Re: Razor and ~500k mail/day

[Ryan Castellucci]

On Apr 4, 2005 10:36 PM, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote:
> Ryan Castellucci wrote:
> > I actualy emailed cloudmark about this for our installation that
> > processes 30k emails to pay, and I got a reply saying that it was fine
> > to use thier servers for free. I'd email them and ask.
> 
> Was this before or after the new license came into effect?

It was about two months ago.

Spamassassin only autolearning ham, not spam after upgrade to 3.0.2

[Kelly Corbin]

I have 4 machines configured identically (with the exception of the -m
option due to differences in resources on each machine) with
SpamAssassin and spamass-milter.  I recently upgraded to 3.0.2 from 2.64
and everything seems to be working pretty good with the exception of one
machine.  After watching the mail log, I noticed that it is not
autolearning any spam, no matter how high it scores.  It does autolearn
ham however, and the other 3 machines autolearn spam fine.
I've looked at everything I can think of (configuration files, file
permissions, checked FAQ's, searched list archives, etc.) and can't
figure out why it won't autolearn any spam.
Any ideas?
Thanks!
Kelly
--

-- Kelly Corbin
-- Network Administrator
--
-- http://www.theiqgroup.com
--
-- The IQ Group, Inc.
-- 6740 Antioch Suite 260
-- Merriam, KS 66204
-- (913)722-6700 x105
-- Fax (913)722-7264

RE: Update on Autolearn, SA/SA-milter ID problem, etc

[Don Levey]

Craig McLean wrote:
> Don, some thoughts inline..
>
> Don Levey wrote:

>>
>>> From what I see now, this is because if root is running it then the
>>> user
>> shifts to 'nobody'. This is damn inconvenient. So, I've tried to
>> shift to
>> using user 'spamassassin' by using the "-u spamassassin" switch on
>> both
>> spamd and spamass-milter. When I do this, though, I can't actually
>> read the
>> user_prefs file for user root. But why am I even trying to open it
>> for root,
>> when spamassassin is the UID?
>
> Why not combine the user_prefs and the local.cf, and move the
> whitelist somewhere where 'spamassassin' user can read/write to it?
>
The latest in my quest to get SA to work properly...

I've made sure that the whitelist and Bayes DB can be written to and be read
by 'spamassassin'.  I've set the '-u spamassassin' flag for both the
/etc/sysconfig/spamassassin and /etc/sysconfig/spamass-milter startup files.
I've restarted spamd, spamass-milter, and sendmail.

My ps list shows that 'spamassassin' is running spamd, and 'root' is running
spamass-milter.  In my maillog file, I am getting errors:
* for 'named' accounts, spamd can't find the user_prefs file
* for 'aliased' accounts, spamd can't find the username.

I know that I can solve the latter by putting the '-x' flag on the
spamass-milter startup line.  Do I need to worry about the former?  That is,
am I causing any problems by running this way, or am I simply now set up so
that I can run user-specific rules in addition to the site-wide ones?

 -Don

p.s. In case it wasn't clear, SpamAssassin really rocks!  I don't want my
current frustration to get in the way of the appreciation and adulation the
developers deserve.

Re: Razor and ~500k mail/day

[Johan Segernäs]

On 2005-04-04 11:03 -0500 or thereabouts, Brian Wong wrote:
> You can also try running your own DCC server.

Working on DCC as well, up and running i 5 hours but I'd like to use
pyzor/razor as well.

Re: Problems with spamassassin, milter-spamc, milter-sender and procmail

[Matt Kettler]

At 04:17 PM 4/4/2005, [EMAIL PROTECTED] wrote:
Well, I thought I had everything working just wonderfully ... all that 
nasty spam was being dropped into the bit
bucket as I wanted.  However, now I don't seem to be passing things 
through procmail such that they get dumped.
I am really puzzled -- I believe this may have started when I upgraded 
spamassassin to v.2.6.3.  Currently, I am using
ClamAV, Spamassassin 2.63, procmail and milter-sender and 
milter-spamc.  Here are some of the pertinent details:
You forgot to mention MailScanner.
However, if nothing else, ditch milter-spamc immediately.
You need to make sure you call spamassassin ONCE per message. You're 
currently calling it at least twice. Once from milter-spamc AND once again 
by calling spamc in procmailrc.  If MailScanner is using SpamAssassin, then 
you've got it called three times!

Ouch! That hurts in performance. To add insult to injury, re-scanning the 
messages might reduce your hit rate, as I explain below.

If milter-spamc sees the message as spam and you don't have "report_safe 0" 
set, it's going to encapsulate the spam in a new message with new headers 
and tag the subject.

Later when procmail passes the encapsulated message to spamc, it no longer 
looks like spam because of the new headers. None of the original Received: 
headers will be scanned for RBLs, as those are in the encapsulated message. 
Thus, to the second call to spamc, this message originated at localhost, 
instead of evilserver.spammer.com.

Poof. X-Spam-Status gets over-written with No.
That's probably your problem. 

Re: Razor and ~500k mail/day

[Daryl C. W. O'Shea]

Ryan Castellucci wrote:
I actualy emailed cloudmark about this for our installation that
processes 30k emails to pay, and I got a reply saying that it was fine
to use thier servers for free. I'd email them and ask.
Was this before or after the new license came into effect?

Re: Razor and ~500k mail/day

[Matt Kettler]

At 08:26 PM 4/4/2005, Ryan Castellucci wrote:
I actualy emailed cloudmark about this for our installation that
processes 30k emails to pay, and I got a reply saying that it was fine
to use thier servers for free. I'd email them and ask.
True, but regardless of what amount of email cloudmark is OK with you doing 
for free, you cannot run a local razor server for free. That's a for-pay 
option only.

Since the OP wanted to run a local razor server, I was stating that would 
not be possible with the free client.

As for doing 500k/day for free, yeah, you can ask cloudmark. However, I 
think the network load on your end might kill you without a local server 
when pushing 500k/day.

Re: RulesDuJour error updating bigevil.cf

[Jeff Chan]

On Monday, April 4, 2005, 8:25:38 AM, Matt Kettler wrote:
> Chris Santerre wrote:
>>I shall remove Bigevil info from the site tomorrow.

> Actually, if you wouldn't mind, Take the info down and replace it with a
> notice that the ruleset is dead and point them to using SURBL instead.

A good suggestion!  :-)

Jeff C.
-- 
Jeff Chan
mailto:[EMAIL PROTECTED]
http://www.surbl.org/

Re: SpamAssassin Without Bayes

[Thomas Cameron]

On Mon, 2005-04-04 at 12:28 -0400, Gustafson, Tim wrote:
> Hi Everyone!
> 
> I know that Bayes is "the" defacto best way to fight SPAM right now, but
> I wonder if anyone out there is running SA without Bayes turned on and
> what their experience with it is?
> 
> I run SA with Bayes enabled right now site-wide for more than 500 e-mail
> accounts, and my problem is that some of my clients who deal in
> industries that are very SPAMmy in nature (like a recruiting firm or an
> insurance agency) are getting e-mails tagged as SPAM that aren't SPAM
> (at least to my client) at all.  Most of these e-mails are being tagged
> because of their Bayes score, and I'm curious how many false negatives
> I'll get if I just turn of Bayes altogether.
> 
> Is there any log analysis tool that will tell me how many SPAMs would
> NOT have been marked as SPAM if a given rule was turned off when the
> e-mail was received?
> 
> Can anyone comment on the effectiveness of SA without Bayes activated?
> 
> Tim Gustafson
> MEI Technology Consulting, Inc
> [EMAIL PROTECTED]
> (516) 379-0001 Office
> (516) 480-1870 Mobile/Emergencies
> (516) 908-4185 Fax
> http://www.meitech.com/ 

I use SA with all the network tests on and spamass-milter to relay mail
from our external MX to the internal Exchange mail server.  We don't use
Bayes at all as there is no good way to train it.  We still have a
phenomenal success rate - very close to 100% accuracy.

I love Bayes for small environments, but even in big ones where it might
not be practical SA still kicks butt.

Thomas

RE: SpamAssassin Without Bayes

[Dan Kohn]

Rather than messing with a (nonexistent) plugin, I use a LearnAsSpam
folder.  This works on every Exchange server with IMAP enabled.

http://wiki.apache.org/spamassassin/SingleUserUnixInstall#head-bea6b8dc4
f219edd3b9976e8f922a8f1c0603125

Or 

http://tinyurl.com/5xhfa

If you want to get fancier, you could do a LearnAsHam folder that then
moved the message back to the Inbox after learning, but I haven't found
it necessary.  More details at:

http://wiki.apache.org/spamassassin/RemoteImapFolder

  - dan
--
Dan Kohn 
   

-Original Message-
From: Gustafson, Tim [mailto:[EMAIL PROTECTED] 
Sent: Monday, April 04, 2005 09:38
To: users@spamassassin.apache.org
Subject: RE: SpamAssassin Without Bayes

> I can't comment on the effectiveness of SA without Bayes, but I can 
> suggest a couple of things.   First, try just lowering the scores
given 
> to Bayes a bit so that emails won't be marked as spam solely because
of 
> Bayes.Secondly, try using per-user Bayes instead of global.   It
is 
> a little more work, but if you are serving email for a varied group of

> email accounts, it will be much more effective.

The problem with per-user Bayes for me is that I am running SpamAssassin
with spamass-milter, and my users are not savvy enough to be able to
update their own Bayes databases.  They don't use any shell accounts -
it's all POP3 and in some cases, after the e-mail passes through my SA
it gets forwarded to their Exchange server.

What would be awesome is if someone would write a plugin for Outlook
(which 99% of my clients use) that would "post" the content of an e-mail
to a web form with either a "SPAM" or "HAM" indicator so that I could
write a PHP script that would add the message to the "SPAM" or "HAM"
database, as needed.

Tim

RE: Spamassasin false positive review

[Dan Kohn]

Pipe the message to "spamassassin -d" to remove the markup.  You can
either do this directly from your Unix mail client or first save it as a
textfile and then run "spamassassin -d < file.txt".

  - dan
--
Dan Kohn 
   
-Original Message-
From: news [mailto:[EMAIL PROTECTED] On Behalf Of Edward Diener
Sent: Monday, April 04, 2005 12:46
To: users@spamassassin.apache.org
Subject: Spamassasin false positive review

I am a client who was able to configure my .procmailrc on a server to
place
spam messages in a file in my $HOME area. Going through this file I
noticed
a message that was not spam. I know I can whitelist this address, but
what I
really need to do immediately is recover the entire message. In the file
I
see part of the message with the actual message supposedly as an
attachment.
How do I find this actual message so that I can read it ?

Eddie

Re: Razor and ~500k mail/day

[Ryan Castellucci]

I actualy emailed cloudmark about this for our installation that
processes 30k emails to pay, and I got a reply saying that it was fine
to use thier servers for free. I'd email them and ask.

On Apr 4, 2005 9:03 AM, Brian Wong <[EMAIL PROTECTED]> wrote:
> On Apr 4, 2005 8:41 AM, Johan Segernäs <[EMAIL PROTECTED]> wrote:
> > On 2005-04-04 09:32 -0400 or thereabouts, Matt Kettler wrote:
> > > There's no way to do that with the free Razor client.
> >
> > Just read some service info and license and it looks like I have to choose
> > something else.
> >
> > A good howto on running my own pyzor server would be nice though.
> >
> >
> 
> You can also try running your own DCC server.
>