Re: X-Amavis-Alert: BANNED, message contains x.com

Hi, On 16.07.24 17:28, Thomas Barth via users wrote: today a mail has been banned (false positive). It says message contains x.com X-Quarantine-ID: X-Amavis-Alert: BANNED, message contains x.com I couldnt find x.com in the mail body itself, but the mail had a zipfile as an attachment. The

Re: X-Amavis-Alert: BANNED, message contains x.com

Bill Cole skrev den 2024-07-16 19:00: asking to be sure That is NOT a SpamAssassin message, as SA does nothing so silly. It is clearly and strictly an Amavis issue. i know :)

Re: X-Amavis-Alert: BANNED, message contains x.com

On 2024-07-16 at 11:55:50 UTC-0400 (Tue, 16 Jul 2024 17:55:50 +0200) Benny Pedersen is rumored to have said: Thomas Barth via users skrev den 2024-07-16 17:28: X-Quarantine-ID: X-Amavis-Alert: BANNED, message contains x.com Are there any further explanations for the banning of x.com

Re: X-Amavis-Alert: BANNED, message contains x.com

Thomas Barth via users skrev den 2024-07-16 17:28: X-Quarantine-ID: X-Amavis-Alert: BANNED, message contains x.com Are there any further explanations for the banning of x.com? ask on amavis maillist are spamassassin using extractext ? asking to be sure

X-Amavis-Alert: BANNED, message contains x.com

Hello, today a mail has been banned (false positive). It says message contains x.com X-Quarantine-ID: X-Amavis-Alert: BANNED, message contains x.com I couldnt find x.com in the mail body itself, but the mail had a zipfile as an attachment. The zip file probably contains invoices. Are

Re: amavis[14826]: (14826-10) SA info: dns: new_dns_packet: domain is utf8 flagged:

zahn skrev den 2018-10-08 12:49: amavis[14826]: (14826-10) SA info: dns: new_dns_packet: domain is utf8 flagged: ns2.yandex.net Is this an error message or can I ignore it - thanks for the reply. SA info, in case of error imho it would say SA error its harmless info

Re: amavis[14826]: (14826-10) SA info: dns: new_dns_packet: domain is utf8 flagged:

You can ignore I believe. See https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7632 On Mon, Oct 8, 2018, 06:49 zahn wrote: > Hello > > I migrated spamassassin from 3.4.1 to 3.4.2 and now I get the following > message > in the logfile. > > amavis[14826]: (1

amavis[14826]: (14826-10) SA info: dns: new_dns_packet: domain is utf8 flagged:

Hello I migrated spamassassin from 3.4.1 to 3.4.2 and now I get the following message in the logfile. amavis[14826]: (14826-10) SA info: dns: new_dns_packet: domain is utf8 flagged: ns2.yandex.net Is this an error message or can I ignore it - thanks for the reply. -- Schöne Grüsse aus

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

On 9/20/2016 9:46 AM, Thomas Barth wrote: Am 20.09.2016 um 15:27 schrieb Bowie Bailey: X-Spam-Status: Yes, score=14.009 tag=2 tag2=6.31 kill=6.31 tests=[HTML_MESSAGE=0.001, MESSAGEID_LOCAL=8, MIME_HTML_ONLY=1.105, PYZOR_CHECK=1.985, RCVD_IN_BRBL_LASTEXT=1.644, RDNS_NONE=1.274]

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

On Tue, 20 Sep 2016 15:46:21 +0200 Thomas Barth wrote: > Am 20.09.2016 um 15:27 schrieb Bowie Bailey: > > >> X-Spam-Status: Yes, score=14.009 tag=2 tag2=6.31 kill=6.31 > >> tests=[HTML_MESSAGE=0.001, MESSAGEID_LOCAL=8, > >> MIME_HTML_ONLY=1.105, > >> PYZOR_CHECK=1.985, RCVD_IN_BRB

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

g 5.0 for years in a tag-and-deliver setup. I delete spam messages at a score of 10 - 15 for a few users who receive large amounts of spam. Also, as I said before, remember that SA's required_score setting is ignored in an Amavis setup. You should use Amavis's tag_level,

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

Am 20.09.2016 um 15:46 schrieb Thomas Barth: I read that 5.0 is aggressive and suitable for single user setup, conservative values are 8.0 or 11.0 depends on your glue, setup and bayes-training many setups tag spam with 5.0 or 5.5 while the glue like a milter rejects spam above 8.0 points

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

Am 20.09.2016 um 15:27 schrieb Bowie Bailey: X-Spam-Status: Yes, score=14.009 tag=2 tag2=6.31 kill=6.31 tests=[HTML_MESSAGE=0.001, MESSAGEID_LOCAL=8, MIME_HTML_ONLY=1.105, PYZOR_CHECK=1.985, RCVD_IN_BRBL_LASTEXT=1.644, RDNS_NONE=1.274] autolearn=no autolearn_force=no

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

here are other spam signs. The best idea with new rules is to add them with a low score at first and keep an eye on them for at least a couple of days to make sure that they are performing as expected before raising the score. Remember that Amavis has its own settings for required_score and messa

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

On 20/09/16 12:31, Thomas Barth wrote: Am 20.09.2016 um 12:23 schrieb Matus UHLAR - fantomas: Message-Id: <20160920154140.f5a976c...@static.vnpt.vn.local> you can put this in /etc/spamassassin/local.cf header MESSAGEID_LOCAL Message-Id

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

PYZOR_CHECK=1.985, RCVD_IN_BRBL_LASTEXT=1.644, RDNS_NONE=1.274] autolearn=no autolearn_force=no I see you don't have bayes DB set up. With amavis you can have site-wide bayes database, stored under amavis user. proper training should get this spam caught. -- Matus UHLAR - fan

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

Am 20.09.2016 um 12:23 schrieb Matus UHLAR - fantomas: Message-Id: <20160920154140.f5a976c...@static.vnpt.vn.local> you can put this in /etc/spamassassin/local.cf header MESSAGEID_LOCAL Message-Id =~ /\.local>$/ scoreMESSAGEID_LOCAL 1 describe MESSAGEID_LOCAL Message-Id contains ".

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

On Tue, 20 Sep 2016 12:50:26 +0200 Thomas Barth wrote: > Thanks for your help Matus > > bayes_auto_learn 1 > > For autolearning do I have to put these mails to a special folder? No, but autolearning is not very good. If you are scanning your own mail you are better-off not using it. IIWY I'd t

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

My system is debian, amavis, spamassassin, clamav. How can I extend Spamassassin? Or can I just call /usr/bin/sa-update --no-gpg regularly and wait to get better ruleset? you should do that. Debian SA does that if you set CRON=1 in /etc/default/spamassassin Ah, ok, I have already added it to the cron

Re: How to reject mails with special message-id (Debian, Amavis, Spamassassin)

TA. My system is debian, amavis, spamassassin, clamav. How can I extend Spamassassin? Or can I just call /usr/bin/sa-update --no-gpg regularly and wait to get better ruleset? you should do that. Debian SA does that if you set CRON=1 in /etc/default/spamassassin -- Matus UHLAR - fantomas,

How to reject mails with special message-id (Debian, Amavis, Spamassassin)

uot; MIME-Version: 1.0 Content-Type: multipart/related; boundary="part_a9cf4dac64cf39e24ba76020748b62f0" Message-Id: <20160920154140.f5a976c...@static.vnpt.vn.local> Date: Tue, 20 Sep 2016 15:41:40 +0700 My system is debian, amavis, spamassassin, clamav. How can I exte

Maybe solved - Re: Not right yet - Re: amavis question

On 11/20/2014 06:21 AM, Robert Moskowitz wrote: Don't know where better to ask this... I am running a new mailserver virtual domain environment with postfix and mysql for the virtual domain definitions. amavis-new seems to be rejecting all emails for my one domain not a sub domain of m

Re: amavis question

On 11/20/2014 07:39 AM, Mark Martinec wrote: Robert Moskowitz wrote: I am running a new mailserver virtual domain environment with postfix and mysql for the virtual domain definitions. amavis-new seems to be rejecting all emails for my one domain not a sub domain of my main one. That is, my

Not right yet - Re: amavis question

=3306', 'postfix', 'password'] ); On 11/20/2014 06:21 AM, Robert Moskowitz wrote: Don't know where better to ask this... I am running a new mailserver virtual domain environment with postfix and mysql for the virtual domain definitions. amavis-new seems to be rej

Re: amavis question

omain environment with postfix and mysql for the virtual domain definitions. amavis-new seems to be rejecting all emails for my one domain not a sub domain of my main one. That is, my domain (as you can see from my email addr) is htt-consult.com and I have not problems processing emails for lab

Re: amavis question

Robert Moskowitz wrote: I am running a new mailserver virtual domain environment with postfix and mysql for the virtual domain definitions. amavis-new seems to be rejecting all emails for my one domain not a sub domain of my main one. That is, my domain (as you can see from my email addr) is

amavis question

Don't know where better to ask this... I am running a new mailserver virtual domain environment with postfix and mysql for the virtual domain definitions. amavis-new seems to be rejecting all emails for my one domain not a sub domain of my main one. That is, my domain (as you can see

Re: bayes: no dbs present, cannot tie DB R/O - Amavis-new

Axb skrev den 2013-09-27 16:43: bayes_path = /var/lib/amavis/.spamassassin/bayes think the path to Bayes was "= /var/lib/amavis/.spamassassin/bayes", Good to hear it worked. put this in user_prefs for amavis not global will be better, then its still possible to have seperate

Re: bayes: no dbs present, cannot tie DB R/O - Amavis-new

On 09/27/2013 02:02 PM, Peter Smith wrote: In the spamasssin config files I have: bayes_path = /var/lib/amavis/.spamassassin/bayes make sure you have this in local.cf: bayes_path /var/lib/amavis/.spamassassin/bayes/bayes and that path /var/lib/amavis/.spamassassin/bayes/ exists h2h Ah

Re: bayes: no dbs present, cannot tie DB R/O - Amavis-new

make sure you have this in local.cf: bayes_path /var/lib/amavis/.spamassassin/bayes/bayes and that path /var/lib/amavis/.spamassassin/bayes/ exists h2h On 09/27/2013 09:54 AM, Peter Smith wrote: Hi all, We've just migrated from an old server running SA 3.2.5 and amavisd-new-2.6.1 to

bayes: no dbs present, cannot tie DB R/O - Amavis-new

Hi all, We've just migrated from an old server running SA 3.2.5 and amavisd-new-2.6.1 to a new machine with SA 3.3.2 and amavisd-new-2.7.1 (both Debian). I copied over the bayes-related files, but Amavis isn't loading them: bayes: no dbs present, cannot tie DB R/O: = /var/

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 4/20/2013 3:20 PM, Benny Pedersen wrote: > Ben Johnson skrev den 2013-04-20 05:02: > >> Yes, I believe that me and the system always execute SA commands as the >> "amavis" user. When I was using the SQL setup, I had the following in >> local.cf: >> >

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

Ben Johnson skrev den 2013-04-20 19:01: Welp, that'll do it! How those four files were set to root:root ownership is beyond me, that means that root have doing some testing :) later amavisd cant write, you should change to amavis user before testing su amavis -c cmd foo but tha

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

Ben Johnson skrev den 2013-04-20 05:02: Yes, I believe that me and the system always execute SA commands as the "amavis" user. When I was using the SQL setup, I had the following in local.cf: bayes_path /var/lib/amavis/.spamassassin/bayes is amavis have homedir in /var/lib/ ? in

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

Ben Johnson skrev den 2013-04-20 04:40: By "feed it a few thousand NEW spams", do you mean to scrap the training corpora that I've hand-sorted in favor of starting over? Or do you mean to clear the database and re-run the training script against the corpora? ls /path/to/maildir/spam >/tmp/sp

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

So, the problem seems not to be SQL-specific, as it occurs with SQL or flat-file DB. Upon following Benny Pedersen's advice (to move SA configuration directives from /etc/spamassassin/local.cf to /var/lib/amavis/.spamassassin/user_prefs), I noticed something unusual: $ ls -lah /var/lib/a

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

Apologies for the rapid-fire here folks, but I wanted to correct something. I had these backwards: >> Yes, I believe that me and the system always execute SA commands as the >> "amavis" user. When I was using the SQL setup, I had the following in >> local.cf: >&

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

the suggestion regarding moving the SA SQL setup into user_prefs. I will look into that soon. Yes, I believe that me and the system always execute SA commands as the "amavis" user. When I was using the SQL setup, I had the following in local.cf: bayes_path /var/lib/amavis/.spamassassin/ba

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

13th message about the same hose to score high on the Bayes tests. Is this an unreasonable expectation? I commented-out all of the DB-related lines in my SA configuration file (local.cf) and restarted amavis-new. I also cleared the existing DB tokens (with "sa-learn --clear") after amavis h

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

Ben Johnson skrev den 2013-04-19 18:02: Still stumped here... for amavisd-new, put spamassassin sql setup into user_prefs file for the user amavisd-new runs as might be working better then have insecure sql settings in /etc/mail/spamassassin :) i dont know if this is really that you have a

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

John Hardin skrev den 2013-04-18 04:15: ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_bin; unicode is overkill since bayes is just ascii it will if unicode is used create bigger db, that will slow down more then ascii Please check the SpamAssassin bugzilla to see if this situation is al

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 04/19/2013 06:02 PM, Ben Johnson wrote: Still stumped here... do a bayes sa-learn --backup switch to file based in SDBM format (which is fast) do a sa-learn --restore feed it a few thousand NEW spams see what happens

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

ly, and add the -t option, it > will show you the number of different types of tokens found in the message: > > X-Spam-Tok-Stat: Tokens: new, 0; hammy, 6; neutral, 84; spammy, 36. > > Regards, > Alex > Alex, thanks very much for the quick reply. I really appreciate it. One can

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

Hi, > Is this normal? If so, what is the explanation for this behavior? I have > marked dozens of nearly-identical messages with the subject "Garden hose >> expands up to three times its length" as SPAM (over the course of >> several weeks) as SPAM, and yet SA reports "not enough usable tokens >>

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

Hi, > Might anyone be in a position to offer an authoritative response to > these questions? > > I continue to see messages that are very similar to dozens of messages > that have been marked as SPAM slipping through with *no Bayes scoring* > (this is *after* fixing the SQL syntax error issue): >

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

t; -- > Apr 18 09:15:36.537 [21797] dbg: bayes: learner_new > self=Mail::SpamAssassin::Plugin::Bayes=HASH(0x4430388), > bayes_store_module=Mail::SpamAssassin::BayesStore::MySQL > Apr 18 09:15:36.568 [21797] dbg: bayes: using u

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

Hi, > Curious: what are your reasons for using Bayes in SQL? > > Are you sharing the DB among several machines? Or is this a single > > box/global bayes setup? > > > > > > Not yet, but that is the ultimate plan (to share the DB across multiple > servers). Also, I like the idea that the Bayes DB

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 4/18/2013 12:26 PM, Axb wrote: > On 04/18/2013 06:18 PM, Ben Johnson wrote: >> I have done some searching-around on the string "cannot use bayes on >> this message; not enough usable tokens found" and have not found >> anything authoritative regarding what this message might mean and >> whethe

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 04/18/2013 06:18 PM, Ben Johnson wrote: I have done some searching-around on the string "cannot use bayes on this message; not enough usable tokens found" and have not found anything authoritative regarding what this message might mean and whether or not it can be ignored or if it is symptomat

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

ot;cannot use bayes on this message; not enough usable tokens found"): # spamassassin -D -t < /tmp/msg.txt 2>&1 | egrep '(bayes:|whitelist:|AWL)' -- Apr 18 09:15:36.537 [21797] dbg: bayes: learner_new self=Mail::SpamAssassin::Plugin::Bayes=HASH(0x4430388), bayes_s

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 4/17/2013 5:39 PM, Tom Hendrikx wrote: > On 17-04-13 21:40, Ben Johnson wrote: >> Ideally, using the above directives will tell us whether we're >> experiencing timeouts, or these spam messages are simply not in the >> Pyzor or Razor2 databases. >> >> Off the top of your head, do you happen to

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On Wed, 17 Apr 2013, Ben Johnson wrote: The first post on that page was the key. In particular, adding the following to each MySQL "CREATE TABLE" statement: ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_bin; Please check the SpamAssassin bugzilla to see if this situation is already mention

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

es DB for all SA calls that reference this configuration file >> set.) >> >> If not, you may be getting a Bayes DB for each user on your system; >> IIRC this is supported (sort of) and default with Amavis. >> >> -kgd >> > > Thanks for jumping-in here

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

not, you may be getting a Bayes DB for each user on your system; > IIRC this is supported (sort of) and default with Amavis. > > -kgd > Thanks for jumping-in here, Kris. Yes, I do have the following in my SA local.cf: bayes_sql_override_username amavis So, all users are sharing the sa

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 17-04-13 21:40, Ben Johnson wrote: > Ideally, using the above directives will tell us whether we're > experiencing timeouts, or these spam messages are simply not in the > Pyzor or Razor2 databases. > > Off the top of your head, do you happen to know what will happen if one > or both of the Pyz

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

that causes Bayes tests not to be > performed. Do you have bayes_sql_override_username set? (This forces use of a single Bayes DB for all SA calls that reference this configuration file set.) If not, you may be getting a Bayes DB for each user on your system; IIRC this is supported (sort of) and

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

ders? (I have tag_level >> set to -999, so SA headers are always added.) > > That sounds like an amavisd command, you may want to check in > ~amavisd/.spamassassin/user_prefs as well I checked in the equivalent path on my system (/var/lib/amavis/.spamassassin/user_prefs) and the

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 4/16/13 2:59 PM, "Ben Johnson" wrote: >Are there any normal circumstances under which Bayes tests are not run? Yes, if USE_BAYES = 0 is included in the local.cf file. > > If not, are there circumstances under which Bayes tests are run but > their results are not included in the message he

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

Apologies for resurrecting the thread, but I never did receive a response to this particular aspect of the problem (asked on Jan 18, 2013, 8:51 AM). This is probably because I replied to my own post before anyone else did, and changed the subject slightly. We are being hammered pretty hard with sp

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On Wed, 6 Feb 2013, Ben Johnson wrote: On 2/1/2013 7:58 PM, John Hardin wrote: That latter brings up another concern for the vetted-corpora model: if a message is *removed* from a training corpora mailbox rather than reclassified, you'd have to wipe and retrain your database from scratch to rem

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 2/1/2013 7:58 PM, John Hardin wrote: > On Sat, 2 Feb 2013, RW wrote: > >> ALLOWING APPENDS >>By appends we mean the case of mail moving when the source folder is >>unknown, e.g. when you move from some other account or with tools >>like offlineimap. You should be careful with allo

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 2/1/2013 12:00 PM, John Hardin wrote: > On Fri, 1 Feb 2013, Ben Johnson wrote: > >> John, thanks for pointing-out the problems associated with re-sending >> the messages via sendmail. >> >> I threw a line out to the Dovecot users group and learned how to move >> messages without going through

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On Sat, 2 Feb 2013, RW wrote: ALLOWING APPENDS By appends we mean the case of mail moving when the source folder is unknown, e.g. when you move from some other account or with tools like offlineimap. You should be careful with allowing APPENDs to SPAM folders. The reason for possibly

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On Fri, 1 Feb 2013 09:00:48 -0800 (PST) John Hardin wrote: > On Fri, 1 Feb 2013, Ben Johnson wrote: > > > John, thanks for pointing-out the problems associated with > > re-sending the messages via sendmail. > > > > I threw a line out to the Dovecot users group and learned how to > > move messages

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On Fri, 1 Feb 2013, Ben Johnson wrote: John, thanks for pointing-out the problems associated with re-sending the messages via sendmail. I threw a line out to the Dovecot users group and learned how to move messages without going through the MTA. Dovecot has a utility executable, "deliver", whic

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 1/31/2013 5:50 PM, RW wrote: > On Thu, 31 Jan 2013 12:12:15 -0800 (PST) > John Hardin wrote: > >> On Thu, 31 Jan 2013, Ben Johnson wrote: >> > >>> So, I finally got around to tackling this change. >>> >>> With a couple of simple modifications, I was able to achieve the >>> desired result wit

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On Thu, 31 Jan 2013 12:12:15 -0800 (PST) John Hardin wrote: > On Thu, 31 Jan 2013, Ben Johnson wrote: > > > So, I finally got around to tackling this change. > > > > With a couple of simple modifications, I was able to achieve the > > desired result with the Dovecot Antispam plug-in. > > > > Bas

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On Thu, 31 Jan 2013, Ben Johnson wrote: On 1/15/2013 5:22 PM, John Hardin wrote: Yes, users are allowed to train Bayes, via Dovecot's Antispam plug-in. They do so unsupervised. Why this could be a problem is obvious. And no, I don't retain their submissions. I probably should. I wonder if I c

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

debugging. >>> Do your users also train ham? Are the procedures similar enough that >>> your users could become easily confused? >> >> They do. The procedure is implemented via Dovecot's Antispam plug-in. >> Basically, moving mail from Inbox to Junk trains it a

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

So, I've been keeping an eye on things again today. Overall, things look pretty good, and most spam is being blocked outright at the MTA and scored appropriately in SA if not. I've been inspecting the X-Spam-Status headers for the handful of messages that do slip through and noticed that most of

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

the last week or >>>> so wasn't *effective* until recently, say, after restarting some >>>> component of the mail stack? My understanding is that calling SA via >>>> Amavis, which does not need/use the spamd daemon, forces all Bayes data >>>> to be up-

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

l_reply_maps I'm not sure it's necessary in your situation. You can find more about this here: http://www.postfix.org/STRESS_README.html No doubt the guys on this list have been incredibly helpful in the past. I'd like to thank them again as well. > Okay, good. Bowie's response to this ques

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

stack? My understanding is that calling SA via Amavis, which does not need/use the spamd daemon, forces all Bayes data to be up-to-date on each call to spamassassin. That shouldn't be the case. SA and sa-learn both use a shared-access database; if you're training the database that SA is l

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

e. SA and sa-learn both use a shared-access database; if you're training the database that SA is learning, the results of training should be effective immediately. Okay, good. Bowie's response to this question differed (he suggested that Amavis would need to be restarted for Bayes to be upd

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

d. I wonder if feeding all of the messages that I "auto-learned manually" -- messages that were tagged as spam (but for reasons unrelated to Bayes) -- contributed significantly to this change. I did this late yesterday afternoon and when I took a status check this morning, I was seein

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 1/16/2013 9:49 AM, Ben Johnson wrote: > smtpd_recipient_restrictions = > reject_rbl_client bl.spamcop.net, spamcop has a reputation of being somewhat aggressive on blocking, and their website recommends using it in a scoring system (eg. SpamAssassin) rather than for outright blocking. Th

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

the Bayes scores seem to be much more accurate now, too. I was hardly ever seeing BAYES_99 before, but now almost all spam messages have BAYES_99. Is it possible that the training I've been doing over the last week or so wasn't *effective* until recently, say, after restarting some co

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

't change that. Is it possible that the training I've been doing over the last week or so wasn't *effective* until recently, say, after restarting some component of the mail stack? My understanding is that calling SA via Amavis, which does not need/use the spamd daemon, forces all Ba

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 1/16/2013 2:02 AM, Tom Hendrikx wrote: > On 1/15/13 5:26 PM, Ben Johnson wrote: > >> >> In postfix's main.cf: >> > >> >> Hmm, very interesting. No, I have no greylisting in place as yet, and >> no, my userbase doesn't demand immediate delivery. I will look into >> greylisting further. > > I

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

scores seemed to be the real problem anyway. That said, the Bayes scores seem to be much more accurate now, too. I was hardly ever seeing BAYES_99 before, but now almost all spam messages have BAYES_99. Is it possible that the training I've been doing over the last week or so wasn't *effective* unt

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 1/15/13 5:26 PM, Ben Johnson wrote: > > In postfix's main.cf: > > > Hmm, very interesting. No, I have no greylisting in place as yet, and > no, my userbase doesn't demand immediate delivery. I will look into > greylisting further. If you're running postfix, consider using postscreen. It's a

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 2013/01/15 17:23, John Hardin wrote: On Tue, 15 Jan 2013, jdow wrote: On 2013/01/15 08:26, Ben Johnson wrote: Based on my responses, what's the next move? Backup the Bayes DB, wipe it, and feed my corpus through the ol' chipper? (Sure to infuriate BUT - read the WHOLE note.) Are you

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On Tue, 15 Jan 2013, jdow wrote: On 2013/01/15 08:26, Ben Johnson wrote: Based on my responses, what's the next move? Backup the Bayes DB, wipe it, and feed my corpus through the ol' chipper? (Sure to infuriate BUT - read the WHOLE note.) Are you sure your Bayes database is well trained?

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 2013/01/15 08:26, Ben Johnson wrote: Based on my responses, what's the next move? Backup the Bayes DB, wipe it, and feed my corpus through the ol' chipper? (Sure to infuriate BUT - read the WHOLE note.) Are you sure your Bayes database is well trained? But let's change that to, "Is the Bay

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 2013/01/15 07:27, Ben Johnson wrote: On 1/14/2013 7:48 PM, Noel wrote: On 1/14/2013 2:59 PM, Ben Johnson wrote: jdow, Noel, and John, I can't thank you enough for your very thorough responses. Your time is valuable and I sincerely appreciate your willingness to help. Glad it was even mar

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

(Antispam + calling SA through Amavis [i.e. not using spamd]) because the results are effective immediately, which seems to be crucial for combating this snowshoe spam (performance and scalability aside). I don't find that procedure to be confusing, but people are different, I suppose. Hm.

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 1/15/2013 4:39 PM, Bowie Bailey wrote: > On 1/15/2013 4:27 PM, Ben Johnson wrote: >> On 1/15/2013 4:05 PM, Bowie Bailey wrote: >>> On 1/15/2013 3:47 PM, Ben Johnson wrote: One final question on this subject (sorry...). Is there value in training Bayes on messages that SA classif

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 1/15/2013 4:27 PM, Ben Johnson wrote: On 1/15/2013 4:05 PM, Bowie Bailey wrote: On 1/15/2013 3:47 PM, Ben Johnson wrote: One final question on this subject (sorry...). Is there value in training Bayes on messages that SA classified as spam *due to other test scores*? In other words, if a me

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 1/15/2013 4:05 PM, Bowie Bailey wrote: > On 1/15/2013 3:47 PM, Ben Johnson wrote: >> One final question on this subject (sorry...). >> >> Is there value in training Bayes on messages that SA classified as spam >> *due to other test scores*? In other words, if a message is classified >> as SPAM

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 1/15/2013 3:47 PM, Ben Johnson wrote: One final question on this subject (sorry...). Is there value in training Bayes on messages that SA classified as spam *due to other test scores*? In other words, if a message is classified as SPAM due to a block-list test, but the message is new enough f

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

One final question on this subject (sorry...). Is there value in training Bayes on messages that SA classified as spam *due to other test scores*? In other words, if a message is classified as SPAM due to a block-list test, but the message is new enough for Bayes to assign a zero score, should tha

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

age to an administrator >> rather than calling sa-learn on the message. > > That would be a very good idea if the number of users doing training is > small. At the very least, the messages should be captured to a permanent > corpus mailbox. Good idea! I'll see if I can set this

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

same user that the MTA is running SA as. Site-wide. And I have hard-coded the username in the SA configuration to prevent confusion in this regard: bayes_sql_override_username amavis What user does your MTA run SA as? What user do you train Bayes as? The MTA should pass scanning off to "

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

lected. but then, I don't > admin a Really Large Install, so YMMV. No, I was sure to disable autolearn after the last Bayes fiasco. :) > Do you use per-user or sitewide Bayes? If per-user, then you need to > make sure that you're training Bayes as the same user that the MTA is

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 1/14/2013 7:48 PM, Noel wrote: > On 1/14/2013 2:59 PM, Ben Johnson wrote: > >> I understand that snowshoe spam may not hit any net tests. I guess my >> confusion is around what, exactly, classifies spam as "snowshoe". > > Snowshoe spam - spreading a spam run across a large number of IPs so >

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

rn reports "Learned tokens from 0 message(s) (1 message(s) examined)". Does this mean that all tokens from these messages have already been learned, thereby making it pointless to continue feeding them to sa-learn? No, it means that Message-ID has been learned from before. Finally, I a

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 1/14/2013 2:59 PM, Ben Johnson wrote: > I understand that snowshoe spam may not hit any net tests. I guess my > confusion is around what, exactly, classifies spam as "snowshoe". Snowshoe spam - spreading a spam run across a large number of IPs so no single IP is sending a large volume. Typica

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

l tokens from these messages have already been learned, thereby making it pointless to continue feeding them to sa-learn? If I receive one more uncaught message about how some mom is angering doctors by doing something crazy to her face, I'm going to hunt-down the ****er and rip her face OFF

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

On 2013/01/14 10:24, Ben Johnson wrote: On 1/11/2013 4:27 PM, Ben Johnson wrote: I enabled Amavis's SA debugging mode on the server in question and was able to extract the debug output for two messages that seem like they should definitely be classified as spam. Message #1: http://pastebin.co

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

ntinue feeding them to sa-learn? If I receive one more uncaught message about how some mom is angering doctors by doing something crazy to her face, I'm going to hunt-down the er and rip her face OFF. Finally, I added the test you supplied to my SA configuration, restarted Amavis, and all messages appear to be tagged with RCVD_IN_HITALL=0.001. Thanks for all your help, -Ben

  1   2   3   >