RE: Custom rules regex help

On Thu, 15 Oct 2015, emailitis.com wrote: I have created 2 rules because almost everything from zcsend is Spam. Rules are: # zcsend Spam header CGK_ZCSEND_1 All =~ /\@zcsend\.net/ score CGK_ZCSEND_1 2.5 ...etc. Did you miss the earlier replies to this question? Read the list archives for t

Re: Custom rules regex help

On 10/15/2015 11:01 AM, emailitis.com wrote: I have created 2 rules because almost everything from zcsend is Spam. Rules are: # zcsend Spam header CGK_ZCSEND_1 All =~ /\@zcsend\.net/ score CGK_ZCSEND_1 2.5 # zcsend Spam header CGK_ZCSEND_2 From =~ /\@zcsend\.net/ score CGK_ZCSEND_2 2.5 a

RE: Custom rules regex help

I have created 2 rules because almost everything from zcsend is Spam. Rules are: # zcsend Spam header CGK_ZCSEND_1 All =~ /\@zcsend\.net/ score CGK_ZCSEND_1 2.5 # zcsend Spam header CGK_ZCSEND_2 From =~ /\@zcsend\.net/ score CGK_ZCSEND_2 2.5 and extract from maillog is: /roo

Re: Custom rules regex help

On Mon, 12 Oct 2015, Bill Cole wrote: Your "All" rule will only match a header named "All" which is unlikely to exist. If you want it to match against all headers, you MUST use 'ALL' rather than 'All' or 'all' or any other capitalization pattern. Ugh, I missed that nuance... -- John Hardin

Re: Custom rules regex help

On 12 Oct 2015, at 14:01, Bill Cole wrote: Your "All" rule will only match a header named "All" which is unlikely to exist. Clarifying: it would match a header named with any capitalization pattern of "All" because individual header names are matched case-insensitively, but it won't match t

Re: Custom rules regex help

On 12 Oct 2015, at 12:41, emailitis.com wrote: Can a regex expert help me identify why that did not trigger one of the CGK_ZCSEND_x rules? Not without seeing the headers of the message in question *as they are seen by SA*. However, I can offer a few generic tips: Header rules match against

Re: Custom rules regex help

On Mon, 12 Oct 2015, emailitis.com wrote: I have created 2 rules because almost everything from zcsend is Spam. Rules are: # zcsend Spam header CGK_ZCSEND_1 All =~ /\@zcsend\.net/ score CGK_ZCSEND_1 2.5 # zcsend Spam header CGK_ZCSEND_2 From =~ /\@zcsend\.net/ score CGK_ZCSEND_2 2.5 You're

Re: custom rules header check please

On 11/8/2013 6:59 AM, emailitis.com wrote: Thank you and Benny for your help. I put those in place and all looks well. We had one captured this morning but wondered if you can explain in the log below which seems as if it has been deleted, yet then allowed: Nov 8 10:05:04 plesk3 spamd[119

RE: custom rules header check please

origin_rdns: mail.domain.com auth: (unknown) encryption: (none) reason: 250_ok_1383905104_qp_18522 Kind Regards, Christoph From: Bowie Bailey [mailto:bowie_bai...@buc.com] Sent: 07 November 2013 15:50 To: users@spamassassin.apache.org Subject: Re: custom rules header check please On 11

Re: custom rules header check please

emailitis.com skrev den 2013-11-07 16:40: header AEXP_ALL ALL =~ /aexp.com/i header EXVM_ALL ALL =~ /exvm.com/i why not blacklist_from ? blacklist_from *@aexp.com blacklist_from *@exvm.com olso remember . needs excapeing \. in header but not as blacklist_from :) does your real name contain

Re: custom rules header check please

On 11/7/2013 10:40 AM, emailitis.com wrote: I am getting lots of Spam which shows on the maillog as: Nov 7 10:50:39 plesk3 qmail-scanner-queue.pl: qmail-scanner[6974]: Clear:RC:0(217.92.121.114):SA:1(5.9/5.0): 9.209114 16127 fr...@aexp.com Or Nov 7 10:15:36 plesk3

Re: [sa] Re: Custom rules - escape characters

On Fri, 7 May 2010, Daniel Lemke wrote: Am I seeing ghosts or is this the third time you asked the same question on this list? Your first mail was already replied so I suggest you have a look there to get your answers. Daniel Oh, good, it's not my mail server acting up again! (smile) To OP: S

Re: Custom rules - escape characters

C.M. Burns wrote: > > Hm, I have not received any mails related to my post and even more have > received errors from the listserver with request to "try again later" > while sending my message. > I will try to find any related posts in the archives. > sorry if I annoyed anyone. > > SK > >

Re: Custom rules - escape characters

> C.M. Burns wrote: > >> Hi list, >> >> when creating acustom rule, what characters have to be escaped? >> >> For example this scustom rule >> http://www.novell.com/communities/node/4630/whitelisting-ip-address-spamassassin >> escapes both [ and ] while in common regex on only [ must be escap

Re: Custom rules - escape characters

C.M. Burns wrote: > > Hi list, > > when creating acustom rule, what characters have to be escaped? > > For example this scustom rule > http://www.novell.com/communities/node/4630/whitelisting-ip-address-spamassassin > escapes both [ and ] while in common regex on only [ must be escaped > http:

Re: custom rules - escape which characters?

Hi, On Thu, May 06, 2010 at 08:48:35AM +0200, C.M. Burns wrote: > > when creating a custom rule, what characters have to be escaped? every character with special meaning in perl regular expressions and in the place it's used. In example it's a big difference if ] is used in a character class

RE: Custom Rules Question SOLVED(ish)

The problem was multiline rules with rawbody. Changing it to full and things work. (I missed that little detail in the wiki, and there are body rules in the dist that have /is) A rule in-between rawbody/full? I.e. the whole body, but not the headers? Or even better, in addition to that, p

Re: Custom Rules Question

Because your first option matches the style inside the brackets and your second option does take into account the forward slash before style? Todd Michael Dilworth wrote: OK, it's late and I'm tired, and this will probably end up being stupid regex issue, but: why does... rawbody STYLE_IN_B

Re: Custom Rules Question

On Sat, 27 Feb 2010, Michael Dilworth wrote: garbage... If you're looking for nonsense STYLE content, take a look in my sandbox. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79

Re: Custom Rules Question

Michael Dilworth wrote on Sat, 27 Feb 2010 18:45:20 -0800: > rawbody STYLE_IN_BODY /\.*\/si not match? because the HTML doesn't contain "

Re: Custom rules

Fabrizio Regalli wrote: Hi Jonathan, nice to hear this. I'm using amavisd-new also. My local.cf is owned by root, but readable from world -rw-r--r-- 1 root root 1304 Dec 1 19:00 local.cf Do you think this is the problem? 2008/12/1 Jonathan Scott

Re: Custom rules

It works! I sent a mail with www.viapaypal.com in the body: *X-Spam-Flag:* YES *X-Spam-Score:* 13.178 *X-Spam-Level:* * *X-Spam-Status:* Yes, score=13.178 tagged_above=undef required=6.31 tests=[BAYES_50=0.001, DKIM_SIGNED=0.001, HTML_MESSAGE=0.001, LOCAL_URI_VIAPAYPAL=5, RA

Re: Custom rules

On Mon, Dec 01, 2008 at 10:37:36PM +0100, Fabrizio Regalli wrote: > >> uri LOCAL_URI_VIAPAYPAL /www\.viapaypal\.com\// > >> score LOCAL_URI_VIAPAYPAL 5.0 > >> (for add five points to e-mail contains www.viapaypal.com < > >> http://www.viapaypal.com/> into body) > >> I've add it to /

Re: Custom rules

Hi Jonathan, nice to hear this. I'm using amavisd-new also. My local.cf is owned by root, but readable from world -rw-r--r-- 1 root root 1304 Dec 1 19:00 local.cf Do you think this is the problem? 2008/12/1 Jonathan Scott <[EMAIL PROTECTED]> > Fabrizio Regalli wrote: > >> Hello. >> I'm w

Re: Custom rules

No, it gives me nothing. :~# spamassassin --lint :~# 2008/12/1 Joe Vieira <[EMAIL PROTECTED]> > does spamassassin --lint give you any errors? > > Joe > > Fabrizio Regalli wrote: > >> Hello. >> I'm writing my custom rule >> uri LOCAL_URI_VIAPAYPAL /www\.viapaypal\.com\// >> score LOCAL_

Re: Custom rules

Fabrizio Regalli wrote: Hello. I'm writing my custom rule uri LOCAL_URI_VIAPAYPAL /www\.viapaypal\.com\// score LOCAL_URI_VIAPAYPAL 5.0 (for add five points to e-mail contains www.viapaypal.com into body) I've add it to /etc/mail/spamassassin/local.

Re: Custom rules

does spamassassin --lint give you any errors? Joe Fabrizio Regalli wrote: Hello. I'm writing my custom rule uri LOCAL_URI_VIAPAYPAL /www\.viapaypal\.com\// score LOCAL_URI_VIAPAYPAL 5.0 (for add five points to e-mail contains www.viapaypal.com into

Re: Custom rules working, but not sa-updates

I appreciate that you would like to see it working right, Daryl. To that, I'd add, "me, too." But, like I said, I had to move on, and I hope to get back to it soon. And, by the way, I played with setting the update paths to all kinds of places, and all kinds of permissions, too. ;-) I'm sure

Re: Custom rules working, but not sa-updates

Andy Norris wrote: No, it was not a permissions issue. I'll get back to working on it soon, but, yes there were newer versions than what I was seeing on my server. There are so many posts about sa-update not working. I'm sure sa-update works, for some folks, but it wasn't for me, and I had to

Re: Custom rules working, but not sa-updates

No, it was not a permissions issue. I'll get back to working on it soon, but, yes there were newer versions than what I was seeing on my server. There are so many posts about sa-update not working. I'm sure sa-update works, for some folks, but it wasn't for me, and I had to quit spending time

Re: Custom rules working, but not sa-updates

Daniel J McDonald wrote: On Tue, 2007-10-30 at 08:35 -0500, Andy Norris wrote: So a down and dirty approach I took was writing a crop job that removes that directory just before running sa-update. So, you delete it every time, even when there are no updates? And since updates occur about

Re: Custom rules working, but not sa-updates

On Tue, 2007-10-30 at 08:35 -0500, Andy Norris wrote: > Hi, > > I don't know if this is relevant for you or not, but on our mail > server I could not get sa-update to work, either. I noticed that if > the directory was not there, however, it would work. Sounds like a permissions issue. >

RE: Custom rules working, but not sa-updates

inal Message- > From: Rob Starr [mailto:[EMAIL PROTECTED] > Sent: 30 October 2007 13:30 > To: users@spamassassin.apache.org > Subject: RE: Custom rules working, but not sa-updates > > > Boy, that's a handy command. I'll have to write that one down. > > I&

RE: Custom rules working, but not sa-updates

Thanks Andy, I have verified that sa-update is running and the rules folder is getting populated with lots of files. -Original Message- From: Andy Norris [mailto:[EMAIL PROTECTED] Sent: October-30-07 9:35 AM To: Randal, Phil Cc: Rob Starr; Subject: Re: Custom rules working, but not sa

Re: Custom rules working, but not sa-updates

ug --debug-sa output say it is using? Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK -Original Message- From: Rob Starr [mailto:[EMAIL PROTECTED] Sent: 30 October 2007 12:29 To: users@spamassassin.apache.org Subject: RE: Custom rules working, but not sa

RE: Custom rules working, but not sa-updates

g? > > Cheers, > > Phil > -- > Phil Randal > Network Engineer > Herefordshire Council > Hereford, UK > >> -Original Message- >> From: Rob Starr [mailto:[EMAIL PROTECTED] >> Sent: 30 October 2007 12:29 >> To: users@spamassassin.apach

RE: Custom rules working, but not sa-updates

t; To: users@spamassassin.apache.org > Subject: RE: Custom rules working, but not sa-updates > > > Thanks for your response Phil, > > In an attempt to resolve the issue, I'm now using MailScanner > 4.64.3 and > have started from a fresh config file, so my "Spam

RE: Custom rules working, but not sa-updates

re Council > Hereford, UK > >> -Original Message- >> From: Rob Starr [mailto:[EMAIL PROTECTED] >> Sent: 30 October 2007 11:54 >> To: users@spamassassin.apache.org >> Subject: Re: Custom rules working, but not sa-updates >> >> >> I

RE: Custom rules working, but not sa-updates

Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Rob Starr [mailto:[EMAIL PROTECTED] > Sent: 30 October 2007 11:54 > To: users@spamassassin.apache.org > Subject: Re: Custom rules working, but not sa-updates > > > I should

Re: Custom rules working, but not sa-updates

I should also mention that SA 3.1.3 was working flawlessly until the update to 3.2.3. I've used the newer config files and been through most of the options, but still no luck. Rob Starr wrote: > > Hi, > > I'm using Postfix + MailScanner + MailWatch + SpamAssassin 3.2.3. > > My problem is

Re: Custom Rules

Diego Pomatta wrote: > I'm new to custom rules. I've written my first one, and I was > wondering if one of the list gurus could tell me if it's correct. > Specially the regex part. Not sure since I don't know jack about Perl > regex. :) Very useful site: http://www.regular-expressions.info/ > W

Re: custom rules within user_prefs

Thanks, Matt and Loren for your responses. Since I'm hosting with a shared hosting environment company myself, I was asking those questions more on a hunt for information so I could suggest to my provider to allow it. But I definitely get Loren's warning about having performance issues if pars

Re: custom rules within user_prefs

While I agree completely with Matt that user rules are in general pretty safe, there is one more thing to be aware of. A badly-written regex can end up being a DOS attack on SA itself, and by implication on the system and mail processing path. Something with lots of * lengths and backtracking

Re: custom rules within user_prefs

ian douglas wrote: > > "Note: if you use spamd, rules placed in user_prefs will be IGNORED by > default. If you add the allow_user_rules option to your local.cf you > can get spamd to honor them. However, before you enable it, you should > know that this is disabled by default for security reasons.

Re: Custom rules

On Wed, Jan 31, 2007 at 02:30:12PM +, Dan Massey wrote: > This obviously does not work in its current format, is there a 'continuation > line' character I can use? No, rules have to be on one line. -- Randomly Selected Tagline: "It's not a huge rocket science thing, but it is a little bit fu

Re: Custom Rules

Jaysen Johnson wrote: > Date in the mail header more than 10 minutes out of sync - 1 point > Date in the mail header more than 30 mintues out of sync- 2 points Out of sync with what? There's nothing meaningful to compare the dates to that can show you that they are 10 or 30 minutes ot

Re: Custom Rules

On Sun, 3 Dec 2006, Jaysen Johnson wrote: > I have been asked by my boss to setup SpamAssassin on the > corporate email server with the following rules. > Date in the mail header more than 10 minutes out of sync - 1 point > Date in the mail header more than 30 mintues out of sync - 2 points You

Re: Custom Rules

Jaysen Johnson wrote: Hello, I have been asked by my boss to setup SpamAssassin on the corporate email server with the following rules. A single header should record the cumulative scores for the following: SPF record not available or not accurate for the sending server- 2 points No. Th

Re: Custom Rules

On Sun, Dec 03, 2006 at 01:16:40PM -0800, Jaysen Johnson wrote: > SPF record not available or not accurate for the sending server- 2 points Check out the current SPF rules. Not available may need some plugin changes. > Date in the mail header more than 10 minutes out of sync - 1 point > D

Re: Custom Rules

[EMAIL PROTECTED] wrote: > Matt Kettler wrote: > >>/\b800\s{1,3}E.?\s{1,3}Vermont\b/i > > > Or this: > /\b800\s{1,3}E\.?\s{1,3}Vermont\b/i > > (Sorry to nitpick) > By all means, do nitpick. Missing the \ in front of the . after E was a mistake on my part..

RE: Custom Rules

Matt Kettler wrote: > /\b800\s{1,3}E.?\s{1,3}Vermont\b/i Or this: /\b800\s{1,3}E\.?\s{1,3}Vermont\b/i (Sorry to nitpick) -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer AIM/Yahoo: mvaneerde MSN: [EMAIL PROTECT

Re: Custom Rules

John D. Maag wrote: > OK, one last question. I am getting email with this header: > > From: "Connie Trivitt" <[EMAIL PROTECTED]> Add to Address Book > To: "John D Maag" <[EMAIL PROTECTED]> > Subject: 800 E Vermont #25101 has a 4.88% fixed rate option. > Date: Thu, 28 Jul 2005 11:50:27 -0400

RE: Custom Rules

The problem lies with the \b sequence. That matches a word _boundary_ but it does not match white space between words. For that you can use \s (matches a single space, tab, CR, LF or form feed) or \s+ (matches one or more spaces). Or you can just use a space in your pattern, since that addres

RE: Custom rules not hitting

Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Thursday, April 28, 2005 12:09 PM To: Johnson, S Cc: users@spamassassin.apache.org Subject: Re: Custom rules not hitting Johnson, S wrote: > Hello, > > I'm on SA version 3.0.2 > > Even to test, I set the score to 1

Re: Custom rules not hitting

Johnson, S wrote: > Hello, > > I’m on SA version 3.0.2 > > Even to test, I set the score to 10 and sent a message with just > “penis size” in it and it was completely missed. > > All of the default rules are working fine. > > Can anyone see any issues with that rule or point me in a direction of >

RE: Custom rules not hitting

Did you restart spamd or whatever is running spamassassin for your mta?   Are you sure the MTA is picking up its local.cf from the same folder in which you created your rule files? From: Johnson, S [mailto:[EMAIL PROTECTED] Sent: Thursday, April 28, 2005 9:45 AMTo: users@spamassassin.apache.or

Re: custom rules

Andy Hester wrote: Hello all, I’m setting up a new spam gateway with amvisd-new and spamassassin. Where do I need to put custom rules/scoring in order to be used correctly. I would like to use for example rules from sare and weight it so that some things such as the adult rules wil

Re: Custom rules in SA 3.x

> I now use SA 2.64 with lots of custom rules, most of them from SARE. > I've read in a post here (can't find the posting) that in SA 3.x some of > the custom rules are included. Whcih rules are included and which should > I continue using i SA 3.x? The simple answer is look at the SARE rules page

RE: Custom rules in SA 3.x

> -Original Message- > From: Kim Leandersson [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 15, 2004 11:36 AM > To: users@spamassassin.apache.org > Subject: Custom rules in SA 3.x > > > I now use SA 2.64 with lots of custom rules, most of them from SARE. > I've read in a post here

Re: Custom Rules

Thanks to everyone who replied. I figured SURBL had a lot to do with the less frequent updates. I was also looking for more of the "inside dirt" kind of stuff, like the Ninja meltdowns. ;-) >>> "Loren Wilton" <[EMAIL PROTECTED]> 12/13 8:25 PM >>> > Is it me, or have the updates to the SARE "cust

Re: Custom Rules

> Is it me, or have the updates to the SARE "custom rules" and "other > rules" pages seem to be a lot less frequent than they used to be? Yup. > Does > anyone know why? Yup. Loren Oh, you want to *know* why? :-) Several reasons. 1.The rules we ahve now are working pretty darn w

RE: Custom Rules

>-Original Message- >From: Joe Zitnik [mailto:[EMAIL PROTECTED] >Sent: Monday, December 13, 2004 1:32 PM >To: users@spamassassin.apache.org >Subject: Custom Rules > > >Is it me, or have the updates to the SARE "custom rules" and "other >rules" pages seem to be a lot less frequent than the