Missed SPAM

2012-03-30 Thread joea
Having some difficulty grasping why some SPAM is getting thru yet some similar is marked. They have different source email address and subject, yet identical "layout" 3 http links, 3 graphics items and like that. When I save the message source (Mime.822 file) and do sa-learn --spam file it

Re: Missed SPAM

2012-03-31 Thread joea
. . . > That's very little information to go on. Sorry. We learn as we go. > Posting samples (with _all_ headers intact) on a pastebin or on a personal > website so we can see them might yield some advice or new rules. Please > don't send samples to the list, just the URLs where the samples

Re: Missed SPAM

2012-03-31 Thread joea
>>> On 3/31/2012 at 8:22 AM, Michael Scheidell wrote: > On 3/31/12 8:04 AM, joea wrote: >> starting below my local and MP details? Hopefully, the latter, as the > former leaves me feeling a bit exposed. >> > we already know everything you think you want

Re: Missed SPAM

2012-03-31 Thread joea
>>> On 3/31/2012 at 6:27 PM, RW wrote: > On Sat, 31 Mar 2012 12:17:52 -0400 > joea wrote: > > >> Beyond that, where can I find the difference, in a SPAM learning >> sense, between "sa-learn --spam filename" and "spamassassin -r < >> filen

Bayes_ignore

2012-04-01 Thread joea
While exploring Bayes stuff, (wanting to populate appropriately for my setup), found reference to removing headers that might confuse Bayes. Specifically bayes_ignore_header. The example they show is an X header. Seems the ones spamassassin puts in there will be ignored without intervention.

Flag mail from certain country codes.

2012-04-08 Thread joea
I find some SPAM slips through un marked, mostly from certain country codes (in the senders email address/domain). I was thinking of a regex to taste and paste (say add 5 to SPAM score), but don't really want to reinvent a wheel. Or run over my own toes. I did find a plug in or two, but th

Malware flagging

2012-04-10 Thread joea
Aside - I originally sent this last evening, it was rejected to the subject line. Let's hope this one is acceptable. >> I get a few of those emails with zip attachments, slipping thru. Scanner, Airline tickets, etc. I guess these are "malware" rather than SPAM, so I began looking at amavis.

updates

2012-04-12 Thread joea
when running sa-update in debug, always end up with this: channel: current version is 895075, new version is 895075, skipping channel Are there no updates, or am I misconfigured for rules updates?

Re: updates

2012-04-12 Thread joea
> >"SpamAssassin version 3.3.2 has not had a rule update since 2012-02-25." > >From this, should I conclude there will be no updates to earlier versions >(3.2.x for instance) ? Must I upgrade in order to update? joe a.

Re: updates

2012-04-12 Thread joea
>>> On 4/12/2012 at 4:30 PM, "Kevin A. McGrail" wrote: > On 4/12/2012 1:34 PM, joea wrote: >>> "SpamAssassin version 3.3.2 has not had a rule update since 2012-02-25." >>> >> > From this, should I conclude there will be no updates to ear

auto add spam/ham for manual learning

2012-04-12 Thread joea
I see where one can forward mail to location and have spamassassin scan them. For both spam and ham I gather. Wondering what settings to change to have it ignore any additional info the forward adds. Yes, I am looking for a bit of spoon feeding here, as, well, it's been along day.

upgrade to 3.3.2

2012-04-12 Thread joea
Having just un tar'd, a quick look at the .raw files tells me I had better ask those who may know. So, I'm asking. . . where can I find what to feed these fellows? And . . . time to relax for a while. Is there a known packaging for SUSE SLES10 ?

Slip thu's

2012-04-17 Thread joea
Getting "scanned document", "pills" and stuff with a url of "blah.blah.ru" Some of these contain something like the snippet below, apparently put in by the sender or perhaps the mail provider. *** MIME-Version: 1.0 X-OriginalArrivalTime: Tue, 17 Apr 2012 05:12:23 -0300

setting up auto submit (forward to sa-learn)

2012-04-22 Thread joea
Attempting to simplify my life, looked to ways to forward ham and spam to the spamassassin box and have it look a them, without further intervention on my part. The link http://gtmp.org/pub/sa-postfix.en.html takes me to a page where there is nothing useful (AFAICT). The next link https://po2.

Re: setting up auto submit (forward to sa-learn)

2012-04-22 Thread joea
>>> On 4/22/2012 at 9:36 AM, "joea" wrote: > Attempting to simplify my life, looked to ways to forward ham and spam to the > spamassassin box and have it look a them, without further intervention on my > part. > > The link http://gtmp.org/pub/sa-postfi

Re: setting up auto submit (forward to sa-learn)

2012-04-23 Thread joea
>>> On 4/22/2012 at 10:29 PM, Dave Funk wrote: > On Sun, 22 Apr 2012, joea wrote: > >> Attempting to simplify my life, looked to ways to forward ham and spam to > the spamassassin box and have it look a them, without further intervention on > my part. >> &

bayes databases, sa-learn, users

2012-04-24 Thread joea
When using a script to help automate submission to sa-learn, learned (so to speak) thru the kindness of others, that there are different results when querying sa-learn for tokens, as different users. The script runs as "script-user" while I normally query as "root". I puzzled over why the

Re: bayes databases, sa-learn, users

2012-04-24 Thread joea
>>> On 4/24/2012 at 2:49 PM, Bowie Bailey wrote: > On 4/24/2012 2:38 PM, joea wrote: >> When using a script to help automate submission to sa-learn, learned (so to > speak) thru the kindness of others, that there >> are different results when querying sa-learn for

Up tick in missed SPAM from co domain

2022-02-03 Thread joea- lists
SA version 3.4.5 Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed SPAM from .co domain. Though obvious SPAM weight loss, phish, "personals", they are scoring rather low. Added a custom rule for that domain, which should deal with it, but wondering if I missed some chan

Re: Up tick in missed SPAM from co domain

2022-02-03 Thread joea- lists
> On Thu, 2022-02-03 at 10:50 -0500, joea- lists wrote: >> SA version 3.4.5 >> >> Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed >> SPAM from .co domain. Though obvious SPAM >> weight loss, phish, "personals", they are scori

Re: Up tick in missed SPAM from co domain

2022-02-03 Thread joea- lists
>> On Thu, 2022‑02‑03 at 10:50 ‑0500, joea‑ lists wrote: SA version 3.4.5 >>> >>> Since yesterday 2/2/22 (gasp!) . . . I've noticed an up tick in missed >>> SPAM from .co domain. Though obvious SPAM >>> weight loss, phish, "personals"

Re: Up tick in missed SPAM from co domain

2022-02-03 Thread joea- lists
> On 2022‑02‑03 16:50, joea‑ lists wrote: >> SA version 3.4.5 > > old version, stable is 3.4.6 now Unless there is a pressing reason to update right away, I prefer to wait for the vendor supplied package to update. But that is not a hard rule for me. >> Since y

resubmit mail or just delete

2022-02-07 Thread joea- lists
After a long outage due to weather, a restart found spamd not running (timed out on startup, a story for later), and a lot of spam got through. Now that it is running, should I re-submit these dozens or hundreds of emails to allow them to be properly classified, drop them in "missed SPAM" or ju

Add header, not beginning with X?

2022-02-14 Thread joea- lists
Nutshell: I want to add "Reply-to: (some address)" to messages without same. While it seems feasible to do this in postfix, I wanted to explore doing it with minimal fuss in SAm or if a FILTER or MILTER might be required. So far I've only found "Basic Message Tagging Options". joe a.

Re: Add header, not beginning with X?

2022-02-14 Thread joea- lists
>>> > "joea‑ lists" writes: > >> Nutshell: I want to add "Reply‑to: (some address)" to messages without same. > > > Please do explain why. It sounds like a clear standards violation > because Reply‑To may only be set by the sender. &

Re: Add header, not beginning with X?

2022-02-14 Thread joea- lists
>>> > On 2022‑02‑14 at 12:31:18 UTC‑0500 (Mon, 14 Feb 2022 12:31:18 ‑0500) > joea‑ lists > is rumored to have said: > >> Nutshell: I want to add "Reply‑to: (some address)" to messages without >> same. >> >> While it seems feasible to do