Re: blacklist.cf needs to die (was Re: Help figuring our why SA is taking like 1.5 minutes to filter...)

[Matt Kettler]

Justin Mason wrote:
>
> Matt, any chance you could open a bz feature request for this?
>   
Done.. also added to it so there's now 3 warning level options.

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5710

> --j.
>   

Re: Myspace's mail headers

[Matt Kettler]

Joseph Brennan wrote:
>
>
> Excerpt, headers from a generated message from myspace (I have folded
> lines for legibility) :
>
> Received: from vmta17.myspace.com (vmta17.myspace.com [204.16.33.80])
>  by cayenne.cc.columbia.edu (8.14.1/8.14.1) with ESMTP id l9U3N5he001961
>  for <[EMAIL PROTECTED]>; Mon, 29 Oct 2007 23:23:10 -0400 (EDT)
> Received: from els2mwebnet1425 (10.44.128.43) by vmta17.myspace.com
>  (PowerMTA(TM) v3.2r17) id h4qhps0f2do3 for <[EMAIL PROTECTED]>;
>  Mon, 29 Oct 2007 20:23:05 -0700 (envelope-from
>  <[EMAIL PROTECTED]>)
> mime-version: 1.0
> from: "=?iso-8859-1?Q?MySpace Admin?="
>  <[EMAIL PROTECTED]>
> to: [EMAIL PROTECTED]
> reply-to: "=?iso-8859-1?Q?MySpace Admin?="
>  <[EMAIL PROTECTED]>
> date: 29 Oct 2007 20:23:04 -0700
> subject: MySpace account cancellation request - please confirm
> content-type: text/plain; charset=utf-8
> content-transfer-encoding: base64
>
>
>
> Notice the all-lower-case field names, which do not conform to the
> RFC 2822 field names that they almost match.  That is, a "from:"
> header is not the same as a "From:" header!
>
> It looks like the FROM ends up undefined in Spamassasssin, and so
> this cannot be whitelisted.  I'm not necessarily saying Spamassassin
> is wrong either.  Any opinions?

Works for me, at least using SA 3.2.3 it does.
>From spamassassin -tLD < testmessage.txt
--
[6091] dbg: eval: all '*From' addrs:
04.15.0.64763231393140636F6C756D6269612E656
[EMAIL PROTECTED] [EMAIL PROTECTED]
--

Re: The Bat! reanimated (suspicious Date header)

[Loren Wilton]

FWFW, I ran masschecks on the original posted rules and got zero hits in any 
corpus.  That rather surprised me.  But it may indicate that this is either 
a very recent thing or isn't all that universal.


   Loren


On Friday, October 26, 2007 11:55 PM +0200 KarstenBräckelmann
<[EMAIL PROTECTED]> wrote:


NOTE:  I only did a very brief investigation of Date: headers sent by
The Bat! users on this list. If anyone can assure this, or got any
inside knowledge whether The Bat! can or can not generate such headers
legitimately, please pipe up. :)


Nice find. I grepped my corpus and found 432 instances of "Date: \t". It
only appears in headers in my known-spam folder. It does appear in other
messages, but only in the headers of forwarded messages carried in the body
of another message. (A check of a few suggests that Mozilla does this.)

The qualification of The Bat in your meta may be too specific. I see the
same thing happening in messages claiming to come from Outlook and Outlook
Express. The header rule should be sufficient by itself.

Re: Myspace's mail headers

[Bart Schaefer]

On Oct 30, 2007 12:27 PM, Joseph Brennan <[EMAIL PROTECTED]> wrote:
>
> Notice the all-lower-case field names, which do not conform to the
> RFC 2822 field names that they almost match.  That is, a "from:"
> header is not the same as a "From:" header!

It's *supposed* to be the same.  RFC *822 does not specify case for
field names.  See RFC 2234 where the ABNF format is defined, section
2.3.

if SA is not finding the from-address as a result of lower-casing
"from:", then SA has a bug.  If SA is *intentionally* ignoring "from:"
because lower-casing is a spam-sign, then that's a somewhat different
matter ... but probably still wrong.

High Qmail-Server Load

[Qnet ..]

Hi Guys,
I'm running a Qmail server with spamassassin + clamav + Simscam.
The server i'm using is a HP ML110 CPU PIV (3.2 GHZ) 2mb chache , 1GB RAM.

The problem is, the i'm getting very high load because spamd is the processes 
which take the most part of the load
(invoked by spamassassin) si it's Spamassassin crash. i can stop spamassassin 
and them start it to work 
again.


Do you know any way to solve it? sorry for my bad english . 
Thank you.

_
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

required_score

[maillist]

SpamAssassin version 3.2.3
 running on Perl version 5.8.8
mimedefang version 2.63
sendmail Version 8.14.0

I have been running spamassassin for over 2 years now, and suddenly, the 
required score has changed.  I have it set to 7.0, but it has suddenly 
changed back to the default of 5.0.  I only noticed it today, and 
haven't got a clue as to where it's pulling the required score from.


/etc/mail/spamassassin/local.cf:

require_score 7.0

I am no using any user_prefs anywhere (that I know of).  But just 
in-case I was, I changed all instances of any file called user_prefs to 7.0.


If I run spamc -c < message, I get back
5.5/7.0

if I run spamassassin -t message
I also get back the correct score.

I start spamd as root like this

/usr/bin/spamd -r /var/run/spamd.pid \
-d --username=defang --max-spare=8 --min-children=10 --max-children=45

Any help is appreciated.

-Aubrey

Re: The Bat! reanimated (suspicious Date header)

[Kenneth Porter]

On Friday, October 26, 2007 11:55 PM +0200 KarstenBräckelmann 
<[EMAIL PROTECTED]> wrote:



NOTE:  I only did a very brief investigation of Date: headers sent by
The Bat! users on this list. If anyone can assure this, or got any
inside knowledge whether The Bat! can or can not generate such headers
legitimately, please pipe up. :)


Nice find. I grepped my corpus and found 432 instances of "Date: \t". It 
only appears in headers in my known-spam folder. It does appear in other 
messages, but only in the headers of forwarded messages carried in the body 
of another message. (A check of a few suggests that Mozilla does this.)


The qualification of The Bat in your meta may be too specific. I see the 
same thing happening in messages claiming to come from Outlook and Outlook 
Express. The header rule should be sufficient by itself.

RE: Spamassassin SPF error

[Jose Luis]

Hi friends,
 
It has solved the problem of the message headers to SA to work with SPF, this 
has been done by applying the Qmail patch QmailSpfPatch which is on the web 
http://wiki.apache.org/spamassassin/QmailSpfPatch
Thanks
 
> Date: Sun, 28 Oct 2007 11:13:06 -0400> From: [EMAIL PROTECTED]> Subject: Re: 
> Spamassassin SPF error> To: [EMAIL PROTECTED]> CC: 
> users@spamassassin.apache.org> > Jose Luis wrote:> > Thanks for the answer,> 
> > > > My mail server is qmail + clamav + sa (spf) + simscan.> > > > I do some 
> configurations Qmail or Simscan to get those headers?> I'm certainly no 
> expert on Qmail, never used it, and I likely never will> unless DJB makes 
> some changes, but that's really a personal preference..> > That said, there 
> might be an updated version of simscan to do this. Ask> the simscan mailing 
> list.> > As an alternative, you can ditch simscan and switch to 
> qmail-scanner,> which AFAIK will generate a "X-Qmail-Scanner-Mail-From" 
> header.> > Simscan might do something similar already, but I know very little 
> about it.> > You can tell SA to use any abnormal headers, like the one 
> qmail-scanner> makes, but using the envelope_sender_header option in SA.> 
_
Invite your mail contacts to join your friends list with Windows Live Spaces. 
It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us

Myspace's mail headers

[Joseph Brennan]

Excerpt, headers from a generated message from myspace (I have folded
lines for legibility) :

Received: from vmta17.myspace.com (vmta17.myspace.com [204.16.33.80])
 by cayenne.cc.columbia.edu (8.14.1/8.14.1) with ESMTP id l9U3N5he001961
 for <[EMAIL PROTECTED]>; Mon, 29 Oct 2007 23:23:10 -0400 (EDT)
Received: from els2mwebnet1425 (10.44.128.43) by vmta17.myspace.com
 (PowerMTA(TM) v3.2r17) id h4qhps0f2do3 for <[EMAIL PROTECTED]>;
 Mon, 29 Oct 2007 20:23:05 -0700 (envelope-from
 <[EMAIL PROTECTED]>)
mime-version: 1.0
from: "=?iso-8859-1?Q?MySpace Admin?="
 <[EMAIL PROTECTED]>
to: [EMAIL PROTECTED]
reply-to: "=?iso-8859-1?Q?MySpace Admin?="
 <[EMAIL PROTECTED]>
date: 29 Oct 2007 20:23:04 -0700
subject: MySpace account cancellation request - please confirm
content-type: text/plain; charset=utf-8
content-transfer-encoding: base64



Notice the all-lower-case field names, which do not conform to the
RFC 2822 field names that they almost match.  That is, a "from:"
header is not the same as a "From:" header!

It looks like the FROM ends up undefined in Spamassasssin, and so
this cannot be whitelisted.  I'm not necessarily saying Spamassassin
is wrong either.  Any opinions?

I sent mail to [EMAIL PROTECTED] this morning.  It would be
nice if they change this.

Joseph Brennan
Columbia University IT

Re: Custom rules working, but not sa-updates

[Andy Norris]

I appreciate that you would like to see it working right, Daryl. To 
that, I'd add, "me, too." But, like I said, I had to move on, and I 
hope to get back to it soon. And, by the way, I played with setting 
the update paths to all kinds of places, and all kinds of 
permissions, too. ;-) I'm sure it's something ON MY MACHINE that's 
not working. I was just trying to offer a suggestion to someone who 
seemed to be in a similar situation.


Thanks,
Andy


At 01:48 PM 2007-10-30, Daryl C. W. O'Shea wrote:

Andy Norris wrote:
No, it was not a permissions issue. I'll get back to working on it 
soon, but, yes there were newer versions than what I was seeing on 
my server. There are so many posts about sa-update not working. I'm 
sure sa-update works, for some folks, but it wasn't for me, and I 
had to quit spending time on it.


If you're referring to issues other than people deciding to screw 
things up by setting their update path to use the same path as the 
default rules directory could you please point me to the many posts 
about sa-update not working?  I haven't seen them and would like to 
see any issues resolved.


Thanks,

Daryl

Re: Custom rules working, but not sa-updates

[Daryl C. W. O'Shea]

Andy Norris wrote:


No, it was not a permissions issue. I'll get back to working on it soon, 
but, yes there were newer versions than what I was seeing on my server. 
There are so many posts about sa-update not working. I'm sure sa-update 
works, for some folks, but it wasn't for me, and I had to quit spending 
time on it.


If you're referring to issues other than people deciding to screw things 
up by setting their update path to use the same path as the default 
rules directory could you please point me to the many posts about 
sa-update not working?  I haven't seen them and would like to see any 
issues resolved.


Thanks,

Daryl

Re: Custom rules working, but not sa-updates

[Andy Norris]

No, it was not a permissions issue. I'll get back to working on it 
soon, but, yes there were newer versions than what I was seeing on my 
server. There are so many posts about sa-update not working. I'm sure 
sa-update works, for some folks, but it wasn't for me, and I had to 
quit spending time on it.


Oh, and I meant "cron job"... not "crop job"... was typing on a tiny 
keyboard. Sorry.


Thanks,
Andy


At 01:09 PM 2007-10-30, Daniel J McDonald wrote:


On Tue, 2007-10-30 at 08:35 -0500, Andy Norris wrote:
> Hi,
>
> I don't know if this is relevant for you or not, but on our mail
> server I could not get sa-update to work, either. I noticed that if
> the directory was not there, however, it would work.

Sounds like a permissions issue.

>  So a down and
> dirty approach I took was writing a crop job that removes that
> directory just before running sa-update.

So, you delete it every time, even when there are no updates?  And since
updates occur about once or twice a month, you are downloading the same
stuff over and over.  Plus you are missing rules at certain points of
the cycle

>  I know this is going to be a
> bit much for some folks on here to handle, but I had to get on with
> life at some point!
true, but you could just find the real problem (permissions) and fix it.

--
Daniel J McDonald, CCIE #2495, CISSP #78281, CNX
Austin Energy
http://www.austinenergy.com

Re: Custom rules working, but not sa-updates

[Daryl C. W. O'Shea]

Daniel J McDonald wrote:

On Tue, 2007-10-30 at 08:35 -0500, Andy Norris wrote:
 So a down and  
dirty approach I took was writing a crop job that removes that  
directory just before running sa-update.


So, you delete it every time, even when there are no updates?  And since
updates occur about once or twice a month, you are downloading the same
stuff over and over.  Plus you are missing rules at certain points of
the cycle


Is this a widespread practice?  It explains why I see *lots* of IPs 
downloading the same versions of the same rulesets at the same time(s) 
every single day.


Daryl

Re: Custom rules working, but not sa-updates

[Daniel J McDonald]

On Tue, 2007-10-30 at 08:35 -0500, Andy Norris wrote:
> Hi,
> 
> I don't know if this is relevant for you or not, but on our mail  
> server I could not get sa-update to work, either. I noticed that if  
> the directory was not there, however, it would work.

Sounds like a permissions issue.  

>  So a down and  
> dirty approach I took was writing a crop job that removes that  
> directory just before running sa-update.

So, you delete it every time, even when there are no updates?  And since
updates occur about once or twice a month, you are downloading the same
stuff over and over.  Plus you are missing rules at certain points of
the cycle

>  I know this is going to be a  
> bit much for some folks on here to handle, but I had to get on with  
> life at some point!
true, but you could just find the real problem (permissions) and fix it.

-- 
Daniel J McDonald, CCIE #2495, CISSP #78281, CNX
Austin Energy
http://www.austinenergy.com

Re: whitelist_from_rcvd with numeric IP?

[Daniel J McDonald]

On Tue, 2007-10-30 at 11:57 -0400, Rosenbaum, Larry M. wrote:
> The documentation for whitelist_from_rcvd shows examples like this:
> 
> whitelist_from_rcvd [EMAIL PROTECTED]  example.com
> 
> What if the sending server has no rDNS?

They you can't use whitelist_from_rcvd, and the sender needs to fix
their rDNS!

>   Is there a way to use this feature with a numeric IP instead of a rDNS 
> domain? 
No.

>  If so, what is the syntax?

If they are adamant that they can't fix rDNS, I usually ask for an SPF
record, and then do a whitelist_from_spf.  When they claim that they can
fix neither rDNS or set their SPF record, I might use amavisd-new's
soft-whitelisting to trim a couple of points, or I tell them to pound
sand.  Usually I can convince people to fix one or the other.

 

-- 
Daniel J McDonald, CCIE #2495, CISSP #78281, CNX
Austin Energy
http://www.austinenergy.com

Re: blacklist.cf needs to die (was Re: Help figuring our why SA is taking like 1.5 minutes to filter...)

[Justin Mason]

Matt Kettler writes:
> Daryl C. W. O'Shea wrote:
> > Justin Mason wrote:
> >> OK, we really need to figure out some way to kill these FAQs off. Every
> >> week, someone asks a question about why SpamAssassin is killing their
> >> server, and most of the time the answer is "stop using blacklist.cf and
> >> blacklist-uri.cf".  If 1 person is asking the question, chances are
> >> there's another 10 people who aren't asking, and who are just ditching
> >> SpamAssassin entirely. :(
> >
> >> I think I'll add a new question right on the top of the FAQ list
> >> about this...
> >>
> >> What else can we do?
> >
> > Has anyone asked Bill to stop distributing the blacklist in a format
> > suitable for direct use with SpamAssassin?  That, to me, seems to be
> > the most effective and sensible way to deal with it.
> I'd agree there.
> >   Modifying the software, as has been discussed, seems a little
> > extreme to me.
> I dono, I think that having some --lint warnings generated when the
> overall config is really absurdly large seems useful for this kind of
> problem in general. A basic "um, dude, that's a lot of config, are you
> sure your server can handle this" might be a good thing. You never know
> when someone else might make a sa-blacklist, or some tool that
> auto-generates rules might get popular and get out-of-control
> sometimes.. etc..

Matt, any chance you could open a bz feature request for this?

--j.

whitelist_from_rcvd with numeric IP?

[Rosenbaum, Larry M.]

The documentation for whitelist_from_rcvd shows examples like this:

whitelist_from_rcvd [EMAIL PROTECTED]  example.com

What if the sending server has no rDNS?  Is there a way to use this feature 
with a numeric IP instead of a rDNS domain?  If so, what is the syntax?

Thanks, Larry

[OT] RE: remove email

[Skip]

> > > xou4 schrieb:
> > >> Hello,
> > >> I want to remove the mails on which a score above 30 

Or for procmail (this rule is for 20, add or decrease \* as appropriate):

:0
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
/dev/null

Re: remove email

[Duane Hill]

On Tue, 30 Oct 2007 15:00:52 +0100
Matthias Haegele <[EMAIL PROTECTED]> confabulated:

> Matthias Haegele schrieb:
> > xou4 schrieb:
> >> Hello,
> >> I want to remove the mails on which a score above 30
> >> Thank you in advance for your help 
> > 
> > spamassassin "tags" messages whatever "filter" you use could do
> > this ...
> 
> Perhaps you want to use amavisd-new or procmail or ...
> 
> (Using Postfix/amavisd-new/spamassassin here)

Using Postfix here too. I remove anything scoring 25 and above with
header_checks like so:

/^X-Spam-Level: \*{25,}$/ DISCARD

(sorry to push off-topic)

--
  _|_
 (_| |

RE: Custom rules working, but not sa-updates

[Randal, Phil]

"debug: using "/usr/share/spamassassin" for default rules dir"

Oh dear, that's definitely wrong.

You should have

  config: using "/var/lib/spamassassin/3.002003" for default rules dir

try setting the MailScanner.conf line to

SpamAssassin Local State Dir = # /var/lib/spamassassin

And see if that helps.

Try a

  MailScanner --lint

too in case there are other issues causing grief.

It's probably best to take this to the MailScanner mailing list.

Cheers,

Phil

--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -Original Message-
> From: Rob Starr [mailto:[EMAIL PROTECTED] 
> Sent: 30 October 2007 13:30
> To: users@spamassassin.apache.org
> Subject: RE: Custom rules working, but not sa-updates
> 
> 
> Boy, that's a handy command. I'll have to write that one down.
> 
> I'm getting:
> In Debugging mode, not forking...
> SpamAssassin temp dir = 
> /var/spool/MailScanner/incoming/SpamAssassin-Temp
> debug: Score set 0 chosen.
> debug: running in taint mode? no
> debug: ignore: test message to precompile patterns and load modules
> debug: using "/usr/share/spamassassin" for default rules dir
> debug: using "/etc/mail/spamassassin" for site rules dir
> debug: using "/var/spool/postfix/.spamassassin/user_prefs" 
> for user prefs
> file
> 
> MailScanner.conf currently has:
> SpamAssassin Site Rules Dir = /etc/mail/spamassassin
> SpamAssassin Local Rules Dir =
> SpamAssassin Local State Dir = /var/lib/spamassassin
> SpamAssassin Default Rules Dir =
> 
> 
> 
> Randal, Phil wrote:
> > 
> > Right, and what does the
> > 
> >   MailScanner --debug --debug-sa
> > 
> > output say it is using?
> > 
> > Cheers,
> > 
> > Phil
> > --
> > Phil Randal
> > Network Engineer
> > Herefordshire Council
> > Hereford, UK  
> > 
> >> -Original Message-
> >> From: Rob Starr [mailto:[EMAIL PROTECTED] 
> >> Sent: 30 October 2007 12:29
> >> To: users@spamassassin.apache.org
> >> Subject: RE: Custom rules working, but not sa-updates
> >> 
> >> 
> >> Thanks for your response Phil,
> >> 
> >> In an attempt to resolve the issue, I'm now using MailScanner 
> >> 4.64.3 and
> >> have started from a fresh config file, so my "Spamassassin 
> >> Local State Dir"
> >> line also reads:
> >> 
> >> SpamAssassin Local State Dir = # /var/lib/spamassassin
> >> 
> >> And, as I mentioned, a lint test shows that SA is 
> successfully reading
> >> /var/lib/spamassassin/3.002003/updates_spamassassin_org.cf 
> >> and all of the
> >> rules in the 
> /var/lib/spamassassin/3.002003/updates_spamassassin_org/
> >> folder.
> >> 
> >> - Here are relavant lines from the lint test --
> >> [24215] dbg: config: read file
> >> /var/lib/spamassassin/3.001003/updates_spamassassin_org.cf
> >> [24215] dbg: plugin: fixed relative path:
> >> /var/lib/spamassassin/3.001003/updates_spamassassin_org/10_misc.cf
> >> [24215] dbg: config: using
> >> "/var/lib/spamassassin/3.001003/updates_spamassassin_org/10_mi
> >> sc.cf" for
> >> included file
> >> [24215] dbg: config: read file
> >> /var/lib/spamassassin/3.001003/updates_spamassassin_org/10_mis
> >> c.cf [24215]
> >> dbg: plugin: fixed relative path:
> >> /var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv
> >> ance_fee.cf
> >> [24215] dbg: config: using
> >> "/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_ad
> >> vance_fee.cf"
> >> for included file
> >> [24215] dbg: config: read file
> >> /var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv
> >> ance_fee.cf 
> >> ...
> >> -
> >> 
> >> Thanks again,
> >> Rob
> >> 
> >> 
> >> Randal, Phil wrote:
> >> > 
> >> > Rob, that could be a MailScanner config problem.  You don't 
> >> say which
> >> > version of MailScanner, alas.
> >> > 
> >> > In /etc/MailScanner/MailScanner.conf check the 
> >> "Spamassassin Local State
> >> > Dir" line.
> >> > 
> >> > Mine reads:
> >> > 
> >> > SpamAssassin Local State Dir = # /var/lib/spamassassin
> >> > 
> >> > Cheers,
> >> > 
> >> > Phil
> >> > --
> >> > Phil Randal
> >> > Network Engineer
> >> > Herefordshire Council
> >> > Hereford, UK  
> >> > 
> >> >> -Original Message-
> >> >> From: Rob Starr [mailto:[EMAIL PROTECTED] 
> >> >> Sent: 30 October 2007 11:54
> >> >> To: users@spamassassin.apache.org
> >> >> Subject: Re: Custom rules working, but not sa-updates
> >> >> 
> >> >> 
> >> >> I should also mention that SA 3.1.3 was working flawlessly 
> >> >> until the update
> >> >> to 3.2.3.  I've used the newer config files and been through 
> >> >> most of the
> >> >> options, but still no luck.
> >> >> 
> >> >> 
> >> >> 
> >> >> Rob Starr wrote:
> >> >> > 
> >> >> > Hi, 
> >> >> > 
> >> >> > I'm using Postfix + MailScanner + MailWatch + 
> >> SpamAssassin 3.2.3. 
> >> >> > 
> >> >> > My problem is that lots of spam is getting through because 
> >> >> the rules 
> >> >> > don't seem to be getting used, however my set of custom 
> >> rules work 
> >> >> > just fine (and disabling the custom ones hasn't helped). 
> >>  I'm using
> >> >> > Mailwatch so I can easil

Re: remove email

[Matthias Haegele]

Matthias Haegele schrieb:

xou4 schrieb:

Hello,
I want to remove the mails on which a score above 30
Thank you in advance for your help 


spamassassin "tags" messages whatever "filter" you use could do this ...


Perhaps you want to use amavisd-new or procmail or ...

(Using Postfix/amavisd-new/spamassassin here)


Xou



--
Grüsse/Greetings
MH


Dont send mail to: [EMAIL PROTECTED]
--

Re: remove email

[Matthias Haegele]

xou4 schrieb:
Hello, 

I want to remove the mails on which a score above 30 

Thank you in advance for your help 


spamassassin "tags" messages whatever "filter" you use could do this ...



Xou



--
Grüsse/Greetings
MH


Dont send mail to: [EMAIL PROTECTED]
--

Re: remove email

[Duane Hill]

On Tue, 30 Oct 2007 06:49:25 -0700 (PDT)
xou4 <[EMAIL PROTECTED]> confabulated:

> 
> Hello, 
> 
> I want to remove the mails on which a score above 30 
> 
> Thank you in advance for your help 
> 
> Xou

Your email server software (MTA) has to do that. SpamAssassin just
scans what you feed it. It does not have the ability to do anything
more.

--
  _|_
 (_| |

remove email

[xou4]

Hello, 

I want to remove the mails on which a score above 30 

Thank you in advance for your help 

Xou
-- 
View this message in context: 
http://www.nabble.com/remove-email-tf4718582.html#a13489061
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

RE: SPAM tagging

[Leon Kolchinsky]

Hi,

 

Read this http://www200.pair.com/mecham/spam/amavisd-settings.html

 

And you’ll be set.

 

 

Regards,

Leon Kolchinsky

 



From: Agnello George [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, October 30, 2007 8:31 AM
To: users@spamassassin.apache.org
Subject: SPAM tagging

 

 

Hi 

i have installed  amavisd new on my postfix mailserver. Now i need to test spam 
, so I  sent a mail with the following text in  the body ( see link )  .. this 
is found at http://spamassassin.apache.org/gtube/ .

 

As per the logs the mal is being blocked, but our requirement is that it should 
be be tagged as SPAM ( ***SPAM*** ) . Bellow is the logs  

 

###

Oct 30 11:50:08 fedora7 amavis[3784]: (03784-01) Blocked SPAM, MYNETS LOCAL 
[127.0.0.1  ] [ 127.0.0.1  ] <[EMAIL 
PROTECTED]> -> < [EMAIL PROTECTED]  >, Message-ID: 
<[EMAIL PROTECTED]>, mail_id: itV2-9cTSct6, Hits: 1001.149, size: 807, 1698 
msOct 30 11:50:08 fedora7 postfix/smtp[3749]: 80590464DE: to=< [EMAIL 
PROTECTED]>, relay=127.0.0.1[ 127.0.0.1  ]:10024, delay=1.8, 
delays=0.06/0/0.01/1.7, dsn=2.7.0, status=sent (250 2.7.0 Ok, discarded, 
id=03784-01 - SPAM)Oct 30 11:50:08 fedora7 postfix/qmgr[3499]: 80590464DE: 
removed

##

Do le me know how to tag SPAM mails 


-- 
God Bless  

Agnello . G .Dsouza

 

RE: Custom rules working, but not sa-updates

[Rob Starr]

Thanks Andy,

I have verified that sa-update is running and the rules folder is getting
populated with lots of files.


-Original Message-
From: Andy Norris [mailto:[EMAIL PROTECTED] 
Sent: October-30-07 9:35 AM
To: Randal, Phil
Cc: Rob Starr; 
Subject: Re: Custom rules working, but not sa-updates

Hi,

I don't know if this is relevant for you or not, but on our mail  
server I could not get sa-update to work, either. I noticed that if  
the directory was not there, however, it would work. So a down and  
dirty approach I took was writing a crop job that removes that  
directory just before running sa-update. I know this is going to be a  
bit much for some folks on here to handle, but I had to get on with  
life at some point!

Good luck,
Andy


On Oct 30, 2007, at 7:39, "Randal, Phil"  
<[EMAIL PROTECTED]> wrote:

> Right, and what does the
>
>  MailScanner --debug --debug-sa
>
> output say it is using?
>
> Cheers,
>
> Phil
> --
> Phil Randal
> Network Engineer
> Herefordshire Council
> Hereford, UK
>
>> -Original Message-
>> From: Rob Starr [mailto:[EMAIL PROTECTED]
>> Sent: 30 October 2007 12:29
>> To: users@spamassassin.apache.org
>> Subject: RE: Custom rules working, but not sa-updates
>>
>>
>> Thanks for your response Phil,
>>
>> In an attempt to resolve the issue, I'm now using MailScanner
>> 4.64.3 and
>> have started from a fresh config file, so my "Spamassassin
>> Local State Dir"
>> line also reads:
>>
>> SpamAssassin Local State Dir = # /var/lib/spamassassin
>>
>> And, as I mentioned, a lint test shows that SA is successfully  
>> reading
>> /var/lib/spamassassin/3.002003/updates_spamassassin_org.cf
>> and all of the
>> rules in the /var/lib/spamassassin/3.002003/updates_spamassassin_org/
>> folder.
>>
>> - Here are relavant lines from the lint test --
>> [24215] dbg: config: read file
>> /var/lib/spamassassin/3.001003/updates_spamassassin_org.cf
>> [24215] dbg: plugin: fixed relative path:
>> /var/lib/spamassassin/3.001003/updates_spamassassin_org/10_misc.cf
>> [24215] dbg: config: using
>> "/var/lib/spamassassin/3.001003/updates_spamassassin_org/10_mi
>> sc.cf" for
>> included file
>> [24215] dbg: config: read file
>> /var/lib/spamassassin/3.001003/updates_spamassassin_org/10_mis
>> c.cf [24215]
>> dbg: plugin: fixed relative path:
>> /var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv
>> ance_fee.cf
>> [24215] dbg: config: using
>> "/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_ad
>> vance_fee.cf"
>> for included file
>> [24215] dbg: config: read file
>> /var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv
>> ance_fee.cf
>> ...
>> -
>>
>> Thanks again,
>> Rob
>>
>>
>> Randal, Phil wrote:
>>>
>>> Rob, that could be a MailScanner config problem.  You don't
>> say which
>>> version of MailScanner, alas.
>>>
>>> In /etc/MailScanner/MailScanner.conf check the
>> "Spamassassin Local State
>>> Dir" line.
>>>
>>> Mine reads:
>>>
>>> SpamAssassin Local State Dir = # /var/lib/spamassassin
>>>
>>> Cheers,
>>>
>>> Phil
>>> --
>>> Phil Randal
>>> Network Engineer
>>> Herefordshire Council
>>> Hereford, UK
>>>
 -Original Message-
 From: Rob Starr [mailto:[EMAIL PROTECTED]
 Sent: 30 October 2007 11:54
 To: users@spamassassin.apache.org
 Subject: Re: Custom rules working, but not sa-updates


 I should also mention that SA 3.1.3 was working flawlessly
 until the update
 to 3.2.3.  I've used the newer config files and been through
 most of the
 options, but still no luck.



 Rob Starr wrote:
>
> Hi,
>
> I'm using Postfix + MailScanner + MailWatch +
>> SpamAssassin 3.2.3.
>
> My problem is that lots of spam is getting through because
 the rules
> don't seem to be getting used, however my set of custom
>> rules work
> just fine (and disabling the custom ones hasn't helped).
>> I'm using
> Mailwatch so I can easily see which rules are being
> hit, and which aren't.
>
> A lint test runs perfectly fine and reads all of the rule
 files without
> error, all modules installed.  "spamassassin -t
 spam-sample.txt", uses
> ALL of the rules and works fine, but any real mail going
 through the
> system misses the spamassassin rules.  Also odd, is that
 Razor2 works
> and the sa-update rule "RAZOR2_CHECK" always gets hit.
>> I've tried
> disabling
> razor2 but no luck there.
>
> Just about every single email being processed hits one of
 these two rules
> (or any of the custom rules I have):
> RAZOR2_CHECK - Listed in Razor2 (http://razor.sf.net/)
> RAZOR2_CF_RANGE_51_100 -Razor2 gives confidence level above 50%
>
> sa-update works fine by placing the latest rules in /var/lib/
> spamassassin/3.002003/.  I also have one custom .cf file in
 /etc/mail/
> spamassassin that always works.
>
> I've been troubleshooting for quite a while now and can't

Re: Custom rules working, but not sa-updates

[Andy Norris]

Hi,

I don't know if this is relevant for you or not, but on our mail  
server I could not get sa-update to work, either. I noticed that if  
the directory was not there, however, it would work. So a down and  
dirty approach I took was writing a crop job that removes that  
directory just before running sa-update. I know this is going to be a  
bit much for some folks on here to handle, but I had to get on with  
life at some point!


Good luck,
Andy


On Oct 30, 2007, at 7:39, "Randal, Phil"  
<[EMAIL PROTECTED]> wrote:



Right, and what does the

 MailScanner --debug --debug-sa

output say it is using?

Cheers,

Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK


-Original Message-
From: Rob Starr [mailto:[EMAIL PROTECTED]
Sent: 30 October 2007 12:29
To: users@spamassassin.apache.org
Subject: RE: Custom rules working, but not sa-updates


Thanks for your response Phil,

In an attempt to resolve the issue, I'm now using MailScanner
4.64.3 and
have started from a fresh config file, so my "Spamassassin
Local State Dir"
line also reads:

SpamAssassin Local State Dir = # /var/lib/spamassassin

And, as I mentioned, a lint test shows that SA is successfully  
reading

/var/lib/spamassassin/3.002003/updates_spamassassin_org.cf
and all of the
rules in the /var/lib/spamassassin/3.002003/updates_spamassassin_org/
folder.

- Here are relavant lines from the lint test --
[24215] dbg: config: read file
/var/lib/spamassassin/3.001003/updates_spamassassin_org.cf
[24215] dbg: plugin: fixed relative path:
/var/lib/spamassassin/3.001003/updates_spamassassin_org/10_misc.cf
[24215] dbg: config: using
"/var/lib/spamassassin/3.001003/updates_spamassassin_org/10_mi
sc.cf" for
included file
[24215] dbg: config: read file
/var/lib/spamassassin/3.001003/updates_spamassassin_org/10_mis
c.cf [24215]
dbg: plugin: fixed relative path:
/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv
ance_fee.cf
[24215] dbg: config: using
"/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_ad
vance_fee.cf"
for included file
[24215] dbg: config: read file
/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv
ance_fee.cf
...
-

Thanks again,
Rob


Randal, Phil wrote:


Rob, that could be a MailScanner config problem.  You don't

say which

version of MailScanner, alas.

In /etc/MailScanner/MailScanner.conf check the

"Spamassassin Local State

Dir" line.

Mine reads:

SpamAssassin Local State Dir = # /var/lib/spamassassin

Cheers,

Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK


-Original Message-
From: Rob Starr [mailto:[EMAIL PROTECTED]
Sent: 30 October 2007 11:54
To: users@spamassassin.apache.org
Subject: Re: Custom rules working, but not sa-updates


I should also mention that SA 3.1.3 was working flawlessly
until the update
to 3.2.3.  I've used the newer config files and been through
most of the
options, but still no luck.



Rob Starr wrote:


Hi,

I'm using Postfix + MailScanner + MailWatch +

SpamAssassin 3.2.3.


My problem is that lots of spam is getting through because

the rules

don't seem to be getting used, however my set of custom

rules work

just fine (and disabling the custom ones hasn't helped).

I'm using

Mailwatch so I can easily see which rules are being
hit, and which aren't.

A lint test runs perfectly fine and reads all of the rule

files without

error, all modules installed.  "spamassassin -t

spam-sample.txt", uses

ALL of the rules and works fine, but any real mail going

through the

system misses the spamassassin rules.  Also odd, is that

Razor2 works

and the sa-update rule "RAZOR2_CHECK" always gets hit.

I've tried

disabling
razor2 but no luck there.

Just about every single email being processed hits one of

these two rules

(or any of the custom rules I have):
RAZOR2_CHECK - Listed in Razor2 (http://razor.sf.net/)
RAZOR2_CF_RANGE_51_100 -Razor2 gives confidence level above 50%

sa-update works fine by placing the latest rules in /var/lib/
spamassassin/3.002003/.  I also have one custom .cf file in

/etc/mail/

spamassassin that always works.

I've been troubleshooting for quite a while now and can't

figure out

why the /var/lib/spamassassin/3.002003/ rules just aren't

being used.

Any troubleshooting tips would be greatly appreciated.

Just let me

know what information you need.

Thanks!



--
View this message in context:
http://www.nabble.com/Custom-rules-working%2C-but-not-sa-updat
es-tf4711874.html#a13468319
Sent from the SpamAssassin - Users mailing list archive at

Nabble.com.








--
View this message in context:
http://www.nabble.com/Custom-rules-working%2C-but-not-sa-updat
es-tf4711874.html#a13487599
Sent from the SpamAssassin - Users mailing list archive at  
Nabble.com.

RE: Custom rules working, but not sa-updates

[Rob Starr]

Boy, that's a handy command. I'll have to write that one down.

I'm getting:
In Debugging mode, not forking...
SpamAssassin temp dir = /var/spool/MailScanner/incoming/SpamAssassin-Temp
debug: Score set 0 chosen.
debug: running in taint mode? no
debug: ignore: test message to precompile patterns and load modules
debug: using "/usr/share/spamassassin" for default rules dir
debug: using "/etc/mail/spamassassin" for site rules dir
debug: using "/var/spool/postfix/.spamassassin/user_prefs" for user prefs
file

MailScanner.conf currently has:
SpamAssassin Site Rules Dir = /etc/mail/spamassassin
SpamAssassin Local Rules Dir =
SpamAssassin Local State Dir = /var/lib/spamassassin
SpamAssassin Default Rules Dir =



Randal, Phil wrote:
> 
> Right, and what does the
> 
>   MailScanner --debug --debug-sa
> 
> output say it is using?
> 
> Cheers,
> 
> Phil
> --
> Phil Randal
> Network Engineer
> Herefordshire Council
> Hereford, UK  
> 
>> -Original Message-
>> From: Rob Starr [mailto:[EMAIL PROTECTED] 
>> Sent: 30 October 2007 12:29
>> To: users@spamassassin.apache.org
>> Subject: RE: Custom rules working, but not sa-updates
>> 
>> 
>> Thanks for your response Phil,
>> 
>> In an attempt to resolve the issue, I'm now using MailScanner 
>> 4.64.3 and
>> have started from a fresh config file, so my "Spamassassin 
>> Local State Dir"
>> line also reads:
>> 
>> SpamAssassin Local State Dir = # /var/lib/spamassassin
>> 
>> And, as I mentioned, a lint test shows that SA is successfully reading
>> /var/lib/spamassassin/3.002003/updates_spamassassin_org.cf 
>> and all of the
>> rules in the /var/lib/spamassassin/3.002003/updates_spamassassin_org/
>> folder.
>> 
>> - Here are relavant lines from the lint test --
>> [24215] dbg: config: read file
>> /var/lib/spamassassin/3.001003/updates_spamassassin_org.cf
>> [24215] dbg: plugin: fixed relative path:
>> /var/lib/spamassassin/3.001003/updates_spamassassin_org/10_misc.cf
>> [24215] dbg: config: using
>> "/var/lib/spamassassin/3.001003/updates_spamassassin_org/10_mi
>> sc.cf" for
>> included file
>> [24215] dbg: config: read file
>> /var/lib/spamassassin/3.001003/updates_spamassassin_org/10_mis
>> c.cf [24215]
>> dbg: plugin: fixed relative path:
>> /var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv
>> ance_fee.cf
>> [24215] dbg: config: using
>> "/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_ad
>> vance_fee.cf"
>> for included file
>> [24215] dbg: config: read file
>> /var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv
>> ance_fee.cf 
>> ...
>> -
>> 
>> Thanks again,
>> Rob
>> 
>> 
>> Randal, Phil wrote:
>> > 
>> > Rob, that could be a MailScanner config problem.  You don't 
>> say which
>> > version of MailScanner, alas.
>> > 
>> > In /etc/MailScanner/MailScanner.conf check the 
>> "Spamassassin Local State
>> > Dir" line.
>> > 
>> > Mine reads:
>> > 
>> > SpamAssassin Local State Dir = # /var/lib/spamassassin
>> > 
>> > Cheers,
>> > 
>> > Phil
>> > --
>> > Phil Randal
>> > Network Engineer
>> > Herefordshire Council
>> > Hereford, UK  
>> > 
>> >> -Original Message-
>> >> From: Rob Starr [mailto:[EMAIL PROTECTED] 
>> >> Sent: 30 October 2007 11:54
>> >> To: users@spamassassin.apache.org
>> >> Subject: Re: Custom rules working, but not sa-updates
>> >> 
>> >> 
>> >> I should also mention that SA 3.1.3 was working flawlessly 
>> >> until the update
>> >> to 3.2.3.  I've used the newer config files and been through 
>> >> most of the
>> >> options, but still no luck.
>> >> 
>> >> 
>> >> 
>> >> Rob Starr wrote:
>> >> > 
>> >> > Hi, 
>> >> > 
>> >> > I'm using Postfix + MailScanner + MailWatch + 
>> SpamAssassin 3.2.3. 
>> >> > 
>> >> > My problem is that lots of spam is getting through because 
>> >> the rules 
>> >> > don't seem to be getting used, however my set of custom 
>> rules work 
>> >> > just fine (and disabling the custom ones hasn't helped). 
>>  I'm using
>> >> > Mailwatch so I can easily see which rules are being 
>> >> > hit, and which aren't. 
>> >> > 
>> >> > A lint test runs perfectly fine and reads all of the rule 
>> >> files without 
>> >> > error, all modules installed.  "spamassassin -t 
>> >> spam-sample.txt", uses 
>> >> > ALL of the rules and works fine, but any real mail going 
>> >> through the 
>> >> > system misses the spamassassin rules.  Also odd, is that 
>> >> Razor2 works 
>> >> > and the sa-update rule "RAZOR2_CHECK" always gets hit.  
>> I've tried
>> >> > disabling 
>> >> > razor2 but no luck there. 
>> >> > 
>> >> > Just about every single email being processed hits one of 
>> >> these two rules
>> >> > (or any of the custom rules I have):
>> >> > RAZOR2_CHECK - Listed in Razor2 (http://razor.sf.net/) 
>> >> > RAZOR2_CF_RANGE_51_100 -Razor2 gives confidence level above 50% 
>> >> > 
>> >> > sa-update works fine by placing the latest rules in /var/lib/ 
>> >> > spamassassin/3.002003/.  I also have one custom .cf file in 
>> >> /etc/mail/ 
>> >> > spamassassin that always works. 
>

Still problems with spamd at 100%

[Peter Fastré]

A few weeks ago, I posted the following question:

Hello

I have a severe problem with one of my mailservers. I'm using spamassassin
3.2.3 in combination with exim 4.66, and experience hanging spamd processes
which consume all my server resources.
I've searched these mailing lists, searched google, searched documentation,
... I found very much old posts of people experiencing the same problems, so
I think it's a very common one. I tried different solutions: tracing the
process (process doesn't do anything when it hangs - no trace output),
clearing the bayes database (doesn't help), ...
The problem is really urgent, because exim receives timeouts from spamd, and
rejects the mails.
I reduced the number of mails each spamd processes, to reduce the risk of
hanging. Usually it hangs after having processed 2 or 3 mails.
Now I've even reduced it to 1, the hangups are less often, but still there!
I hope someone has a solution, or a clue to what I can do!
I checked the log files and debug output, which is very consistent. The last
thing all hanging processes do, is this:
Oct 19 09:42:09 mail01 spamd[6072]: rules: ran uri rule __DOS_HAS_ANY_URI
==> got hit: "k"
After this line in the log, the process hangs.

For your reference: the full log file is here:
 http://peter.lunatis.be/temp/spamd.txt

After trying some things that were suggested, the problem went away for a
time. Now it's back though, and I can't work around it. I really hope
someone can give me a direction to search, because this thing is really
driving me crazy!
I noticed the startup is a little bit weird too:
 
http://peter.lunatis.be/temp/spamd-startup.txt

What am I doing wrong?

Regards,

Peter

Enevelope from does not match header from

[ram]

Is there a rule where I can give a score for enevelope from  not
matching header from
Atleast the domain part 

for eg, if someone forges my banks domain name in the header from ( They
cant use that in the envelope from because my bank uses SPF records and
phishers get caught easily ) then I want to mark it as spam. No one has
any business putting mybanks domain name in the from id  




Thanks
Ram

RE: Custom rules working, but not sa-updates

[Randal, Phil]

Right, and what does the

  MailScanner --debug --debug-sa

output say it is using?

Cheers,

Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -Original Message-
> From: Rob Starr [mailto:[EMAIL PROTECTED] 
> Sent: 30 October 2007 12:29
> To: users@spamassassin.apache.org
> Subject: RE: Custom rules working, but not sa-updates
> 
> 
> Thanks for your response Phil,
> 
> In an attempt to resolve the issue, I'm now using MailScanner 
> 4.64.3 and
> have started from a fresh config file, so my "Spamassassin 
> Local State Dir"
> line also reads:
> 
> SpamAssassin Local State Dir = # /var/lib/spamassassin
> 
> And, as I mentioned, a lint test shows that SA is successfully reading
> /var/lib/spamassassin/3.002003/updates_spamassassin_org.cf 
> and all of the
> rules in the /var/lib/spamassassin/3.002003/updates_spamassassin_org/
> folder.
> 
> - Here are relavant lines from the lint test --
> [24215] dbg: config: read file
> /var/lib/spamassassin/3.001003/updates_spamassassin_org.cf
> [24215] dbg: plugin: fixed relative path:
> /var/lib/spamassassin/3.001003/updates_spamassassin_org/10_misc.cf
> [24215] dbg: config: using
> "/var/lib/spamassassin/3.001003/updates_spamassassin_org/10_mi
> sc.cf" for
> included file
> [24215] dbg: config: read file
> /var/lib/spamassassin/3.001003/updates_spamassassin_org/10_mis
> c.cf [24215]
> dbg: plugin: fixed relative path:
> /var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv
> ance_fee.cf
> [24215] dbg: config: using
> "/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_ad
> vance_fee.cf"
> for included file
> [24215] dbg: config: read file
> /var/lib/spamassassin/3.001003/updates_spamassassin_org/20_adv
> ance_fee.cf 
> ...
> -
> 
> Thanks again,
> Rob
> 
> 
> Randal, Phil wrote:
> > 
> > Rob, that could be a MailScanner config problem.  You don't 
> say which
> > version of MailScanner, alas.
> > 
> > In /etc/MailScanner/MailScanner.conf check the 
> "Spamassassin Local State
> > Dir" line.
> > 
> > Mine reads:
> > 
> > SpamAssassin Local State Dir = # /var/lib/spamassassin
> > 
> > Cheers,
> > 
> > Phil
> > --
> > Phil Randal
> > Network Engineer
> > Herefordshire Council
> > Hereford, UK  
> > 
> >> -Original Message-
> >> From: Rob Starr [mailto:[EMAIL PROTECTED] 
> >> Sent: 30 October 2007 11:54
> >> To: users@spamassassin.apache.org
> >> Subject: Re: Custom rules working, but not sa-updates
> >> 
> >> 
> >> I should also mention that SA 3.1.3 was working flawlessly 
> >> until the update
> >> to 3.2.3.  I've used the newer config files and been through 
> >> most of the
> >> options, but still no luck.
> >> 
> >> 
> >> 
> >> Rob Starr wrote:
> >> > 
> >> > Hi, 
> >> > 
> >> > I'm using Postfix + MailScanner + MailWatch + 
> SpamAssassin 3.2.3. 
> >> > 
> >> > My problem is that lots of spam is getting through because 
> >> the rules 
> >> > don't seem to be getting used, however my set of custom 
> rules work 
> >> > just fine (and disabling the custom ones hasn't helped). 
>  I'm using
> >> > Mailwatch so I can easily see which rules are being 
> >> > hit, and which aren't. 
> >> > 
> >> > A lint test runs perfectly fine and reads all of the rule 
> >> files without 
> >> > error, all modules installed.  "spamassassin -t 
> >> spam-sample.txt", uses 
> >> > ALL of the rules and works fine, but any real mail going 
> >> through the 
> >> > system misses the spamassassin rules.  Also odd, is that 
> >> Razor2 works 
> >> > and the sa-update rule "RAZOR2_CHECK" always gets hit.  
> I've tried
> >> > disabling 
> >> > razor2 but no luck there. 
> >> > 
> >> > Just about every single email being processed hits one of 
> >> these two rules
> >> > (or any of the custom rules I have):
> >> > RAZOR2_CHECK - Listed in Razor2 (http://razor.sf.net/) 
> >> > RAZOR2_CF_RANGE_51_100 -Razor2 gives confidence level above 50% 
> >> > 
> >> > sa-update works fine by placing the latest rules in /var/lib/ 
> >> > spamassassin/3.002003/.  I also have one custom .cf file in 
> >> /etc/mail/ 
> >> > spamassassin that always works. 
> >> > 
> >> > I've been troubleshooting for quite a while now and can't 
> >> figure out 
> >> > why the /var/lib/spamassassin/3.002003/ rules just aren't 
> >> being used. 
> >> > Any troubleshooting tips would be greatly appreciated.  
> Just let me 
> >> > know what information you need. 
> >> > 
> >> > Thanks! 
> >> > 
> >> 
> >> -- 
> >> View this message in context: 
> >> http://www.nabble.com/Custom-rules-working%2C-but-not-sa-updat
> >> es-tf4711874.html#a13468319
> >> Sent from the SpamAssassin - Users mailing list archive at 
> Nabble.com.
> >> 
> >> 
> > 
> > 
> 
> -- 
> View this message in context: 
> http://www.nabble.com/Custom-rules-working%2C-but-not-sa-updat
> es-tf4711874.html#a13487599
> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
> 
> 

Re: Win32.pm

[Duane Hill]

On Tue, 30 Oct 2007 02:04:31 -0400
Payne <[EMAIL PROTECTED]> confabulated:

> Guys,
> 
> How can I fix this?
> 
> error: Can't locate Sys/Syslog/Win32.pm in @INC (@INC contains: 
> /usr/lib/perl5/vendor_perl/5.8.8/i586-linux-thread-multi 
> /usr/lib/perl5/vendor_perl/5.8.8 
> /usr/lib/perl5/5.8.8/i586-linux-thread-multi /usr/lib/perl5/5.8.8 
> /usr/lib/perl5/site_perl/5.8.8/i586-linux-thread-multi 
> /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl 
> /usr/lib/perl5/vendor_perl) at (eval 12) line 2.
> [1141] error: Can't locate Sys/Syslog/Win32.pm in @INC (@INC
> contains: /usr/lib/perl5/vendor_perl/5.8.8/i586-linux-thread-multi 
> /usr/lib/perl5/vendor_perl/5.8.8 
> /usr/lib/perl5/5.8.8/i586-linux-thread-multi /usr/lib/perl5/5.8.8 
> /usr/lib/perl5/site_perl/5.8.8/i586-linux-thread-multi 
> /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl 
> /usr/lib/perl5/vendor_perl) at (eval 12) line 2.
> [1141] error: BEGIN failed--compilation aborted at (eval 12) line 2.
> 
> I found this on the web but don't see where in spamassassin I can set
> it.
> 
> 
> It is definately Sys:Syslog causing the problem.  If you look in the
> actual spamd file, it gives some indication of this.  I found that if
> I specified my log file options in the spamassassin options files
> that the problem is resolved.  Add something like -s /var/log/spam.d
> to the existing options and the error clears.
> 
> I have the lastest and greatest Sys::Syslog installed. 

Yes. But do you have Sys::Syslog::Win32 installed via PPM or CPAN?
That's what the error is showing. I would think that would make the
error go away.

--
  _|_
 (_| |

RE: Custom rules working, but not sa-updates

[Rob Starr]

Thanks for your response Phil,

In an attempt to resolve the issue, I'm now using MailScanner 4.64.3 and
have started from a fresh config file, so my "Spamassassin Local State Dir"
line also reads:

SpamAssassin Local State Dir = # /var/lib/spamassassin

And, as I mentioned, a lint test shows that SA is successfully reading
/var/lib/spamassassin/3.002003/updates_spamassassin_org.cf and all of the
rules in the /var/lib/spamassassin/3.002003/updates_spamassassin_org/
folder.

- Here are relavant lines from the lint test --
[24215] dbg: config: read file
/var/lib/spamassassin/3.001003/updates_spamassassin_org.cf
[24215] dbg: plugin: fixed relative path:
/var/lib/spamassassin/3.001003/updates_spamassassin_org/10_misc.cf
[24215] dbg: config: using
"/var/lib/spamassassin/3.001003/updates_spamassassin_org/10_misc.cf" for
included file
[24215] dbg: config: read file
/var/lib/spamassassin/3.001003/updates_spamassassin_org/10_misc.cf [24215]
dbg: plugin: fixed relative path:
/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_advance_fee.cf
[24215] dbg: config: using
"/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_advance_fee.cf"
for included file
[24215] dbg: config: read file
/var/lib/spamassassin/3.001003/updates_spamassassin_org/20_advance_fee.cf 
...
-

Thanks again,
Rob


Randal, Phil wrote:
> 
> Rob, that could be a MailScanner config problem.  You don't say which
> version of MailScanner, alas.
> 
> In /etc/MailScanner/MailScanner.conf check the "Spamassassin Local State
> Dir" line.
> 
> Mine reads:
> 
> SpamAssassin Local State Dir = # /var/lib/spamassassin
> 
> Cheers,
> 
> Phil
> --
> Phil Randal
> Network Engineer
> Herefordshire Council
> Hereford, UK  
> 
>> -Original Message-
>> From: Rob Starr [mailto:[EMAIL PROTECTED] 
>> Sent: 30 October 2007 11:54
>> To: users@spamassassin.apache.org
>> Subject: Re: Custom rules working, but not sa-updates
>> 
>> 
>> I should also mention that SA 3.1.3 was working flawlessly 
>> until the update
>> to 3.2.3.  I've used the newer config files and been through 
>> most of the
>> options, but still no luck.
>> 
>> 
>> 
>> Rob Starr wrote:
>> > 
>> > Hi, 
>> > 
>> > I'm using Postfix + MailScanner + MailWatch + SpamAssassin 3.2.3. 
>> > 
>> > My problem is that lots of spam is getting through because 
>> the rules 
>> > don't seem to be getting used, however my set of custom rules work 
>> > just fine (and disabling the custom ones hasn't helped).  I'm using
>> > Mailwatch so I can easily see which rules are being 
>> > hit, and which aren't. 
>> > 
>> > A lint test runs perfectly fine and reads all of the rule 
>> files without 
>> > error, all modules installed.  "spamassassin -t 
>> spam-sample.txt", uses 
>> > ALL of the rules and works fine, but any real mail going 
>> through the 
>> > system misses the spamassassin rules.  Also odd, is that 
>> Razor2 works 
>> > and the sa-update rule "RAZOR2_CHECK" always gets hit.  I've tried
>> > disabling 
>> > razor2 but no luck there. 
>> > 
>> > Just about every single email being processed hits one of 
>> these two rules
>> > (or any of the custom rules I have):
>> > RAZOR2_CHECK - Listed in Razor2 (http://razor.sf.net/) 
>> > RAZOR2_CF_RANGE_51_100 -Razor2 gives confidence level above 50% 
>> > 
>> > sa-update works fine by placing the latest rules in /var/lib/ 
>> > spamassassin/3.002003/.  I also have one custom .cf file in 
>> /etc/mail/ 
>> > spamassassin that always works. 
>> > 
>> > I've been troubleshooting for quite a while now and can't 
>> figure out 
>> > why the /var/lib/spamassassin/3.002003/ rules just aren't 
>> being used. 
>> > Any troubleshooting tips would be greatly appreciated.  Just let me 
>> > know what information you need. 
>> > 
>> > Thanks! 
>> > 
>> 
>> -- 
>> View this message in context: 
>> http://www.nabble.com/Custom-rules-working%2C-but-not-sa-updat
>> es-tf4711874.html#a13468319
>> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>> 
>> 
> 
> 

-- 
View this message in context: 
http://www.nabble.com/Custom-rules-working%2C-but-not-sa-updates-tf4711874.html#a13487599
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Win32.pm

[Payne]

Guys,

How can I fix this?

error: Can't locate Sys/Syslog/Win32.pm in @INC (@INC contains: 
/usr/lib/perl5/vendor_perl/5.8.8/i586-linux-thread-multi 
/usr/lib/perl5/vendor_perl/5.8.8 
/usr/lib/perl5/5.8.8/i586-linux-thread-multi /usr/lib/perl5/5.8.8 
/usr/lib/perl5/site_perl/5.8.8/i586-linux-thread-multi 
/usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl 
/usr/lib/perl5/vendor_perl) at (eval 12) line 2.
[1141] error: Can't locate Sys/Syslog/Win32.pm in @INC (@INC contains: 
/usr/lib/perl5/vendor_perl/5.8.8/i586-linux-thread-multi 
/usr/lib/perl5/vendor_perl/5.8.8 
/usr/lib/perl5/5.8.8/i586-linux-thread-multi /usr/lib/perl5/5.8.8 
/usr/lib/perl5/site_perl/5.8.8/i586-linux-thread-multi 
/usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl 
/usr/lib/perl5/vendor_perl) at (eval 12) line 2.

[1141] error: BEGIN failed--compilation aborted at (eval 12) line 2.

I found this on the web but don't see where in spamassassin I can set it.


It is definately Sys:Syslog causing the problem.  If you look in the actual
spamd file, it gives some indication of this.  I found that if I specified
my log file options in the spamassassin options files that the problem is
resolved.  Add something like -s /var/log/spam.d to the existing options and
the error clears.

I have the lastest and greatest Sys::Syslog installed. 


Payne

bw - Rank1st

RE: Custom rules working, but not sa-updates

[Randal, Phil]

Rob, that could be a MailScanner config problem.  You don't say which
version of MailScanner, alas.

In /etc/MailScanner/MailScanner.conf check the "Spamassassin Local State
Dir" line.

Mine reads:

SpamAssassin Local State Dir = # /var/lib/spamassassin

Cheers,

Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -Original Message-
> From: Rob Starr [mailto:[EMAIL PROTECTED] 
> Sent: 30 October 2007 11:54
> To: users@spamassassin.apache.org
> Subject: Re: Custom rules working, but not sa-updates
> 
> 
> I should also mention that SA 3.1.3 was working flawlessly 
> until the update
> to 3.2.3.  I've used the newer config files and been through 
> most of the
> options, but still no luck.
> 
> 
> 
> Rob Starr wrote:
> > 
> > Hi, 
> > 
> > I'm using Postfix + MailScanner + MailWatch + SpamAssassin 3.2.3. 
> > 
> > My problem is that lots of spam is getting through because 
> the rules 
> > don't seem to be getting used, however my set of custom rules work 
> > just fine (and disabling the custom ones hasn't helped).  I'm using
> > Mailwatch so I can easily see which rules are being 
> > hit, and which aren't. 
> > 
> > A lint test runs perfectly fine and reads all of the rule 
> files without 
> > error, all modules installed.  "spamassassin -t 
> spam-sample.txt", uses 
> > ALL of the rules and works fine, but any real mail going 
> through the 
> > system misses the spamassassin rules.  Also odd, is that 
> Razor2 works 
> > and the sa-update rule "RAZOR2_CHECK" always gets hit.  I've tried
> > disabling 
> > razor2 but no luck there. 
> > 
> > Just about every single email being processed hits one of 
> these two rules
> > (or any of the custom rules I have):
> > RAZOR2_CHECK - Listed in Razor2 (http://razor.sf.net/) 
> > RAZOR2_CF_RANGE_51_100 -Razor2 gives confidence level above 50% 
> > 
> > sa-update works fine by placing the latest rules in /var/lib/ 
> > spamassassin/3.002003/.  I also have one custom .cf file in 
> /etc/mail/ 
> > spamassassin that always works. 
> > 
> > I've been troubleshooting for quite a while now and can't 
> figure out 
> > why the /var/lib/spamassassin/3.002003/ rules just aren't 
> being used. 
> > Any troubleshooting tips would be greatly appreciated.  Just let me 
> > know what information you need. 
> > 
> > Thanks! 
> > 
> 
> -- 
> View this message in context: 
> http://www.nabble.com/Custom-rules-working%2C-but-not-sa-updat
> es-tf4711874.html#a13468319
> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
> 
> 

Re: Custom rules working, but not sa-updates

[Rob Starr]

I should also mention that SA 3.1.3 was working flawlessly until the update
to 3.2.3.  I've used the newer config files and been through most of the
options, but still no luck.



Rob Starr wrote:
> 
> Hi, 
> 
> I'm using Postfix + MailScanner + MailWatch + SpamAssassin 3.2.3. 
> 
> My problem is that lots of spam is getting through because the rules 
> don't seem to be getting used, however my set of custom rules work 
> just fine (and disabling the custom ones hasn't helped).  I'm using
> Mailwatch so I can easily see which rules are being 
> hit, and which aren't. 
> 
> A lint test runs perfectly fine and reads all of the rule files without 
> error, all modules installed.  "spamassassin -t spam-sample.txt", uses 
> ALL of the rules and works fine, but any real mail going through the 
> system misses the spamassassin rules.  Also odd, is that Razor2 works 
> and the sa-update rule "RAZOR2_CHECK" always gets hit.  I've tried
> disabling 
> razor2 but no luck there. 
> 
> Just about every single email being processed hits one of these two rules
> (or any of the custom rules I have):
> RAZOR2_CHECK - Listed in Razor2 (http://razor.sf.net/) 
> RAZOR2_CF_RANGE_51_100 -Razor2 gives confidence level above 50% 
> 
> sa-update works fine by placing the latest rules in /var/lib/ 
> spamassassin/3.002003/.  I also have one custom .cf file in /etc/mail/ 
> spamassassin that always works. 
> 
> I've been troubleshooting for quite a while now and can't figure out 
> why the /var/lib/spamassassin/3.002003/ rules just aren't being used. 
> Any troubleshooting tips would be greatly appreciated.  Just let me 
> know what information you need. 
> 
> Thanks! 
> 

-- 
View this message in context: 
http://www.nabble.com/Custom-rules-working%2C-but-not-sa-updates-tf4711874.html#a13468319
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: sa-update

[Obantec Support]

- Original Message - 
From: "Matt Kettler" <[EMAIL PROTECTED]>

To: "Obantec Support" <[EMAIL PROTECTED]>
Cc: 
Sent: Monday, October 29, 2007 11:29 PM
Subject: Re: sa-update



Obantec Support wrote:

Hi

i run sa-update from cron and last update seems to be Oct18 2007

running spamassassin 3.2.3 on FC3

/var/lib/spamassassin/3.002003 updates_spamassassin_org.cf
first line is # UPDATE version 585505

not seen any reports on list of sa-update issues any pointers welcomed.


Um.. What would lead you to believe there's a problem?

Updates for SA aren't like updates for an AV scanner, there aren't
updates every day. SpamAssassin doesn't need new rules for every new
spam email, so it's quite reasonable the updates are fewer and further
between. This is particularly on the released versions where there's
more of a "don't push updates without a good reason to do so" mindset.
When the need arises, updates are made, but they're not going to push
out all the latest unproven test rules to the normal release channel.

If you look at the SVN tags, there's no sa-update_3.2_* tag that's newer
than: sa-update_3.2_20071017134827

Which is from October 17, 20007.

See for yourself:  http://svn.apache.org/repos/asf/spamassassin/tags/

If you look back, there were no updates to 3.2 between July 15 and
September 4 (51 days). Then 8 updates between September 21 and October
17th (26 days, for an average of 1 every 3.25 days). This is perfectly
normal. The dev team is just reacting to changes in spam when they occur..


There's some newer stuff in the 3.3 development branch sa-update, but
that's a devel branch, there's going to be lots of in-development rules
freely published to it with less testing.




Thanks for the comprehensive info. makes sense.

Mark 

Re: SPAM tagging

[Matthias Haegele]

Agnello George schrieb:

Hi
i have installed  amavisd new on my postfix mailserver. Now i need to test
spam , so I  sent a mail with the following text in  the body ( see link )
 .. this is found at http://spamassassin.apache.org/gtube/ .

As per the logs the mal is being blocked, but our requirement is that it
should be be tagged as SPAM ( ***SPAM*** ) . Bellow is the logs

###
Oct 30 11:50:08 fedora7 amavis[3784]: (03784-01) Blocked SPAM, MYNETS LOCAL
[127.0.0.1] [ 127.0.0.1] <[EMAIL PROTECTED]> ->
<[EMAIL PROTECTED]>,
Message-ID: <[EMAIL PROTECTED]>, mail_id:
itV2-9cTSct6, Hits: 1001.149, size: 807, 1698 msOct 30 11:50:08 fedora7
postfix/smtp[3749]: 80590464DE: to=< [EMAIL PROTECTED]>, relay=
127.0.0.1[127.0.0.1]:10024, delay=1.8, delays=0.06/0/0.01/1.7, dsn=2.7.0,
status=sent (250 2.7.0 Ok, discarded, id=03784-01 - SPAM)Oct 30 11:50:08
fedora7 postfix/qmgr[3499]: 80590464DE: removed
##
Do le me know how to tag SPAM mails




Perhaps this is not a amavisd-new list ;-).

You should read through the well commented amavisd config (located here 
on Debian/Etch):



zless /usr/share/doc/amavisd-new/examples/amavisd.conf-sample.gz


look for tag_level and which actions are taken especially on kill_level 
(default might be to quarantine or discard)



$sa_tag_level_deflt
$sa_kill_level_deflt









--
Grüsse/Greetings
MH


Dont send mail to: [EMAIL PROTECTED]
--