bayes not available ?
Hi when i start spamassassin -D --lint, i have: [20058] dbg: bayes: tie-ing to DB file R/O /var/spool/spamassassin/bayes_toks [20058] dbg: bayes: tie-ing to DB file R/O /var/spool/spamassassin/bayes_seen [20058] dbg: bayes: found bayes db version 3 [20058] dbg: bayes: DB journal sync: last sync: 0 [20058] dbg: bayes: not available for scanning, only 0 ham(s) in bayes DB 200 [20058] dbg: bayes: untie-ing [20058] dbg: bayes: untie-ing db_toks [20058] dbg: bayes: untie-ing db_seen It's a new server and in my local.conf: bayes_auto_learn1 bayes_auto_learn_threshold_nonspam 0.1 bayes_auto_learn_threshold_spam 9.0 bayes_path /var/spool/spamassassin/bayes bayes_file_mode 0777 on antoher server, same config i have: [18780] dbg: bayes: DB journal sync: last sync: 1178611276 [18780] dbg: bayes: corpus size: nspam = 5668441, nham = 16242 [18780] dbg: bayes: score = 0.324607088968461 [18780] dbg: bayes: DB journal sync: last sync: 1178611276 [18780] dbg: bayes: untie-ing [18780] dbg: bayes: untie-ing db_toks [18780] dbg: bayes: untie-ing db_seen I don't understand why on my first server, the counter dont increase after 48h of work and 100 000 mails recevied. Into /var/log/mail, i have a big quantity of: May 8 10:03:23 spam-9 spamd[27832]: prefork: child states: BIIB May 8 10:03:24 spam-9 spamd[21462]: spamd: identified spam (11.2/4.9) for qscand:407 in 4.1 seconds, 3155 bytes. May 8 10:03:24 spam-9 spamd[21462]: spamd: result: Y 11 - BOTNET_SERVERWORDS,DCC_CHECK,DIGEST_MULTIPLE,DRUGS_ERECTILE,DRUGS_STOCK_MIMEOLE,DRUG_ED_CAPS,FB_VIAGRA_LEO3,HTML_FONT_BIG,HTML_MESSAGE,IMPOTENCE,J_CHICKENPOX_43,J_CHICKENPOX_65,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_MILLIONSOF,SARE_SXLIFE scantime=4.1,size=3155,user=qscand,uid=407,required_score=4.9,rhost=spam-9.mydomaine.org,raddr=127.0.0.1,rport=34255,mid=[EMAIL PROTECTED],autolearn=spam May 8 10:03:24 spam-9 spamd[27832]: prefork: child states: BIII May 8 10:03:24 spam-9 spamd[27832]: spamd: handled cleanup of child pid 21462 due to SIGCHLD May 8 10:03:24 spam-9 spamd[27832]: prefork: child states: BII May 8 10:03:25 spam-9 spamd[18315]: spamd: identified spam (9.9/4.9) for qscand:407 in 2.9 seconds, 2261 bytes. May 8 10:03:25 spam-9 spamd[18315]: spamd: result: Y 9 - BOTNET_SERVERWORDS,DCC_CHECK,FM_NO_STYLE,HTML_FONT_BIG,HTML_MESSAGE,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB,SARE_LWTARGETP,SARE_MLB_Stock1,SARE_PROLOSTOCK_SYM1 scantime=2.9,size=2261,user=qscand,uid=407,required_score=4.9,rhost=spam-9.mydomaine.org,raddr=127.0.0.1,rport=34263,mid=[EMAIL PROTECTED],autolearn=spam he put a big quantity og autolearn=spam Thanks for your help
Second question on Bayes
Hi it's normal that i have a very big quantity of file into /var/spool/spamassassin ? : -r 1 qscand qscand168 déc 11 23:00 bayes.lock.mx-2.mondomaine.org.10008 -r 1 qscand qscand 96 fév 5 23:00 bayes.lock.mx-2.mondomaine.org.10159 -r 1 qscand qscand 72 avr 19 23:00 bayes.lock.mx-2.mondomaine.org.10359 -r 1 qscand qscand 96 mar 21 23:00 bayes.lock.mx-2.mondomaine.org.10366 -r 1 qscand qscand 24 avr 19 23:00 bayes.lock.mx-2.mondomaine.org.10377 -r 1 qscand qscand 96 mar 12 23:00 bayes.lock.mx-2.mondomaine.org.10413 -r 1 qscand qscand 24 fév 5 23:00 bayes.lock.mx-2.mondomaine.org.10471 -r 1 qscand qscand120 mar 15 23:00 bayes.lock.mx-2.mondomaine.org.10768 -r 1 qscand qscand 72 fév 3 23:00 bayes.lock.mx-2.mondomaine.org.10926 -r 1 qscand qscand168 fév 28 23:00 bayes.lock.mx-2.mondomaine.org.11341 -r 1 qscand qscand144 fév 28 23:00 bayes.lock.mx-2.mondomaine.org.11342 -r 1 qscand qscand 23 mar 25 23:00 bayes.lock.mx-2.mondomaine.org.1137 -r 1 qscand qscand120 fév 27 23:00 bayes.lock.mx-2.mondomaine.org.11446 -r 1 qscand qscand 24 jan 23 23:00 bayes.lock.mx-2.mondomaine.org.11465 -r 1 qscand qscand 48 déc 21 23:00 bayes.lock.mx-2.mondomaine.org.11466 ... -rw-rw-rw- 1 qscand qscand5058560 jan 16 07:50 bayes_toks.expire3397 -rw-rw-rw- 1 qscand qscand9936896 jan 14 13:40 bayes_toks.expire3463 -rw-rw-rw- 1 qscand qscand4952064 jan 15 00:09 bayes_toks.expire3488 -rw-rw-rw- 1 qscand qscand2572288 jan 16 03:42 bayes_toks.expire350 -rw-rw-rw- 1 qscand qscand 21053440 jan 6 01:19 bayes_toks.expire357 -rw-rw-rw- 1 qscand qscand5005312 jan 15 01:27 bayes_toks.expire4026 -rw-rw-rw- 1 qscand qscand 17428480 jan 14 00:22 bayes_toks.expire4039 -rw-rw-rw- 1 qscand qscand 17764352 jan 13 23:53 bayes_toks.expire4040 -rw-rw-rw- 1 qscand qscand 17285120 jan 14 00:32 bayes_toks.expire4118 -rw-rw-rw- 1 qscand qscand5079040 jan 16 05:41 bayes_toks.expire4229 -rw-rw-rw- 1 qscand qscand9715712 jan 14 16:39 bayes_toks.expire4464 -rw-rw-rw- 1 qscand qscand 21323776 jan 13 17:32 bayes_toks.expire449 -rw-rw-rw- 1 qscand qscand2531328 jan 16 21:08 bayes_toks.expire4722 -rw-rw-rw- 1 qscand qscand 21016576 jan 13 19:05 bayes_toks.expire4921 -rw-rw-rw- 1 qscand qscand 20795392 jan 13 22:33 bayes_toks.expire5131 -rw-rw-rw- 1 qscand qscand 21139456 fév 1 15:10 bayes_toks.expire5271 -rw-rw-rw- 1 qscand qscand5079040 jan 16 05:45 bayes_toks.expire5404 -rw-rw-rw- 1 qscand qscand 21041152 jan 13 20:54 bayes_toks.expire5421 -rw-rw-rw- 1 qscand qscand 21319680 mar 15 11:28 bayes_toks.expire5428 -rw-rw-rw- 1 qscand qscand 20983808 jan 11 16:18 bayes_toks.expire5901 -rw-rw-rw- 1 qscand qscand 21045248 jan 6 01:09 bayes_toks.expire5911 -rw-rw-rw- 1 qscand qscand 21110784 mar 19 12:27 bayes_toks.expire5949 -rw-rw-rw- 1 qscand qscand 21000192 jan 3 10:08 bayes_toks.expire6077 -rw-rw-rw- 1 qscand qscand 20987904 jan 11 16:03 bayes_toks.expire6081 Thanks
Re: Second question on Bayes
hi -- read the FAQ. --j. Noc Phibee writes: Hi it's normal that i have a very big quantity of file into /var/spool/spamassassin ? : -r 1 qscand qscand168 déc 11 23:00 bayes.lock.mx-2.mondomaine.org.10008 -r 1 qscand qscand 96 fév 5 23:00 bayes.lock.mx-2.mondomaine.org.10159 -r 1 qscand qscand 72 avr 19 23:00 bayes.lock.mx-2.mondomaine.org.10359 -r 1 qscand qscand 96 mar 21 23:00 bayes.lock.mx-2.mondomaine.org.10366 -r 1 qscand qscand 24 avr 19 23:00 bayes.lock.mx-2.mondomaine.org.10377 -r 1 qscand qscand 96 mar 12 23:00 bayes.lock.mx-2.mondomaine.org.10413 -r 1 qscand qscand 24 fév 5 23:00 bayes.lock.mx-2.mondomaine.org.10471 -r 1 qscand qscand120 mar 15 23:00 bayes.lock.mx-2.mondomaine.org.10768 -r 1 qscand qscand 72 fév 3 23:00 bayes.lock.mx-2.mondomaine.org.10926 -r 1 qscand qscand168 fév 28 23:00 bayes.lock.mx-2.mondomaine.org.11341 -r 1 qscand qscand144 fév 28 23:00 bayes.lock.mx-2.mondomaine.org.11342 -r 1 qscand qscand 23 mar 25 23:00 bayes.lock.mx-2.mondomaine.org.1137 -r 1 qscand qscand120 fév 27 23:00 bayes.lock.mx-2.mondomaine.org.11446 -r 1 qscand qscand 24 jan 23 23:00 bayes.lock.mx-2.mondomaine.org.11465 -r 1 qscand qscand 48 déc 21 23:00 bayes.lock.mx-2.mondomaine.org.11466 ... -rw-rw-rw- 1 qscand qscand5058560 jan 16 07:50 bayes_toks.expire3397 -rw-rw-rw- 1 qscand qscand9936896 jan 14 13:40 bayes_toks.expire3463 -rw-rw-rw- 1 qscand qscand4952064 jan 15 00:09 bayes_toks.expire3488 -rw-rw-rw- 1 qscand qscand2572288 jan 16 03:42 bayes_toks.expire350 -rw-rw-rw- 1 qscand qscand 21053440 jan 6 01:19 bayes_toks.expire357 -rw-rw-rw- 1 qscand qscand5005312 jan 15 01:27 bayes_toks.expire4026 -rw-rw-rw- 1 qscand qscand 17428480 jan 14 00:22 bayes_toks.expire4039 -rw-rw-rw- 1 qscand qscand 17764352 jan 13 23:53 bayes_toks.expire4040 -rw-rw-rw- 1 qscand qscand 17285120 jan 14 00:32 bayes_toks.expire4118 -rw-rw-rw- 1 qscand qscand5079040 jan 16 05:41 bayes_toks.expire4229 -rw-rw-rw- 1 qscand qscand9715712 jan 14 16:39 bayes_toks.expire4464 -rw-rw-rw- 1 qscand qscand 21323776 jan 13 17:32 bayes_toks.expire449 -rw-rw-rw- 1 qscand qscand2531328 jan 16 21:08 bayes_toks.expire4722 -rw-rw-rw- 1 qscand qscand 21016576 jan 13 19:05 bayes_toks.expire4921 -rw-rw-rw- 1 qscand qscand 20795392 jan 13 22:33 bayes_toks.expire5131 -rw-rw-rw- 1 qscand qscand 21139456 fév 1 15:10 bayes_toks.expire5271 -rw-rw-rw- 1 qscand qscand5079040 jan 16 05:45 bayes_toks.expire5404 -rw-rw-rw- 1 qscand qscand 21041152 jan 13 20:54 bayes_toks.expire5421 -rw-rw-rw- 1 qscand qscand 21319680 mar 15 11:28 bayes_toks.expire5428 -rw-rw-rw- 1 qscand qscand 20983808 jan 11 16:18 bayes_toks.expire5901 -rw-rw-rw- 1 qscand qscand 21045248 jan 6 01:09 bayes_toks.expire5911 -rw-rw-rw- 1 qscand qscand 21110784 mar 19 12:27 bayes_toks.expire5949 -rw-rw-rw- 1 qscand qscand 21000192 jan 3 10:08 bayes_toks.expire6077 -rw-rw-rw- 1 qscand qscand 20987904 jan 11 16:03 bayes_toks.expire6081 Thanks
Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available
Duane Hill writes: On Mon, 7 May 2007, Justin Mason wrote: Duane Hill writes: On Sat, 5 May 2007, Michael Scheidell wrote: [SNIP] There are a LOT of subtle changes... But for the brave, here is a tarball. cd /usr/ports/mail/p5-Mail-SpamAssassin rm -rf Untar this there: http://www.secnap.com/downloads/sa320.tgz Just an FYI followup. I have upgraded without any errors. I did notice sa-compile is not checked in the config by default. I know it is apparently broken. really? news to me ;) Or are you referring to the FAQ? 1) Doing a 'make config' from the port directory, the option for sa-compile states right after it 'broken'. hmm. There might be better ways to phrase this. unpackaged maybe. 2) In the Makefile, it states sa-compile doesn't work on FreeBSD and Solaris if you elect to use it and try doing a 'make' from the port directory. 3) Michael Scheidell stated in a response to my message And its obnoxious if you try to select it ;-) However, your response has prodded me to go beyond. I have uncommented the IGNORE within the make file and did a complete fresh install from scratch. I do get sa-compile to run without specifying any additional options on the command line. However, I get a few warning messages: body_0.xs: In function 'XS_Mail__SpamAssassin__CompiledRegexps__body_0_scan': body_0.xs:43: warning: ISO C90 forbids mixed declarations and code body_0.xs:51: warning: ISO C90 forbids mixed declarations and code body_0.xs:59: warning: ISO C90 forbids mixed declarations and code body_0.xs:67: warning: ISO C90 forbids mixed declarations and code Interesting! I hadn't heard of that warning before. We'll be fixing that in 3.2.1 anyway, since it seems MSVC considers it an error rather than a warning. I also uncommented the loadplugin line in v320.pre for the Rule2XSBody plugin. The compiled rules must be active according to the response I received from starting spamd: [18036] info: zoom: able to use 309/309 'body_0' compiled rules (100%) The version of re2c that was installed through an updated FreeBSD ports collection is 0.11.1 running on FreeBSD 6.2-RELEASE. That sounds like it's working -- although the FAQ I was talking about links to a comment by the re2c developer that versions 0.12.x *are* indeed broken, or at least can generate bad output or incorrect output. 0.12.0 works fine. --j.
SA 3.2.0 and Bayes
Hi, Since upgrading Bayes nolonger appears to trigger. If I run a -D --lint in the tests section at the bottom it does not report :- [18375] dbg: check: tests=BAYES_20,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS,TO_CC_NONE plus no RBL tests fire anymore :( I have checked the pre-requisites and that all looks fine. I have tested with a spam message and debug enabled and no errors are produced. Is there any additional debugging I can do ? TIA -- --[ UxBoD ]-- // PGP Key: curl -s http://www.splatnix.net/uxbod.asc | gpg --import // Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8 // Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8 // Phone: +44 (0) 845 869 2749 SIP: [EMAIL PROTECTED] -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
Re: SA 3.2.0 and Bayes
Here is my lint :-
SpamAssassin Lint[18703] dbg: logger: adding facilities: all0
[18703] dbg: logger: logging level is DBG 8E-05
[18703] dbg: generic: SpamAssassin version 3.2.03E-05
[18703] dbg: config: score set 0 chosen.0.00064
[18703] dbg: util: running in taint mode? no0.0004
[18703] dbg: dns: no ipv6 0.00452
[18703] dbg: dns: is Net::DNS::Resolver available? yes 3E-05
[18703] dbg: dns: Net::DNS version: 0.593E-05
[18703] dbg: diag: perl platform: 5.008008 linux0.17238
[18703] dbg: diag: module installed: Digest::SHA1, version 2.11 3E-05
[18703] dbg: diag: module installed: HTML::Parser, version 3.56 2E-05
[18703] dbg: diag: module installed: Net::DNS, version 0.59 2E-05
[18703] dbg: diag: module installed: MIME::Base64, version 3.05 3E-05
[18703] dbg: diag: module installed: DB_File, version 1.815 2E-05
[18703] dbg: diag: module installed: Net::SMTP, version 2.303E-05
[18703] dbg: diag: module not installed: Mail::SPF ('require' failed) 3E-05
[18703] dbg: diag: module installed: Mail::SPF::Query, version 1.999001
3E-05
[18703] dbg: diag: module installed: IP::Country::Fast, version 604.001
3E-05
[18703] dbg: diag: module installed: Razor2::Client::Agent, version 2.82
3E-05
[18703] dbg: diag: module installed: Net::Ident, version 1.20 3E-05
[18703] dbg: diag: module installed: IO::Socket::INET6, version 2.513E-05
[18703] dbg: diag: module installed: IO::Socket::SSL, version 1.05 2E-05
[18703] dbg: diag: module installed: Compress::Zlib, version 2.001 2E-05
[18703] dbg: diag: module installed: Time::HiRes, version 1.97070.0004
[18703] dbg: diag: module installed: Mail::DomainKeys, version 1.0 2E-05
[18703] dbg: diag: module installed: Mail::DKIM, version 0.24 2E-05
[18703] dbg: diag: module installed: DBI, version 1.54 3E-05
[18703] dbg: diag: module installed: Getopt::Long, version 2.36 2E-05
[18703] dbg: diag: module installed: LWP::UserAgent, version 2.033 3E-05
[18703] dbg: diag: module installed: HTTP::Date, version 1.47 2E-05
[18703] dbg: diag: module installed: Archive::Tar, version 1.30 2E-05
[18703] dbg: diag: module installed: IO::Zlib, version 1.05 2E-05
[18703] dbg: ignore: using a test message to lint rules 3E-05
[18703] dbg: config: using /etc/mail/spamassassin for site rules pre files
3E-05
[18703] dbg: config: read file /etc/mail/spamassassin/init.pre 2E-05
[18703] dbg: config: read file /etc/mail/spamassassin/v310.pre 2E-05
[18703] dbg: config: read file /etc/mail/spamassassin/v312.pre 2E-05
[18703] dbg: config: read file /etc/mail/spamassassin/v320.pre 2E-05
[18703] dbg: config: using /var/lib/spamassassin/3.002000 for sys rules pre
files 3E-05
[18703] dbg: config: read file
/var/lib/spamassassin/3.002000/saupdates_openprotect_com.pre 3E-05
[18703] dbg: config: using /var/lib/spamassassin/3.002000 for default rules
dir 3E-05
[18703] dbg: config: read file
/var/lib/spamassassin/3.002000/saupdates_openprotect_com.cf 2E-05
[18703] dbg: config: using /etc/mail/spamassassin for site rules dir 3E-05
[18703] dbg: config: read file /etc/mail/spamassassin/Botnet.cf 0.0003
[18703] dbg: config: read file /etc/mail/spamassassin/Chinese_rules.cf 0.00146
[18703] dbg: config: read file /etc/mail/spamassassin/FuzzyOcr.cf 0.00044
[18703] dbg: config: read file /etc/mail/spamassassin/local.cf 9E-05
[18703] dbg: config: read file /etc/mail/spamassassin/mailscanner.cf0.00019
[18703] dbg: config: read file /etc/mail/spamassassin/secrets.cf8E-05
[18703] dbg: config: read file /etc/mail/spamassassin/uxbod.cf 5E-05
[18703] dbg: config: using /opt/MailScanner/etc/spam.assassin.prefs.conf for
user prefs file 0.00049
[18703] dbg: config: read file /opt/MailScanner/etc/spam.assassin.prefs.conf
0.00021
[18703] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
0.00225
[18703] dbg: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
0.00354
[18703] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC 0.00194
[18703] dbg: plugin: loading Mail::SpamAssassin::Plugin::DCC from @INC 0.00361
[18703] dbg: dcc: local tests only, disabling DCC 0.00461
[18703] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
0.00021
[18703] dbg: plugin: did not register
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x2635010), already registered
0.00018
[18703] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor from @INC
6E-05
[18703] dbg: pyzor: local tests only, disabling Pyzor 0.00185
[18703] dbg: plugin: loading Mail::SpamAssassin::Plugin::Razor2 from @INC
0.00014
[18703] dbg: razor2: local tests only, skipping Razor 0.00194
[18703] dbg: plugin: loading Mail::SpamAssassin::Plugin::SpamCop from @INC
0.00013
[18703] dbg: reporter: local tests only, disabling SpamCop
Re: bayes not available ?
Noc Phibee schrieb: Hi when i start spamassassin -D --lint, i have: [20058] dbg: bayes: tie-ing to DB file R/O /var/spool/spamassassin/bayes_toks [20058] dbg: bayes: tie-ing to DB file R/O /var/spool/spamassassin/bayes_seen [20058] dbg: bayes: found bayes db version 3 [20058] dbg: bayes: DB journal sync: last sync: 0 [20058] dbg: bayes: not available for scanning, only 0 ham(s) in bayes DB 200 [20058] dbg: bayes: untie-ing [20058] dbg: bayes: untie-ing db_toks [20058] dbg: bayes: untie-ing db_seen It's a new server and in my local.conf: bayes_auto_learn1 bayes_auto_learn_threshold_nonspam 0.1 bayes_auto_learn_threshold_spam 9.0 bayes_path /var/spool/spamassassin/bayes bayes_file_mode 0777 on antoher server, same config i have: [18780] dbg: bayes: DB journal sync: last sync: 1178611276 [18780] dbg: bayes: corpus size: nspam = 5668441, nham = 16242 [18780] dbg: bayes: score = 0.324607088968461 [18780] dbg: bayes: DB journal sync: last sync: 1178611276 [18780] dbg: bayes: untie-ing [18780] dbg: bayes: untie-ing db_toks [18780] dbg: bayes: untie-ing db_seen I don't understand why on my first server, the counter dont increase after 48h of work and 100 000 mails recevied. Into /var/log/mail, i have a big quantity of: May 8 10:03:23 spam-9 spamd[27832]: prefork: child states: BIIB May 8 10:03:24 spam-9 spamd[21462]: spamd: identified spam (11.2/4.9) for qscand:407 in 4.1 seconds, 3155 bytes. May 8 10:03:24 spam-9 spamd[21462]: spamd: result: Y 11 - BOTNET_SERVERWORDS,DCC_CHECK,DIGEST_MULTIPLE,DRUGS_ERECTILE,DRUGS_STOCK_MIMEOLE,DRUG_ED_CAPS,FB_VIAGRA_LEO3,HTML_FONT_BIG,HTML_MESSAGE,IMPOTENCE,J_CHICKENPOX_43,J_CHICKENPOX_65,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,RAZOR2_CHECK,SARE_MILLIONSOF,SARE_SXLIFE scantime=4.1,size=3155,user=qscand,uid=407,required_score=4.9,rhost=spam-9.mydomaine.org,raddr=127.0.0.1,rport=34255,mid=[EMAIL PROTECTED],autolearn=spam May 8 10:03:24 spam-9 spamd[27832]: prefork: child states: BIII May 8 10:03:24 spam-9 spamd[27832]: spamd: handled cleanup of child pid 21462 due to SIGCHLD May 8 10:03:24 spam-9 spamd[27832]: prefork: child states: BII May 8 10:03:25 spam-9 spamd[18315]: spamd: identified spam (9.9/4.9) for qscand:407 in 2.9 seconds, 2261 bytes. May 8 10:03:25 spam-9 spamd[18315]: spamd: result: Y 9 - BOTNET_SERVERWORDS,DCC_CHECK,FM_NO_STYLE,HTML_FONT_BIG,HTML_MESSAGE,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB,SARE_LWTARGETP,SARE_MLB_Stock1,SARE_PROLOSTOCK_SYM1 scantime=2.9,size=2261,user=qscand,uid=407,required_score=4.9,rhost=spam-9.mydomaine.org,raddr=127.0.0.1,rport=34263,mid=[EMAIL PROTECTED],autolearn=spam Only to be sure: It´s the same user (for autolearning) and for spamassassin --lint? he put a big quantity og autolearn=spam Thanks for your help -- Grüsse/Greetings MH Dont send mail to: [EMAIL PROTECTED] --
Re: FuzzyOcr 3.5.1 released
The installation notes for Fedora Core (version 5 and 6) should say that the rpm needed is giflib-utils not libungif-utils. Can someone amend the wiki please? I don't know how to use a wiki (in fact I really don't like them). Cheers Bill -- Bill Maidment Maidment Enterprises Pty Ltd www.maidment.vu
RE: ANNOUNCE: Apache SpamAssassin 3.2.0 available
-Original Message- From: Duane Hill [mailto:[EMAIL PROTECTED] Sent: Monday, May 07, 2007 8:06 PM To: users@spamassassin.apache.org Subject: Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available body_0.xs: In function 'XS_Mail__SpamAssassin__CompiledRegexps__body_0_scan': body_0.xs:43: warning: ISO C90 forbids mixed declarations and code body_0.xs:51: warning: ISO C90 forbids mixed declarations and code body_0.xs:59: warning: ISO C90 forbids mixed declarations and code body_0.xs:67: warning: ISO C90 forbids mixed declarations and code I also uncommented the loadplugin line in v320.pre for the Rule2XSBody plugin. The compiled rules must be active according to the response I received from starting spamd: And randomly, spamd will crash since... .11.1 is broken. Maybe prode maintainer to fix it. -- Michael Scheidell, CTO Join SECNAP at SecureWorld Philadelphia May 16-17 http://www.secnap.com/events for free and discounted seminar tickets _ This email has been scanned and certified safe by SpammerTrap(tm). For Information please see http://www.spammertrap.com _
RE: ANNOUNCE: Apache SpamAssassin 3.2.0 available
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, May 07, 2007 6:59 PM To: Duane Hill Cc: users@spamassassin.apache.org Subject: Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available really? news to me ;) Not sa-compile, just sa-compile on freebsd (since it requires version .12 of re2c and port is currently at .11.1) I have emailed the port maintainer, and may test some patches myself if I get a chance. _ This email has been scanned and certified safe by SpammerTrap(tm). For Information please see http://www.spammertrap.com _
SPF custom rule
Hi all I need to look at setting up a custom rule based on a SPF result. If mail is sent from domain xyz.com and the SPF record matches, let it pass as per normal. If on the other hand the SPF record fails for xyz.com, add +5 to the score. This has to happen ONLY for domain xyz.com. All others will be handled by Spamassassin the normal way. I'm new to these sort of rules so any help would be greatly appreciated. Regards JvdW
RE: ANNOUNCE: Apache SpamAssassin 3.2.0 available
On Tue, 8 May 2007, Michael Scheidell wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, May 07, 2007 6:59 PM To: Duane Hill Cc: users@spamassassin.apache.org Subject: Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available really? news to me ;) Not sa-compile, just sa-compile on freebsd (since it requires version .12 of re2c and port is currently at .11.1) I have emailed the port maintainer, and may test some patches myself if I get a chance. I have just successfully installed re2c 0.12.0 from sources. The version reported back from 're2c -V' shows '001200'. Further testing by tossing random messages through with text from the tests, I have not seen any errors yet.
RE: SPF custom rule
I need to look at setting up a custom rule based on a SPF result. If mail is sent from domain xyz.com and the SPF record matches, let it pass as per normal. If on the other hand the SPF record fails for xyz.com, add +5 to the score. This has to happen ONLY for domain xyz.com. All others will be handled by Spamassassin the normal way. I can't specify the syntax directly for you, but a good method of doing this would be to create a rule to detect the message is from that domain then use a meta rule to score if the message hits both from that domain and SPF_FAIL. Bret
automagic rejection
I know there are 3 new packages out for MailScanner, spamd and clamd however I cannot determine with is adding to the /etc/mail/access file 550 We do not accept junk mail . I need to turn of this feature as it block transmission from secondary to +primary. Also I am running Botnet 0.7 . -- Member - Liberal International This is [EMAIL PROTECTED] Ici [EMAIL PROTECTED] God Queen and country! Beware Anti-Christ rising! Manitoba!! On 22 May Get rid of the extremists and VOTE LIBERAL! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
Re: automagic rejection
The Doctor wrote: I know there are 3 new packages out for MailScanner, spamd and clamd however I cannot determine with is adding to the /etc/mail/access file 550 We do not accept junk mail . I need to turn of this feature as it block transmission from secondary to +primary. Also I am running Botnet 0.7 . First, is it really being added to /etc/mail/access? Or is it doing a 550 based on a milter? I run MailScanner, and with MailScanner you do NOT need spamd. In fact, it WILL NOT use spamd, as that would be slower. Given that MailScanner uses the perl API directly and caches it's own Mail::SpamAssassin objects, it is in essence its own spamd. So save yourself the memory and shut spamd down. Also, AFAIK, none of those tools has any feature to add to /etc/mail/access by default, but there might be some add-on tool you've installed that might parse your logs and add such things.
Re: automagic rejection
On Tue, May 08, 2007 at 10:21:38AM -0400, Matt Kettler wrote: The Doctor wrote: I know there are 3 new packages out for MailScanner, spamd and clamd however I cannot determine with is adding to the /etc/mail/access file 550 We do not accept junk mail . I need to turn of this feature as it block transmission from secondary to +primary. Also I am running Botnet 0.7 . First, is it really being added to /etc/mail/access? Or is it doing a 550 based on a milter? I run MailScanner, and with MailScanner you do NOT need spamd. In fact, it WILL NOT use spamd, as that would be slower. Given that MailScanner uses the perl API directly and caches it's own Mail::SpamAssassin objects, it is in essence its own spamd. So save yourself the memory and shut spamd down. Also, AFAIK, none of those tools has any feature to add to /etc/mail/access by default, but there might be some add-on tool you've installed that might parse your logs and add such things. Interesting enough when spamd choke on the secondary server, it just piled the mail up. Still getting back to the original question, is their anything new that is causing this? -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- Member - Liberal International This is [EMAIL PROTECTED] Ici [EMAIL PROTECTED] God Queen and country! Beware Anti-Christ rising! Manitoba!! On 22 May Get rid of the extremists and VOTE LIBERAL! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
different scores with spamc
setup : [EMAIL PROTECTED]:/tmp$ spamc -V SpamAssassin Client version 3.1.7 compiled with SSL support (OpenSSL 0.9.8c 05 Sep 2006) i get totaly different scores when i run spamc from the commandline as vpopmail user as when i run i from procmail also as vpopmail user. Here are some outputs run from procmail as vpopmail user X-Spam-Status: No, score=-2.4 required=3.4 tests=ADVANCE_FEE_1,AWL,BAYES_00 autolearn=ham version=3.1.7 run from cmd line as vpopmail user X-Spam-Status: No, score=3.2 required=3.4 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_00,MISSING_HB_SEP,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS, TO_CC_NONE autolearn=no version=3.1.7 what makes the the difference between running it from procmail or running it on the commandline. 1) i am 99% sure it is run as the same user any idea's, i am hopeless after 8 hours of searching /* part of spamd logging in syslog */ I see that it is run a vpopmail users UID = 89 May 8 10:28:18 vmdebian1 spamd[12459]: spamd: connection from localhost.localdomain [127.0.0.1] at port 54573 May 8 10:28:18 vmdebian1 spamd[12459]: spamd: processing message [EMAIL PROTECTED] for vpopmail:89 May 8 10:28:18 vmdebian1 spamd[12459]: spamd: clean message (-2.4/3.5) for vpopmail:89 in 0.2 seconds, 3130 bytes. May 8 10:28:18 vmdebian1 spamd[12459]: spamd: result: . -2 - ADVANCE_FEE_1,AWL,BAYES_00 scantime=0.2 ,size=3130,user=vpopmail,uid=89,required_score=3.5,rhost= localhost.localdomain,raddr=127.0.0.1,rport=54573,mid= [EMAIL PROTECTED],bayes=1.11022302462516e-16 ,autolearn=ham May 8 10:28:18 vmdebian1 spamd[581]: prefork: child states: II
Re: Problem installing SA 3.2.0 via CPAN on OPenSuSE 10.2 or SLES 10
Stephen: Cannot help you out, but I also receive the same errors on both of my SLES10 boxes. Install on Opensuse 10.1 from either source or cpan works fine which is strange since SLES10 is based on 10.1. Best, Stephen Carter wrote: Hi guys, I've tried to install SA 3.2.0 on both an unpatched and fully patched versions of OpenSuSE 10.2 and SLES 10 via CPAN but on all attempts I receive the following errors during one of the test phases. It would be great if someone could help me out. t/spamc_z...Not found: firstline = Return-Path: [EMAIL PROTECTED] # Failed test 2 in t/SATest.pm at line 633 Not found: subj = Subject: There yours for FREE! # Failed test 3 in t/SATest.pm at line 633 fail #2 Not found: endsinnums = TEST_ENDSNUMS # Failed test 4 in t/SATest.pm at line 633 fail #3 Not found: noreal = TEST_NOREALNAME # Failed test 5 in t/SATest.pm at line 633 fail #4 Not found: lastline = This must be the very last line # Failed test 6 in t/SATest.pm at line 633 fail #5 Not found: flag = X-Spam-Flag: YES # Failed test 7 in t/SATest.pm at line 633 fail #6 Not found: stars = X-Spam-Level: ** # Failed test 8 in t/SATest.pm at line 633 fail #7 Not found: status = X-Spam-Status: Yes, score= # Failed test 9 in t/SATest.pm at line 633 fail #8 Output can be examined in: log/d.spamc_z/out.1 t/spamc_z...FAILED tests 2-9 Failed 8/9 tests, 11.11% okay Thanks, begin:vcard fn:Dr. Craig Carriere n:Carriere;Craig org:Cobatco Inc. adr:;;1215 NE Adams Street;Peoria;IL;61550;USA email;internet:[EMAIL PROTECTED] tel;work:309.676.2663 tel;fax:309.676.2667 url:http://www.cobatco.com version:2.1 end:vcard
Re: different scores with spamc
On Tue, May 08, 2007 at 05:02:28PM +0200, Joeri Belis wrote: run from cmd line as vpopmail user X-Spam-Status: No, score=3.2 required=3.4 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_00,MISSING_HB_SEP,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS, TO_CC_NONE autolearn=no version=3.1.7 Everything after BAYES_00 indicates that SA isn't receiving the mail properly. -- Randomly Selected Tagline: The universe is already insane, anything else would be redundant. - Londo on Babylon 5 pgpz8AinMW5dD.pgp Description: PGP signature
[Fwd: Re: ports/112524: patches to update re2c to .12.0]
fyi: anyone wanting to experiment with sa-compile on FREEBSD can dl the patches here: http://www.secnap.com/downloads/re2c.tgz (if you have to ask how to modify Makefile to make it work, then wait till I can release 3.2.0_1) Original Message Subject:Re: ports/112524: patches to update re2c to .12.0 Date: Tue, 8 May 2007 16:40:04 GMT From: [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED], [EMAIL PROTECTED] To: Michael Scheidell [EMAIL PROTECTED] Thank you very much for your problem report. It has the internal identification `ports/112524'. The individual assigned to look at your report is: freebsd-ports-bugs. You can access the state of your problem report at any time via this link: http://www.freebsd.org/cgi/query-pr.cgi?pr=112524 Category: ports Responsible:freebsd-ports-bugs Synopsis: patches to update re2c to .12.0 Arrival-Date: Tue May 08 16:40:04 GMT 2007 _ This email has been scanned and certified safe by SpammerTrap(tm). For Information please see http://www.spammertrap.com _
HELO_DYNAMIC_IPADDR not explainable
Emails from one of my accounts often get the HELO_DYNAMIC_IPADDR but I can´t see why! Check this mail: Received: from localhost by webbox413.server-home.net with SpamAssassin (version 3.1.3); Tue, 08 May 2007 15:52:01 +0200 From: Marcel Korte [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: *SPAM* TEST!!! Date: Tue, 8 May 2007 15:51:46 +0200 Message-Id: [EMAIL PROTECTED] X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on webbox413.server-home.net X-Spam-Level: *** X-Spam-Status: Yes, score=7.6 required=5.0 tests=AWL,BAYES_80, FORGED_RCVD_HELO,HELO_DYNAMIC_IPADDR,PLING_PLING autolearn=no version=3.1.3 X-Spam-Report: * 4.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr * 1) * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8032] * 0.3 PLING_PLING Subject has lots of exclamation marks * 1.0 AWL AWL: From: address is in the auto white-list MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=--=_46408081.5D87A5E1 This is a multi-part message in MIME format. -- View this message in context: http://www.nabble.com/HELO_DYNAMIC_IPADDR-not-explainable-tf3710870.html#a10379762 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: HELO_DYNAMIC_IPADDR not explainable
DogMatz wrote: Emails from one of my accounts often get the HELO_DYNAMIC_IPADDR but I can´t see why! Nor can we since you didn't include the headers from the actual message scanned, rather just the report_safe encapsulation headers. Daryl Check this mail: Received: from localhost by webbox413.server-home.net with SpamAssassin (version 3.1.3); Tue, 08 May 2007 15:52:01 +0200 From: Marcel Korte [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: *SPAM* TEST!!! Date: Tue, 8 May 2007 15:51:46 +0200 Message-Id: [EMAIL PROTECTED] X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on webbox413.server-home.net X-Spam-Level: *** X-Spam-Status: Yes, score=7.6 required=5.0 tests=AWL,BAYES_80, FORGED_RCVD_HELO,HELO_DYNAMIC_IPADDR,PLING_PLING autolearn=no version=3.1.3 X-Spam-Report: * 4.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr * 1) * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8032] * 0.3 PLING_PLING Subject has lots of exclamation marks * 1.0 AWL AWL: From: address is in the auto white-list MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=--=_46408081.5D87A5E1 This is a multi-part message in MIME format.
Spamd/perl error.
I am having trouble running spamd. This started after I installed FuzzyOCR, found errors, upgraded perl to 5.8.8 to resolve those errors and ended up with this: [EMAIL PROTECTED] ~]# /etc/init.d/spamassassin start Starting spamd: Can't locate object method register_domain via package IO::Socket::INET at /usr/local/lib/perl5/5.8.8/i686-linux/IO/Socket/INET.pm line 22. Compilation failed in require at /usr/bin/spamd line 44. BEGIN failed--compilation aborted at /usr/bin/spamd line 79. [FAILED] The INET installed is: cpan[12] install IO::Socket::INET IO::Socket::INET is up to date (1.31). I've posted the results of spamassassin -D --lint here: http://avas.cnc.bc.ca/lint.txt If I neglect the warnings at the bottom of lint then spamd should start anyways but it doesn't. I'm pretty sure its a perl problem at this point, but I'm not strong enough yet in perl to get to the bottom of it. Anyone out there that could help out? = Kevin W. Gagel Network Administrator Information Technology Services (250) 562-2131 local 448 My Blog: http://mail.cnc.bc.ca/blogs/gagel --- The College of New Caledonia, Visit us at http://www.cnc.bc.ca Virus scanning is done on all incoming and outgoing email. Anti-spam information for CNC can be found at http://avas.cnc.bc.ca ---
Poor performance with v3.2.0
Running SpamAssassin v3.2.0 on Solaris 9, perl v5.8.8. I am getting really poor performance with v3.2.0 compared with v3.1.8. Average scan time per message is doubled (or worse). I'm also seeing messages like this in the log file (although not all the time): May 7 17:10:20 localhost spamd[19457]: plugin: eval failed: child processing timeout at /usr/local/bin/spamd line 1259, GEN390 line 377. May 7 17:11:24 localhost spamd[19447]: plugin: eval failed: child processing timeout at /usr/local/bin/spamd line 1259, GEN464 line 1097. Is there any way to tell what the timeout was waiting for, or why performance has gotten worse? I haven't changed the rules. Thanks, Larry
Re: HELO_DYNAMIC_IPADDR not explainable
Ooops :-) Here we go: --- Content-Type: message/rfc822; x-spam-type=original Content-Description: original message before SpamAssassin Content-Disposition: inline Content-Transfer-Encoding: 8bit Return-Path: [EMAIL PROTECTED] X-Original-To: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Received: from lvps87-230-7-51.dedicated.hosteurope.de (server.marcelkorte.de [87.230.7.51]) by webbox413.server-home.net (Postfix) with ESMTP id 1E854783 for [EMAIL PROTECTED]; Tue, 8 May 2007 15:51:59 +0200 (CEST) Received: (qmail 15347 invoked from network); 8 May 2007 15:51:59 +0200 Received: from ip234.165.1211g-cud12k-02.ish.de (HELO ?192.168.178.20?) (62.143.165.234) by server.marcelkorte.de with SMTP; 8 May 2007 15:51:58 +0200 Mime-Version: 1.0 (Apple Message framework v752.3) Content-Transfer-Encoding: 7bit Message-Id: [EMAIL PROTECTED] Content-Type: text/plain; charset=US-ASCII; format=flowed To: [EMAIL PROTECTED] From: Marcel Korte [EMAIL PROTECTED] Subject: TEST!!! Date: Tue, 8 May 2007 15:51:46 +0200 X-Mailer: Apple Mail (2.752.3) -- Well, I guess that the reason lies in Received: from lvps87-230-7-51.dedicated.hosteurope.de. But still. I don´t understand where that might come frome since nslookup 87.230.7.51 shows the correct hostname server.marcelkorte.de. Daryl C. W. O wrote: DogMatz wrote: Emails from one of my accounts often get the HELO_DYNAMIC_IPADDR but I can´t see why! Nor can we since you didn't include the headers from the actual message scanned, rather just the report_safe encapsulation headers. Daryl Check this mail: Received: from localhost by webbox413.server-home.net with SpamAssassin (version 3.1.3); Tue, 08 May 2007 15:52:01 +0200 From: Marcel Korte [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: *SPAM* TEST!!! Date: Tue, 8 May 2007 15:51:46 +0200 Message-Id: [EMAIL PROTECTED] X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on webbox413.server-home.net X-Spam-Level: *** X-Spam-Status: Yes, score=7.6 required=5.0 tests=AWL,BAYES_80, FORGED_RCVD_HELO,HELO_DYNAMIC_IPADDR,PLING_PLING autolearn=no version=3.1.3 X-Spam-Report: * 4.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr * 1) * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO * 2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95% * [score: 0.8032] * 0.3 PLING_PLING Subject has lots of exclamation marks * 1.0 AWL AWL: From: address is in the auto white-list MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=--=_46408081.5D87A5E1 This is a multi-part message in MIME format. -- View this message in context: http://www.nabble.com/HELO_DYNAMIC_IPADDR-not-explainable-tf3710870.html#a10381040 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Problem installing SA 3.2.0 via CPAN on OPenSuSE 10.2 or SLES 10
Stephen: A follow up to my own message. I have been able to successfully install 3.2 on my backup SLES 10 mail server from the download source code. CPAN still fails with the error you mentioned. When I installed 3.18 I used CPAN without problems. Best Craig Carriere wrote: Stephen: Cannot help you out, but I also receive the same errors on both of my SLES10 boxes. Install on Opensuse 10.1 from either source or cpan works fine which is strange since SLES10 is based on 10.1. Best, Stephen Carter wrote: Hi guys, I've tried to install SA 3.2.0 on both an unpatched and fully patched versions of OpenSuSE 10.2 and SLES 10 via CPAN but on all attempts I receive the following errors during one of the test phases. It would be great if someone could help me out. t/spamc_z...Not found: firstline = Return-Path: [EMAIL PROTECTED] # Failed test 2 in t/SATest.pm at line 633 Not found: subj = Subject: There yours for FREE! # Failed test 3 in t/SATest.pm at line 633 fail #2 Not found: endsinnums = TEST_ENDSNUMS # Failed test 4 in t/SATest.pm at line 633 fail #3 Not found: noreal = TEST_NOREALNAME # Failed test 5 in t/SATest.pm at line 633 fail #4 Not found: lastline = This must be the very last line # Failed test 6 in t/SATest.pm at line 633 fail #5 Not found: flag = X-Spam-Flag: YES # Failed test 7 in t/SATest.pm at line 633 fail #6 Not found: stars = X-Spam-Level: ** # Failed test 8 in t/SATest.pm at line 633 fail #7 Not found: status = X-Spam-Status: Yes, score= # Failed test 9 in t/SATest.pm at line 633 fail #8 Output can be examined in: log/d.spamc_z/out.1 t/spamc_z...FAILED tests 2-9 Failed 8/9 tests, 11.11% okay Thanks, begin:vcard fn:Dr. Craig Carriere n:Carriere;Craig org:Cobatco Inc. adr:;;1215 NE Adams Street;Peoria;IL;61550;USA email;internet:[EMAIL PROTECTED] tel;work:309.676.2663 tel;fax:309.676.2667 url:http://www.cobatco.com version:2.1 end:vcard
Re: HELO_DYNAMIC_IPADDR not explainable
On Tue, 8 May 2007, DogMatz wrote: Received: from lvps87-230-7-51.dedicated.hosteurope.de (server.marcelkorte.de [87.230.7.51]) Well, I guess that the reason lies in Received: from lvps87-230-7-51.dedicated.hosteurope.de. Yup. But still. I don´t understand where that might come frome since nslookup 87.230.7.51 shows the correct hostname server.marcelkorte.de. What the client says in its HELO command has nothing to do with what its rDNS is. The client can say anything it wants in its HELO. If that system is under your control, you should either verify that your hostname is set to server.marcelkorte.de (most clients will use the local hostname for the HELO), or check your MTA or mail client program docs for how to explicitly specify what it says in the HELO. That said, I would observe that HELO_DYNAMIC_IPADDR probably shouldn't fire on a HELO containing the string dedicated, but how many possible variations of that theme are there...? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- Gun Control is marketed to the public using the appealing delusion that violent criminals will obey the law. --- 546 days until the Presidential Election
CLOSED: HELO_DYNAMIC_IPADDR not explainable
Hey John, thanks very much! It was infact the hostname. Changed it and now it´s all good! Cheers mate! John D. Hardin wrote: On Tue, 8 May 2007, DogMatz wrote: Received: from lvps87-230-7-51.dedicated.hosteurope.de (server.marcelkorte.de [87.230.7.51]) Well, I guess that the reason lies in Received: from lvps87-230-7-51.dedicated.hosteurope.de. Yup. But still. I don´t understand where that might come frome since nslookup 87.230.7.51 shows the correct hostname server.marcelkorte.de. What the client says in its HELO command has nothing to do with what its rDNS is. The client can say anything it wants in its HELO. If that system is under your control, you should either verify that your hostname is set to server.marcelkorte.de (most clients will use the local hostname for the HELO), or check your MTA or mail client program docs for how to explicitly specify what it says in the HELO. That said, I would observe that HELO_DYNAMIC_IPADDR probably shouldn't fire on a HELO containing the string dedicated, but how many possible variations of that theme are there...? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- Gun Control is marketed to the public using the appealing delusion that violent criminals will obey the law. --- 546 days until the Presidential Election -- View this message in context: http://www.nabble.com/HELO_DYNAMIC_IPADDR-not-explainable-tf3710870.html#a10382951 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Poor performance with v3.2.0
Rosenbaum, Larry M. wrote: Running SpamAssassin v3.2.0 on Solaris 9, perl v5.8.8. I am getting really poor performance with v3.2.0 compared with v3.1.8. Average scan time per message is doubled (or worse). I’m also seeing messages like this in the log file (although not all the time): Trying running with debug enabled so that you can see what's holding things up. Does running with -L (local test only) complete quickly? May 7 17:10:20 localhost spamd[19457]: plugin: eval failed: child processing timeout at /usr/local/bin/spamd line 1259, GEN390 line 377. Bayes auto expiries (taking to long and getting killed)? I think that's a 600 second timeout. Is there any way to tell what the timeout was waiting for, or why performance has gotten worse? I haven’t changed the rules. Run with debug enabled. Daryl
Re: per-user rules from mysql
Duane Hill wrote: header L_TO_ME ToCc =~ /[EMAIL PROTECTED]/ describe L_TO_ME Email addressed to me score L_TO_ME 0.010 You can't do rules with SQL user prefs, not even with allow_user_rules. Only non-admin config options are allowed. Michael
Re: per-user rules from mysql
On Tue, 8 May 2007, Michael Parker wrote: Duane Hill wrote: header L_TO_ME ToCc =~ /[EMAIL PROTECTED]/ describe L_TO_ME Email addressed to me score L_TO_ME 0.010 You can't do rules with SQL user prefs, not even with allow_user_rules. Only non-admin config options are allowed. That's what I've come to the conclusion already. Thanks for confirming. And, I've already seen from the spamd man page you can't combine --sql-config and --virtual-config-dir. Oh, well. That's ok. I was just doing some experimenting in a controlled install. I may visit the path with the virtual config dir.
Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available
Has anyone contacted the FreeBSD ports maintainer for re2c to update to 0.12.0? On 5/8/07, Duane Hill [EMAIL PROTECTED] wrote: On Tue, 8 May 2007, Michael Scheidell wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, May 07, 2007 6:59 PM To: Duane Hill Cc: users@spamassassin.apache.org Subject: Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available really? news to me ;) Not sa-compile, just sa-compile on freebsd (since it requires version .12 of re2c and port is currently at .11.1) I have emailed the port maintainer, and may test some patches myself if I get a chance. I have just successfully installed re2c 0.12.0 from sources. The version reported back from 're2c -V' shows '001200'. Further testing by tossing random messages through with text from the tests, I have not seen any errors yet.
RE: ANNOUNCE: Apache SpamAssassin 3.2.0 available
Yes, there is a PR in the queue. The FreeBSD ports tree is currently frozen for the Xorg 7.2 import. LER -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 512-248-2683E-Mail: [EMAIL PROTECTED] US Mail: 430 Valona Loop, Round Rock, TX 78681-3893 -Original Message- From: Julian Yap [mailto:[EMAIL PROTECTED] Sent: Tuesday, May 08, 2007 5:08 PM To: Duane Hill Cc: users@spamassassin.apache.org Subject: Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available Has anyone contacted the FreeBSD ports maintainer for re2c to update to 0.12.0? On 5/8/07, Duane Hill [EMAIL PROTECTED] wrote: On Tue, 8 May 2007, Michael Scheidell wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, May 07, 2007 6:59 PM To: Duane Hill Cc: users@spamassassin.apache.org Subject: Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available really? news to me ;) Not sa-compile, just sa-compile on freebsd (since it requires version .12 of re2c and port is currently at .11.1) I have emailed the port maintainer, and may test some patches myself if I get a chance. I have just successfully installed re2c 0.12.0 from sources. The version reported back from 're2c -V' shows '001200'. Further testing by tossing random messages through with text from the tests, I have not seen any errors yet.
Re: Apache SpamAssassin 3.2.0 using older version of ImageInfo
looks like I found the problematic file: 70_imageinfo.cf was in /etc/mail/spamassassin
Re: Poor performance with v3.2.0
At 01:26 PM 5/8/2007, Daryl C. W. O'Shea wrote: Bayes auto expiries (taking to long and getting killed)? I think that's a 600 second timeout. A couple of months ago I was getting a lot of timeouts due to auto-expire so I disabled it and set a cron job to stop the mail server and force expire once a day. Works great. Now I'm getting timeouts from the Perl bug thing. -- Jerry Durand, Durand Interstellar, Inc. www.interstellar.com tel: +1 408 356-3886, USA toll free: 1 866 356-3886 Skype: jerrydurand
Re: automagic rejection
The Doctor wrote: Interesting enough when spamd choke on the secondary server, it just piled the mail up. Sounds like you've got your mail being double-scanned. Once by MailScanner, once by something using spamd. Still getting back to the original question, is their anything new that is causing this? Judging from the MailScanner list, it looks like your culprit seems to be Vispan.
Re: different scores with spamc
Joeri Belis wrote: setup : [EMAIL PROTECTED]:/tmp$ spamc -V SpamAssassin Client version 3.1.7 compiled with SSL support (OpenSSL 0.9.8c 05 Sep 2006) i get totaly different scores when i run spamc from the commandline as vpopmail user as when i run i from procmail also as vpopmail user. Here are some outputs run from procmail as vpopmail user X-Spam-Status: No, score=-2.4 required=3.4 tests=ADVANCE_FEE_1,AWL,BAYES_00 autolearn=ham version=3.1.7 run from cmd line as vpopmail user X-Spam-Status: No, score=3.2 required=3.4 tests=ADVANCE_FEE_1,ADVANCE_FEE_2, BAYES_00,MISSING_HB_SEP,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS, TO_CC_NONE autolearn=no version=3.1.7 what makes the the difference between running it from procmail or running it on the commandline. 1) i am 99% sure it is run as the same user As a more expansive response, but along the same lines as Theo, are you sure that you're feeding the WHOLE message when you run on the command line? The extra rule hits imply there's no headers, and that you're scanning body-text only, or at least there's nothing that SA can recognize as properly formed headers.
Re: Poor performance with v3.2.0
Jerry Durand wrote: At 01:26 PM 5/8/2007, Daryl C. W. O'Shea wrote: Bayes auto expiries (taking to long and getting killed)? I think that's a 600 second timeout. A couple of months ago I was getting a lot of timeouts due to auto-expire so I disabled it and set a cron job to stop the mail server and force expire once a day. Works great. Now I'm getting timeouts from the Perl bug thing. I have to admit that I'm seeing higher server load levels since upgrading to 3.2.0 from 3.1.8 as well. It was enough to make me wonder if some ne features were slowing things down.
Re: Poor performance with v3.2.0
On Tue, May 08, 2007 at 06:45:32PM -0700, Marc Perkel wrote: I have to admit that I'm seeing higher server load levels since upgrading to 3.2.0 from 3.1.8 as well. It was enough to make me wonder if some ne features were slowing things down. Last time I checked, which has been a while, granted, 3.2 has more rules than 3.1. More rules mean more resource usage and slower scans. FWIW. -- Randomly Selected Tagline: He's cut so many fish that he can't even go to the beach for fear of retribution. - Alton Brown, Good Eats, Hook, Line Dinner pgplqSJDDOuIy.pgp Description: PGP signature
Re: DKIM_POLICY_SIGNSOME matches all mail
On Tue, May 8, 2007 02:02, Ken A wrote: I Installed MAIL::DKIM and enabled the DKIM plugin. Now I'm seeing DKIM_POLICY_SIGNSOME hit every message unless the message hits DKIM_SIGNED and DKIM_VERIFIED. The score for DKIM_POLICY_SIGNSOME is set to 0. Obviously this is wrong, since most spam isn't coming from domains that 'sign some'. Any ideas? i see the same here X-Spam-Status: Yes, score=10.578 tag=1 tag2=5 kill=6.31 tests=[ADVANCE_FEE_2=1.234, ADVANCE_FEE_3=1.432, ADVANCE_FEE_4=0.639, BAYES_50=0.001, BOTNET_SERVERWORDS=-0.7, DKIM_POLICY_SIGNSOME=0, DNSWL_SERVICENET_NONE=-0.1, HTML_MESSAGE=0.001, KAM_LOTTO1=2.899, SPF_PASS=-0.001, SUBJ_ALL_CAPS=2.077, UNCLAIMED_MONEY=3.096] gentoo amavisd-new 2.4.5 r1 gentoo spamasassin 3.2.0 r1 gentoo mail-dkim 0.24 the error is not in spamassassin 3.1.8 -- This message was sent using 100% recycled spam mails.
Re: SPF custom rule
On Tue, May 8, 2007 13:47, JvdW wrote: score. This has to happen ONLY for domain xyz.com. All others will be handled by Spamassassin the normal way. I'm new to these sort of rules so any help would be greatly appreciated. in local.cf put whitelist_from_spf [EMAIL PROTECTED] or def_whitelist_from_spf [EMAIL PROTECTED] diff is that the scores is not the same here you will need the spf plugin enabled with i belive you allready have and forget the blacklist :-) -- This message was sent using 100% recycled spam mails.
Re: Poor performance with v3.2.0
It would be interesting on some system experiencing this slowdown to put 'use bytes' back into SA and see what happens with the performance. This wouldn't be any sort of a solution, but it would be an interesting data point. Loren I have to admit that I'm seeing higher server load levels since upgrading to 3.2.0 from 3.1.8 as well. It was enough to make me wonder if some ne features were slowing things down.
Re: Poor performance with v3.2.0
Theo Van Dinter wrote: On Tue, May 08, 2007 at 06:45:32PM -0700, Marc Perkel wrote: I have to admit that I'm seeing higher server load levels since upgrading to 3.2.0 from 3.1.8 as well. It was enough to make me wonder if some ne features were slowing things down. Last time I checked, which has been a while, granted, 3.2 has more rules than 3.1. More rules mean more resource usage and slower scans. FWIW. Well, if it catches more spam I don't mind.
re: Problem upgrading from 3.1.8 to 3.1.20, check.pm
Hi, I've been upgrading several stable servers running 3.1.8 for months without any issues to 3.1.20, and got a problem in one of them. When trying to restart spamd, I get this: Beyond the s/3.1.20/v3.2.0/ issue that some people cannot get past. I have the same issue. I had to juggle my cf/pre files entries for quite some time to get past the check_scan problem you describe for spamd to run peachy. I, like you I suspect, loaded up one single file with all my config entries. The v3.2 suite seems to want these in a number of files. Where v3.1.x was forgiving I guess. So in v3.2 if you remove all your .pre files and just have local.cf with all your rules you cannot sa-update, it will bomb. You need to spread the files around. I found a load order as well, but that might be voodoo while pulling out my hair. But this is a good example of the sa-update issue. # cd /etc/mail/spamassassin/ # ls channels.txt init.pre sa-update-keys # mv init.pre local.cf # sa-update config: no configuration text or files found! please check your setup check: no loaded plugin implements 'check_main': cannot scan! at /usr/local/share/perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 164. # mv local.cf init.pre # sa-update config: warning: score set for non-existent rule PART_CID_STOCK ... previous line repeated 123 times for all the lines in 50_scores.cf .. that I don't have plugins loaded for and are not ifplugin/endif wrapped channel: lint check of update failed, channel failed if you run with -D/--debug you will have an ending like this, note that the version is v3.2 and the directory it wants is 3.002000, seems odd. [8263] dbg: channel: update directory /var/lib/spamassassin/3.002000/updates_spamassassin_org [8263] dbg: channel: channel cf file /var/lib/spamassassin/3.002000/updates_spamassassin_org.cf [8263] dbg: channel: channel pre file /var/lib/spamassassin/3.002000/updates_spamassassin_org.pre [8263] dbg: dns: 0.2.3.updates.spamassassin.org = 535131, parsed as 535131 [8263] dbg: channel: preparing temp directory for new channel [8263] dbg: generic: update tmp directory /tmp/.spamassassin8263KG8Pl9tmp [8263] dbg: generic: lint checking site pre files once before attempting channel updates [8263] dbg: generic: SpamAssassin version 3.2.0 [8263] dbg: config: score set 0 chosen. [8263] dbg: dns: no ipv6 [8263] dbg: dns: is Net::DNS::Resolver available? yes [8263] dbg: dns: Net::DNS version: 0.59 [8263] dbg: ignore: using a test message to lint rules [8263] dbg: config: using /etc/mail/spamassassin for site rules pre files [8263] dbg: config: using /tmp/.spamassassin8263KG8Pl9tmp/doesnotexist for sys rules pre files [8263] dbg: config: using /tmp/.spamassassin8263KG8Pl9tmp/doesnotexist for default rules dir [8263] dbg: config: using /tmp/.spamassassin8263KG8Pl9tmp/doesnotexist/doesnotexist for user prefs file config: no configuration text or files found! please check your setup [8263] dbg: conf: finish parsing [8263] dbg: config: score set 0 chosen. [8263] dbg: message: main message type: text/plain [8263] dbg: message: MIME PARSER START [8263] dbg: message: parsing normal part [8263] dbg: message: MIME PARSER END check: no loaded plugin implements 'check_main': cannot scan! at /usr/local/share/perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 164
