box. At least with the

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-06 Thread Paolo Cravero as2594
Jesse Shumaker wrote: Hi This looks good and I think I may try this perl module. It seems that it's geared towards a single workstation and not a network of machines. They say that you point your client to localhost, which means that each machine must have this installed. How are you guys run

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-05 Thread Paolo Cravero as2594
Jesse Shumaker wrote: Jesse, It would be just like a web proxy. The outlook clients are redirectd to the spamassassin box which filters the e-mail and forwards/relays the requests onto our ISP's e-mail servers. If you can assist me at all with this I would be greatly appreciated. you can tr

Re: OT: Mail/Spam Stats and MRTG

2005-06-06 Thread Paolo Cravero as2594
Jake Colman wrote: Does anyone have any suggestions for using mrtg to produce a graph showing the amount of received email and how much of it was flagged as spam? I am using mrtg, sendmail, and procmail on all the same server. You need to write an external "program" (script) for the SNMPdeamon

Re: Logfile analyzer

2005-05-27 Thread Paolo Cravero as2594
Chris Santerre wrote: Can anyone recommend a good logfile analyzer for Spamassassin? Depends on what you want to analyze. One of the ninjas wrote a great script to parse the logs and show rule hit statistics. If you are looking for that I can see if I can find it my vast archive of ninja info.

Re: R: German Spam

2005-05-18 Thread Paolo Cravero as2594
Netmail wrote: Ok Now this is my config file # This is the right place to customize your installation of SpamAssassin. # See 'perldoc Mail::SpamAssassin::Conf' for details of what can be # tweaked. # ### # rewrite_subject 1 #r

Re: German Spam

2005-05-18 Thread Paolo Cravero as2594
Netmail wrote: Hi I'm new for spamassassin , when modify the local.cf file after restart sendmail or what ? If you are using spamc/spamd you need to restart spamd in order to activate new rules. If you are simply calling spamassassin executable from sendmail (highly inefficient), no restart is

Re: RCVD_IN_SORBS_WEB

2005-04-14 Thread Paolo Cravero as2594
Craig McLean wrote: Or just switch off SA scanning of that customer's mail for a day or so, that should give them an idea of how effective it is... ;-) I am convinced more and more every day that we should turn off SA once every two weeks or so for "maintainance" reasons. Then users will stop com

SA3.0.2 + amavisd-new ignoring $sa_tag_level_deflt ?

2005-03-10 Thread Paolo Cravero as2594
Hi, I'm testing a setup with amavisd-new (latest download version) and SA 3.0.2 on RedHat ES3. This setup serves as a laboratory for upgrading our SA 2.64 servers. I would like to have amavisd-new to add X-Spam-* headers to all messages, so I set the following: $sa_tag_level_deflt = -999; #

Re: highly available sitewide bayes, local db vs. sql

2005-02-24 Thread Paolo Cravero as2594
Ben Poliakoff wrote: Hi Ben What sort of experiences have people had managing a sitewide bayes db that is used by spamassassin (spamd|amavisd) instances on multiple machines? I've got an environment with spamassassin/amavisd-new running in parallel on a pool of two (but possibly more in the future