High load average

2008-08-11 Thread Martin Schweizer
Hello On my mail server, I run FreeBSD 7.0 with sendmail/spamass-milter. Since some times I see some high usage of the processes "spamass-milter". Since then it seems that I have now I bad response time. But I have no idea from when... I solutions could be to you two servers: one with spamassins a

Re: High load average [sendmail+milter]

2008-08-11 Thread Andrzej Adam Filip
"Martin Schweizer" <[EMAIL PROTECTED]> wrote: > On my mail server, I run FreeBSD 7.0 with sendmail/spamass-milter. > Since some times I see some high usage of the processes > "spamass-milter". Since then it seems that I have now I bad response > time. But I have no idea from when... I solutions cou

Re: Mass-check not scanning all messages.

2008-08-11 Thread Justin Mason
hmm. that sounds like it's not using mboxes. are you sure you are? If not, just use "ham:detect:" or "ham:dir:". --j. Chris Reed writes: > I added /* to the end of the dir paths but that didn't change anything. The > mails do have a somewhat weird naming convention. They were used on imap so >

Re: High load average [sendmail+milter]

2008-08-11 Thread Martin Schweizer
Hello Andrzej 2008/8/11 Andrzej Adam Filip <[EMAIL PROTECTED]>: > "Martin Schweizer" <[EMAIL PROTECTED]> wrote: >> On my mail server, I run FreeBSD 7.0 with sendmail/spamass-milter. >> Since some times I see some high usage of the processes >> "spamass-milter". Since then it seems that I have now

FM Viagra 1114

2008-08-11 Thread Markus Senoner
Hi all! E-Mails from a collegue of mine continue to be classified as spam. Mainly due to the following: 3.8 FM_VIAGRA_SPAM1114 Signs of a Viagra spam 11/14/2006 "Signs of a Viagra spam 11/14/2006" ? He never sent any kind of spam. What does trigger this 3,8 points? What text should my colle

spamassassin on another machine with different OS

2008-08-11 Thread Brent Clark
Hi I decided on adding another spamassassin to / for my MTA. But this sits on another machine (FreeBSD 7). I got my spamassassin working, and it does tell the MTA what is / is not spam. But in log file I see the following spamd: handle_user unable to find user: 'Debian-exim' My question is

Re: FM Viagra 1114

2008-08-11 Thread Justin Mason
Markus Senoner writes: > > Hi all! > > E-Mails from a collegue of mine continue to be classified as spam. > Mainly due to the following: > > 3.8 FM_VIAGRA_SPAM1114 Signs of a Viagra spam 11/14/2006 > > "Signs of a Viagra spam 11/14/2006" ? He never sent any kind of spam. > What does trigger

more help on whitelist_from_rcvd

2008-08-11 Thread Skip
I'm trying to make sure email from ebay is legit. I received an email from ebay today with the following headers: Received: from mxsmfpool02.ebay.com ([66.135.209.199] helo=mxsmfpool01.ebay.com) by box106.bluehost.com with esmtp (Exim 4.69) (envelope-from <[EMAIL PROTECTED]>)

RE: more help on whitelist_from_rcvd

2008-08-11 Thread Randal, Phil
whitelist_from_dkim might be a better way to go: http://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Plugin_D KIM.html Cheers, Phil -- Phil Randal Networks Engineer Herefordshire Council Hereford, UK -Original Message- From: Skip [mailto:[EMAIL PROTECTED] Sent: 11 August

Re: more help on whitelist_from_rcvd

2008-08-11 Thread McDonald, Dan
On Mon, 2008-08-11 at 09:14 -0400, Skip wrote: > I'm trying to make sure email from ebay is legit. I received an email > from ebay today with the following headers: > > DomainKey-Signature: a=rsa-sha1; s=dksm28; d=ebay.com; c=nofws; q=dns; > h=x-ebay-mailtracker:to:from:mime-version:con

RE: Mass-check not scanning all messages.

2008-08-11 Thread Chris Reed
J, Really appreciate it sir. I wasn't aware that the mbox was a switch. Changed it to spam:dir and ham:dir and then removed the trailing /* and it worked (at least appeared to) work wonderfully. Thanks to all that helped. :) -- Chris -Original Message- From: [EMAIL PROTECTED] [mailto:[

Spamassassin start script confused

2008-08-11 Thread Owen B. Mehegan
I've recently added a line to my crontab which calls a script to run sa-update and restart spamd if new rules are found. Since doing that, I'm noticing that the restart doesn't usually work. It returns this error: "Stopping SpamAssassin Mail Filter Daemon: No spamd found running; none kille

Re: more help on whitelist_from_rcvd

2008-08-11 Thread Skip
Awesome. The DKIM module works for that message, but I can't get it to accept this message Received: from e3uspmta152.emarsys.net ([91.194.248.152]) by box106.bluehost.com with esmtp (Exim 4.69) (envelope-from <[EMAIL PROTECTED]>) id 1KSGh7-0004Qw-2I for [EMAIL PRO

Re: more help on whitelist_from_rcvd

2008-08-11 Thread Joseph Brennan
Received: from mxsmfpool02.ebay.com ([66.135.209.199] helo=mxsmfpool01.ebay.com) by box106.bluehost.com with esmtp (Exim 4.69) (envelope-from <[EMAIL PROTECTED]>) id 1KSISe-0003wZ-8P for [EMAIL PROTECTED]; Sun, 10 Aug 2008 15:28:24 -0600 And I figured the f

RE: more help on whitelist_from_rcvd

2008-08-11 Thread Randal, Phil
I see no whitelist_from_dkim [EMAIL PROTECTED] emarsys.net in your list. Not that I'm sure that's the problem. A whitelist_from_rcvd [EMAIL PROTECTED] emarsys.net Should have caught that one too (if your really trust emarsys.net). Phil -- Phil Randal Networks Engineer Herefordshire Counc

Re: more help on whitelist_from_rcvd

2008-08-11 Thread Skip
Randal, Phil wrote: I see no whitelist_from_dkim [EMAIL PROTECTED] emarsys.net in your list. Not that I'm sure that's the problem. A whitelist_from_rcvd [EMAIL PROTECTED] emarsys.net Should have caught that one too (if your really trust emarsys.net). Phil -- Phil Randal Networks Engi

Re: more help on whitelist_from_rcvd

2008-08-11 Thread Noel Jones
On Mon, Aug 11, 2008 at 12:30 PM, Skip <[EMAIL PROTECTED]> wrote: > > > Randal, Phil wrote: > >> I see no >> >> whitelist_from_dkim [EMAIL PROTECTED] emarsys.net >> >> in your list. >> >> Not that I'm sure that's the problem. >> >> A >> >> whitelist_from_rcvd [EMAIL PROTECTED] emarsys.net >> >>

Re: Sender NOT in Whitelist-- Re: more help on whitelist_from_rcvd

2008-08-11 Thread Skip
Noel Jones wrote: On Mon, Aug 11, 2008 at 12:30 PM, Skip <[EMAIL PROTECTED]> wrote: Randal, Phil wrote: I see no  whitelist_from_dkim *@ebay.com emarsys.net in your list. Not that I'm sure that's the problem. A  whitelist_from_rcvd *@

Re: Re: more help on whitelist_from_rcvd

2008-08-11 Thread Skip
Skip wrote: Noel Jones wrote: On Mon, Aug 11, 2008 at 12:30 PM, Skip <[EMAIL PROTECTED]> wrote: Randal, Phil wrote: I see no  whitelist_from_dkim *@ebay.com emarsys.net in your list. Not that I'm sure that's the problem.

Re: Debugging TrustPath Problem

2008-08-11 Thread Bob Proulx
Matus UHLAR - fantomas wrote: > Bob Proulx wrote: > > Shouldn't that message trigger RCVD_IN_SORBS_DUL? > > trusted_networks 199.232.76.173 > only if 199.232.76.173 is in your internal_networks... Hmm... I had never realized the difference between trusted_networks and internal_networks previous

Re: Debugging TrustPath Problem

2008-08-11 Thread Henrik K
On Mon, Aug 11, 2008 at 01:35:30PM -0600, Bob Proulx wrote: > Hmm... I had never realized the difference between trusted_networks > and internal_networks previously. I had always set the > trusted_networks parameter and didn't even know about the > internal_networks one. The TrustPath entry on t

Q about bayes_vars/token and id value

2008-08-11 Thread Michael Scheidell
I was looking at the sql commands used to expire bayes data and noticed some indexes that combined 'id' with token and atime. (two indexes, on bayes_token) and noticed id also on bayes_vars. i tried to see what the 'id' value was used for, since every row in both tables had id=1. select coun

Testing for existence of header

2008-08-11 Thread Kenneth Porter
Shows how to test for text associated with a header. How do I test if the header is present at all? (Or not present?)

Re: Testing for existence of header

2008-08-11 Thread Michael Scheidell
> From: Kenneth Porter <[EMAIL PROTECTED]> > Date: Mon, 11 Aug 2008 22:34:05 -0700 > To: SpamAssassin Users List > Subject: Testing for existence of header > > > > Shows how to test for text associated with a header. How do I test if the > head