I upgraded from 3.1.0 to 3.1.1 and my delays went from less than 20 to
900 to over 1000. Here is my rule sets used by rules du jour and my SA
config (same as prior to upgrade). I don't see anything that needs to be
changed, can someone suggest what I am doing wrong?
[ "${TRUSTED_RULESETS}" ] || \
TRUSTED_RULESETS="TRIPWIRE SARE_EVILNUMBERS0 BLACKLIST ANTIDRUG \
BLACKLIST_URI BOGUSVIRUS SARE_ADULT \
SARE_FRAUD SARE_BML SARE_HEADER0 \
SARE_HTML0 SARE_SPECIFIC SARE_SPOOF SARE_REDIRECT_POST300 \
SARE_GENLSUBJ SARE_UNSUB \
SARE_URI0 SARE_URI1 SARE_URI3 SARE_RANDOM SARE_BAYES_POISON_NXM \
SARE_EVILNUMBERS0 SARE_EVILNUMBERS1 SARE_EVILNUMBERS2";
SA config:
rewrite_header Subject *****SPAM*****
lock_method flock
ok_languages en es fr it da de el ga gd ko nl no ru zh.big5
report_safe 1
trusted_networks 10/8 127/8 208.38.145.0/27 208.38.145.32/27 216.139.202.0/27
use_bayes 1
bayes_path /var/amavis/.spamassassin/bayes
skip_rbl_checks 1
dns_available yes
score RAZOR2_CHECK 2.500
score BAYES_99 4.300
score BAYES_80 3.000
<snip whitelists>
uri GEOCITIES /^http:\/\/[a-z0-9-]{1,30}\.geocities\.com\b/i
describe GEOCITIES High amounts of spam from Geocities.
score GEOCITIES 6.01
uri GEOCITIES_YAHOO /^http:\/\/(?:www\.)?geocities\.yahoo\.com\.br\b/i
describe GEOCITIES_YAHOO High amounts of spam from Geocities.
score GEOCITIES_YAHOO 6.01
header __SOBER_P_MSGID Message-ID =~ /<[0-9a-f\.]{15,22}\@/
header __SOBER_P_CTYPE Content-Type =~ /text\/plain.*charset=\"us-ascii\"/
header __SOBER_P_PRIO X-Priority =~ /^3 /
header __SOBER_P_IMP Importance =~ /^Normal/
meta SOBER_P_SPAM (__SOBER_P_MSGID && __SOBER_P_CTYPE && __SOBER_P_PRIO &&
__SOBER_P_IMP )
score SOBER_P_SPAM 18.0
describe SOBER_P_SPAM Rassistische Mail Sober-P
In addition to the config above, I also have the ruleset to catch german
sober virus spam bounces, which has probably 20 different body, header,
meta, score and describe entries.
--
Robert
