RE: DKIM Checks

2011-05-18 Thread Rosenbaum, Larry M.
> From: Matt [mailto:lm7...@gmail.com] > Sent: Wednesday, May 18, 2011 11:32 AM > To: users > Subject: DKIM Checks > > I am running spamassassin-3.2.5-1.el5 on 64 bit CentOS. > > sa-update -D seems to indicate that the DKIM libraries are installed. > ... > May 18 10:25:02.683 [15134] dbg: diag:

RE: Fake MX

2010-12-13 Thread Rosenbaum, Larry M.
> From: Bob Proulx [mailto:b...@proulx.com] > Subject: Re: Fake MX > > > > [...] but that is distinct from being a tarpit, which is what > > > I'm trying to clarify. > > > > A discussion around the definition of tarpit, and why tarbaby might be a > > suboptimal, though catchy, name? > > For the r

RE: email address forgery

2010-11-12 Thread Rosenbaum, Larry M.
Are there domains that have actually defined SPF record type records? I haven’t been able to find any, but it could be the fault of the tools I’m using. L From: Noel Butler [mailto:noel.but...@ausics.net] Sent: Thursday, November 11, 2010 5:14 PM To: users@spamassassin.apache.org Subject: Re: e

RE: DOS_OE_TO_MX

2010-09-29 Thread Rosenbaum, Larry M.
ing. It is in /var/lib/spamassassin/3.003001/updates_spamassassin_org/50_scores.cf or some similar directory. To find your config directory path, try this: spamassassin -D config --lint > > Rosenbaum, Larry M. wrote: > > > > > > > >> -Original Message- > >&

RE: DOS_OE_TO_MX

2010-09-29 Thread Rosenbaum, Larry M.
> -Original Message- > From: njjrdell [mailto:nruggi...@dellmagazines.net] > Sent: Wednesday, September 29, 2010 11:32 AM > To: users@spamassassin.apache.org > Subject: Re: DOS_OE_TO_MX > > > I'm pretty sure she would not send a GTUBE. Here is another from her > > Sep 28 08:35:26 nsmai

Moving from Solaris to Red Hat

2010-08-11 Thread Rosenbaum, Larry M.
We are currently running SA v3.3.1 on Solaris 9 and Solaris 10 and are planning to move to Red Hat. I don't have much experience with Red Hat (or Linux in general). Could you point me to some tips and documentation about installing and running SA on Red Hat? FYI, on Solaris I install by downl

RE: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-28 Thread Rosenbaum, Larry M.
> What is the best way to completely whitelist all internal emails so that > there is no danger of any internal emails being blacklisted The best way is to not feed internal emails to SpamAssassin.

compiling: Illegal octal digit '9' ignored...

2010-07-23 Thread Rosenbaum, Larry M.
I'm seeing warnings like this when I run sa-compile: Illegal octal digit '9' ignored at /usr/local/lib/perl5/site_perl/5.10.1/Mail/SpamAssassin/Plugin/BodyRuleBaseExtractor.pm line 1083, <$fh> line 5645. Illegal octal digit '9' ignored at /usr/local/lib/perl5/site_perl/5.10.1/Mail/SpamAssassin/

RE: new PDF "Launch" malware exploit (with sample)

2010-04-29 Thread Rosenbaum, Larry M.
> From: d.h...@yournetplus.com [mailto:d.h...@yournetplus.com] > Sent: Wednesday, April 28, 2010 2:29 PM > To: users@spamassassin.apache.org > Subject: RE: new PDF "Launch" malware exploit (with sample) > > Quoting "Rosenbaum, Larry M." : > > > Ple

RE: new PDF "Launch" malware exploit (with sample)

2010-04-28 Thread Rosenbaum, Larry M.
Please don't send live malware samples to the list. > -Original Message- > From: Chip M. [mailto:sa_c...@iowahoneypot.com] > Sent: Wednesday, April 28, 2010 2:01 PM > To: users@spamassassin.apache.org > Subject: new PDF "Launch" malware exploit (with sample) > > FILE QUARANTINED > > Micr

RE: More freemail URI spam

2010-04-20 Thread Rosenbaum, Larry M.
> Generally speaking, anything deemed worthwhile is added to SA proper > (unless there's a licensing question). The exceptions come from > automated rules (like Sought, MBL, SARE 2tld, and Khop-sc-neighbors), 90_2tld.cf has been replaced by the official rule file 20_aux_tlds.cf. From the commen

RE: 90_sare_freemail.cf.sare.sa-update.dostech.net

2010-03-09 Thread Rosenbaum, Larry M.
> From: Yet Another Ninja [mailto:sa-l...@alexb.ch] > > On 3/4/2010 7:34 PM, Rosenbaum, Larry M. wrote: > > > >> From: Karsten Bräckelmann [mailto:guent...@rudersport.de] > >> > >> On Thu, 2010-03-04 at 00:12 +0100, Yet Another Ninja wrote: > >&g

RE: 90_sare_freemail.cf.sare.sa-update.dostech.net

2010-03-04 Thread Rosenbaum, Larry M.
t Another Ninja wrote: > > On 3/3/2010 10:09 PM, Karsten Bräckelmann wrote: > > > On Wed, 2010-03-03 at 15:38 -0500, Rosenbaum, Larry M. wrote: > > >> Is there still a reason for this update channel? > > >> > > >> 90_sare_freemail.cf.sar

90_sare_freemail.cf.sare.sa-update.dostech.net

2010-03-03 Thread Rosenbaum, Larry M.
Is there still a reason for this update channel? 90_sare_freemail.cf.sare.sa-update.dostech.net Or is it now built in to SA v3.3.0?

90_sare_freemail.cf.sare.sa-update.dostech.net

2010-02-01 Thread Rosenbaum, Larry M.
Is there still a reason for this update channel? 90_sare_freemail.cf.sare.sa-update.dostech.net Or is it now built in to SA v3.3.0?

spamd: respawning server - why?

2010-01-15 Thread Rosenbaum, Larry M.
Yesterday one of our servers started having problems. I found the following messages in the syslog file: Jan 14 14:12:38 localhost spamd[20926]: spamd: respawning server at /usr/local/bin/spamd line 1080. Jan 14 14:12:38 localhost spamd[20927]: spamd: respawning server at /usr/local/bin/spamd

Spamd startup locale question

2010-01-13 Thread Rosenbaum, Larry M.
SpamAssassin Server version 3.2.5 running on Perl 5.8.8 with zlib support (Compress::Zlib 2.011) SunOS ornl72 5.9 Generic_122300-07 sun4u sparc SUNW,Sun-Fire-V240 What causes the following error message when restarting spamd? perl: warning: Setting locale failed. perl: warning: Please check t

RE: spamassassin bug

2010-01-11 Thread Rosenbaum, Larry M.
> check: no loaded plugin implements 'check_main': cannot scan! at > /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/PerMsgStatus.pm > line > 164. > >What plugin do I need to have loaded to resolve this error? It looks like you are missing the v320.pre file, which contains loadplugin Mai

RE: About upgrading

2010-01-10 Thread Rosenbaum, Larry M.
> -Original Message- > From: Bill Landry [mailto:b...@inetmsg.com] > Sent: Sunday, January 10, 2010 12:42 PM > To: users@spamassassin.apache.org > Subject: Re: About upgrading > > LuKreme wrote: > > On 9-Jan-2010, at 21:23, Rosenbaum, Larry M. wrote: > >

RE: About upgrading

2010-01-09 Thread Rosenbaum, Larry M.
--Original Message- > From: Alex [mailto:mysqlstud...@gmail.com] > Sent: Saturday, January 09, 2010 9:13 PM > To: SA Mailing list > Subject: Re: About upgrading > > Hi, > > >   sa-learn --dump magic gives: > >       0.000          0          3          0  non-token data: bayes > db version >

Solaris 10 requires --syslog-socket=native

2009-12-30 Thread Rosenbaum, Larry M.
I have just recently installed SA v3.3.0-rc1 on Solaris 10. I have discovered that in order for syslog logging to work, I have to start spamd with the switch "--syslog-socket=native". It won't work if I set it to "unix" or "inet" or if I omit the switch entirely. As this is my first time runn

Recommended version of re2c?

2009-12-21 Thread Rosenbaum, Larry M.
What is the recommended version of re2c to use with SpamAssassin v3.3.0? What about with v3.2.5? Thanks, Larry

RE: ANNOUNCE: Apache SpamAssassin 3.3.0-beta1 available

2009-12-09 Thread Rosenbaum, Larry M.
> From: Mark Martinec [mailto:mark.martinec...@ijs.si] > > > Thanks for testing! Which version of a perl module Time::HiRes > > do you have installed? See what is reported by: > > $ perl -MTime::HiRes -le 'print Time::HiRes->VERSION' 1.9719 This is the version that came with Perl 5.10.1, and i

RE: ANNOUNCE: Apache SpamAssassin 3.3.0-beta1 available

2009-12-08 Thread Rosenbaum, Larry M.
SpamAssassin version 3.3.0-beta1 running on Perl version 5.10.1 Solaris 9 Sparc I am getting the following errors in "make test": t/timeout.t ... 5/27 # Failed test 5 in t/timeout.t at line 63 t/timeout.t ... 7/27 # Failed test 7 in t/timeout.t at line

RE: ANNOUNCE: Apache SpamAssassin 3.3.0-beta1 available

2009-12-08 Thread Rosenbaum, Larry M.
> From: Warren Togami [mailto:wtog...@redhat.com] > Subject: ANNOUNCE: Apache SpamAssassin 3.3.0-beta1 available > ... > - if module Digest::SHA is not available, a module Digest::SHA1 > will be used, but at least one of them must be installed; > a DKIM plugin requires Digest::SHA (the ol

RE: DCC problems

2009-07-07 Thread Rosenbaum, Larry M.
Thanks. It was a firewall issue. From: Michael Scheidell [mailto:scheid...@secnap.net] Sent: Tuesday, July 07, 2009 2:54 PM To: Rosenbaum, Larry M. Cc: users@spamassassin.apache.org Subject: Re: DCC problems Rosenbaum, Larry M. wrote: Recently I've started seeing message like this in ou

DCC problems

2009-07-07 Thread Rosenbaum, Larry M.
Recently I've started seeing message like this in our log files: Jul 7 13:22:48 ornl73 dccifd[21907]: [ID 702911 mail.notice] no working DCC serversdcc1.dcc-servers.net dcc2.dcc-servers.net dcc3.dcc-servers.net ... at 64.124.52.232 208.201.249.2 Jul 7 13:22:48 ornl73 dccifd[21907]: [ID 702911

Bayes expiration logic

2009-07-06 Thread Rosenbaum, Larry M.
Has anybody considered revising the Bayes expiration logic? Maybe it's just our data that's weird, but the built-in expiration logic doesn't seem to work very well for us. Here are my observations: There's no point in checking anything older than oldest_atime. For this value and older, zero

RE: Plugin extracting text from docs

2009-07-06 Thread Rosenbaum, Larry M.
> From: Jonas Eckerman [mailto:jonas_li...@frukt.org] > > Rosenbaum, Larry M. wrote: > > > It appears that "pdftohtml" is only available as a Windows executable > (on Sourceforge). > > If you want a precompiled executable it seems Windows is the only >

RE: Plugin extracting text from docs

2009-07-02 Thread Rosenbaum, Larry M.
> And, please tell me of problems. > pdftohtml is imho not found in gentoo, but pdf2html is maybe the same ? It appears that "pdftohtml" is only available as a Windows executable (on Sourceforge). I need something that will run on Solaris.

RE: Plugin extracting text from docs (was: new spam using large images)

2009-07-01 Thread Rosenbaum, Larry M.
We can use antiword to render text from MSWord files, and unrtf to render text from RTF files. What is the best tool to render text from PDF files? (We are running Solaris 9) L > -Original Message- > From: Jonas Eckerman [mailto:jonas_li...@frukt.org] > Sent: Wednesday, June 24, 2009 1

RE: SORBS bites the dust

2009-06-23 Thread Rosenbaum, Larry M.
> -Original Message- > From: Matus UHLAR - fantomas [mailto:uh...@fantomas.sk] > > >IMPORTANT: If sorbs does not get picked-up by a new host, will SA > > >developers be ready to roll-out an SA update to remove the sorbs > rules, so > > >that we don't suffer a bunch of timeouts? Or how doe

RE: new spam using large images

2009-06-19 Thread Rosenbaum, Larry M.
> From: felic...@kluge.net On Behalf Of Theo Van Dinter > > On Fri, Jun 19, 2009 at 3:04 AM, Jason Haar > wrote: > > Speaking of image/rtf/word attachment spam; is there any work going > on > > to standardize this so that the textual output of such attachments > could > > be fed back into SA? > >

419 scams in .doc and .rtf attachments

2009-06-16 Thread Rosenbaum, Larry M.
We get a significant number of 419 scam letters where the actual spam text is in a Word (.doc or .rtf) or PDF attachment. Example: http://pastebin.com/m4a161daa It would be really great if there was an SA plugin to extract the text from the attachment and then feed the text to the regular SA b

Do I need to adjust bayes_expiry_max_db_size?

2009-03-19 Thread Rosenbaum, Larry M.
We are running SpamAssassin version 3.2.5 running on Perl version 5.8.8 Solaris 9 Sparc with the MySQL Bayes store and autolearning. We are using bayes_expiry_max_db_size 100 Expiry is done manually once a day. Here is a typical output from expiry: Thu Mar 19 00:12:00 EDT 2009 Forcing B

RE: Hostname in X-Spam-Checker-Version Header

2009-03-17 Thread Rosenbaum, Larry M.
> From: netz-haut - stephan seitz [mailto:s.se...@netz-haut.de] > Sent: Tuesday, March 17, 2009 1:15 PM > To: users@spamassassin.apache.org > Subject: Hostname in X-Spam-Checker-Version Header > > Hi there, > > as shown in the manual, the X-Spam-Checker-Version header is not > configurable for so

freemail_re error

2009-02-27 Thread Rosenbaum, Larry M.
What is the significance of this message in the spamd log? Feb 27 12:56:25 localhost spamd[222]: config: dup unknown type freemail_re, Regexp (Somebody asked a similar question in November, but I didn't see an answer.) Thanks, Larry

RE: misc_10.cf

2009-02-10 Thread Rosenbaum, Larry M.
The information on the download page should be corrected to point to the right file. Or perhaps removed entirely: when you build from source, the build procedure prompts you for site contact information and puts it into the 10_default_prefs.cf file. It is also put into the sa-update script, so

RE: sa-update damages existing SA installation

2008-12-22 Thread Rosenbaum, Larry M.
> From: Daryl C. W. O'Shea [mailto:spamassas...@dostech.ca] > Sent: Saturday, December 20, 2008 2:48 AM > > On 19/12/2008 5:40 AM, Marcin Krol wrote: > > Daryl C. W. O'Shea wrote: > >> do it all at once. See my SARE sa-update page for details: > > > >> http://daryl.dostech.ca/sa-update/sare/sare-s

RE: Backup command for AWL?

2008-12-05 Thread Rosenbaum, Larry M.
> From: Theo Van Dinter [mailto:[EMAIL PROTECTED] > > On Fri, Dec 05, 2008 at 11:58:26AM -0500, Rosenbaum, Larry M. wrote: > > The Bayes database can be backed up and restored with sa-learn -- > backup/--restore. Is there any similar way to back up and restore a > MySQL-bas

Backup command for AWL?

2008-12-05 Thread Rosenbaum, Larry M.
The Bayes database can be backed up and restored with sa-learn --backup/--restore. Is there any similar way to back up and restore a MySQL-based AWL database? The "check_whitelist" command is only good for DBM files.

RE: why is SA testing my server in DNSBLs?

2008-12-02 Thread Rosenbaum, Larry M.
> From: Brian J. Murrell [mailto:[EMAIL PROTECTED] > > Hi All, > > I was doing a bit of "spamassassin -D" testing with SA 3.2.4 and > noticed > that it's running my own mail server name through various DNSBL tests. > > Here are the headers of the particular message I am testing: > > >From [EMAIL PR

RE: optional modules

2008-11-13 Thread Rosenbaum, Larry M.
> From: Stefan Jakobs [mailto:[EMAIL PROTECTED] > > > INFO: SA version: 3.2.5, 3.002005, no optional modules: > Sys::Hostname::Long > What is the benefit of using this modul? Sys::Hostname::Long is required by Mail::SPF::Query. However, Mail::SPF::Query has been superseded by Mail::SP

RE: SURBL Usage Policy change

2008-11-12 Thread Rosenbaum, Larry M.
Where is the price list? I haven't been able to find it. > -Original Message- > From: Joseph Brennan [mailto:[EMAIL PROTECTED] > Sent: Wednesday, November 12, 2008 12:25 PM > To: users@spamassassin.apache.org > Subject: Re: SURBL Usage Policy change > > > Jeff Chan <[EMAIL PROTECTED]> wro

RE: bayes_token table too big?

2008-10-06 Thread Rosenbaum, Larry M.
> From: Theo Van Dinter [mailto:[EMAIL PROTECTED] > > On Mon, Oct 06, 2008 at 03:42:53PM -0400, Rosenbaum, Larry M. wrote: > > And here is the information from the local.cf file: > > > > bayes_expiry_max_db_size 50 > > > > So the config file says 500 th

bayes_token table too big?

2008-10-06 Thread Rosenbaum, Larry M.
SpamAssassin version 3.2.5, running on Perl version 5.8.8, Solaris 9 Using MySQL for Bayes database. I'm wondering if our Bayes token database is too big, and why. Based on some posts to this list, I decided to try converting our Bayes and AWL databases to InnoDB to improve performance. So I co

RE: Skip scanning for large mails

2008-09-15 Thread Rosenbaum, Larry M.
> From: Evan Platt [mailto:[EMAIL PROTECTED] > > Rosenbaum, Larry M. wrote: > > > > We just received a 419 spam with a 642 KB JPG file. It would be nice > if SpamAssassin could at least look at the text of messages like that. > > > > > Wouldn't FuzzyOCR

RE: Skip scanning for large mails

2008-09-15 Thread Rosenbaum, Larry M.
> From: mouss [mailto:[EMAIL PROTECTED] > > Rosenbaum, Larry M. wrote: > >> From: mouss [mailto:[EMAIL PROTECTED] > >> > >> The samples I looked at could easily be stopped otherwise (I don't > >> "usuall" get a lot of lottery mail with a

RE: Skip scanning for large mails

2008-09-15 Thread Rosenbaum, Larry M.
> From: mouss [mailto:[EMAIL PROTECTED] > > The samples I looked at could easily be stopped otherwise (I don't > "usuall" get a lot of lottery mail with a large .tif from a gmail > address!!). but it's not worth the pain. if spammers start sending > large > messages, things will change... We just

SpamAssassin slowdown

2008-09-09 Thread Rosenbaum, Larry M.
SpamAssassin version 3.2.5 running on Perl version 5.8.8 Solaris 9 SPARC For the past few days I have noticed SpamAssassin takes much longer to process messages between about 10:00am and 1:00pm EDT. It doesn't appear to be a memory problem or a problem with our DNS server. To try to figure i

RE: Spam flooding recent days

2008-07-22 Thread Rosenbaum, Larry M.
> From: Michał Jęczalik [mailto:[EMAIL PROTECTED] > Subject: Spam flooding recent days > > Hello, > > I've noticed a huge increase of spam rate in past 2-3 weeks. Most of it > are messages with some quite normal Subject:, often (but not > neccesarily) > referring to some fake event (i.e. some polit

RE: Upgrade SpamAssassin failing

2008-04-01 Thread Rosenbaum, Larry M.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5591 > -Original Message- > From: Asif Iqbal [mailto:[EMAIL PROTECTED] > Sent: Tuesday, April 01, 2008 3:59 PM > To: users@spamassassin.apache.org > Subject: Re: Upgrade SpamAssassin failing > > Still looking for some suggestion on th

RE: AWL scores high after receiving spam "from myself"?

2008-02-22 Thread Rosenbaum, Larry M.
> From: Andreas Ntaflos [mailto:[EMAIL PROTECTED] > To spamassassin this spam appears to come from myself. It scored a low > AWL but > over 16 points all in all so the next message received from > [EMAIL PROTECTED] would certainly get high AWL score. > > My questions are these: did I get this right

RE: Rule for Russian character sets

2008-02-15 Thread Rosenbaum, Larry M.
> From: Karsten Bräckelmann [mailto:[EMAIL PROTECTED] > > I've pointed it out before. Just use ok_locales, which is all about > these char sets. No REs, almost no thinking required, no headache. A > single line, and you're done. What's the best way to test the character set for use in a meta rule?

RE: sa-compile format the standard now?

2008-02-14 Thread Rosenbaum, Larry M.
> From: Bowie Bailey [mailto:[EMAIL PROTECTED] > > Rosenbaum, Larry M. wrote: > > > From: Bowie Bailey [mailto:[EMAIL PROTECTED] > > > > > > I would say that sa-compile is the preferred method due to its > > > performance benefits. There aren't

RE: sa-compile format the standard now?

2008-02-14 Thread Rosenbaum, Larry M.
> From: Bowie Bailey [mailto:[EMAIL PROTECTED] > > I would say that sa-compile is the preferred method due to its > performance benefits. There aren't many (any?) drawbacks to using it. I don't use it here because it takes too long (over 20 minutes) to compile. (This is with SA v3.2.4, which is a

RE: Googlepages & Livefilestore spams

2008-01-10 Thread Rosenbaum, Larry M.
Is it safe to use unbounded quantifiers like + and {2,} in uri rules? I avoid them in regular body rules. L > -Original Message- > From: Ben Lentz [mailto:[EMAIL PROTECTED] > Sent: Wednesday, January 09, 2008 10:56 PM > To: users@spamassassin.apache.org > Subject: Re: Googlepages & Live

Mismatched URLs revisited

2007-12-06 Thread Rosenbaum, Larry M.
Some time ago (and more than once) there have been discussions on this list about email containing hyperlinks where the link text is a URL that doesn't match the URL in the link HREF, and the pros and cons of testing for and scoring these mismatched links. My management has raised this issue.

whitelist_from_rcvd with numeric IP?

2007-10-30 Thread Rosenbaum, Larry M.
The documentation for whitelist_from_rcvd shows examples like this: whitelist_from_rcvd [EMAIL PROTECTED] example.com What if the sending server has no rDNS? Is there a way to use this feature with a numeric IP instead of a rDNS domain? If so, what is the syntax? Thanks, Larry

spamd children killed but don't die?

2007-08-24 Thread Rosenbaum, Larry M.
This morning on one of our servers, spamd was having problems. There were 8 spamd children running, but "top" showed only two of them were using any CPU time even though there was a backlog of messages to be processed. The log file included lines like this: Aug 24 08:49:22 localhost spamd[21051]

RE: warning - score undef for rule 'MISSING_SUBJECT'...

2007-08-15 Thread Rosenbaum, Larry M.
> From: Leon Kolchinsky [mailto:[EMAIL PROTECTED] > > > The first time I run sa-update after a v3.2.3 install, I get the > > following warnings: > > > > rules: score undef for rule 'MISSING_SUBJECT' in '' 'MISSING_SUBJECT' > at > > ... > > The score MISSING_SUBJECT is removed from 3.1.x and 3.2.x

warning - score undef for rule 'MISSING_SUBJECT'...

2007-08-14 Thread Rosenbaum, Larry M.
The first time I run sa-update after a v3.2.3 install, I get the following warnings: rules: score undef for rule 'MISSING_SUBJECT' in '' 'MISSING_SUBJECT' at /usr/local/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 2140. rules: score undef for rule 'EMPTY_MESSAGE' in '' 'EMPTY_M

3.2.3 spamd_hup test failed

2007-08-09 Thread Rosenbaum, Larry M.
SpamAssassin v3.2.3, Perl 5.8.8, Solaris 9 What would cause this error? t/spamd_hup.ok 1/110# Failed test 5 in t/spamd_hup.t at line 40 # t/spamd_hup.t line 40 is: ok (-e $pid_file) or warn "$pid_file does not exist post restart"; log/spamd.pid does not exist post r

RE: ANNOUNCE: Apache SpamAssassin 3.2.3 available

2007-08-09 Thread Rosenbaum, Larry M.
I don't see it. How long does it take to get to the mirrors? > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Justin Mason > Sent: Thursday, August 09, 2007 3:39 PM > To: users@SpamAssassin.apache.org; [EMAIL PROTECTED]; > [EMAIL PROTECTED] > Subject:

iXhash zone transfer?

2007-08-07 Thread Rosenbaum, Larry M.
Is it possible to get zone transfers of the iXhash data?

What is bug 5548

2007-08-03 Thread Rosenbaum, Larry M.
In the SA 3.2.2 announcement was this item: - bug 5548: Certain mail input can take a long time to scan with 100% CPU utilisation, due to backtracking in a rule's regexp. fix but when I went to look up the bug, I didn't have permission. Could somebody give me more detail on this bug? In parti

Microsoft Antigen Spam Manager

2007-07-06 Thread Rosenbaum, Larry M.
I have been asked to look into Microsoft Antigen Spam Manager (and MS Forefront for Exchange Server). Does anybody have any information (or can point me to independent reviews) as to how good this product is and how it compares with SpamAssassin? Thanks ...

RE: URIBL_BLACK matching on messages with no URLs in them...

2007-07-02 Thread Rosenbaum, Larry M.
> From: Jo Rhett [mailto:[EMAIL PROTECTED] > > > SA doesn't just look for full URLs, it looks for things that could be > > hostnames ala "copy www.example.com into your browser". > > This is fairly nonfunctional. I've been chasing around all sorts of > FPs that seem to hit pretty much every mess

RE: SA 3.2.1 not using SQL for bayes

2007-06-20 Thread Rosenbaum, Larry M.
> From: Hamie [mailto:[EMAIL PROTECTED] > > Small problem with SA 3.2.1... I'm using a mysql database. The DB works > fine for amavisd-new, and SA AWL. e.g. > > [438288] dbg: auto-whitelist: sql-based connected to > DBI:mysql:sadb:ixx: > [438288] dbg: auto-whitelist: sql-based using username:

RE: "make test" dnsbl tests sporadically fail

2007-06-15 Thread Rosenbaum, Larry M.
in the "DNS tests getting aborted" thread? Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK ________ From: Rosenbaum, Larry M. [mailto:[EMAIL PROTECTED] Sent: 13 June 2007 22:01

RE: Error on startup after upgrade to 3.2.1:CompiledRegexps

2007-06-13 Thread Rosenbaum, Larry M.
> From: Steven W. Orr [mailto:[EMAIL PROTECTED] > > [EMAIL PROTECTED] ~]# rpm -Uvh > /usr/src/redhat/RPMS/i386/spamassassin-3.2.1-1.i386.rpm > /usr/src/redhat/RPMS/i386/perl-Mail-SpamAssassin-3.2.1-1.i386.rpm > Preparing... ### > [100%] > 1:perl-Mail-Spa

"make test" dnsbl tests sporadically fail

2007-06-13 Thread Rosenbaum, Larry M.
When I run "make test" for v3.2.1, why do some of the dnsbl tests sporadically fail? For instance: t/dnsbl.Not found: P_2 = [127.0.0.4] # Failed test 1 in t/SATest.pm at line 635 Not found: P_7 = # Failed test 2 in t/SATest.pm at line 635 fail #2 N

v3.2.1 gives "spamd: handle_user unable to find user:"

2007-06-13 Thread Rosenbaum, Larry M.
SpamAssassin Server version 3.2.1 running on Perl 5.8.8 with zlib support (Compress::Zlib 2.004) I've started seeing the "spamd: handle_user unable to find user:" message in the spamd log file. This was not happening in v3.2.0. We are starting spamd with this command: spamd -d -u s

RE: ANNOUNCE: Apache SpamAssassin 3.2.1 available

2007-06-12 Thread Rosenbaum, Larry M.
> From: Duncan Hill [mailto:[EMAIL PROTECTED] > > On Tue, June 12, 2007 13:33, Justin Mason wrote: > > Daniel J McDonald writes: > >> So, you can't build the RPM as root. > >> > >> > >> I just added all of the various groups to my user, set up a user > build > >> directory tree, compiled it under

RE: sa-compile and SARE

2007-06-08 Thread Rosenbaum, Larry M.
> From: Doc Schneider [mailto:[EMAIL PROTECTED] > > Rosenbaum, Larry M. wrote: > > > > Does this fix the performance problems I was having, or does it just > fix > > the UTF errors showing in the logs with Perl < 5.8.8 ? > > You might try it and see if

RE: sa-compile and SARE

2007-05-22 Thread Rosenbaum, Larry M.
> -Original Message- > From: Loren Wilton [mailto:[EMAIL PROTECTED] > Sent: Tuesday, May 22, 2007 1:36 PM > To: users@spamassassin.apache.org > Subject: Re: sa-compile and SARE > > > So, can we now remove the "use bytes;" line? > > Should be able to. If this doesn't work we have some m

RE: possible conflict in a SA setup between .pre and local.cf issue

2007-05-21 Thread Rosenbaum, Larry M.
> From: Abba Communications [mailto:[EMAIL PROTECTED] > > I think I just noticed a conflict. Not sure if I made the mistake or not, > yet I probably did. > > In my init.pre I have > > loadplugin Mail::SpamAssassin::Plugin::URIDNSBL > > uncommented > > and in my > > local.cf I have purposely s

RE: Spamassassin 3.2.0

2007-05-21 Thread Rosenbaum, Larry M.
> From: Christopher X. Candreva [mailto:[EMAIL PROTECTED] > > On Sat, 19 May 2007, Ming Hou wrote: > > > My issue Mail::DKIM and Mail::DomainKeys are required > Crypt::OpenSSL::Random > > and Crypt::OpenSSL::RSA. But, I could not get Crypt::OpenSSL::Random to > be > > built successfully because

spamc -H favors one host (v3.2.0)

2007-05-14 Thread Rosenbaum, Larry M.
We have just upgraded from v3.1.8 to v3.2.0. We invoke spamc as follows: spamc -H -E -t 180 -s 20 -d spamd.ornl.gov # nslookup spamd.ornl.gov Name:spamd.ornl.gov Addresses: 160.91.4.92, 160.91.1.172 This used to connect equally to the two hosts, but now it makes almost al

RE: Poor performance with v3.2.0

2007-05-10 Thread Rosenbaum, Larry M.
> -Original Message- > From: Doc Schneider [mailto:[EMAIL PROTECTED] > > If he is getting the UTF-8 error, this would indeed be odd, since he is > using perl-5.8.8 which supposedly handles those regexps which causes the > error. > > What SARE rules are you running Larry? /usr/local/spam

RE: Poor performance with v3.2.0

2007-05-10 Thread Rosenbaum, Larry M.
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Did you have a massive volume of "Malformed UTF-8" warning messages in the > syslog output? No, I upgraded Perl to v5.8.8, which got rid of the warning messages but there was still a performance problem. Adding "use bytes" seems to have fixed

RE: Poor performance with v3.2.0

2007-05-10 Thread Rosenbaum, Larry M.
> From: Loren Wilton [mailto:[EMAIL PROTECTED] > Subject: Re: Poor performance with v3.2.0 > > It would be interesting on some system experiencing this slowdown to put > 'use bytes' back into SA and see what happens with the performance. This > wouldn't be any sort of a solution, but it would be a

RE: Poor performance with v3.2.0

2007-05-10 Thread Rosenbaum, Larry M.
> > Took 10 mins on my 2.8gh 512mb ram, with a bunch of sares rules. > > You using .12.0 of re2c? Yes. I think most of the time is spent in the rule extraction steps and the gcc compiles, and not in the re2c steps. (gcc is v3.4.6) > > Yes, you are right, after "use warnings;". I ran SA3.2 on

RE: Poor performance with v3.2.0

2007-05-09 Thread Rosenbaum, Larry M.
>> Bayes auto expiries (taking to long and getting killed)? I think >> that's a 600 second timeout. We're not using auto-expiry. Bayes expiry is being done with a batch job. > It would be interesting on some system experiencing this slowdown to put > 'use bytes' back into SA and see what happe

Poor performance with v3.2.0

2007-05-08 Thread Rosenbaum, Larry M.
Running SpamAssassin v3.2.0 on Solaris 9, perl v5.8.8. I am getting really poor performance with v3.2.0 compared with v3.1.8. Average scan time per message is doubled (or worse). I'm also seeing messages like this in the log file (although not all the time): May 7 17:10:20 localhost spamd

RE: Justa a small nag from 3.2.0...

2007-05-04 Thread Rosenbaum, Larry M.
> From: Luis Hernán Otegui [mailto:[EMAIL PROTECTED] > > Hi, list, I have a cron job running in order to learn from each user's > HAM and SPAM subdirs. Whenever it runs, it complains like this: > > Subroutine FuzzyOcr::O_NONBLOCK redefined at > /usr/share/perl/5.8/Exporter.pm line 65. > at /usr/

RE: ANNOUNCE: Apache SpamAssassin 3.2.0-rc3 PRERELEASE available!

2007-04-24 Thread Rosenbaum, Larry M.
> > 2) I tried to compile the rules to see how much speed increase I could > > get, but it didn't work. After running sa-compile and uncommenting the > > Rule2XSBody plugin, I got the following error: > > > > # spamassassin --lint > > ld.so.1: /usr/local/bin/spamassassin: fatal: relocation error:

RE: ANNOUNCE: Apache SpamAssassin 3.2.0-rc3 PRERELEASE available! - UTF error

2007-04-24 Thread Rosenbaum, Larry M.
Testing v3.2.0-rc3 on Solaris 8 I'm finding zillions of the following errors in the log file: Apr 24 10:13:27 emaildev.ornl.gov spamd[12593]: Malformed UTF-8 character (unexpected non-continuation by te 0x00, immediately after start byte 0xce) in pattern match (m//) at /etc/mail/spamassassin/70_sa

RE: ANNOUNCE: Apache SpamAssassin 3.2.0-rc3 PRERELEASE available!

2007-04-24 Thread Rosenbaum, Larry M.
> From: Justin Mason [mailto:[EMAIL PROTECTED] > Subject: ANNOUNCE: Apache SpamAssassin 3.2.0-rc3 PRERELEASE available! > > Apache SpamAssassin 3.2.0-rc3 is now available! This is a *PRERELEASE*, > not the full release of 3.2.0. I have found the following (non-fatal) issues with SA v3.2.0-rc3:

Bug 5420 - RE: 3.2.0-rc2?

2007-04-17 Thread Rosenbaum, Larry M.
Any chance of fixing Bug #5420 before the final release? http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5420 > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Tuesday, April 17, 2007 12:05 PM > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED]; users@Spa

RE: Simple hosting user: can I install my own SA?

2007-02-02 Thread Rosenbaum, Larry M.
> From: Andy Figueroa [mailto:[EMAIL PROTECTED] > > Woo Hoo - that's a good trick and good intel. Thinking ... Won't it > still try to use /usr/share/spamassassin for rules and > /var/lib/spamassassin for updates and /etc/mail/spamasassin for > configuration and so forth? Can't do that without r

RE: use or not use awl

2007-01-22 Thread Rosenbaum, Larry M.
> From: Dave Koontz [mailto:[EMAIL PROTECTED] > Not neccessarily. Put your awl on a sql database and add a timestamp > column > to the awl table, which gets automagically a new timestamp by the dbms > each > time a record is updated. The "timestamp" column type in Mysql is such a > type. > > show

BODY rule fails with double-spaced text

2006-12-14 Thread Rosenbaum, Larry M.
The doc for BODY rules says "All HTML tags and line breaks will be removed before matching". I was also told on this list that multiple whitespace was compressed to single space characters. So if I have text like this: xyzzy abcde and the following rules: bodyT_LMRTESTB1 /xyzzy a

RE: spam

2006-12-05 Thread Rosenbaum, Larry M.
Has anybody come up with a rule for these yet? I tried the following: body ORNL_B0RKEN1 /^\d{3,5}\n{1,3}$/s describe ORNL_B0RKEN1 B0rken spamware, message just contains a short number scoreORNL_B0RKEN1 1 This matches the spam message, but it also matches messages where the number is foll

RE: new Botnet plugin version soon

2006-11-30 Thread Rosenbaum, Larry M.
> From: Dennis Davis [mailto:[EMAIL PROTECTED] > ... > > > Question 2: someone asked why my module is "Botnet" instead of > > "Mail::SpamAssassin::Plugin::Botnet". The answer is: when I > > first started this (and this is/was my first SA Plugin authoring > > attempt), I tried that and it didn't w

RE: sa-update and 'doesnotexist'

2006-10-10 Thread Rosenbaum, Larry M.
> From: Ben Lentz [mailto:[EMAIL PROTECTED] > > Greetings, List! > I just upgraded from sa 3.1.3 to sa 3.1.6 and am having some weird > problems with sa-update that I've never seen before. It would seem that > my sys rules/default rules directory (/usr/share/spamassassin) is not > being loaded by

RE: 2 different scores?

2006-10-06 Thread Rosenbaum, Larry M.
> From: Evan Platt [mailto:[EMAIL PROTECTED] >... > I changed my procmailrc to; > > :0fw: spamassassin.lock > | spamd -L -c -s 512000 Shouldn't that be spamc?

RE: spamd Sys-Hostname-Long-1.4 error

2006-10-06 Thread Rosenbaum, Larry M.
In Long.pm, go to line 91 and change this my $tmp = `hostname` . '.' . `domainname`; to this my $tmph = `hostname`; my $tmpd = `domainname`; my $tmp = "$tmph.$tmpd"; > -Original Message- > From: John Goubeaux [mailto:[EMAIL PROTECTED] > Posted At: Friday, October 06,

RE: sa-learn and "Caught" spams

2006-09-27 Thread Rosenbaum, Larry M.
> From: Mike Woods [mailto:[EMAIL PROTECTED] > > The internet is a great place for raising more questions than it answers > :D > > Given all the opinions I think I will move the caught spam's into the > learning cycle however i'm also going to make sure that each spam is > only ever fed through t

RE: URIBL false matches

2006-09-07 Thread Rosenbaum, Larry M.
> From: Mark G. Thomas [mailto:[EMAIL PROTECTED] > > Hi, > > I have a problem with incorrect URIBL hits on incoming forwarded messages > that have been mangled by Lotus Notes. > > I have a customer with the domain name "Yimaging.com". > (Not really "Y"). > > "ng.com" is on the URIBL bla

  1   2   >