RE: mail slipping through

2009-08-20 Thread Gary Smith
> All BAYES_50? Silly question, but are you sure you're properly > training? > Running sa-learn as the right user, and all that? > I must have been tired. I thought I had run sa-learn --dump ealier, but I guess I didn't. It looks like the new server has a very high ham rate and a low spam rat

RE: mail slipping through

2009-08-20 Thread Duane Hill
On Thu, 20 Aug 2009, Gary Smith wrote: Aug 19 15:03:11 hsoakmsa03l02 spamd[28319]: spamd: result: Y 4 - BAYES_50,HTML_MESSAGE,MIME_HTML_ONLY,SPF_HELO_PASS,URIBL_BLACK,URIBL_RH S_DOB scantime=0.2,size=4543,user=filter,uid=124,required_score=0.0,rhost=10. 80.65.9,raddr=10.80.65.9,rport=53097,

RE: mail slipping through

2009-08-20 Thread Gary Smith
> > Aug 19 15:03:11 hsoakmsa03l02 spamd[28319]: spamd: result: Y 4 - > > > BAYES_50,HTML_MESSAGE,MIME_HTML_ONLY,SPF_HELO_PASS,URIBL_BLACK,URIBL_RH > S_DOB > > > scantime=0.2,size=4543,user=filter,uid=124,required_score=0.0,rhost=10. > 80.65.9,raddr=10.80.65.9,rport=53097,mid=<509800d.5...@biblegame

RE: mail slipping through

2009-08-20 Thread John Hardin
On Wed, 19 Aug 2009, Gary Smith wrote: Aug 19 14:53:10 hsoakmsa03l02 spamd[28319]: spamd: result: Y 5 - BAYES_50,HTML_MESSAGE,MIME_HTML_ONLY,RDNS_NONE,SPF_HELO_SOFTFAIL,URIBL_BLACK,URIBL_RHS_DOB scantime=0.1,size=4525,user=filter,uid=124,required_score=0.0,rhost=10.80.65.9,raddr=10.80.65.9,rpor

RE: mail slipping through

2009-08-19 Thread Gary Smith
> > Ah. Okay. You might also be able to look up the Message-ID in > /var/log/maillog, if you're using spamd. > Didn't think of that. Here is the corresponding spam result for the pastbin entry (http://pastebin.com/m51fd9344) <503bb52.5...@biblegame.info> Aug 19 14:53:10 hsoakmsa03l02 spamd[2

RE: mail slipping through

2009-08-19 Thread John Hardin
On Wed, 19 Aug 2009, Gary Smith wrote: That was in the comment right after the pastebin attachment. I will enable debugging on the SA server so I can save it there tonight and see what it says. Huh? You've lost me. Sorry for the confusion. I had meant that there are no SA headers becau

RE: mail slipping through

2009-08-19 Thread Gary Smith
> > That was in the comment right after the pastebin attachment. I will > > enable debugging on the SA server so I can save it there tonight and > see > > what it says. > > Huh? You've lost me. > > And I meant to say "disclaimer text", the "Any such information we > gather > shall never be share

RE: mail slipping through

2009-08-19 Thread John Hardin
On Wed, 19 Aug 2009, Gary Smith wrote: I'd think that disclaimer code would be good bayes fodder, if the spams are as consistent as you say. That was in the comment right after the pastebin attachment. I will enable debugging on the SA server so I can save it there tonight and see what it s

RE: mail slipping through

2009-08-19 Thread Gary Smith
> > I'd think that disclaimer code would be good bayes fodder, if the spams > are as consistent as you say. That was in the comment right after the pastebin attachment. I will enable debugging on the SA server so I can save it there tonight and see what it says.

RE: mail slipping through

2009-08-19 Thread John Hardin
On Wed, 19 Aug 2009, Gary Smith wrote: Anyway, Header: http://pastebin.com/m51fd9344 I don't see any SA markup. What rules hit? body: http://pastebin.com/m7fe4c798 I'd think that disclaimer code would be good bayes fodder, if the spams are as consistent as you say. -- John Hardin KA7OH

RE: mail slipping through

2009-08-19 Thread Gary Smith
> Is it pretty much the same body, just different senders? Yes and no. They are all the same body layout, some with different items in it. You can take a look at the body content here (screen captures of the content): http://www.localassociates.com/?page_id=7 Wares range from auto warrantee'

Re: mail slipping through

2009-08-19 Thread Dennis B. Hopp
Quoting Gary Smith : I've been having a pretty good hit rate on spam until recently (about two weeks). Two types of email have been coming through at a good rate. I'm receiving at least four per hour from the domains included below. I've also been training bayes with them as well, to

mail slipping through

2009-08-19 Thread Gary Smith
I've been having a pretty good hit rate on spam until recently (about two weeks). Two types of email have been coming through at a good rate. I'm receiving at least four per hour from the domains included below. I've also been training bayes with them as well, to no avail. *...@chocolatebear