Re: Log ASN data via default syslog lines

Hi, Depending on how you deliver mail after SA has added headers, you might be able to use postfix header checks to log your header,using action INFO or WARN. Something along the likes of: main.cf: header_checks = pcre:/etc/postfix/header_checks header_checks: /^X-Spam-ASN:/ WARN See https

Re: Log reporting spamd[11912]: dns: [...] messages

On 2022-05-30 at 06:22:39 UTC-0400 (Mon, 30 May 2022 22:22:39 +1200) DL Neil is rumored to have said: On 30/05/2022 03.06, Bill Cole wrote: On 2022-05-28 at 19:25:46 UTC-0400 (Sun, 29 May 2022 11:25:46 +1200) DL Neil is rumored to have said: No, he said it. SpamAssassin x86_64 3.4.0 Cent

Re: Log reporting spamd[11912]: dns: [...] messages

On 30/05/2022 03.06, Bill Cole wrote: > On 2022-05-28 at 19:25:46 UTC-0400 (Sun, 29 May 2022 11:25:46 +1200) > DL Neil > is rumored to have said: No, he said it. >> SpamAssassin x86_64 3.4.0 CentOS 6.el7 release >> Postfix 2.10.1 >> unbound 1.6.6 > > Obsolete antiques all... May be so, but so

Re: Log reporting spamd[11912]: dns: [...] messages

On 2022-05-28 at 19:25:46 UTC-0400 (Sun, 29 May 2022 11:25:46 +1200) DL Neil is rumored to have said: SpamAssassin x86_64 3.4.0 CentOS 6.el7 release Postfix 2.10.1 unbound 1.6.6 Obsolete antiques all... Expanded defences to include dnswl. Recommendation to install local dns caching server f

Re: Log reporting spamd[11912]: dns: [...] messages

On 2022-05-29 01:25, DL Neil wrote: SpamAssassin x86_64 3.4.0 CentOS 6.el7 release Postfix 2.10.1 unbound 1.6.6 upgrade centos and check you dont added -D or --debug into spamd options more help show spamd options

Re: Log reporting spamd[11912]: dns: [...] messages

DL Neil: > SpamAssassin x86_64 3.4.0 CentOS 6.el7 release > Postfix 2.10.1 > unbound 1.6.6 This does not answer your question, but I noticed that the versions you gave are all ~5–8 years old. Often enough such problems disappear after upgrading to a current version.

Re: log sender IP

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Just as a note to everyone who will stumble upon similair problems. The easiest way I know of to print certain fields in the mailheaders to the logs is to use header_checks in postfix to print out the matching field to the syslog which later on can be

Re: log sender IP

On Thu, May 17, 2012 at 4:35 PM, Chris Hunt wrote: > I'm hoping to track scores by sender IP.  Do any gurus know how I can > get the original sender's IP address into this log line? > > May 17 04:08:19 mail01 spamd[20409]: spamd: result: . 2 - > AWL,BAYES_50,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HT

Re: log sender IP

On Thu, 17 May 2012, Brent Gardner wrote: I'm hoping to track scores by sender IP. Do any gurus know how I can get the original sender's IP address into this log line? Can you get what you need from Postfix logs? I use sendmail, and spamassassin/amavis as milter, and I run all sort of sta

Re: log sender IP

On Thu, 17 May 2012, Chris Hunt wrote: I'm hoping to track scores by sender IP. Do any gurus know how I can get the original sender's IP address into this log line? May 17 04:08:19 mail01 spamd[20409]: spamd: result: . 2 - AWL,BAYES_50,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_02,

Re: log sender IP

On 05/17/2012 04:35 PM, Chris Hunt wrote: I'm hoping to track scores by sender IP. Do any gurus know how I can get the original sender's IP address into this log line? May 17 04:08:19 mail01 spamd[20409]: spamd: result: . 2 - AWL,BAYES_50,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_02

Re: log scans

On 5/31/2011 6:20 AM, Mihamina Rakotomandimby wrote: >> On Tue, 31 May 2011 13:11:17 +0300 >> Mihamina Rakotomandimby wrote: >> Hi all, >> >> I am runnin Postfix + Amavis + Spamassassin on Debian Squeeze >> >> Postfix throws messages to Amavis, >> Amavis is supposed to submit messages to Spamassas

Re: log scans

> On Tue, 31 May 2011 15:21:18 +0200 > Benny Pedersen wrote: > remove amavis > install amavisd-new already the "new" one. mihamina@hostname:~$ dpkg -l | grep amavis ii amavisd-new1:2.6.4-3 Thanks ;-) -- RMA.

Re: log scans

On Tue, 31 May 2011 13:11:17 +0300, Mihamina Rakotomandimby wrote: > I am runnin Postfix + Amavis + Spamassassin on Debian Squeeze > How to? remove amavis install amavisd-new stop spamd there is no step 4 :)

Re: log scans

> On Tue, 31 May 2011 13:18:55 +0300 > Jari Fredriksson wrote: > You don't need spamd with amavis, it is not using it. It is directly > linked to SpamAssassin library, and loads it itself. OK. I also found this: http://www.sapphirepaw.org/blog/index.php?/archives/331-Tips-for-amavisd-new-and-Spa

Re: log scans

> On Tue, 31 May 2011 13:11:17 +0300 > Mihamina Rakotomandimby wrote: > > Hi all, > > I am runnin Postfix + Amavis + Spamassassin on Debian Squeeze > > Postfix throws messages to Amavis, > Amavis is supposed to submit messages to Spamassassin. > "spamd" is running on localhost:783 > I dont se

Re: log scans

31.5.2011 13:11, Mihamina Rakotomandimby kirjoitti: > > Hi all, > > I am runnin Postfix + Amavis + Spamassassin on Debian Squeeze > > Postfix throws messages to Amavis, > Amavis is supposed to submit messages to Spamassassin. > > "spamd" is running on localhost:783 > > I dont see any Amavis co

Re: Log

On Sat, Dec 06, 2008 at 01:50:20PM +0100, Jon Essen-Moller wrote: > So you look in the /var/log/maillog (maybe with grep) and find messages > and their id you are interested in. I get you that far. :) > Are there a log somewhere where one can find information like the last > log entry you paste

Re: Log

Hi, Thanks again for your answer and sorry for the HTML ;-| So you look in the /var/log/maillog (maybe with grep) and find messages and their id you are interested in. I get you that far. Are there a log somewhere where one can find information like the last log entry you pasted below? Bes

Re: Log

Hi, Thanks for quick answer! I wish to check a specific mail address and see if many mails are classified as spam that are sent to that address. /jon Tenka AB Jon Essen-Moller Djurgardsbrunnsvagen 54 115 25 Stockholm Sweden Direct +46 (0)70 779 33 03 Office +46 (0)8 32 25 06 Fax +46 (0)8 55

Re: Log

On Fri, Dec 05, 2008 at 12:53:20AM +0100, Jon Essen-Moller wrote: the mail was in HTML, so it's basically unreadable. text please. I did get out of it: "I wish to check a specific mail address and see if many mails are classified as spam that are sent to that address." It sounds like you want

Re: Log

On Thu, Dec 04, 2008 at 10:52:18PM +0100, Jon wrote: > Does anyone know if it is possible to retrieve information from any of > theses files below about mails that are classified as spam? > > Or in general. I there a way to view statistics from spammassassin? > > bayes_seen > bayes_toks What

Re: Log Mail Caught As Spam

Panagiotis Christias wrote: > >> >> Thanks for your answer, and yes, spam word is everywhere in that email, I >> forgot to say that I already did an sa-learn -ham on this email. What >> else >> can I do ? > > Hello, > > you have probably not setup correctly whitelist_from_rcvd. Whitelist > ent

Re: Log Mail Caught As Spam

On 11/21/06, itdelany <[EMAIL PROTECTED]> wrote: Panagiotis Christias wrote: > >> >> Thanks for your answer, and yes, spam word is everywhere in that email, I >> forgot to say that I already did an sa-learn -ham on this email. What >> else >> can I do ? > > Hello, > > you have probably not setu

Re: Log Mail Caught As Spam

On 11/20/06, itdelany <[EMAIL PROTECTED]> wrote: François Rousseau wrote: > > In your log, do you have any things like top 10 spammer, 10 top spam > ... > or something like this? > > URIBL_AB_SURBL=3.812, URIBL_PH_SURBL=2.8, URIBL_SC_SURBL=4.498, >URIBL_WS_SURBL=2.14] > > those tag

Re: Log Mail Caught As Spam

jdow wrote: > > > Did you run "sa-learn" as the same user that is active when the email > is being scanned coming in? > Yes, the same user. jdow wrote: > > You do not give enough headers to diagnose the problem. WHAT spam > rules hit, for example? That email may be going down in flames for

Re: Log Mail Caught As Spam

From: "itdelany" <[EMAIL PROTECTED]> Hi :) I successfully run spamassassin with bayes filter on my site and is working really really fine. But, this morning i noticed that an email i receive everyday from my server (It's from LogWatch application, it sends detailed log information from past ev

Re: Log Mail Caught As Spam

Magnus Holmgren wrote: > > A better approach however would be to skip running those messages through > SA > at all, or to whitelist the sender address (read about whitelist_from_rcvd > in > Mail::SpamAssassin::Conf(3pm) manual page. Also, is the server in > trusted_networks? > The server th

Re: Log Mail Caught As Spam

On Monday 06 November 2006 13:59, itdelany took the opportunity to say: > I successfully run spamassassin with bayes filter on my site and is working > really really fine. But, this morning i noticed that an email i receive > everyday from my server (It's from LogWatch application, it sends detaile

Re: LOG: Re: Drink it, forget it ! .... bug in _check_date_diff

I personally am probably not interested in mail from people who don't know how to set their system's time but you could implement it using a threshold. To me that's a lot better than assuming an n hour difference b/w Received and Date: etc which the sender can easily forge. Unless the Recei

Re: LOG: Re: Drink it, forget it ! .... bug in _check_date_diff

Robert Nicholson wrote: If you converted all times to GMT and compared them against now and if they were > now how often would that be FPing? I suppose that the spam hit rate would go up a little for the DATE_IN_FUTURE_* rules, while the ham hit rate (caused by the thousands of people who don

Re: LOG: Re: Drink it, forget it ! .... bug in _check_date_diff

If you converted all times to GMT and compared them against now and if they were > now how often would that be FPing?On Sep 10, 2006, at 2:21 PM, Daryl C. W. O'Shea wrote:    Accepting to folder lists/unix/spamassassin-usersFrom: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]>Date: September 10, 2006 2:21

OT: Webmail (was Re: LOG: Re: Marking Mail in the future as SPAM?)

jdow wrote: Take to heart my comment about web mail clients. At today's prices for bits on disks IMAO Web Mail clients are not worth the price of their storage for the executable file. Even Outlook Express, which I use, is faster and sorts by either received date or sent date apparently with cor

Re: LOG: Re: Marking Mail in the future as SPAM?

Take to heart my comment about web mail clients. At today's prices for bits on disks IMAO Web Mail clients are not worth the price of their storage for the executable file. Even Outlook Express, which I use, is faster and sorts by either received date or sent date apparently with correct regard f

Re: LOG: Re: Marking Mail in the future as SPAM?

I've used Horde/IMP for ever but is there a commonly regarded better quality web based IMAP client then?On Sep 8, 2006, at 5:50 PM, jdow wrote:    Accepting to folder lists/unix/spamassassin-usersFrom: "jdow" <[EMAIL PROTECTED]>Date: September 8, 2006 5:50:36 PM CDTTo:

Re: LOG: Re: Report

Do I have to specifically enable that plugin? I have that installed.On Aug 13, 2006, at 3:22 PM, Michele Neylon :: Blacknight.ie wrote:    Accepting to folder lists/unix/spamassassin-usersFrom: "Michele Neylon :: Blacknight.ie" <[EMAIL PROTECTED]>Date: August 13, 2006 3:22:04 PM CDTTo: Robert Nicho

RE: log analyser for SA v3?

> > I've tried using: > * sa-stats 1.3 by Brad Rathbun (get zeroed stats when i run it) > * sa-stats 0.5 by Dallas Engelken (this actually claims to > work with SA v3, but i cant actually work out how to use it > coz cant find docs and cant get a usage statement) Well I know mine works with 3.0