email address is in etc...
My current DB machines are a HA pairing of dual AMD 1.8 Ghz w/ 2G RAM in
an active passive configuration using SAN storage.
Thanks to the list as always.
Ronan
--
Regards
Ronan McGlue
===
Analyst / Programmer
Queens University Belfast
which takes
precedence I guess is what im after.
I reject all incoming mail at the MTA at SMTP time if the spamscoreint
variable is above 100 ie 10 points. How much use are the options
provided(the panels) other than white/black listing?
--
Regards
Ronan McGlue
===
Analyst
since upgrading to 3.2 i have been getting regular messages in the
exim's panic log.
2007-05-17 02:16:03 1HoVX0-0002df-PP spam acl condition: cannot parse
spamd output
anyone else seen this or know any reasons why it happens?
R
Regards
Ronan McGlue
===
An
a certain minimum threshold to begin
working, however surely the AWL should start working immediately?
thanks
R
--
Regards
Ronan McGlue
===
Analyst / Programmer
Queens University Belfast
Tony Finch wrote:
On Tue, 27 Feb 2007, #Ronan McGlue wrote:
I am looking to move to peruser scanning, so I would need to change only one
line of the above to
spam= $local_part:true
which will use the local part of the email address as the username.
This won't work because
her
user_awl_sql_username
bayes_sql_username
etc
R
--
Regards
Ronan McGlue
===
Analyst / Programmer
Queens University Belfast
can someone give me a listing of the latest timestamps regarding their
rulesdujour updates?
I've just noticed that none of the files have been updated on my machine
since mid augaust... surely this isn't normal...
thanks
Ronan
--
Ronan McGlue
Analyst / Programmer
CMC Systems Gro
recurring topic but anything that makes my life easier
is good imo.
Ronan
--
Ronan McGlue
Analyst / Programmer
CMC Systems Group
Queens University Belfast
score assigned. Even though there are now SA headers in
the mail does this affect the baysian learner, or is it smart enough to
remove / ignore any SA tags it finds!?
Thanks
Ronan
--
Ronan McGlue
Analyst / Programmer
CMC Systems Group
Queens University Belfast
t from the headers. Why not just
post the whole spam with headers, and obfuscate the email address in it?
--Chris
--
Ronan McGlue
Analyst / Programmer
CMC Systems Group
Queens University Belfast
16 0 118m 86m 2512 S 6.2 4.3 1:43.37 spamd
Ronan
There are some rules on SARE that cause a big mem usage. I tried once
one that blacklists something from William Stearns. I quickly replaced
it with the postfix version and now rsync that rules, which is BTW much
more efficient
Paul Smit wrote:
Does this mailutil also works for Dovecot IMAP folders?
AFAIK it works on normal mbx format folders.
2006/2/15, Ronan McGlue <[EMAIL PROTECTED]>:
On Wed, 15 Feb 2006 12:36:29 +0100
Paul Smit <[EMAIL PROTECTED]> wrote:
Hey All,
Can anyone tell me i
On Wed, 15 Feb 2006 12:36:29 +0100
Paul Smit <[EMAIL PROTECTED]> wrote:
> Hey All,
>
> Can anyone tell me if there is a possibility to empty my
> "sa-lean" folder after I scanned it? I want to delete all
> mail in that mbox folder, because it's not being used
> anymore.
you can use the mail-util
reference to it on the web.
Anyone have any input on this? What would be the implications? Should it
just be a straight translation perl -> c , or are there other factors?
Ronan
--
Ronan McGlue
Analyst / Programmer
CMC Systems Group
Queens University Belfast
ih/timeout...
What modifications would be needed to SA to accomplish this or is this
an MTA issue to rewrite the headers on the hosts?
We run EXIM on all MTAs and hosts here so it shouldn't be too much of an
issue at that level.
What do you think?
Ronan
--
Ronan McGlue
Analyst / Programmer
CM
If the server is primarily a
spamd machine then I think it would be worth your while to enable
--round-robin on the CL when you start SA.
Ronan
as my corpus is quite
accurate... Is there another (less destructive) way?
Ronan
sounds like the same problem I and a lot of other users have had. Its
the apache forking mechanism which may be the issue here.
Try applying the --round-robin CL switch to the way you start the daemon..
Ronan
Justin Mason wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Ronan writes:
getting quite a few of the following in the logs which are letting
messages through unscanned.
running a dedicated server serving 3 mtas.
SA 3.1
MTA exim 4.54
Nov 3 03:05:44 dung spamd[11633]: spamd: bad
be able to read them into an array/table and work on them
how do i get it so I can have the pairs deined as
eg a two column table
aa bb
cc dd
ee ff gg hh
ii jj
any help greatly appreciated...
Ronan
getting quite a few of the following in the logs which are letting
messages through unscanned.
running a dedicated server serving 3 mtas.
SA 3.1
MTA exim 4.54
Nov 3 03:05:44 dung spamd[11633]: spamd: bad protocol: header error:
(Content-Length mismatch: Expected 29131 bytes, got 2
0440 bytes)
Spamd times out/ dies and I get the following in the maillog...
[EMAIL PROTECTED]:/var/log# egrep -v
"connection|checking|identified|result|salearn|clean|imap|spawned|internal
error" maillog > /home/ronan/spamd
[EMAIL PROTECTED]:/var/log# cat /home/ronan/spamd
Oct 27 00:08:
In a heavily loaded server with a lot of connections hitting it per
second, what is the best way to run spamd...
the standard 3.1 (hot children) or the old style round robin???
I have been having problems over the last 2 weeks etc with the spamd
timing out connections from the mta's i run so i
nd logs approriately on the Spamd server... however if i
dont specify the -i switch (should listen on all IPs on box ) I get ACL
errors (meaning the exim box cant connect to server) again from exim and
no logging occurs on the Spamd Box.
thanks
Ronan
can someone tell me a nice way to prune the bayes_seen database (in
MySQL)or even point me to a place where i can read more about it.
Ronan
at all and how should i go around pruning this??
thanks
Ronan
wsuit...
Ronan
Is there a way to merger 2 (or more)bayes DBs?
Im still reading up on the MySQL option to my 2 servers but a stop-gap
solution would be to merge the two DBs nightly and let them run as
normal during the day...
Ronan
ps ive man'd sa-learn and saw nothing relevant so i presume I cant
SA 3.1pre
spamassassin --lint -D
warn: config: failed to parse line, skipping: use_dcc 1
warn: config: failed to parse line, skipping: use_razor2 1
although use_pyzor 1 doesnt flag an error!??
identical in terms of accuracy for our domain... I dont really need both
of them atm as one machine only ever hits .75~.8 load constanly at full
throughput.
Would the MySql option be a better future proof method as i coud just
tag servers onto the 'cluster'.
ronan
ore: $spam_bar ($spam_score)\n\
X-Spam-Score-Int: $spam_score_int
condition = ${if <{$message_size}{80k}{1}{0}}
spam = nobody:true
our process stay between 30-40Meg and means we can run 10 children at a
time.
--
Regards
???
thanks
--
Regards
Ronan McGlue
Info. Services
QUB
MIKE YRABEDRA wrote:
on 6/13/05 8:01 AM, Ronan McGlue at [EMAIL PROTECTED] wrote:
MIKE YRABEDRA wrote:
on 6/13/05 6:07 AM, Bart Verwilst at [EMAIL PROTECTED] wrote:
Hi
Try MailGraph :) That's what I'm using for my servers..
Google for mailgraph, first hit :)
See ya
Looks
en simply grep on the day >
pipe to a file and plot on the basis of that. v simple, clean and pretty :)
ill show u the script if u want.. its only 10 or so lines long :)
easy
Ronan
-Original Message-
From: MIKE YRABEDRA [mailto:[EMAIL PROTECTED]
Sent: Monday, June
Matt Kettler wrote:
At 08:32 AM 6/9/2005, Ronan McGlue wrote:
anyclues as to why SA isnt 'apparently' using the hosts file??
This is because SA doesn't use the system resolver, it uses Net::DNS's
resolver. This gives SA a lot of control over queries, but doesn't
Victor Brilon wrote:
--- Ronan McGlue <[EMAIL PROTECTED]> wrote:
yes, but BIND isnt running on the machine in
question... (atm)
The nets guys here are seeing a lot of lookups from
this SPAMD machine
for our mailhubs to the Local dns...
which is an extra couple of miliseconds i want to
Jeff Chan wrote:
On Thursday, June 9, 2005, 5:32:23 AM, Ronan McGlue wrote:
Niek wrote:
On 6/9/2005 2:19 PM +0200, Ronan McGlue wrote:
sry should have added that the DNS order in /etc/resolv.conf is also
correct...
What order ? The nameservers are used randomly...
again, my semantics
Niek wrote:
On 6/9/2005 2:19 PM +0200, Ronan McGlue wrote:
sry should have added that the DNS order in /etc/resolv.conf is also
correct...
What order ? The nameservers are used randomly...
again, my semantics need work... :S
the DNS *is in* order in /etc/resolv.conf...
anyclues as to
Niek wrote:
On 6/9/2005 2:15 PM +0200, Ronan McGlue wrote:
hi
SA is continually looking up my 3 mailhubs to our local DNS even
though i have them hardcoded into /etc/hosts and /etc/nsswitch.conf is
configured properly etc etc...
How can I make SA use the hosts file if such an option
hi
SA is continually looking up my 3 mailhubs to our local DNS even though
i have them hardcoded into /etc/hosts and /etc/nsswitch.conf is
configured properly etc etc...
How can I make SA use the hosts file if such an option exists... anyone
else notice this behaviour??
ronan
pos' with
linespoints
And then it's just 'gnuplot gnuplotrc' and presto, pretty pictures.
Regards, Paul Boven.
i like it... thanks i was gonna go rrdtool but i like the looks of this.
but why isnt your "complicated script-magic I don't dare share in here"
GNU public licesnce
;)
ronan
--
Regards
Ronan McGlue
Info. Services
QUB
is there an 'easy' way to get a grpahical representation of how well SA
is doing??
preferably something flashy with lots of primary colours for the
managment elite??
if not i suppose i gotta start hackin rrdtool scripts or similar!!?
mnay thanks
Ronan
--
Regards
Ronan M
???
--
Regards
Ronan McGlue
Info. Services
QUB
of all the dummy conns going to the same
daemon... it was a small denial of service for our legitimate mail so
all we had to do was set up a second daemon which only matched the dummy
IP...
hope it helps
--
====
Regards
Ronan McGlue
Info. Services
QUB
Dale Blount wrote:
Morning Ronan,
I added a dummy mx record (lowest preference) as we all know its
generally the one th spammers target first, which is getting hit with
about 50% of our daily connections, of which i defer all of them at a
very low overhead.
May I ask what kind of
ffort!!!
thoughts?
--
Regards
Ronan McGlue
Info. Services
QUB
assin... ie with the full SA headers etc
also what about learning spam gotten through a mailing list.. ie
recently i got a lot of the german spam through a couple of lists i sub
to... should i learn them as ham or just leave them be...???
all these questions, are they frequently asked??
thanks
trying to train bayes with german spam
so i take a mail out of my imap folder and put it into a sile on the
spamD server..
I Vee-eye it and take out the spamassassin headers ( is this the right
move?) then run the following
[EMAIL PROTECTED]:/home/ronan# sa-learn --spam -D spam1
debug
reports spam you can guaratee
that all the other rules are surplus to requiremtns... IMHO
ronan
--
====
Regards
Ronan McGlue
Info. Services
QUB
TIPLEMessage hits more than one network digest check
End of SpamAssassin results
--
====
Regards
Ronan McGlue
Info. Services
QUB
/dcc/SURBL through the main node which,
currently, is the only node with internet access???
Is there a better way of running this config??
ronan
--
Regards
Ronan McGlue
Info. Services
QUB
me. apparently 1 spam every week is still not good enought
protection for him.
thanks
ronan
begin:vcard
fn:Ronan McGlue
n:McGlue;Ronan
email;internet:ronan(dot)mcglue(at)qub(dot)ac(dot)uk
x-mozilla-html:FALSE
version:2.1
end:vcard
dont have enough conns-per-child etc... or what?
any help please?
ronan
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
another list user, david baines helped me out on this one...
its very simply that your version of getopt::long is not recent enough
get the latest from cpan and install and it works perfectly from then on
ronan
Stephan Paukner wrote:
On Wed, December 15, 2004 9:53, Ronan said:
I actually never
D.W.T.Baines wrote:
Hello Ronan,
We use sa-stats.pl here but I haven't seen that error even when running
it with exactly the same args as shown below. I wonder if the problem
could be related to the version of perl or of Getopt::Long you are
using. We are using perl 5.8, not sure off hand
Ronan wrote:
I actually never knew about this until i was having a hoke around...
anyway cant get it to run..
./sa-stats.pl -l /var/log/syslog -H -T 5 -u
Error in option spec: "top|T:25"
Error in option spec: "SCALAR(0x4c9a68)"
bash-2.03$
i presume this is to do with the p
it even flags when i run
bash-2.03$ ./sa-stats.pl -l /var/log/syslog
Error in option spec: "top|T:25"
Error in option spec: "SCALAR(0x4c9a38)"
and even
bash-2.03$ ./sa-stats.pl
Error in option spec: "top|T:25"
Error in option spec: "SCALAR(0x4c9a20)"
any h
Martin Hepworth wrote:
Ronan wrote:
Ok well I hounded or DNS guys to finally put multi.surbls.org into the
dns(as a master), watched him HUP named and then
should i notice a difference??
im still getting 10+ seconds scantime on some messages..
how do i tell if its working?
well granted i
Rick Beebe wrote:
Ronan wrote:
Hey list,
I am in the quite sureal situation of being given a blank
cheque by my boss to buy 2 new servers for SA. They were so
impressed with the upgrade to v3 + SURIBLS et al that when i said
that our current setup was hitting load max they found some
Jeff Chan wrote:
On Tuesday, November 30, 2004, 4:28:35 AM, Ronan Ronan wrote:
Hey list,
I am in the quite sureal situation of being given a blank cheque by my
boss to buy 2 new servers for SA. They were so impressed with the
upgrade to v3 + SURIBLS et al that when i said that our current
reason there are
2 machines of each is because im gonna implement fail over using
heartbeat. Does it make a difference the Solaris / Linux route? Will SA
benefit from the dual processor option? Any other factors I should consider?
many thanks as always
ronan
--
Regards
Ronan McGlue
there that could
be useful? Im using exim + exiscan w/ SA
ronan
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
what changes do i need to make to the local.cf site-wide configuration
if I am putting the SURBL zone files into my DNS?
Am i right in saying that i really dont need to make much change (to SA)
other than configuring the dns to act as a secondary to the surbl's dns??
ronan
--
Regards
ail::spamassassin::conf autolearn is on by default, as
is use_bayes/ use_bayes_rules etc...
anyone?
thanks
ronan
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
Jim Maul wrote:
Ronan wrote:
so it doesnt make a difference if you have inordinately larger amounts
of one than the other?? I would have thought it would've worked better
with more ham...
i read somewhere on the list thats its best to balance.
you'll get conflicting answers to thi
Jim Maul wrote:
Ronan wrote:
hi all.
for those of you running large volume servers you no doubt have an
abundance of spam to feed into sa-learn, and i suppose that goes for
all sizes of volumes.
but one question. how do you manage to match the same number with hams
/ real messages. how do you
hanks
ronan
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
local.cf
are any of the above redundant in 3.0.1, and is there a list somewhere
of the rulesets that are made redundant with subsequent versions of
SA??? maybe helpful..
thanks
ronan
aww D'oh!
i lint'd and checked path but...
i didnt restart spamd.
thanks matt
computing 101...
Matt Kettler wrote:
At 12:02 PM 11/23/2004 +0000, Ronan wrote:
can i add the following line to local.cf for sitewide effect?
score ALL_TRUSTED -1.8
i ask because ive tried this already and i
can i add the following line to local.cf for sitewide effect?
score ALL_TRUSTED -1.8
i ask because ive tried this already and it is still coming through as
the default -2.8
SA checks the rule files first then uses local.cf as an overiding
authority isnt that right?
thanks
ronan
--
Regards
can anyone shed some light on this please
thanks
ronan
hi ive fed sa-learn about 450 each of spam ham
bash-2.03$ sa-learn --dump magic
0.000 0 3 0 non-token data: bayes db version
0.000 0426 0 non-token data: nspam
0.000 0427
n by default, but should i
explicity dictate this in the local.cf config file??
thanks
r
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
yeah i read that line too, but i was unfamiliar with the unix standard
file format being categorised as mbox
sarcasm much appreciated though
ronan
Jim Maul wrote:
Ronan wrote:
what format does sa-learn expect mail to be in.
I tried to feed it a 2meg standard unix email file of my spam folder
what format does sa-learn expect mail to be in.
I tried to feed it a 2meg standard unix email file of my spam folder and
it only registered it as one email but with 4000 tokens...
Anyone... there is nothing in hte man [page about it
ronan
--
Regards
Ronan McGlue
==
Analyst/Programmer
trusted fraternity ie the email group) to upload their spam to it.
So is it simply a case of whatever isnt spam put it in ham?
thanks
ronan
Matt Kettler wrote:
At 02:29 PM 11/9/2004 +, Ronan wrote:
1) Am I right in thinking that i can run sa-learn spam on a folder
which contains spam, of which
baysian???
4) Anything else i should be looking into???
thanks all
ronan
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
a little high, but one of the last messages my server
sent out was fairly large, and went out to over 150 people from a
listserv.
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
just to check am i right in thinking that the ham folder is there to
expliicity stop false positives coming through the filters? ie based on
domain or list or email address content etc or is that just a
superficial explanation...?
ronan
0. When running spamassassin or spamd in debug mode, I see the
following:
plugin:mail::spamassassin::plugin::uridnsbl=hash(0x1d82310) inhibited
further callbacks
This happens about a dozen times, then SA goes on.
Any thoughts?
grant
dtri
--
Regards
Ronan McGlue
==
Analyst/Programmer
Infor
/spamd -d -r /logs/spamd.pid
because of this i am thinking i may need to migrate all spam scanning to
a dedicated server and have all 3 hubs point to it.
has anyone else had this sort of problem...
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
as per subject title or do they have to be standard unix format
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
my problem is that SA is running on the mailhubs while all the mailboxes
are on the mail servers. is there a flag to pass to sa-learn that will
read remote imap folders or do i just have to copy them onto a dir on
the 'local' machine!?
ronan
Jeffrey Lee wrote:
You have to start ba
'autolearn=no' attached
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
thing else i should take into account...???
thoughts / recommendations please.
thanks
ronan
further to the above is there an option for sa-learn to read remote
mailboxes / folders.
Ie with above configuration mail folders are stored on the mail servers
so would i need to copy over any designated spa
thing else i should take into account...???
thoughts / recommendations please.
thanks
ronan
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
Ron Johnson wrote:
Ronan writes:
Answering Matt's question:
debug: bayes: found bayes db version 2
bayes: bayes db version 2 is not able to be used, aborting! at
/usr/local/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/BayesStore/DBM.pm
line 160.
No.
i dont know hwat you mean here when u s
regexp tests; score so far=-1.053
debug: is spam? score=-1.053 required=5
debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
debug:
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID
bash-2.03#
install DBI?
others?
Matt Kettler wrote:
At 02:50 PM 10/20/2004 +0100, Ronan wrote:
help? upgrade bayes DB???
Did you run sa-learn --sync, as per the UPGRADE document?
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
.6.1/Mail/SpamAssassin/BayesStore/DBM.pm
line 160.
ERROR: Bayes dump returned an error, please re-run with -D for more
information
help? upgrade bayes DB???
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
can someone post the rules du jour script as the link is down on the
website
thanks
Martin Hepworth wrote:
Ronan
the rules in www.rulesemporium.com/rules and
http://www.rulesemporium.com/other-rules.htm
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
Adam D. Barratt wrote:
On Wednesday, October 20, 2004 10:14 AM, Ronan <[EMAIL PROTECTED]> wrote:
Matt Kettler wrote:
[...]
And of course, SURBL support replaces bigevil.cf, and
sa-blacklist-uri.cf, so you no longer need those if you have the
URIBL's running.
and the way to enable the
Matt Kettler wrote:
At 02:05 PM 10/19/2004, Ronan wrote:
> (Note: antidrug is built into SA 3.0, so don't add it if you're
running 3.0)
>
ok on that last statement - which of the rules from exit0 and
rulesemporium etc are included in 3.0 by default.
ronan
From the SA 3.0 rele
Matt Kettler wrote:
At 09:57 AM 10/19/2004, Ronan wrote:
i see a limit to the regex descriptions which implement the matching
on rules... you can search for 'cunt' but this provides a problem due
to the scunthorpe affect.
I want to implement a filter that in a buffer of arbitrary leng
i am not a regex guru im still trying to implement this
but i thought id throw it out to yis anyway
thanks
ronan
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
i presume wont allow the suid nobody so when a connection is
attempted from the spamc(exiscan) what uid will it run as the spamd or
the eim uid which calls it!???
ronan
Matt Kettler wrote:
At 10:56 AM 10/18/2004, Ronan wrote:
so theres no way for the forseeable future to have them idle as non
so theres no way for the forseeable future to have them idle as non root???
Is it advisable jsut to let the configuration be for the time being!? or
are the other options available to me?!
thanks
ronqn
Rick Macdougall wrote:
Matt Kettler wrote:
At 02:12 PM 10/18/2004 +0100, Ronan wrote:
In SA
Matt Kettler wrote:
At 10:26 AM 10/18/2004 +0100, Ronan wrote:
what is the switch to set my spamd children to run as non root. Ive
looked throuhg all the docs but i must have skipped over it or i am
just in a monday mood and cant understand it...
by default spamd will *refuse* to run as root
what is the switch to set my spamd children to run as non root. Ive
looked throuhg all the docs but i must have skipped over it or i am just
in a monday mood and cant understand it
thnaks
ronan
ps what are the preferred options / tweaks to SA3 to be done to an 'out
of the box
Is there any way to compare the effectiveness or otherwise or 2.6x vs
/3.0.0??
I have just upgraded one of my 3 mailhubs to 3.0.0 and want to compare
it to the other 2 in terms of effectiveness...
how would i go about this or is there no way?
ronan
--
Regards
Ronan McGlue
/bin/spamd -d -r /logs/spamd.pid
it is being called by exiscan acl...
ronan
Alan Munday wrote:
-Original Message-
From: Ronan [mailto:[EMAIL PROTECTED]
Sent: Wednesday, October 13, 2004 11:32 AM
To: spam
Subject: upgrade not going to plan
Just completed an upgrade to v3.0 from 2.63.
SA not
refernce to it in the sourece or readmes...
roinan
--
Regards
Ronan McGlue
==
Analyst/Programmer
Information Services
Queens University Belfast
BT7 1NN
1 - 100 of 102 matches
Mail list logo