I just upgraded to SA 3.0.2 from 2.6x and got it running ok, but noticed a
couple of issues:
SA 3.0.2 doesn't write to the pidfile the way it used to. The man pages
still show that the -r switch will make it do this, but using the same
startup script and restart script that I've been using all a
se
> the scores for bayes_90.
Rational, I suppose, but I use the network tests and still found it
neccessary to bump the bayes 9x up to get decent results after upgrading
from 2.63 the other day.
BTW, it looks like bayes_90 has been deprecated. When I run a lint on my
local.cf, I get:
warning: scor
According to:
http://spamassassin.apache.org/tests_3_0_x.html
The rule "AWL" should always hit "1", but I just found that it's hitting
5.1. I am not overriding it in local.cf, and there are no user-configs
allowed. The rule is not listed at all in 50_scores.cf so I take it that
it's hard coded
nsult this file every time? What's the best way to
keep it under control?
Not to quibble, but why doesn't the SA default to putting all these files
under /var or at least /usr ? Filling up the root FS can cause big
problems...
Thanks,
James Smallacombe PlantageNet, In
Since upgrading to 3.02 from 2.63 and tweaking some rules, I've had
problems with smtp connections skyrocketing at times. I have raised the
limit (qmail-smtpd with tcpserver) to 400 connections so there would
always be an smtp connection available for legitimate relaying, but it
occasionally hits
t; copied over some custom rules from the SARE site, but that was it, I
> > just copied them over. Now SA is not flagging any mail. Any
> > suggestions? Our secondary mx box is picking up the load right now.
>
> Check your file system.
> Check the files in /etc/mail/spam
> >
> >On Fri, 04 Feb 2005 15:18:10 -0600, Kenneth Andresen <[EMAIL PROTECTED]>
> >wrote:
> >
> >
> >>Hello Filip,
> >>
> >>Thank you for your script! I have been looking up several alternative
> >>paths now, and yours seem to be th
I'm suddenly getting errors on both custom and built-in rules in my
maillog:
Feb 6 23:20:28 mail spamd[66363]: Subroutine PORN_16_body_test redefined
at /usr/local/share/spamassassin/20_porn.cf, rule PORN_16, line 10,
line 208.
Feb 6 23:20:28 mail spamd[66363]: Subroutine SARE_BIGRMEMBER_body_
I'm suddenly getting errors on both custom and built-in rules in my
maillog:
Feb 6 23:16:23 mail spamd[66367]: Subroutine EXCUSE_10_body_test
redefined at /usr/local/share/spamassassin/20_phrases.cf, rule EXCUSE_10,
line 10, line 99.
Feb 6 23:16:23 mail spamd[66367]: Subroutine SEKS1_body_test
I just created a rule for the most common spams that have been making it
through SA, but for some reason, it's not showing up in the tests:
body SEE_ATTACH /See attachment message.html/i
describe SEE_ATTACH body contains See attachment message.html
score SEE_A
On Mon, 7 Feb 2005 [EMAIL PROTECTED] wrote:
>
> I just created a rule for the most common spams that have been making it
> through SA, but for some reason, it's not showing up in the tests:
>
> body SEE_ATTACH /See attachment message.html/i
> describe SEE_A
On Mon, 7 Feb 2005, Alex Broens wrote:
> [EMAIL PROTECTED] wrote:
> > On Mon, 7 Feb 2005 [EMAIL PROTECTED] wrote:
> >
> >>I just created a rule for the most common spams that have been making it
> >>through SA, but for some reason, it's not showing up
On Mon, 7 Feb 2005, Matt Kettler wrote:
> I suspect the message in question has the "see attachment" text directly
> after a Content-Transfer-Encoding: section header with no line break. I've
> seen some floating around like that, and they are intentionally creating a
> malformed message knowing m
(running 3.0.2) Nearly all spam that gets through is being tagged as
"BAYES_00" since I started using sbl_xbl at the smtp level (before that,
alot more was hitting).
I've been using the same corpus with daily manual additions of my own, and
also using 70_sare_bayes_poison_nxm.cf to prevent this k
As I'm sure others will point out, SA doesn't "move spams" to any folders,
it just marks them up. You have some other filtering mechanism doing
that, and that's where the problem is.
On Thu, 10 Feb 2005, Tony Yat-Tung Cheung wrote:
> Hi,
>
> I have configur
On Thu, 26 May 2005, Joe Zitnik wrote:
> I think points can be made for both sides of the argument. The thing
> that makes bayes different, is that a well trained bayes database is
> specific to your environment. If you're a law firm, your learned ham is
> going to be heavy in legalese, medical
We're suddenly getting a ton of spam with koi8-r encoding...I tried to do
a custom rule for it like this:
header SUBJ_RUSS_CHAR Subject =~/koi8-r/i
describe SUBJ_RUSS_CHAR has Russian char encoding
score SUBJ_RUSS_CHAR3.5
The short headers for these spams look like
On Thu, 14 Feb 2008, Per Jessen wrote:
> [EMAIL PROTECTED] wrote:
>
> >
> > We're suddenly getting a ton of spam with koi8-r encoding...I tried to
> > do a custom rule for it like this:
> >
> > header SUBJ_RUSS_CHAR Subject =~/koi8-r/i
> > describe SUBJ_RUSS_CHAR has Russian char
I've seen this before, but it's been a while. An AOL user who's on
Verizon DSL, sends an email that trips two DNS BLs in SA. This user's
Verizon DSL IP is listed for being an open relay, which it may or may not
be, since this is presumably a dynamic IP The mail is then relayed
through AOL's net
On Wed, 2 Aug 2006, Andrzej Adam Filip wrote:
> "Steven W. Orr" <[EMAIL PROTECTED]> writes:
>
> > On Wednesday, Aug 2nd 2006 at 13:50 -0700, quoth Derek Harding:
> >
> > =>On Wed, 2006-08-02 at 16:37 -0400, Tom Ray wrote:
> > =>> Anyone serious about stopping SPAM should not use SpamCop. They have
I've been running SA on 5.6.1, but I'm building a new FreeBSD box and its
"prefered" version is 5.8. I noticed that in the SA docs, it mentions
performance problems with 5.8.
FreeBSD has version 5.6.2 in ports, but I seem to recall that one
shouldn't use perl versions that ended in even numbers,
I've had a couple of these since upgrading to 3.0.4. Headers with NO IP
address in it, just this:
Received: from localhost by (our server)
I assume that if it's not a bug on my end, some users and/or servers are
sending out from 127.0.0.1, which in turn sets off:
RCVD_IN_BL_SPAMCOP_NET,RCVD_IN
Sorry for the OT post, but the simscan list appears to be completely dead
and I need to figure this out. I've used simscan in the past with no
problems; I just can't figure out what's happening to spam scoring higher
than 6.0 but less than 12.0, so anybody who's familiar with the latest
sims
Getting back to the subject...can anyone enlighten us to the efficacy of
this DNSBL? For example, how does it compare to zen.spamhaus.org, varius
DUL type lists, etc. I would love to reject more before SA gets involved.
James Smallacombe PlantageNet, Inc. CEO and Janitor
tives. Looking through the 631 domains
that did not have enough points to be classed as spam, I didn't see more
than one or two that shouldn't have been blocked. granted, i did not
look through the emails themselves, just the domain name.
I'm currently scoring it 1.0, and might rai
On Wed, 24 Sep 2008, [EMAIL PROTECTED] wrote:
I was actually hoping to use it like I use zen.spamhaus.org and dul.sorbs.net
and just reject emails listed on those. It is very rare that I get a false
positive from either, but their efficacy isn't what it used to be, either.
So, I just configur
Of the fair amount of false negatives that get through, more than 90% of
them appear to hit on URIBL_BLACK. I have incrementally increased it
recently to a score of 5.0 (I hit on 6.0). The stuff that's still getting
through seems to be hitting on only URIBL_BLACK.
I am very tempted to bump
On Wed, 17 Dec 2008, LuKreme wrote:
On 16-Dec-2008, at 23:57, ram wrote:
http://www.surbl.org/usage-policy.html
I did the 'request a quote'. For 3,000 users and 550,000 emails a day (hey,
i was just making up numbers here) the cost is US$600/year. If you're a
non-profit
He's hitting on 2 different DUL rules, because he's sending directly from
his DSL IP to your S/A server. You need to whitelist his IP address, or
otherwise have it bypasss S/A scanning.
On Tue, 5 Dec 2006, John Tice wrote:
> I have a new client whose mail is scoring way high... several others
>
On Thu, 16 Feb 2006, mouss wrote:
> Matt Kettler a ?crit :
> > Philip Prindeville wrote:
> >
> >
> >>Well, I could whitelist the list sender, but the MAIL FROM: includes a
> >>monotonically increasing integer... so it's never the same string twice.
> >>
> >>That's sort of shoots us in the foot, d
On Thu, 27 Apr 2006, Theo Van Dinter wrote:
> On Wed, Apr 26, 2006 at 05:32:45PM -0400, Joe Flowers wrote:
> > Any educated guesses on when 3.1.2 will be released?
> > From a selfish point of view, I'm trying to kill several upgrades with
> > one stone.
>
> I was hoping to get it out this month, b
r I upgraded, I killed the
old daemon and tried to start the new one and it complained about the
socket address already being in use. There were alot of old children
running, but I've never seen that be a problem before...I tried to:
killall -9 spamd
but no matching processese were found,
I upgraded from 3.0.4 yesterday without too much trouble...once I got
3.1.2 online, I noticed a nice reduction in false negatives, and cpu
remained low (holiday here in US).
This morning, spamd died with no warning, except of course a huge increase
in spam. Nothing in /var/log/messages, and only
Ok, I'm giving that a shot. The only changes I noted wrt DCC were
licensing-related, but I hadn't run it in so long, I can't recall wether
it was worth the trouble or not. I've already noticed CPU went way down
after disabling it. :)
BTW, can anybody tell me whether or not spamd re-reads the .p
27;s time at 25, and smtp connections are stacking up behind it
and occasionally spamd is so overwhelmed a spam gets through with no
checks. CPU also spikes up to over 20.0 at times, on a dual Xeon server
with maybe a thousand mailboxes.
In the logs, the only thing I see that's showing an i
's an
> > issue.
> >
> > I raised max children from 15 to 25, yet it still seems to be spending
> > most of it's time at 25, and smtp connections are stacking up behind
> > it and occasionally spamd is so overwhelmed a spam gets through with
> > no chec
On Wed, 31 May 2006 [EMAIL PROTECTED] wrote:
> [EMAIL PROTECTED] wrote:
> > A couple of days after an upgrade from 3.0.4 to 3.1.2, I'm noticing
> > that it seems alot slower. I turned off most network tests,
> > including DCC, Pyzor and Razor and it still looks like there's an
> > issue.
>
> Is i
On Wed, 31 May 2006, Theo Van Dinter wrote:
> On Wed, May 31, 2006 at 11:12:03AM -0400, [EMAIL PROTECTED] wrote:
> > > > May 31 07:53:52 mail spamd[59117]: Use of uninitialized value in
> > > > subtraction (-) at
> > > /usr/local/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Locker/UnixNFSSafe.pm
>
On Wed, 31 May 2006 [EMAIL PROTECTED] wrote:
> On Wed, 31 May 2006, Theo Van Dinter wrote:
>
> > On Wed, May 31, 2006 at 11:12:03AM -0400, [EMAIL PROTECTED] wrote:
> > > > > May 31 07:53:52 mail spamd[59117]: Use of uninitialized value in
> > > > > subtraction (-) at
> > > > /usr/local/lib/perl5/s
On Wed, 31 May 2006, Justin Mason wrote:
>
> Can you get output of
>
> strace -f -o trace
>
> on the affected processes? (easy way: just stop spamd, then strace the
> spamd startup script.)
Ok, that's going without any output as of yet. I did notice from the
console log that a perl dumped co
On Wed, 31 May 2006 [EMAIL PROTECTED] wrote:
> On Wed, 31 May 2006, Justin Mason wrote:
> >
> > Can you get output of
> >
> > strace -f -o trace
> >
> > on the affected processes? (easy way: just stop spamd, then strace the
> > spamd startup script.)
>
> Ok, that's going without any output as
On Wed, 31 May 2006 [EMAIL PROTECTED] wrote:
> On Wed, 31 May 2006 [EMAIL PROTECTED] wrote:
>
> > On Wed, 31 May 2006, Justin Mason wrote:
> > >
> > > Can you get output of
> > >
> > > strace -f -o trace
> > >
> > > on the affected processes? (easy way: just stop spamd, then strace the
> > >
I just performed a routine sa-update (just on stock SA rules, no SARE) and
the scores are no longer appearing in the message headers, and spam isn't
being filtered. The log shows the following:
Jul 10 09:26:39 mail spamd[37580]: spamd: result: . 0 - SARE_DIPLOMA2
scantime=0.6,size=40476,user=sim
43 matches
Mail list logo
