Re: change spamhaus.org's score

On Wed, Nov 15, 2006 at 09:04:59PM -0500, Matt Kettler wrote: > All of them are scores. They're for the different scoresets, each of > which is used in different situations depending on what features (bayes > and network) are enabled. This allows the body-text only rules to "pick > up the slack" an

Re: change spamhaus.org's score

On Tue, Nov 14, 2006 at 08:40:36PM -0500, Matt Kettler wrote: > That's the un-scored parent rule that causes the DNS query. There are > two child rules that don't perform a DNS lookup, they just use the > results fetched by the rule above. > > The Two scored rules are *DIRECTLY* below the rule abo

Re: change spamhaus.org's score

On Mon, Nov 13, 2006 at 11:29:16PM -0500, Matt Kettler wrote: > > I cannot find the score in default rule folder i.e > > /usr/share/spamassassin/ > > No scores are given for those rules. > > > > Should be something like this in 50_scores.cf: > > score RCVD_IN_BL_SPAMCOP_NET 0 1.332 0 1.558 >

Re: change spamhaus.org's score

On Mon, Nov 13, 2006 at 08:09:39PM -0500, Michael Scheidell wrote: > > I want to give a higher score to those mails whose senders IPs are > > listed which are listed in spamhaus.org, how do I do that? I use SA > > in its default configuration. > > As with any SA rule, just edit local.cf, put in

change spamhaus.org's score

Hi, I want to give a higher score to those mails whose senders IPs are listed which are listed in spamhaus.org, how do I do that? I use SA in its default configuration. With warm regards, -Payal

anatrim spams

Hi, Anyone knows how to stop anatrim spams. Even these basic rules are not working for me. I have not caught a single mail with these rules. Is there anything wrong or can someone give better rules? With warm regards, -Payal bodyANATRIM_SPAM/Anatrim/i describe ANATRIM_SPAM ANATRIM SPA

Re: SA increasing load average a lot and spams getting through

On Fri, Sep 22, 2006 at 10:44:11AM -0700, John Goubeaux wrote: > you might also want to check: > > http://spamassassin.apache.org/full/3.1.x/dist/doc/Mail_SpamAssassin_Conf.html#miscellaneous_options > > eg lock_method I had the same bayes files errors and set this to > lock_method flock an

Re: SA increasing load average a lot and spams getting through

On Thu, Sep 21, 2006 at 03:59:00PM +0100, Martin Hepworth wrote: > How many emails per day are you processing.?? and of what average > size. Many these days around 5000-7000 daily (including spam). Average mai size is 4k approximately. Many kids are subscribed to kids forums and newletters,

Re: SA increasing load average a lot and spams getting through

On Thu, Sep 21, 2006 at 07:55:40AM -0700, Loren Wilton wrote: > >The load average always hovers around 20.0 and top shows spamd is > >culprit. Also, I have trained over 10,000 each of spam and ham and also > > You probably have too many spamd children running. With only 512M you > probably want

SA increasing load average a lot and spams getting through

Hi, A friend of mine is maintaining a mail server for a school and I am helpig her out. There are just 150-200 accounts and the machine is having 512 Mb RAM and 1Gb swap running Cent OS with processor being AMD Athlon. spamd and spamc pair is used with qmail as mailserver and processing done vi

Re: whitelist include file

On Wed, Jun 28, 2006 at 02:11:33PM -0400, Theo Van Dinter wrote: > You could use an include, but just put the whitelist entries in > another file > named .cf, and you're done. SpamAssassin reads all .cf files in > /etc/mail/spamassassin -- local.cf is just the common one that gets used. Thanks a

whitelist include file

Hi, I plan to keep all my white_list from addresses in a separate file instead of local.cf. Can anyone please tell me how to use an include file in local.cf? With warm regards, -Payal

Re: "news spam"

On Tue, Mar 21, 2006 at 10:12:53AM -0500, Dimitri Yioulos wrote: > My system is tagging these messages, mainly with bayes, dcc, and > razor. Phile Randall posted a rule to tag "news" in the subject just > a few days ago, and that's also being hit. Do you have the rule by Phile? I cannot seem to

"news spam"

Hi, To my various email addresses I am getting lot of "Re: news" spam. SA is not catching all of it. I have pasted a links of headers and body at, http://pastebin.ca/46477 Can someone advise on it please? With warm regards, -Payal

Re: This isn't being tagged

On Fri, Mar 17, 2006 at 02:21:56PM -0500, Dimitri Yioulos wrote: > All, > > I'm happy to say that with your help, and some very minor tweaking, the > "Pharama" mail is now tagged in my system as high scoring spam, and dealt > with accordingly ("bad pharma spam, bad!"). Still looking forward

Re: more pharmacy woes

On Sat, Mar 11, 2006 at 06:40:35PM +0530, Dhawal Doshy wrote: > For URIBL, see http://www.uribl.com/usage.shtml OR add this to your > local.cf I am getting an error which say, 2006-03-14_10:47:27.97266 2006-03-14 10:47:27 [17977] i: server killed by SIGTERM, shutting down 2006-03-14_10:47:35.617

Re: more pharmacy woes

On Fri, Mar 10, 2006 at 04:07:34PM +0530, Dhawal Doshy wrote: > Do you use SURBL (surbl.org), URIBL (uribl.com) and collaborative > network tests like razor/pyzor/dcc? No, can you please tell in short how to use surbl exactly? I am very new to SA. > Also the pasted spam originates from a korean

more pharmacy woes

Hi all, I need help in decoding pharmacy spam again. I am getting 100s of them. I have attached them at, http://pastebin.ca/45108 Can someone tell how to block these things out? With warm regards, -Payal

Re: pharma spam still coming

On Thu, Mar 09, 2006 at 04:39:50PM -, Martin Hepworth wrote: > Payal > > Need the full headers as well mate. Here they are, http://deadbeefbabe.org/paste/3097 With warm regards, -Payal

Re: pharma spam still coming

On Wed, Mar 08, 2006 at 01:53:21PM -0500, Theo Van Dinter wrote: > I don't think anyone can make suggestions without seeing the mail (for > instance, I have 0 spams with "Ultimate Online" in the subject in my > March corpus). Can you post the mail on the web somewhere and send a link? > Perhaps us

pharma spam still coming

Hi, I am still getting many spams with Subject: The Ultimate Online Pharmaceutical. Can someone suggest anything for them? I canot attach the body here because then the list is rejecting my mail. With warm regards, -Payal

Re: sa-learn

On Wed, Feb 22, 2006 at 11:24:11AM -0500, Theo Van Dinter wrote: > Usually you would see a X-Spam-Status header which would include a > BAYES_## rule hit. I cannot see such a header. > I have no idea how that program works so I have no input for you about > how it operates. It may not put in a S

Re: sa-learn

On Wed, Feb 22, 2006 at 11:12:49AM -0500, Theo Van Dinter wrote: > I think that would be fine. I'd say you should definitely continue > learning any ham mails that get a Bayes score over 70%, but otherwise > auto-learning will probably take care of things for you. How would I know which mails ha

Re: sa-learn

On Wed, Feb 22, 2006 at 10:54:45AM -0500, Theo Van Dinter wrote: > This is normal. Here's a post I made about it last month: > > http://article.gmane.org/gmane.mail.spam.spamassassin.general/76672 > > as long as the data seen via "sa-learn --dump magic" changes, you're > all set. Thanks for the

sa-learn

Hi, I am not sure if spam learning is really taking place. I have, # ll /var/bayes/ total 14548 -rwxrwxrwx 1 spamd spamd89616 Feb 21 20:49 bayes_journal -rwxrwxrwx 1 root root 10567680 Feb 21 20:43 bayes_seen -rwxrwxrwx 1 spamd spamd 5304320 Feb 21 20:43 bayes_toks I used sa-learn to lea

safe upgrading

Hi, I use SA 2.61, I want to upgrade next week. How safe is it? It is our client's server and they have given it to us to use so we cannot disturb it cos' they too have 2 domains of theirs on it. It is a RH ES 3.0 Also what is the best way to upgrade safely and to which version is it recommended

spamd overloading

Hi, I run qmailscanner with SA and clamav. I find out that spamd is overloading my system. I start spamd with -m 10 switch and I expect 10 child processes to be started. But when I do ps aux | grep -c "spamd" I get 150 and above. What is wrong? With warm regards, -Payal

new type of spam

Hi, I am getting a lot of new spam since yesterday with subject "Re: news". The body of the mail contains junk like, | Hi | CxIcAcLdIoSi x$q3i,s3r3t | V y A o LvleUtMw i$s1e,n2v1w | V o IhAyG you RsAs t $f3 o , g 7 g 5y | http://www.checpri.com How can I deal with the

Re: Using Inet to launch spamd

On Sun, Feb 12, 2006 at 10:49:50AM -0800, Don O'Neil wrote: > Anyone using inetd to launch spamd? I've had my process die a couple of > times and it would be nice to have inetd around to make sure it's allways > running. If you have, what did you put in inetd.conf? You can run it with tcpserver an

Re: lots of new spam

.61? With warm regards, -Payal > > -Original Message- > From: Payal Rathod [mailto:[EMAIL PROTECTED] > Sent: Friday, February 10, 2006 5:40 AM > To: users@spamassassin.apache.org > Subject: Re: lots of new spam > > On Thu, Feb 09, 2006 at 10:36:29AM -0700, Craig Bair

Re: lots of new spam

On Thu, Feb 09, 2006 at 10:36:29AM -0700, Craig Baird wrote: > These are one of the latest stock spam variations. I was getting a gazillion > of these when they first started. I upgraded to the latest copy of > 70_sare_stocks.cf, and I don't think I've seen one since. Note that you do > need

Re: lots of new spam

On Thu, Feb 09, 2006 at 09:46:02AM -0500, Chris Santerre wrote: > With regard to enabling URIBL: > http://www.uribl.com/usage.shtml I put the listing given on the page in local.cf but in logs I get an error as, Feb 9 14:57:51 dc2 spamd[20236]: Failed to run URIBL_GREY SpamAssassin test, skippi

Re: lots of new spam

On Thu, Feb 09, 2006 at 09:32:32AM -0500, JamesDR wrote: > Yes, you have something missconfigured, Bayes is poisoned, net test > are failing and/or you don't have URIBL's enabled. What does Bayes poisoning mean? And how do I enable URIBL? With warm regards, -Payal

lots of new spam

Hi, >From 4-5 days I have been receiving a lot of spams, 100s of them with weird subjects like, Re: a f news 141, Re: K R news 721, Re: B l news 203 etc. I have with bayes learned alteast 200 of them, but they are still pouring in. Any ideas on their blocking? With warm regards, -Payal

Re: bayes problem

On Mon, May 02, 2005 at 02:11:19PM -0400, Matt Kettler wrote: > How is SA called? from procmail, or something else? For .qmail file with a script ifspamh > > One major problem I see is that the bayes files have permissions of 400, > but the bayes DB is site-wide. You generally need to use bayes_

bayes problem

Hi, I am looking after a friend's email server till he returns from his vacation. In his local.cf (SA 2.61 and yes I know it is time for upgrade) file he has, bayes_path /etc/mail/spamassassin/bayes use_bayes 1 score BAYES_50 0.001 Also bayes is well trained with, -rw---1 root root

Re: how much training?

On Mon, Oct 18, 2004 at 12:07:08PM -0700, [EMAIL PROTECTED] wrote: > Automate the training... when you notice a false positive, put it in a "false > positives" location. When you notice a false negative, put it in a "false > negatives" location. > But that means again I have scan mailboxes manu

how much training?

Hi, I have SA and bayes for a few accounts and have trained bayes to around 1200 hams and 1000 spams. Is this enough? I have reduced spam a lot, but still a few spam mails do pass through. What do I do about them? I do training manually, checking each mailbox, so it is a hectic process. When do I s

Re: bayes training

Hi, On Mon, Oct 11, 2004 at 03:33:14PM -0700, Loren Wilton wrote: > Forwarding from OE will screw the mail over badly, you DO NOT want to do > that. Probably the same from NS or most any other mail client, for that Thank goodness I did not do it. Well, I will ask them to keep a copy of mails o

bayes training

Hi, My users use OE or Netscape mail client to check their mails. Can I ask the users to forward their mails to an account say "spam" to teach SA? I am scared that if they *forward* their mails to that account bayes might learn wrongly learn their addresses as that of spammers. Can someone clear

Re: white listing

On Wed, Oct 06, 2004 at 09:06:39AM -0400, John Stegenga wrote: > That ought to do it. > > white listing in the local cf file for the domain should work fine. Thanks for the tip. With warm regards, -Payal

white listing

Hi, We have co-hosted a domain on my friend's server (qmail). Now, the ISP provides SA 2.61 with each users having their own pref file managed through a GUI. But some of my client's mails were being marked as SPAM. So, I requested the admin to whitelist that client's domain. He said he will put t

Re: bayes problem

On Mon, Oct 04, 2004 at 01:07:43PM -0500, Andy Jezierski wrote: > You have to continually keep bayes updated! If not, it won't help much > with the ever changing nature of spam messages. Read through the docs [...] Thanks for the info. I am still a little bit unconvinced that bayes is really wo

Re: bayes problem

On Mon, Oct 04, 2004 at 12:48:18PM -0500, Andy Jezierski wrote: > Yep, bayes is working, notice the BAYESS_99 rule hit above. Another thing > to keep in mind is that Bayes only kicks in after you have 200 ham & 200 > spam messages learned. Looks like your bayes has only recently gone above > the

Re: bayes problem

On Mon, Oct 04, 2004 at 01:13:50PM -0400, Theo Van Dinter wrote: > Watch the rest of the debug output, run "spamassassin -D", etc. You mean spamd -D, right. spamassassin -D just waits for till I press ctrl-c I modified the local.cf file slightly to have, #bayes_path /root/.spamassassin/bayes use_

Re: bayes problem

On Mon, Oct 04, 2004 at 12:05:35PM -0500, Andy Jezierski wrote: > > In your local.cf you should have use_bayes 1 Now it is, required_hits 4.5 report_safe 0 skip_rbl_checks 1 rewrite_subject 1 subject_tag [SPAM] score DEAR_SOMETHING 0.8 score FROM_WEBMAIL_END_NUMS6 1.5 bayes_path /root/.spamass

Re: bayes problem

On Mon, Oct 04, 2004 at 11:52:04AM -0500, Andy Jezierski wrote: > Look farther down in the debug, after the plugins get loaded and before the > DNS lookups.. [...] I get no such output. There are only 4 lines with word bayes in them. Is there anything I am missing? Do I have to enable bayes somew

Re: bayes problem

On Mon, Oct 04, 2004 at 11:59:12AM -0400, Theo Van Dinter wrote: > That's the init message being sent through spamd -- there are no Bayes DBs at > that point. Ignore it. :) But how do I know for sure bayes is working or not? -Payal

bayes problem

Hi, I am trying SA for the first time on my friend's server. We are starting it like, # ps waux | grep spam root 10589 0.0 1.9 25264 19808 ? SOct02 0:03 /usr/bin/spamd -d -a We use SpamAssassin version 2.61 an RPM install on RH Linux. Now we have a qmail system there and we ar