Re: [AMaViS-user] score
* Andrea Bencini [EMAIL PROTECTED]: b) the local.cf is not in the correct location. Use amavis debug-sa to see which local.cf spamassassin/amavis is using. I am becoming crazy!!! My amavisd.conf file is in the directory /etc/amavisd/. /etc/amavisd/amavisd.conf I used, as you recommended, the line command amavisd debug-sa to debug spamassassin. I received this message: Config file /etc/amavisd.conf does not exist, at /usr/sbin/amavisd line 1429. /etc/amavisd.conf != /etc/amavisd/amavisd.conf -- Ralf Hildebrandt (i.A. des IT-Zentrums) [EMAIL PROTECTED] Charite - Universitätsmedizin BerlinTel. +49 (0)30-450 570-155 Gemeinsame Einrichtung von FU- und HU-BerlinFax. +49 (0)30-450 570-962 IT-Zentrum Standort CBFsend no mail to [EMAIL PROTECTED] - This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/ ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] score
b) the local.cf is not in the correct location. Use amavis debug-sa to see which local.cf spamassassin/amavis is using. I found the solution, for now. amavisd -c /etc/amavisd/amavisd.con debug-sa Thanks Andrea - This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/ ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] score
b) the local.cf is not in the correct location. Use amavis debug-sa to see which local.cf spamassassin/amavis is using. I am becoming crazy!!! My amavisd.conf file is in the directory /etc/amavisd/. I used, as you recommended, the line command amavisd debug-sa to debug spamassassin. I received this message: Config file /etc/amavisd.conf does not exist, at /usr/sbin/amavisd line 1429. Andrea - This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/ ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] score
Andrea Bencini wrote: I installed postfix-2.4.5-2.fc8, amavisd-new-2.5.2-2.fc8 and spamassassin-3.2.3-2.fc8. They are running. I would like to test spam changing score in local.cf. My local.cf is: report_safe 0 use_bayes 1 use_bayes_rules 1 skip_rbl_checks 0 bayes_path /var/spool/amavisd/.spamassassin/bayes score FREE_PORN 1000 score LIVE_PORN 1100 Now I send an e-mail where there are the words porno and sex in the message body. I receive the e-mail via postfix/amavisd and in the message header there are X-Spam-Flag: NO X-Spam-Score: 3.181 X-Spam-Level: *** X-Spam-Status: No, score=3.181 tagged_above=0 required=5 tests=[AWL=-0.320, BAYES_99=3.5, STOX_REPLY_TYPE=0.001] Why there aren't FREE_PORN and LIVE_PORN scores? Did you restart amavis ? Thanks Andrea - This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/ ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] score
Andrea Bencini wrote: I installed postfix-2.4.5-2.fc8, amavisd-new-2.5.2-2.fc8 and spamassassin-3.2.3-2.fc8. They are running. I would like to test spam changing score in local.cf. My local.cf is: report_safe 0 use_bayes 1 use_bayes_rules 1 skip_rbl_checks 0 bayes_path /var/spool/amavisd/.spamassassin/bayes score FREE_PORN 1000 score LIVE_PORN 1100 Now I send an e-mail where there are the words porno and sex in the message body. I receive the e-mail via postfix/amavisd and in the message header there are X-Spam-Flag: NO X-Spam-Score: 3.181 X-Spam-Level: *** X-Spam-Status: No, score=3.181 tagged_above=0 required=5 tests=[AWL=-0.320, BAYES_99=3.5, STOX_REPLY_TYPE=0.001] Why there aren't FREE_PORN and LIVE_PORN scores? Did you restart amavis ? Yes I did. Andrea - This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/ ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
[AMaViS-user] score
I installed postfix-2.4.5-2.fc8, amavisd-new-2.5.2-2.fc8 and spamassassin-3.2.3-2.fc8. They are running. I would like to test spam changing score in local.cf. My local.cf is: report_safe 0 use_bayes 1 use_bayes_rules 1 skip_rbl_checks 0 bayes_path /var/spool/amavisd/.spamassassin/bayes score FREE_PORN 1000 score LIVE_PORN 1100 Now I send an e-mail where there are the words porno and sex in the message body. I receive the e-mail via postfix/amavisd and in the message header there are X-Spam-Flag: NO X-Spam-Score: 3.181 X-Spam-Level: *** X-Spam-Status: No, score=3.181 tagged_above=0 required=5 tests=[AWL=-0.320, BAYES_99=3.5, STOX_REPLY_TYPE=0.001] Why there aren't FREE_PORN and LIVE_PORN scores? Thanks Andrea - This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/ ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] score
Andrea Bencini wrote: Andrea Bencini wrote: I installed postfix-2.4.5-2.fc8, amavisd-new-2.5.2-2.fc8 and spamassassin-3.2.3-2.fc8. They are running. I would like to test spam changing score in local.cf. My local.cf is: score FREE_PORN 1000 score LIVE_PORN 1100 Now I send an e-mail where there are the words porno and sex in the message body. Why there aren't FREE_PORN and LIVE_PORN scores? Did you restart amavis ? Yes I did. Andrea So two things come to mind: a) the FREE_PORN pattern hits only when porn is preceded by free /\bfree (?:porn|xxx|adult)/i The LIVE_PORN likewise requires live followed by 0 or 9 characters, followed by sex (or other). See the patterns in 20_porn.cf, wherever that may reside on your system. b) the local.cf is not in the correct location. Use amavis debug-sa to see which local.cf spamassassin/amavis is using. MrC - This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/ ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] score
MrC wrote: Andrea Bencini wrote: Andrea Bencini wrote: I installed postfix-2.4.5-2.fc8, amavisd-new-2.5.2-2.fc8 and spamassassin-3.2.3-2.fc8. They are running. I would like to test spam changing score in local.cf. My local.cf is: score FREE_PORN 1000 score LIVE_PORN 1100 Now I send an e-mail where there are the words porno and sex in the message body. Why there aren't FREE_PORN and LIVE_PORN scores? Did you restart amavis ? Yes I did. Andrea So two things come to mind: a) the FREE_PORN pattern hits only when porn is preceded by free /\bfree (?:porn|xxx|adult)/i The LIVE_PORN likewise requires live followed by 0 or 9 characters, followed by sex (or other). See the patterns in 20_porn.cf, wherever that may reside on your system. People ought to know that simplistic keyword matching is wrong: - SusSEX, EsSEX, - cuCUMbers, - Charles DICKens - babCOCK State Park, ... - www.apluSEXam.com - www.surpluSEXchange.org - oTITS media - Sweet sixTEEN (and double score if you mispelle the 'i' :) - St MarTEEN - vaPOR NOble gas ... - This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse012070mrt/direct/01/ ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score= -
X-Spam-Score: - X-Spam-Status: No, score=x tagged_above=-999 required=5 tests=[] When spamassassin is not called, score=x is reported. When score is undefined, score='-' is reported. Yes. Actually both the '-' and 'x' mean the same thing, i.e. score is not known (normally because SA was not called). It is just that '-' appears in X-Spam-Score header field and an 'x' in other fields and in the log. The inconsistency was introduced when I decided to prefer 'x' to visually better distinguish it from negative scores, while I kept the '-' in X-Spam-Score for backwards compatibility. Mark - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score= -
--- Mark Martinec [EMAIL PROTECTED] wrote: X-Spam-Score: - X-Spam-Status: No, score=x tagged_above=-999 required=5 tests=[] When spamassassin is not called, score=x is reported. When score is undefined, score='-' is reported. Yes. Actually both the '-' and 'x' mean the same thing, i.e. score is not known (normally because SA was not called). It is just that '-' appears in X-Spam-Score header field and an 'x' in other fields and in the log. I've also wondered about the '-' score. Now my question is why SA would not be called? Peter __ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score= -
Peter, I've also wondered about the '-' score. Now my question is why SA would not be called? - message larger than $sa_mail_body_size_limit, or - all recipients have bypass_spam_checks, or - sender is hard- white or blacklisted. Mark - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score= -
On Mon, December 4, 2006 07:40, MrC wrote: When spamassassin is not called, score=x is reported. When score is undefined, score='-' is reported. olso if mail is oversized this happend -- This message was sent using 100% recycled spam mails. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
[AMaViS-user] Score= -
I've seen a couple of mails come through lately with score = x or score = -. Perhaps there have been some coming in all along like that and I haven't noticed it. What does score= x or score= - mean? Thanks, Mike X-Virus-Scanned: amavisd-new at cajuninc.com X-Spam-Score: - X-Spam-Level: X-Spam-Status: No, score=x tagged_above=-999 required=5 tests=[] Received: from moe.cajuninc.com ([127.0.0.1]) by localhost (moe.cajuninc.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7KvJkRngs1av for [EMAIL PROTECTED]; Sun, 3 Dec 2006 22:44:31 -0500 (EST) Received: from moe.cajuninc.com (moe.cajuninc.com [127.0.0.1]) by moe.cajuninc.com (Postfix) with ESMTP id C45E95F824D for [EMAIL PROTECTED]; Sun, 3 Dec 2006 22:44:00 -0500 (EST) Delivered-To: [EMAIL PROTECTED] -- This login session: $13.76, but for you: $11.88. 22:50:01 up 4 days, 12:16, 0 users, load average: 0.43, 0.41, 0.32 Linux Registered User #241685 http://counter.li.org - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score= -
I've seen a couple of mails come through lately with score = x or score = -. Perhaps there have been some coming in all along like that and I haven't noticed it. What does score= x or score= - mean? Thanks, Mike X-Virus-Scanned: amavisd-new at cajuninc.com X-Spam-Score: - X-Spam-Level: X-Spam-Status: No, score=x tagged_above=-999 required=5 tests=[] When spamassassin is not called, score=x is reported. When score is undefined, score='-' is reported. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
[AMaViS-user] Score too low in amavis
Hi, I'm really confused of how amavisd-new is using SpamAssassin, as I just cant get it to catch all my spammails. I've recently upgraded from a setup with SpamAssassin and ClamAV together with Qmail to a setup with postfix and amavisd-ew (with SpamAssassin and ClamAV). I changed my setup because I like that amavisd-new takes virus- and spammails in quarantine instead of the users having to set up mailrules to get rid of the infected mails. My big problem now is to actually put all the spammails in quarantine and not just deliver them to my mailusers. When SpamAssassin marks a message as being spam I have no guarantee that it will be marked as spam from amavis and that is very odd, as I see it. I have a been tailing my mail.log to see what score (hits) amavis gets from each of the mails and they often differ very much. As an example I have an email where amavis said: Passed CLEAN, [...] Hits: 3.427 [...] Though, when manually testing it through SpamAssassin (spamassassin -t -D mailfile) with the exact same configuration and bayes database it gets: Content analysis details: (12.6 points, 5.0 required) Now back to my frustration - why do amavis change this score? Is it somehow possible to change the behaviour of amavis so it will use the correct score from SpamAssassin? If the hits amavis is working with are not those from SpamAssassin, then how dows it calculate them? My setup is a Debian Stable with Postfix, SpamAssassin, ClamAV and amavisd-new from the backports repository. Hopefully someone will be able to help me. Thanks in advance. Sincerely, Jacob Volstrup - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score too low in amavis
Jacob wrote: Hi, I'm really confused of how amavisd-new is using SpamAssassin, as I just cant get it to catch all my spammails. I've recently upgraded from a setup with SpamAssassin and ClamAV together with Qmail to a setup with postfix and amavisd-ew (with SpamAssassin and ClamAV). I changed my setup because I like that amavisd-new takes virus- and spammails in quarantine instead of the users having to set up mailrules to get rid of the infected mails. My big problem now is to actually put all the spammails in quarantine and not just deliver them to my mailusers. When SpamAssassin marks a message as being spam I have no guarantee that it will be marked as spam from amavis and that is very odd, as I see it. I have a been tailing my mail.log to see what score (hits) amavis gets from each of the mails and they often differ very much. As an example I have an email where amavis said: Passed CLEAN, [...] Hits: 3.427 [...] Though, when manually testing it through SpamAssassin (spamassassin -t -D mailfile) with the exact same configuration and bayes database it gets: Content analysis details: (12.6 points, 5.0 required) Now back to my frustration - why do amavis change this score? Is it somehow possible to change the behaviour of amavis so it will use the correct score from SpamAssassin? If the hits amavis is working with are not those from SpamAssassin, then how dows it calculate them? My setup is a Debian Stable with Postfix, SpamAssassin, ClamAV and amavisd-new from the backports repository. Hopefully someone will be able to help me. Thanks in advance. Sincerely, Jacob Volstrup Read the section SpamAssassin returns different score http://www.ijs.si/software/amavisd/#faq-spam possibly most important, set: $sa_local_tests_only = 0; in amavisd.conf (or 50_user if that's what you have) It would have been informative if you had shown what rules hit in both cases. Gary V - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
[AMaViS-user] score=1.648-3 ?
Hi, I reviewed headers of a Yahoo Group I receive in my mailbox and found an interesting value for score in X-Spam-Status: X-Spam-Score: -1.352 X-Spam-Level: X-Spam-Status: No, score=1.648-3 tagged_above=-999 required=3.5 tests=[BAYES_50=0.001, DNS_FROM_RFC_ABUSE=0.2, DNS_FROM_RFC_WHOIS=1.447] I am probably missing something from the documentation and release notes, but why does it add -3, and based upon which rule? amavisd-new 2.4.2 and SA 3.1.3. TIA, Paolo - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] score=1.648-3 ?
I reviewed headers of a Yahoo Group I receive in my mailbox and found an interesting value for score in X-Spam-Status: X-Spam-Score: -1.352 X-Spam-Status: No, score=1.648-3 ... ^^ I am probably missing something from the documentation and release notes, but why does it add -3, and based upon which rule? amavisd-new 2.4.2 and SA 3.1.3. The -3 comes from score boost generated by amavisd itself. It is a sum of: pen pals and score_sender lookups. You probably have this entry in your @score_sender_maps: 'returns.groups.yahoo.com' = -3.0, Mark - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score ends in +10?
With amavisd-new-2.4.1 the list is compressed, successive same values are removed and represented by one number, so in the above example it would be only -1.814-3. Mark Thanks Mark. That will definitely make things easier. -Aaron --- All the advantages of Linux Managed Hosting--Without the Cost and Risk! Fully trained technicians. The highest number of Red Hat certifications in the hosting industry. Fanatical Support. Click to learn more http://sel.as-us.falkag.net/sel?cmd=lnkkid=107521bid=248729dat=121642 ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
[AMaViS-user] Score ends in +10?
Hello list, I'm trying to run amavislogsumm against my mail logs, and some of the scores are listed with a +10 at the end, which breaks the script. For example: May 23 10:17:22 216.186.73.25 amavis[7301]: (07301-01-9) SPAM-TAG, [EMAIL PROTECTED] - [EMAIL PROTECTED], Yes, score=6.13+10 tagged_above=1 required=6.2 tests=[BAYES_50=0.001, BODY_OPT_OUT=1, FH_FROM_START_1=0.233, FORGED_RCVD_HELO=0.135, FU_DOM_END_NUM=0.35, FU_DOM_START_NUM=0.259, HELO_MISMATCH_INFO=1.448, HOST_NMATCH_HELOCOM=0.311, HTML_MESSAGE=0.001, MIME_HEADER_CTYPE_ONLY=0, MIME_HTML_ONLY=0.001, MSGID_FROM_MTA_ID=1.393, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, TO_BE_REMOVED_4=1] Is that normal? -Aaron --- All the advantages of Linux Managed Hosting--Without the Cost and Risk! Fully trained technicians. The highest number of Red Hat certifications in the hosting industry. Fanatical Support. Click to learn more http://sel.as-us.falkag.net/sel?cmd=lnkkid=107521bid=248729dat=121642 ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score ends in +10?
On Tuesday 23 May 2006 12:45, Aaron Grewell wrote: Hello list, I'm trying to run amavislogsumm against my mail logs, and some of the scores are listed with a +10 at the end, which breaks the script. For example: May 23 10:17:22 216.186.73.25 amavis[7301]: (07301-01-9) SPAM-TAG, [EMAIL PROTECTED] - [EMAIL PROTECTED], Yes, score=6.13+10 tagged_above=1 required=6.2 tests=[BAYES_50=0.001, BODY_OPT_OUT=1, FH_FROM_START_1=0.233, FORGED_RCVD_HELO=0.135, FU_DOM_END_NUM=0.35, FU_DOM_START_NUM=0.259, HELO_MISMATCH_INFO=1.448, HOST_NMATCH_HELOCOM=0.311, HTML_MESSAGE=0.001, MIME_HEADER_CTYPE_ONLY=0, MIME_HTML_ONLY=0.001, MSGID_FROM_MTA_ID=1.393, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, TO_BE_REMOVED_4=1] Is that normal? -Aaron To expand on this, I'm running amavisd-new 2.4.0 SA 3.1.1 via Postfix on RHEL4 if that helps. When I updated from amavisd-new 2.3.0 SA 3.0.1 to the latest versions it broke amavislogsumm entirely, so I grabbed the latest release since it listed updates for 3.1.x. It kinda works, but doesn't like those scores, since it views them as non-numeric. I can chop them off in Perl if I have to, but I'd like to know what's causing them to appear in the first place. It seems like a strange way to score a message. Any insight you may have would be greatly appreciated. Thanks much, -Aaron --- All the advantages of Linux Managed Hosting--Without the Cost and Risk! Fully trained technicians. The highest number of Red Hat certifications in the hosting industry. Fanatical Support. Click to learn more http://sel.as-us.falkag.net/sel?cmd=lnkkid=107521bid=248729dat=121642 ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score ends in +10?
Aaron Grewell wrote: Hello list, I'm trying to run amavislogsumm against my mail logs, and some of the scores are listed with a +10 at the end, which breaks the script. For example: May 23 10:17:22 216.186.73.25 amavis[7301]: (07301-01-9) SPAM-TAG, [EMAIL PROTECTED] - [EMAIL PROTECTED], Yes, score=6.13+10 tagged_above=1 required=6.2 tests=[BAYES_50=0.001, BODY_OPT_OUT=1, FH_FROM_START_1=0.233, FORGED_RCVD_HELO=0.135, FU_DOM_END_NUM=0.35, FU_DOM_START_NUM=0.259, HELO_MISMATCH_INFO=1.448, HOST_NMATCH_HELOCOM=0.311, HTML_MESSAGE=0.001, MIME_HEADER_CTYPE_ONLY=0, MIME_HTML_ONLY=0.001, MSGID_FROM_MTA_ID=1.393, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, TO_BE_REMOVED_4=1] Is that normal? From what I understand of it the 6.13 is the score returned by spamassassin. the +10 is what amavisd added to the score because of soft-whitelisting/soft-blacklisting. The final score that amavisd-new goes by is not listed. You would have to add the sums up. This way you can distinguish between what spamassassin scored it and how amavisd-new scored it after soft white/blacklisting.. Very handy information than just showing the score as 16.13 I have also seen something like this... Hits: -1.814+(-3,-3,-3,-3,-3,-3,-3,-3,-3,-3,-3) when multiple whitelisting matched. The final score that amavisd-new acted on would be -34.814 --- All the advantages of Linux Managed Hosting--Without the Cost and Risk! Fully trained technicians. The highest number of Red Hat certifications in the hosting industry. Fanatical Support. Click to learn more http://sel.as-us.falkag.net/sel?cmd=lnkkid=107521bid=248729dat=121642 ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score ends in +10?
Aaron, Hits: -1.814+(-3,-3,-3,-3,-3,-3,-3,-3,-3,-3,-3) Ah, OK. Thanks. That last one is pretty evil. I shall have to consult my local Perlmeister and see if he can't help me fix up this script. One sender-score boost value (soft-whitelisting) for each recipient of the message, first recipient scores -1.814-3, second -1.814-3, ... With amavisd-new-2.4.1 the list is compressed, successive same values are removed and represented by one number, so in the above example it would be only -1.814-3. Mark --- All the advantages of Linux Managed Hosting--Without the Cost and Risk! Fully trained technicians. The highest number of Red Hat certifications in the hosting industry. Fanatical Support. Click to learn more http://sel.as-us.falkag.net/sel?cmd=lnkkid=107521bid=248729dat=121642 ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score Sender Maps
Chris, I currnetly have this in the file: # HASH LOOKUPS (associative array lookups) [EMAIL PROTECTED] 0 [EMAIL PROTECTED] 0 Yes, this is syntactically correct. But semantically - adding 0 score points to the SA score doesn't achieve much, does it? Add positive points to bend the score towards more-spammy (towards blacklisting), and add negative score points to bend it towards whitelisting. I assume this works, or should the syntax be: '[EMAIL PROTECTED] 0' No, not quotes in the file read by read_hash. --- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_id=7637alloc_id=16865op=click ___ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
Re: [AMaViS-user] Score Sender Maps
Chris,
Am I to understand via the example in amavisd.conf-sample, that the
whitelisting example can be put into a file
(/var/amavis/sender_scores_sitewide) then hashed and not within the
amavisd.conf file itself?
Yes indeed. Specify one sender address per line, either an exact sender
envelope address, or just a domain part (without '@'), possibly
prefixed by a dot to include subdomains. Domain is case-insensitive,
localpart is also usually case-insensitive (unless you have a
global setting $localpart_is_case_sensitive=1).
Comments from the source:
# read a lookup associative array (Perl hash) from a file - may be called
# from amavisd.conf
#
# Format: one key per line, anything from '#' to the end of line
# is considered a comment, but '#' within correctly quoted rfc2821
# addresses is not treated as a comment (e.g. a hash sign within
# strange # \foo\ address@example.com is part of the string).
# Lines may contain a pair: key value, separated by whitespace, or key only,
# in which case a value 1 is implied. Trailing whitespace is discarded,
# empty lines (containing only whitespace and comment) are ignored.
# Addresses (lefthand-side) are converted from rfc2821-quoted form
# into internal (raw) form and inserted as keys into a given hash.
# NOTE: the format is partly compatible with Postfix maps (not aliases):
# no continuation lines are honoured, Postfix maps do not allow
# rfc2821-quoted addresses containing whitespace, Postfix only allows
# comments starting at the beginning of a line.
#
# The $hashref argument is returned for convenience, so that one can do
# for example:
# $per_recip_whitelist_sender_lookup_tables = {
# '.my1.example.com' = read_hash({},'/var/amavis/my1-example-com.wl'),
# '.my2.example.com' = read_hash({},'/var/amavis/my2-example-com.wl') }
# or even simpler:
# $per_recip_whitelist_sender_lookup_tables = {
# '.my1.example.com' = read_hash('/var/amavis/my1-example-com.wl'),
# '.my2.example.com' = read_hash('/var/amavis/my2-example-com.wl') }
#
sub read_hash(@) { ...
Mark
---
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637alloc_id=16865op=click
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
