Re: Missed spam, suggestions?

2016-03-15 Thread John Hardin
On Fri, 11 Mar 2016, Robert Chalmers wrote: Found a copy here … http://www.impsec.org/~jhardin/antispam/sa-stats.pl Note that I also host a version that works with gzipped log files, if you have compression enabled in your log rotator. But that's not the latest. I don't know where the v1.03

Re: sa-stats log analyzer (RE: Missed spam, suggestions?)

2016-03-13 Thread rob...@chalmers.com.au
;> I would like to know how to get these stats too. >> >> From: Robert Chalmers [mailto:rob...@chalmers.com.au] >> Sent: Tuesday, March 08, 2016 5:25 AM >> To: users@spamassassin.apache.org >> Subject: Re: Missed spam, suggestions? >> >> Can I ask, how a

Re: Missed spam, suggestions?

2016-03-11 Thread Robert Chalmers
( 0%) 0 ( 0%) >>> 2016-03-11 17 0 ( 0%) 0 ( 0%) >>> 2016-03-11 18 0 ( 0%) 0 ( 0%) >>> 2016-03-11 19 0 ( 0%) 0 ( 0%) >>> 2016-03-11 20 0 ( 0%) 0 ( 0%) >>&

Re: Missed spam, suggestions?

2016-03-11 Thread Robert Chalmers
0%) 0 ( 0%) >> 2016-03-11 20 0 ( 0%) 0 ( 0%) >> 2016-03-11 21 0 ( 0%) 0 ( 0%) >> 2016-03-11 22 0 ( 0%) 0 ( 0%) >> 2016-03-11 23 0 ( 0%) 0 ( 0%) >> Done. Report generate

Re: Missed spam, suggestions?

2016-03-11 Thread Robert Chalmers
0 ( 0%) 0 ( 0%) >> 2016-03-11 20 0 ( 0%) 0 ( 0%) >> 2016-03-11 21 0 ( 0%) 0 ( 0%) >> 2016-03-11 22 0 ( 0%) 0 ( 0%) >> 2016-03-11 23 0 ( 0%) 0 ( 0%) >> Done. Report

Re: Missed spam, suggestions?

2016-03-11 Thread Dave Funk
how to get these stats too. From: Robert Chalmers [mailto:rob...@chalmers.com.au] Sent: Tuesday, March 08, 2016 5:25 AM To: users@spamassassin.apache.org Subject: Re: Missed spam, suggestions? Can I ask, how are you getting these stats please? Thanks On 8 Mar 2016, at 05:11, David B Funk w

Re: Missed spam, suggestions?

2016-03-11 Thread Robert Chalmers
u] > Sent: Tuesday, March 08, 2016 5:25 AM > To: users@spamassassin.apache.org > Subject: Re: Missed spam, suggestions? > > Can I ask, how are you getting these stats please? > > Thanks > On 8 Mar 2016, at 05:11, David B Funk <mailto:dbf...@engineering.uiowa.edu

Re: Missed spam, suggestions?

2016-03-11 Thread Robert Chalmers
rote: > > I would like to know how to get these stats too. > > From: Robert Chalmers [mailto:rob...@chalmers.com.au] > Sent: Tuesday, March 08, 2016 5:25 AM > To: users@spamassassin.apache.org > Subject: Re: Missed spam, suggestions? > > Can I ask, how are you gettin

Re: Missed spam, suggestions?

2016-03-10 Thread Robert Chalmers
ers [mailto:rob...@chalmers.com.au] > Sent: Tuesday, March 08, 2016 5:25 AM > To: users@spamassassin.apache.org > Subject: Re: Missed spam, suggestions? > > Can I ask, how are you getting these stats please? > > Thanks > On 8 Mar 2016, at 05:11, David B Funk <mailto:dbf...@engi

sa-stats log analyzer (RE: Missed spam, suggestions?)

2016-03-10 Thread David B Funk
to know how to get these stats too.   From: Robert Chalmers [mailto:rob...@chalmers.com.au] Sent: Tuesday, March 08, 2016 5:25 AM To: users@spamassassin.apache.org Subject: Re: Missed spam, suggestions?   Can I ask, how are you getting these stats please?   Thanks On 8 Mar 2016, at 05:11

RE: Missed spam, suggestions?

2016-03-10 Thread Erickarlo Porro
I would like to know how to get these stats too. From: Robert Chalmers [mailto:rob...@chalmers.com.au] Sent: Tuesday, March 08, 2016 5:25 AM To: users@spamassassin.apache.org Subject: Re: Missed spam, suggestions? Can I ask, how are you getting these stats please? Thanks On 8 Mar 2016, at 05:11

Re: Missed spam, suggestions?

2016-03-08 Thread David B Funk
On Tue, 8 Mar 2016, Matus UHLAR - fantomas wrote: On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: how can these two stats be different? On 08.03.16 10:19, @lbutlr wrote: Because one is for SPAM and one is for HAM. On Mar 8, 2016, at 10:41 AM, Matus UHLAR - fantomas wrote: Wh

Re: Missed spam, suggestions?

2016-03-08 Thread Matus UHLAR - fantomas
On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: how can these two stats be different? On 08.03.16 10:19, @lbutlr wrote: Because one is for SPAM and one is for HAM. On Mar 8, 2016, at 10:41 AM, Matus UHLAR - fantomas wrote: Why did you remove the important part? On 08.03.16 11

Re: Missed spam, suggestions?

2016-03-08 Thread John Hardin
On Tue, 8 Mar 2016, Matus UHLAR - fantomas wrote: On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: > how can these two stats be different? On 08.03.16 10:19, @lbutlr wrote: Because one is for SPAM and one is for HAM. TOP SPAM RULES FIRED RANK RULE NAME COUNT %OF

Re: Missed spam, suggestions?

2016-03-08 Thread @lbutlr
> On Mar 8, 2016, at 10:41 AM, Matus UHLAR - fantomas wrote: > >> On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: >>> how can these two stats be different? > > On 08.03.16 10:19, @lbutlr wrote: >> Because one is for SPAM and one is for HAM. > > Why did you remove the important part?

Re: Missed spam, suggestions?

2016-03-08 Thread Benny Pedersen
On 8. mar. 2016 18.42.03 Matus UHLAR - fantomas wrote: Why did the same rule hit 38.98% of all mail and 50.51% of all mail? grep foo ./hamfolder grep bar ./spamfolder Why should both folders need same counts of mails ?

Re: Missed spam, suggestions?

2016-03-08 Thread Matus UHLAR - fantomas
On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: how can these two stats be different? On 08.03.16 10:19, @lbutlr wrote: Because one is for SPAM and one is for HAM. Why did you remove the important part? TOP SPAM RULES FIRED RANKRULE NAME COUNT %OFRULES

Re: Missed spam, suggestions?

2016-03-08 Thread @lbutlr
On Mar 8, 2016, at 7:31 AM, Matus UHLAR - fantomas wrote: > how can these two stats be different? Because one is for SPAM and one is for HAM. -- No man is free who is not master of himself

Re: Missed spam, suggestions?

2016-03-08 Thread Matus UHLAR - fantomas
On 07.03.16 23:39, Charles Sprickman wrote: TOP SPAM RULES FIRED RANKRULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM 2 HTML_MESSAGE12714 8.18 38.98 87.85 90.80 TOP HAM RULES FIRED RANKRULE NAME COUNT %O

Re: Missed spam, suggestions?

2016-03-08 Thread Robert Chalmers
Can I ask, how are you getting these stats please? Thanks > On 8 Mar 2016, at 05:11, David B Funk wrote: > > On Mon, 7 Mar 2016, Charles Sprickman wrote: > >> I’ve been running with some daily training for a little over a week and I’m >> seeing less spam in my inbox. I’ve seen a few things sl

Re: Missed spam, suggestions?

2016-03-07 Thread David B Funk
On Mon, 7 Mar 2016, Charles Sprickman wrote: I’ve been running with some daily training for a little over a week and I’m seeing less spam in my inbox. I’ve seen a few things slip through because bayes tipped them below the default score, these were two phishing emails. Here’s some rule stats

Re: Missed spam, suggestions?

2016-03-07 Thread Charles Sprickman
> On Feb 29, 2016, at 3:18 PM, Reindl Harald wrote: > > Am 29.02.2016 um 21:05 schrieb Charles Sprickman: >>> On Feb 29, 2016, at 4:23 AM, Reindl Harald wrote: >>> >>> Am 29.02.2016 um 06:24 schrieb Charles Sprickman: I’ve not had much luck with Bayes - when I had it enabled recently on a

Re: Missed spam, suggestions?

2016-02-29 Thread John Hardin
On Mon, 29 Feb 2016, Charles Sprickman wrote: My concern with disabling autolearn is that then I’m the only one training. My spam probably looks like everyone else’s, but my ham is very different, lots list traffic and such. You can still have your users provide misses for training, you'd ju

Re: Missed spam, suggestions?

2016-02-29 Thread Reindl Harald
Am 29.02.2016 um 21:05 schrieb Charles Sprickman: On Feb 29, 2016, at 4:23 AM, Reindl Harald wrote: Am 29.02.2016 um 06:24 schrieb Charles Sprickman: I’ve not had much luck with Bayes - when I had it enabled recently on a per-user basis it was just hitting the master DB server too hard with

Re: Missed spam, suggestions?

2016-02-29 Thread Charles Sprickman
> On Feb 29, 2016, at 4:23 AM, Reindl Harald wrote: > > > > Am 29.02.2016 um 06:24 schrieb Charles Sprickman: >> I’ve not had much luck with Bayes - when I had it enabled recently on a >> per-user basis it was just hitting the master DB server too hard with udpates > > just make a sitewide b

Re: Missed spam, suggestions?

2016-02-29 Thread Reindl Harald
Am 29.02.2016 um 06:24 schrieb Charles Sprickman: I’ve not had much luck with Bayes - when I had it enabled recently on a per-user basis it was just hitting the master DB server too hard with udpates just make a sitewide bayes (https://wiki.apache.org/spamassassin/SiteWideBayesSetup) withou

Re: Missed spam, suggestions?

2016-02-29 Thread Tom Hendrikx
On 29-02-16 06:24, Charles Sprickman wrote: > Hi all, > > Recently I occasionally get bursts of spam that slips through Postfix > (postscreen BL checks, protocol checks) and SpamAssassin. I just had > another big jump in the last week. This was mostly spam touting Oil > Changes, SUV sales and

Re: Missed SPAM

2012-04-04 Thread John Hardin
On Thu, 5 Apr 2012, Jason Haar wrote: Is this the format being referred to? These are consistently getting through SA for us too http://pastebin.com/VHkfnTtm No, it's not. On 01/04/12 10:05, John Hardin wrote: On Sat, 31 Mar 2012, joea wrote: On 3/31/2012 at 8:22 AM, Michael Scheidell

Re: Missed SPAM

2012-04-04 Thread Frank Chan
On 04-04-2012 11:26, Jason Haar wrote: Is this the format being referred to? These are consistently getting through SA for us too http://pastebin.com/VHkfnTtm Jason On 01/04/12 10:05, John Hardin wrote: On Sat, 31 Mar 2012, joea wrote: On 3/31/2012 at 8:22 AM, Michael Scheidell wrote:

Re: Missed SPAM

2012-04-04 Thread Jason Haar
Is this the format being referred to? These are consistently getting through SA for us too http://pastebin.com/VHkfnTtm Jason On 01/04/12 10:05, John Hardin wrote: > On Sat, 31 Mar 2012, joea wrote: > > On 3/31/2012 at 8:22 AM, Michael Scheidell > >> wrote: >> >>> if you need help, you

Re: Missed SPAM

2012-03-31 Thread joea
>>> On 3/31/2012 at 6:27 PM, RW wrote: > On Sat, 31 Mar 2012 12:17:52 -0400 > joea wrote: > > >> Beyond that, where can I find the difference, in a SPAM learning >> sense, between "sa-learn --spam filename" and "spamassassin -r < >> filename"? >> >> If I do the sa-learn on the same file, after

Re: Missed SPAM

2012-03-31 Thread RW
On Sat, 31 Mar 2012 12:17:52 -0400 joea wrote: > Beyond that, where can I find the difference, in a SPAM learning > sense, between "sa-learn --spam filename" and "spamassassin -r < > filename"? > > If I do the sa-learn on the same file, after doing spamassassin, it > tells me 0 tokens. If I then

Re: Missed SPAM

2012-03-31 Thread John Hardin
On Sat, 31 Mar 2012, joea wrote: On 3/31/2012 at 8:22 AM, Michael Scheidell wrote: if you need help, you need enough full information. Or, you make the pastebin 'private', and send the link offlist to someone who has volunteered to help. . . . . If there are more volunteers, beyond the p

Re: Missed SPAM

2012-03-31 Thread Jari Fredriksson
31.3.2012 19:17, joea kirjoitti: > Beyond that, where can I find the difference, in a SPAM learning sense, > between "sa-learn --spam filename" and "spamassassin -r < filename"? > > If I do the sa-learn on the same file, after doing spamassassin, it tells me > 0 tokens. > If I then do "sa-learn -

Re: Missed SPAM

2012-03-31 Thread Jeremy McSpadden
Post what you feel. The ML will help if they can. You can replace IPs and domains etc. -- Jeremy McSpadden On Mar 31, 2012, at 11:19 AM, "joea" wrote: On 3/31/2012 at 8:22 AM, Michael Scheidell > wrote: >> On 3/31/12 8:04 AM, joea wrote: >>> starting below my local and MP details? Ho

Re: Missed SPAM

2012-03-31 Thread joea
>>> On 3/31/2012 at 8:22 AM, Michael Scheidell wrote: > On 3/31/12 8:04 AM, joea wrote: >> starting below my local and MP details? Hopefully, the latter, as the > former leaves me feeling a bit exposed. >> > we already know everything you think you want to hide. Well, let's hope not . . . >

Re: Missed SPAM

2012-03-31 Thread Michael Scheidell
On 3/31/12 8:04 AM, joea wrote: starting below my local and MP details? Hopefully, the latter, as the former leaves me feeling a bit exposed. we already know everything you think you want to hide. if you need help, you need enough full information. Or, you make the pastebin 'private', and s

Re: Missed SPAM

2012-03-31 Thread joea
. . . > That's very little information to go on. Sorry. We learn as we go. > Posting samples (with _all_ headers intact) on a pastebin or on a personal > website so we can see them might yield some advice or new rules. Please > don't send samples to the list, just the URLs where the samples

Re: Missed SPAM

2012-03-30 Thread John Hardin
On Fri, 30 Mar 2012, joea wrote: Having some difficulty grasping why some SPAM is getting thru yet some similar is marked. They have different source email address and subject, yet identical "layout" 3 http links, 3 graphics items and like that. "Layout" generally isn't relevant. The link

Re: Missed spam

2004-11-30 Thread Jeremy Rumpf
On Friday 26 November 2004 10:28 am, Jerry Bell wrote: > This spam went through with a score of 0. I'm using 3.01 with most of the > sare rulesets. Any ideas on how to catch these? > Just as a me too. I've been battling these for the last month or so with SA 3.0.1 with varied results. I run wit

Re: Missed spam

2004-11-26 Thread Jim Maul
Jerry Bell wrote: When I run it manually, this is what I get: X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on db.stelesys.com X-Spam-Status: No, score=0.1 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 X-Spam-Level: What's this best way to get it out of the AWL and b

Re: Missed spam

2004-11-26 Thread Jerry Bell
When I run it manually, this is what I get: X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on db.stelesys.com X-Spam-Status: No, score=0.1 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 X-Spam-Level: What's this best way to get it out of the AWL and bayes? Thanks for

Re: Missed spam

2004-11-26 Thread Jim Maul
Jerry Bell wrote: I wonder if my bayes db has been poisoned to the point of thinking this is ham? In the logs, it autolearned this one as ham, so I suspect that may be the case. You say it scored 0 points..does this mean it triggered no rules or the + - rules totaled up to 0? Regardless of bayes

Re: Missed spam

2004-11-26 Thread Jerry Bell
I wonder if my bayes db has been poisoned to the point of thinking this is ham? In the logs, it autolearned this one as ham, so I suspect that may be the case. > Jerry Bell wrote: >> I'm using SA through exim/exiscan, and I've got it set up to only report >> if it is spam. Guess I should change t

Re: Missed spam

2004-11-26 Thread Jim Maul
Jerry Bell wrote: I'm using SA through exim/exiscan, and I've got it set up to only report if it is spam. Guess I should change that. The SA logs showing it getting a score of 0. SA is working really well for me the other 99% of the time. Jerry Jerry Bell wrote: This spam went through with a scor

Re: Missed spam

2004-11-26 Thread Jerry Bell
I'm using SA through exim/exiscan, and I've got it set up to only report if it is spam. Guess I should change that. The SA logs showing it getting a score of 0. SA is working really well for me the other 99% of the time. Jerry > Jerry Bell wrote: >> This spam went through with a score of 0. I'

Re: Missed spam

2004-11-26 Thread Jim Maul
Jerry Bell wrote: This spam went through with a score of 0. I'm using 3.01 with most of the sare rulesets. Any ideas on how to catch these? Thanks, Jerry http://www.syslog.org Return-path: <[EMAIL PROTECTED]> Envelope-to: [EMAIL PROTECTED], [EMAIL PROTECTED] Delivery-date: Thu, 25 Nov 2004 1