Re: Further information on tweaking tips...

2009-04-13 Thread McDonald, Dan
On Sun, 2009-04-12 at 22:08 +0200, Karsten Bräckelmann wrote: > On Fri, 2009-04-10 at 13:29 -0500, McDonald, Dan wrote: > > X-Spam-Report: > > * 3.0 KB_RATWARE_MSGID Ratware Message-Id > > Ah, nice... :) Thanks. > > > The only custom rule that it hit was: > Actually, my RATWARE_MSGID rul

Re: Further information on tweaking tips...

2009-04-12 Thread Karsten Bräckelmann
On Fri, 2009-04-10 at 13:29 -0500, McDonald, Dan wrote: > X-Spam-Report: > * 2.0 RCVD_IN_BRBL_RELAY RBL: received via a relay rated as poor by > * Barracuda > * [121.58.201.246 listed in b.barracudacentral.org] > * 3.0 BARE_GEOCITIES URI: Body contains spammed

Re: Further information on tweaking tips...

2009-04-12 Thread Karsten Bräckelmann
On Sat, 2009-04-11 at 09:14 -0400, martes wrote: > Greetings Karsten. > > How can you tell that the header was mangled? > > I have not gotten that deep into email analysis yet, however, I don't > see what you mean. Your pastebin sample expired -- so here goes from memory. The Received headers,

Re: Further information on tweaking tips...

2009-04-12 Thread Karsten Bräckelmann
On Fri, 2009-04-10 at 23:29 -0400, martes wrote: > I have to admit that I am still fresh-newbie to SA administration, > however, the "integration" method is simply to pipe mail from citadel > to spamd, which happens to be on the same server, and then if the > filtration passes, then the mail gets p

Re: Further information on tweaking tips...

2009-04-11 Thread martes
Greetings Karsten. How can you tell that the header was mangled? I have not gotten that deep into email analysis yet, however, I don't see what you mean. I also have to "train" my bayesian filter, so that could be why some mail is slipping through. In response to some other inquiries, citadel

Re: Further information on tweaking tips...

2009-04-11 Thread martes
Greetings Karsten. How can you tell that the header was mangled? I have not gotten that deep into email analysis yet, however, I don't see what you mean. I also have to "train" my bayesian filter, so that could be why some mail is slipping through. In response to some other inquiries, citadel

Re: Further information on tweaking tips...

2009-04-10 Thread martes
Thanks for the responses. I have to admit that I am still fresh-newbie to SA administration, however, the "integration" method is simply to pipe mail from citadel to spamd, which happens to be on the same server, and then if the filtration passes, then the mail gets passed back to the email server

Re: Further information on tweaking tips...

2009-04-10 Thread Karsten Bräckelmann
On Fri, 2009-04-10 at 19:24 -0400, martes wrote: > There was a mention of evolution's junk plugin, however, I had to > disable that plugin and just rely on the server, since it would just > cause an infinite loop, whenever new mail was looked at, causing > Evloution to lock up. While the "loop" i

Re: Further information on tweaking tips...

2009-04-10 Thread martes
I will check on all of these things, however, I have to read some docs on the subject. I was just getting into this type of configuration when I got swamped with some other projects. I will have to research bayes configurations. I am reinstalling spamassassin to include some of the optional perl

Re: Further information on tweaking tips...

2009-04-10 Thread Martin Gregorie
On Fri, 2009-04-10 at 14:05 -0400, martes wrote: > Thanks for the tips guys. > > In response to the simpler of the two inquiries, after using the > syslog switch, I am only able to get the logs sent directly to > spamd.log, so the frequent archiving that syslogd does is not going to > be done for

Re: Further information on tweaking tips...

2009-04-10 Thread Karsten Bräckelmann
On Fri, 2009-04-10 at 11:20 -0700, John Hardin wrote: > On Fri, 10 Apr 2009, martes wrote: > > Here is a link to the listed message that passed through the filter. > > > > http://pastebin.com/d6fe63bd6 > > The headers in that spample don't say anything about SA at all. Did you > export the messa

Re: Further information on tweaking tips...

2009-04-10 Thread McDonald, Dan
On Fri, 2009-04-10 at 14:05 -0400, martes wrote: > Thanks for the tips guys. > > In response to the simpler of the two inquiries, after using the > syslog switch, I am only able to get the logs sent directly to > spamd.log, so the frequent archiving that syslogd does is not going to > be done for

Re: Further information on tweaking tips...

2009-04-10 Thread John Hardin
On Fri, 10 Apr 2009, martes wrote: Apr 10 10:00:07 dataserver1 spamd[94633]: spamd: result: . 2 - MSGID_FROM_MTA_HEADER,RCVD_IN_PBL,XMAILER_MIMEOLE_OL_4BF4C scantime=0.8,size=1219,user=(unknown),uid=1004,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=51745,mid=<01c9ba27$b4686080$f6c93.

Re: Further information on tweaking tips...

2009-04-10 Thread martes
Thanks for the tips guys. In response to the simpler of the two inquiries, after using the syslog switch, I am only able to get the logs sent directly to spamd.log, so the frequent archiving that syslogd does is not going to be done for this file. I guess this is good enough for now. However, I

Re: Further information on tweaking tips...

2009-04-10 Thread John Hardin
On Fri, 10 Apr 2009, martes wrote: I have been running spamassassin in default install mode for a few months now, and in the past week, I have been getting some miss-fires, I would have to assume, since I have been receiving obvious spam. Where should I start in troubleshooting this type of i

Re: Further information on tweaking tips...

2009-04-10 Thread Duane Hill
On Fri, 10 Apr 2009, martes wrote: I also want to know how to pipe the logs from spamd into /var/log/spamd.log. I have newsyslog.conf and syslog.conf set up to shoot those logs to that log file, however, nothing gets sent there. I guess everything is getting picked up by the maillog.info direct

Re: Further information on tweaking tips...

2009-04-10 Thread Martin Gregorie
On Fri, 2009-04-10 at 12:13 -0400, martes wrote: > Where should I start in troubleshooting this type of issue? > Are you getting rules updates? If not, that could have a bearing. Running sa_update as a daily or weekly cron job is pretty much a fire and forget solution. > I have not had the time

Re: Further information on tweaking tips...

2009-04-10 Thread Karsten Bräckelmann
On Fri, 2009-04-10 at 12:13 -0400, martes wrote: > I have been running spamassassin in default install mode for a few > months now, and in the past week, I have been getting some miss-fires, I > would have to assume, since I have been receiving obvious spam. By mis-fire you actually mean "not fi

Re: Further information on tweaking tips...

2009-04-10 Thread martes
Actually, I have just come across the -s options, etc... I think this is where I may be able derive the functionality that I need from the logging facilities. However, I would still like some input for the tweaking tips for correcting the current miss-fires that seem to be occuring, which are al

Further information on tweaking tips...

2009-04-10 Thread martes
Greetings list. I have been running spamassassin in default install mode for a few months now, and in the past week, I have been getting some miss-fires, I would have to assume, since I have been receiving obvious spam. Where should I start in troubleshooting this type of issue? I have not h