Re: Weird problem with Spamassassin and Net::DNS, using ipv6 and failing - more info

[Luigi Lauro]

> Weird indeed. Which version of IO::Socket::INET6 do you have?

marvin% perl -le 'use IO::Socket::INET6; print IO::Socket::INET6->VERSION'
2.57


> Try capturing your traffic on a loopback interface for port 53:

This is the output with -vv for protocol decode with my recursive
local DNS on 127.0.0.1 and my authorative DNS on listening on
2002:4e2e:3890::1 and 78.46.56.144

marvin% cat logtcp.log
08:12:36.235450 IP (tos 0x0, ttl 64, id 40217, offset 0, flags [none],
proto UDP (17), length 51, bad cksum 0 (->df9e)!)
localhost.45390 > localhost.domain: [udp sum ok] 32759+ A? 256.1. (23)
08:12:36.235511 IP (tos 0x0, ttl 64, id 40218, offset 0, flags [none],
proto UDP (17), length 51, bad cksum 0 (->df9d)!)
localhost.domain > localhost.45390: [udp sum ok] 32759 NXDomain*
q: A? 256.1. 0/0/0 (23)
08:12:36.235571 IP (tos 0x0, ttl 64, id 40219, offset 0, flags [none],
proto UDP (17), length 65, bad cksum 0 (->df8e)!)
localhost.55868 > localhost.domain: [udp sum ok] 32760+ A?
256.1.luigilauro.it. (37)
08:12:36.235606 IP (tos 0x0, ttl 64, id 40220, offset 0, flags [none],
proto UDP (17), length 81, bad cksum 0 (->df7d)!)
localhost.domain > localhost.55868: [udp sum ok] 32760 q: A?
256.1.luigilauro.it. 1/0/0 256.1.luigilauro.it. A 78.46.56.144 (53)
08:12:36.370027 IP (tos 0x0, ttl 64, id 40240, offset 0, flags [none],
proto UDP (17), length 53, bad cksum 0 (->df85)!)
localhost.20826 > localhost.domain: [udp sum ok] 32761+ ? 0.0.0.0. (25)
08:12:36.370079 IP (tos 0x0, ttl 64, id 40241, offset 0, flags [none],
proto UDP (17), length 53, bad cksum 0 (->df84)!)
localhost.domain > localhost.20826: [udp sum ok] 32761 q: ?
0.0.0.0. 0/0/0 (25)
08:12:36.370121 IP (tos 0x0, ttl 64, id 40242, offset 0, flags [none],
proto UDP (17), length 67, bad cksum 0 (->df75)!)
localhost.52422 > localhost.domain: [udp sum ok] 32762+ ?
0.0.0.0.luigilauro.it. (39)
08:12:36.370173 IP (tos 0x0, ttl 64, id 40243, offset 0, flags [none],
proto UDP (17), length 95, bad cksum 0 (->df58)!)
localhost.domain > localhost.52422: [udp sum ok] 32762 q: ?
0.0.0.0.luigilauro.it. 1/0/0 0.0.0.0.luigilauro.it. 
2002:4e2e:3890::1 (67)
08:12:36.370264 IP (tos 0x0, ttl 64, id 40244, offset 0, flags [none],
proto UDP (17), length 53, bad cksum 0 (->df81)!)
localhost.24531 > localhost.domain: [udp sum ok] 32763+ ? 0.0.0.0. (25)
08:12:36.370293 IP (tos 0x0, ttl 64, id 40245, offset 0, flags [none],
proto UDP (17), length 53, bad cksum 0 (->df80)!)
localhost.domain > localhost.24531: [udp sum ok] 32763 q: ?
0.0.0.0. 0/0/0 (25)
08:12:36.370329 IP (tos 0x0, ttl 64, id 40246, offset 0, flags [none],
proto UDP (17), length 67, bad cksum 0 (->df71)!)
localhost.26186 > localhost.domain: [udp sum ok] 32764+ ?
0.0.0.0.luigilauro.it. (39)
08:12:36.370361 IP (tos 0x0, ttl 64, id 40247, offset 0, flags [none],
proto UDP (17), length 95, bad cksum 0 (->df54)!)
localhost.domain > localhost.26186: [udp sum ok] 32764 q: ?
0.0.0.0.luigilauro.it. 1/0/0 0.0.0.0.luigilauro.it. 
2002:4e2e:3890::1 (67)
08:12:37.290121 IP (tos 0x0, ttl 64, id 40435, offset 0, flags [none],
proto UDP (17), length 53, bad cksum 0 (->dec2)!)
localhost.50361 > localhost.domain: [udp sum ok] 32765+ ? 0.0.0.0. (25)
08:12:37.290171 IP (tos 0x0, ttl 64, id 40436, offset 0, flags [none],
proto UDP (17), length 53, bad cksum 0 (->dec1)!)
localhost.domain > localhost.50361: [udp sum ok] 32765 q: ?
0.0.0.0. 0/0/0 (25)
08:12:37.290209 IP (tos 0x0, ttl 64, id 40437, offset 0, flags [none],
proto UDP (17), length 67, bad cksum 0 (->deb2)!)
localhost.24761 > localhost.domain: [udp sum ok] 32766+ ?
0.0.0.0.luigilauro.it. (39)
08:12:37.290242 IP (tos 0x0, ttl 64, id 40438, offset 0, flags [none],
proto UDP (17), length 95, bad cksum 0 (->de95)!)
localhost.domain > localhost.24761: [udp sum ok] 32766 q: ?
0.0.0.0.luigilauro.it. 1/0/0 0.0.0.0.luigilauro.it. 
2002:4e2e:3890::1 (67)
08:12:37.290316 IP (tos 0x0, ttl 64, id 40439, offset 0, flags [none],
proto UDP (17), length 53, bad cksum 0 (->debe)!)
localhost.57357 > localhost.domain: [udp sum ok] 32767+ ? 0.0.0.0. (25)
08:12:37.290342 IP (tos 0x0, ttl 64, id 40440, offset 0, flags [none],
proto UDP (17), length 53, bad cksum 0 (->debd)!)
localhost.domain > localhost.57357: [udp sum ok] 32767 q: ?
0.0.0.0. 0/0/0 (25)
08:12:37.290377 IP (tos 0x0, ttl 64, id 40441, offset 0, flags [none],
proto UDP (17), length 67, bad cksum 0 (->deae)!)
localhost.14897 > localhost.domain: [udp sum ok] 32768+ ?
0.0.0.0.luigilauro.it. (39)
08:12:37.290430 IP (tos 0x0, ttl 64, id 40442, offset 0, flags [none],
proto UDP (17), length 95, bad cksum 0 (->de91)!)
localhost.domain > localhost.14897: [udp sum ok] 32768 q: ?
0.0.0.0.luigilauro.it. 1/0/0 0.0.0.0.luigilauro.it. 
2002:4e2e:3890::1 (67)
08:12:37.291147 IP (tos 0x0, ttl 64, id 40443, offset 0, flags [none],
proto UDP (17), length 53, bad cksum 0 (->deba)!)
localhost.19958 > local

SA 3.3.0 depends on Perl 5.10 (FreeBSD Ports)???

[James Smallacombe]

I tried to upgrade from SA 3.2.5 to 3.3.0 by installing the newer one from 
FreeBSD Ports.  It seems that at least the Ports version thinks that the 
latest SA requires perl 5.10.x, rather than 5.8.9, which I was already 
using.  Installing from ports automatically installs perl 5.10.1 which 
causes spamc children to run wild and basically, spamd can't cope with it.


I don't need or want perl 5.bleeding.edge, 5.8.9 was working just fine.  I 
tried doing a 'make clean' then removing 5.10 and correcting all the 
symlinks to point to 5.8.9, I tried running use.perl system, but SA just 
keeps looking for 510 and installing it when it doesn't find it.


Reading the SA docs, it doesn't seem to require anything later than 
5.8.8...can anyone clue me in as to how to tell the ports version of it to 
use 5.8.9?  Or should I just use the source directly?


James Smallacombe PlantageNet, Inc. CEO and Janitor
u...@3.am   http://3.am
=

Re: About Training ( sa-learn )

[Henrique Fernandes]

Every email that comes in postfix i send to that filter, and this filter
send the email.  When i use the  with the option -u ${recipient}  it
override the user that is runing and do the process with the user that is
reciving the email, when it autolearn it goes to a diferent user in the
table. So i have diferent databases for each user.

And after go through the spamc filter it repass the email.

good enough ?

[]'sf.rique


On Thu, Mar 4, 2010 at 9:54 PM, LuKreme  wrote:

> On 4-Mar-2010, at 07:45, Henrique Fernandes wrote:
> >
> > I have set up my spamassassin to traing individual database (mysql ) with
> > this filter in postfix
> >
> > spamassassin unix - n   n   -   -   pipe
> >flags=Rq user=spamassassin argv=/usr/bin/spamc -u ${recipient} -f
> -e
> >/usr/sbin/sendmail -oi -f ${sender} -- ${recipient}
>
> Wait, what exactly is this doing?
>
>
> --
> Windle shook his head sadly. Five exclamation marks, the sure sign of an
> insane mind. --Reaper Man
>
>

Re: SA team lambasted in RISKS Digest

[Karsten Bräckelmann]

On Fri, 2010-03-05 at 09:45 +0800, jida...@jidanni.org wrote:
> http://catless.ncl.ac.uk/Risks/25.94.html#subj11
> I suggest someone send RISKS a clarification if indeed the issue is resolved.

I suggest the author checks the facts. The following quote, the
beginning of that, err... text, is utter bullshit.

  In RISKS-25.89 ("Y2K+10 problem 4: SpamAssassin tags '2010' e-mail as
  spammish") M. Burstein wrote that the problem was that "It seems the 'year
  date' was hard/hand coded, as opposed to making a comparison to 'today's'
  date." and observed that "The SpamAssassin folk have a new version which
  corrects this problem."  In fact, they do not.  The replacement rule
  incorporates the same problem as before, scheduled to occur simply ten years
  further into the future, in January 2020.  This mistake has not been learned
  from, let alone corrected.

There are bugs open about this. There are rules currently under
evaluation, which will make this a fluid target, rather than a hardcoded
year.

We've got ten years, to close that bug and finish the evaluation. And
even to come up with a more narrow definition of "grossly in the
future".

Yes, that quote is what you get if you base your judgement *and* future
predictions solely on the incident -- but forget to check current
development and what's being done to prevent it.

That quote hardly was worth my reply. *sigh*


-- 
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

SA team lambasted in RISKS Digest

[jidanni]

http://catless.ncl.ac.uk/Risks/25.94.html#subj11
I suggest someone send RISKS a clarification if indeed the issue is resolved.

Re: About Training ( sa-learn )

[LuKreme]

On 4-Mar-2010, at 07:45, Henrique Fernandes wrote:
> 
> I have set up my spamassassin to traing individual database (mysql ) with
> this filter in postfix
> 
> spamassassin unix - n   n   -   -   pipe
>flags=Rq user=spamassassin argv=/usr/bin/spamc -u ${recipient} -f -e
>/usr/sbin/sendmail -oi -f ${sender} -- ${recipient}

Wait, what exactly is this doing?


-- 
Windle shook his head sadly. Five exclamation marks, the sure sign of an insane 
mind. --Reaper Man

Re: Spam Score

[LuKreme]

On 4-Mar-2010, at 15:04, Walter Breno wrote:
> 
> Hi, i have some problems with false positives so i need that the e-mails
> with spamassassin score 2 or 3 has being marked as spam but delivered to the
> user,

Why would you mark emails with scores of 2 or 3 as spam?

You're doing it wrong.

-- 
I WILL NOT SELL LAND IN FLORIDA
Bart chalkboard Ep. 7F16

Re: Weird problem with Spamassassin and Net::DNS, using ipv6 and failing - more info

[Mark Martinec]

Luigi,

> Mar  4 21:14:52.177 [4180] dbg: dns: no packet! err=Connection refused
> packet=undef
> Mar  4 21:14:55.196 [4180] dbg: dns: NS lookup of apache.org using
> 127.0.0.1 failed, no results found

Weird indeed. Which version of IO::Socket::INET6 do you have?

$ perl -le 'use IO::Socket::INET6; print IO::Socket::INET6->VERSION'
2.57

Try capturing your traffic on a loopback interface for port 53:

  tcpdump -i lo0 -s 0 -w 0.log 'port 53'

then we can decide whether the fault lies with SpamAssassin and
its underlying inet sockets module, or with your DNS server(s),
or even with your TCP stack implementation. Btw, what OS is that?

  Mark

Re: Spam Score

[Karsten Bräckelmann]

On Thu, 2010-03-04 at 19:04 -0300, Walter Breno wrote:
> Hi, i have some problems with false positives so i need that the

False Positive. A mail, that has been (positively) classified as spam,
but is not (false).

> e-mails with spamassassin score 2 or 3 has being marked as spam but

You are classifying a SA score of 2(!) as spam!? There is your problem
right there. Don't. That of course if prone to FPs. And *will* result in
FPs.

The default required_score threshold of 5 is there for a reason. All SA
scores are set with that threshold in mind. Do NOT change it, unless you
really know what you are doing.

> delivered to the user, what is the parameter that can help me with
> this problem?

required_score 5.0

Seriously, though, SA does not deliver your mail. You can change the
score that is required for a mail to be classified spam (back to the
default). But your MDA, ultimately delivering your mail -- possibly
based on the SA score -- is something else.


-- 
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: Spam Score

[Jari Fredriksson]

On 5.3.2010 0:04, Walter Breno wrote:
> Hi, i have some problems with false positives so i need that the e-mails
> with spamassassin score 2 or 3 has being marked as spam but delivered to
> the user, what is the parameter that can help me with this problem?

SpamAssassin does not do anything in order to the delivery. There must
be some other software involved, which has to be tuned.

By default, SpamAssassin marks scores 5 and up as spam, so normally
those scoring 2 or 3 would be ham.

-- 
http://www.iki.fi/jarif/

The lunatic, the lover, and the poet,
Are of imagination all compact...
-- Wm. Shakespeare, "A Midsummer Night's Dream"



signature.asc
Description: OpenPGP digital signature

Spam Score

[Walter Breno]

Hi, i have some problems with false positives so i need that the e-mails
with spamassassin score 2 or 3 has being marked as spam but delivered to the
user, what is the parameter that can help me with this problem?

Re: Spamd Is Failing in Logs

[Carlos Williams]

On Thu, Mar 4, 2010 at 3:48 PM, Carlos Williams  wrote:
> I just installed Spamassassin today on my Postfix email server and
> don't understand why I am getting errors in my logs. It's not working
> and I can't start the service for some reason...

All, I apologize but I resolved this. I couldn't successfully start
'spamd' because I 1st needed to run 'sa-update' and now I appear to be
flowing mail properly but can you guys please review this session from
my mail.log and tell me if this is how SA should act and work with my
MTA? I have not used it before on this kind of server so I am
wondering if this looks correct to everyone:

Mar  4 16:15:05 mail postfix/smtpd[1477]: connect from
mail.adl.gov[xxx.xxx.xxx.xxx]
Mar  4 16:15:06 mail postgrey[1147]: action=pass, reason=triplet
found, client_name=mail.adl.gov, client_address=xxx.xxx.xxx.xxx,
sender=car...@adl.gov, recipient=car...@iamghost.com
Mar  4 16:15:06 mail postfix/smtpd[1477]: 4E01183F: client=mail.adl.gov[1.2.3.4]
Mar  4 16:15:06 mail postfix/cleanup[1481]: 4E01183F:
message-id=<2a50942b1457f94083d1ec233ca274f2b113aaf...@xyh11c8evs1.adl.gov>
Mar  4 16:15:06 mail postfix/qmgr[1449]: 4E01183F:
from=, size=1206, nrcpt=1 (queue active)
Mar  4 16:15:06 mail postfix/smtpd[1477]: disconnect from mail.adl.gov[1.2.3.4]
Mar  4 16:15:10 mail postfix/pickup[1448]: A282684A: uid=5001
from=
Mar  4 16:15:10 mail postfix/cleanup[1481]: A282684A:
message-id=<2a50942b1457f94083d1ec233ca274f2b113aaf...@stri011c8evs1.peostri.army.mil>
Mar  4 16:15:10 mail postfix/qmgr[1449]: 4E01183F: removed
Mar  4 16:15:10 mail postfix/pipe[1482]: 4E01183F:
to=, relay=spamassassin, delay=4.6,
delays=0.65/0.01/0/4, dsn=2.0.0, status=sent (delivered via
spamassassin service)
Mar  4 16:15:10 mail postfix/qmgr[1449]: A282684A:
from=, size=1508, nrcpt=1 (queue active)
Mar  4 16:15:10 mail postfix/local[1486]: A282684A:
to=, relay=local, delay=0.12,
delays=0.08/0.01/0/0.03, dsn=2.0.0, status=sent (delivered to maildir)
Mar  4 16:15:10 mail postfix/qmgr[1449]: A282684A: removed

Does the above look correct in regards to SA integrating the message
between Postfix? Anyone have any comments or suggestions?

Re: user_prefs not recognized?

[Ron Johnson]

On 2010-03-04 15:13, Karsten Bräckelmann wrote:

On Thu, 2010-03-04 at 14:36 -0600, Ron Johnson wrote:
I want my users (it's a small at-home setup of fetchmail, postfix, 
SA and courier-imap) to be able to whitelist certain users.


You do *not* need allow_user_rules, to enable per-user whitelist_* or
blacklist_* settings.

See the docs [1], and pay special attention to the first sentence in the
User Preferences section. Also note that Whitelist and Blacklist Options
is a sub-section of this. :)



Already read this:
full/3.3.x/doc/Mail_SpamAssassin_Conf.html#user_preferences


On a related note, the plain whitelist_from without a rcvd or auth
constraint is dangerous to use. If possible, always use the constraint
ones, and the plain one strictly as a fall-back if there is no other
possibility -- and you really need the whitelist. In almost all cases,
you don't, and the real problem (if any) goes by unnoticed.


Right.  I wanted to get the "simple stuff" working first; then the 
more complicated configurations.





This is what my various config files look like:

 $ tail -n1 /etc/spamassassin/local.cf
 allow_user_rules1

 $ cat ~/.spamassassin/user_prefs
 headerL_TO_ME   ToCc =~ /ron\.l\.johns...@cox\.net/
 describe  L_TO_ME   Email addressed to me
 score L_TO_ME   0.010


For this, you need allow_user_rules 1.


 whitelist_from  nytdir...@nytimes.com


For this, you don't.


OK.


However, you did *not* show any evidence, headers, or whatever, that the
L_TO_ME user rule does not work...


In Thunderbird View->"Message Source", I searched for L_TO_ME.

Am I fundamentally *wrong* about something here?


How is SA called?


(Lines manually "continued" for easy reading.)

# grep spam /etc/postfix/master.cf
smtp  inet  n   -   n   -   -   \
  smtpd -o content_filter=spamfilter:
spamfilter unix - n n - - pipe flags=Rq user=spamfilter \
  argv=/usr/local/bin/spamfilter.sh \
  -f ${sender} -- ${recipient}


   Are you using per-user configuration?


I think so.  But that "user=spamfilter" makes me now think 
otherwise.  I set this up years ago, and only now care about 
whitelisting.



[1] http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Conf.html




--
Ron Johnson, Jr.
Jefferson LA  USA

"If God had wanted man to play soccer, he wouldn't have given
us arms."  Mike Ditka

Re: user_prefs not recognized?

[Karsten Bräckelmann]

On Thu, 2010-03-04 at 14:36 -0600, Ron Johnson wrote:
> I want my users (it's a small at-home setup of fetchmail, postfix, 
> SA and courier-imap) to be able to whitelist certain users.

You do *not* need allow_user_rules, to enable per-user whitelist_* or
blacklist_* settings.

See the docs [1], and pay special attention to the first sentence in the
User Preferences section. Also note that Whitelist and Blacklist Options
is a sub-section of this. :)


On a related note, the plain whitelist_from without a rcvd or auth
constraint is dangerous to use. If possible, always use the constraint
ones, and the plain one strictly as a fall-back if there is no other
possibility -- and you really need the whitelist. In almost all cases,
you don't, and the real problem (if any) goes by unnoticed.


> This is what my various config files look like:
> 
>  $ tail -n1 /etc/spamassassin/local.cf
>  allow_user_rules1
> 
>  $ cat ~/.spamassassin/user_prefs
>  headerL_TO_ME   ToCc =~ /ron\.l\.johns...@cox\.net/
>  describe  L_TO_ME   Email addressed to me
>  score L_TO_ME   0.010

For this, you need allow_user_rules 1.

>  whitelist_from  nytdir...@nytimes.com

For this, you don't.

However, you did *not* show any evidence, headers, or whatever, that the
L_TO_ME user rule does not work...

How is SA called? Are you using per-user configuration?


[1] http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Conf.html

-- 
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Spamd Is Failing in Logs

[Carlos Williams]

I just installed Spamassassin today on my Postfix email server and
don't understand why I am getting errors in my logs. It's not working
and I can't start the service for some reason...

Mar  4 15:42:37 mail spamc[1303]: connect to spamd on 127.0.0.1
failed, retrying (#1 of 3): Connection refused
Mar  4 15:42:38 mail spamc[1303]: connect to spamd on 127.0.0.1
failed, retrying (#2 of 3): Connection refused
Mar  4 15:42:39 mail spamc[1303]: connect to spamd on 127.0.0.1
failed, retrying (#3 of 3): Connection refused
Mar  4 15:42:40 mail spamc[1303]: connection attempt to spamd aborted
after 3 retries
Mar  4 15:42:40 mail postfix/pickup[1295]: D4DFD83F: uid=5001
from=
Mar  4 15:42:40 mail postfix/cleanup[1301]: D4DFD83F:
message-id=
Mar  4 15:42:40 mail postfix/qmgr[1146]: 6DCEE83B: removed
Mar  4 15:42:40 mail postfix/pipe[1302]: 6DCEE83B:
to=, relay=spamassassin, delay=3.9,
delays=0.75/0.01/0/3.1, dsn=2.0.0, status=sent (delivered via
spamassassin service)
Mar  4 15:42:40 mail postfix/qmgr[1146]: D4DFD83F:
from=, size=1656, nrcpt=1 (queue active)
Mar  4 15:42:40 mail postfix/local[1306]: D4DFD83F:
to=, relay=local, delay=0.17,
delays=0.12/0.01/0/0.04, dsn=2.0.0, status=sent (delivered to maildir)
Mar  4 15:42:40 mail postfix/qmgr[1146]: D4DFD83F: removed
Mar  4 15:43:07 mail postfix/smtpd[1297]: disconnect from
mail-fx0-f209.google.com[209.85.220.209]

I am unable to start the spamassassin service daemon because I get the
following error:

[r...@mail ~]# /etc/rc.d/spamd restart
:: Stopping spamd

 [FAIL]
:: Starting spamd

 [BUSY] child process [1329]
exited or timed out without signaling production of a PID file: exit
255 at /usr/bin/perlbin/vendor/spamd line 2536.


 [FAIL]

I followed the installation instructions exactly so I don't know why
Postfix and SpamAssassin are not working together. Anyone have any
ideas?

user_prefs not recognized?

[Ron Johnson]

Hi,

I want my users (it's a small at-home setup of fetchmail, postfix, 
SA and courier-imap) to be able to whitelist certain users.


This is what my various config files look like:

$ tail -n1 /etc/spamassassin/local.cf
allow_user_rules1

$ cat ~/.spamassassin/user_prefs
headerL_TO_ME   ToCc =~ /ron\.l\.johns...@cox\.net/
describe  L_TO_ME   Email addressed to me
score L_TO_ME   0.010
whitelist_from  nytdir...@nytimes.com


After adding allow_user_rules to local.cf, I bounced SA by doing:
# /etc/init.d/spamassassin restart

The L_TO_ME stuff I got from the wiki page:
http://wiki.apache.org/spamassassin/UserPrefRuleTest

If relevant, this is Debian Sid, running v3.3.0-1

Thanks

--
Ron Johnson, Jr.
Jefferson LA  USA

"If God had wanted man to play soccer, he wouldn't have given
us arms."  Mike Ditka

Weird problem with Spamassassin and Net::DNS, using ipv6 and failing

[Luigi Lauro]

My spamassassin is failing DNS query with a very curious output, as if
he's trying ipv6 despite the fact my resolv.conf give a correct
127.0.0.1 nameserver (im running I'm running a local resolver on
127.0.0.1 and an authorative nameserver on public IPs)

Some info

marvin% uname -a
FreeBSD marvin.luigilauro.it 8.0-STABLE FreeBSD 8.0-STABLE #6 r204039:
Thu Feb 18 13:42:04 CET 2010
r...@marvin.luigilauro.it:/usr/obj/usr/src/sys/MARVIN  amd64

marvin% spamassassin -V
SpamAssassin version 3.3.0
  running on Perl version 5.10.1

marvin% sockstat -4 -l
USER COMMANDPID   FD PROTO  LOCAL ADDRESS FOREIGN ADDRESS
bind zoneserver 8257  5  tcp4   78.46.56.157:53   *:*
bind zoneserver 8256  3  tcp4   78.46.56.144:53   *:*
bind maradns.au 8228  3  udp4   78.46.56.144:53   *:*
bind maradns.au 8228  5  udp4   78.46.56.157:53   *:*
Gdnscache dnscache  1060  3  udp4   127.0.0.1:53  *:*
Gdnscache dnscache  1060  4  tcp4   127.0.0.1:53  *:*

marvin% sockstat -6 -l
USER COMMANDPID   FD PROTO  LOCAL ADDRESS FOREIGN ADDRESS
bind maradns.au 8228  6  udp6   2002:4e2e:3890::1:53  *:*

marvin% cat /etc/resolv.conf
domain luigilauro.it
nameserver 127.0.0.1

marvin% sudo spamassassin -D < /home/omero/sample-spam.txt
Mar  4 20:58:03.718 [2784] dbg: logger: adding facilities: all
Mar  4 20:58:03.718 [2784] dbg: logger: logging level is DBG
Mar  4 20:58:03.718 [2784] dbg: generic: SpamAssassin version 3.3.0
Mar  4 20:58:03.718 [2784] dbg: generic: Perl 5.010001,
PREFIX=/usr/local, DEF_RULES_DIR=/usr/local/share/spamassassin,
LOCAL_RULES_DIR=/usr/local/etc/mail/spamassassin,
LOCAL_STATE_DIR=/var/db/spamassassin
Mar  4 20:58:03.718 [2784] dbg: config: timing enabled
Mar  4 20:58:03.719 [2784] dbg: config: score set 0 chosen.
Mar  4 20:58:03.720 [2784] dbg: util: running in taint mode? yes
Mar  4 20:58:03.720 [2784] dbg: util: taint mode: deleting unsafe
environment variables, resetting PATH
Mar  4 20:58:03.720 [2784] dbg: util: PATH included
'/usr/local/libexec/ccache', keeping
Mar  4 20:58:03.720 [2784] dbg: util: PATH included
'/usr/local/libexec/ccache', keeping
Mar  4 20:58:03.720 [2784] dbg: util: PATH included '/sbin', keeping
Mar  4 20:58:03.720 [2784] dbg: util: PATH included '/bin', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/usr/sbin', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/usr/bin', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/usr/games', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/usr/local/sbin', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/usr/local/bin', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/home/omero/bin',
which is unusable, dropping: No such file or directory
Mar  4 20:58:03.721 [2784] dbg: util: final PATH set to:
/usr/local/libexec/ccache:/usr/local/libexec/ccache:/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin
Mar  4 20:58:03.725 [2784] dbg: dns: is Net::DNS::Resolver available? yes
Mar  4 20:58:03.725 [2784] dbg: dns: Net::DNS version: 0.66
Mar  4 20:58:03.725 [2784] dbg: config: using
"/usr/local/etc/mail/spamassassin" for site rules pre files
Mar  4 20:58:03.726 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/init.pre
Mar  4 20:58:03.726 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/v310.pre
Mar  4 20:58:03.726 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/v312.pre
Mar  4 20:58:03.726 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/v320.pre
Mar  4 20:58:03.726 [2784] dbg: config: using
"/var/db/spamassassin/3.003000" for sys rules pre files
Mar  4 20:58:03.726 [2784] dbg: config: using
"/var/db/spamassassin/3.003000" for default rules dir
Mar  4 20:58:03.726 [2784] dbg: config: read file
/var/db/spamassassin/3.003000/updates_spamassassin_org.cf
Mar  4 20:58:03.727 [2784] dbg: config: using
"/usr/local/etc/mail/spamassassin" for site rules dir
Mar  4 20:58:03.727 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/FuzzyOcr.cf
Mar  4 20:58:03.727 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/local.cf
Mar  4 20:58:03.727 [2784] dbg: config: using
"/home/omero/.spamassassin" for user state dir
Mar  4 20:58:03.727 [2784] dbg: config: using
"/home/omero/.spamassassin/user_prefs" for user prefs file
Mar  4 20:58:03.727 [2784] dbg: config: read file
/home/omero/.spamassassin/user_prefs
Mar  4 20:58:03.728 [2784] dbg: plugin: loading
Mail::SpamAssassin::Plugin::RelayCountry from @INC
Mar  4 20:58:03.729 [2784] dbg: plugin: loading
Mail::SpamAssassin::Plugin::URIDNSBL from @INC
Mar  4 20:58:03.732 [2784] dbg: plugin: loading
Mail::SpamAssassin::Plugin::Hashcash from @INC
Mar  4 20:58:03.738 [2784] dbg: plugin: loading
Mail::SpamAssassin::Plugin::SPF from @INC
Mar  4 20:58:03.741 [2784] dbg: plugin: loading
Mail::SpamAssassin::Plugin::DCC from @INC
Mar  4 20:58:03.746 [2784] dbg: dcc: network tests on, registering 

UPS Delivery problem

[twofers]

This is the OP of this issue.

I would like to report that my problem, after weeks of issue (That I didn't 
have time to deal with it and so I just used the delete button as my spam 
filter) seems to be unconditionally corrected.

What did I do?

I just posted my problem here, that is all. Now I do not receive these spammys 
any more. Voila - Dissapeared. (At least for one day so far that is) As I have 
done nothing else other than read the feedback.

So somebody is watching and listening here I suppose and took my IP or other 
identification off their Spam List.

How convienient? Is that?

The wonder of it all.

(I hope I don't appear to sarcastic for what reason I am not sure) But if it 
was that easy to fix this issue, then it's a bigger issue somewhere else...I 
would think.

Hummm, I wonder again. I am no Spam techie know it all. I know enough to just 
get me by and know my resources to get me thru. But you guys that know this 
stuff like the back of your hand.well, I think there is something weird 
going on. I don't know what it is tho.

Thanks for the help!

Wes


  

Weird problem with Spamassassin and Net::DNS, using ipv6 and failing - more info

[Luigi Lauro]

Since it seems spamassassin was querying wrongly my authoritative DNS
server on ipv6, i tried disabling it for a few minutes, and ran again
spamassassin -D.

More weird output:

Mar  4 21:14:52.174 [4180] dbg: dns: is_dns_available() last checked
1267733692.2 seconds ago; re-checking
Mar  4 21:14:52.175 [4180] dbg: dns: is Net::DNS::Resolver available? yes
Mar  4 21:14:52.175 [4180] dbg: dns: Net::DNS version: 0.66
Mar  4 21:14:52.176 [4180] dbg: dns: name server: 127.0.0.1, LocalAddr: 0.0.0.0
Mar  4 21:14:52.176 [4180] dbg: dns: resolver socket rx buffer size is
42080 bytes
Mar  4 21:14:52.176 [4180] dbg: dns: testing resolver nameservers: 127.0.0.1
Mar  4 21:14:52.176 [4180] dbg: dns: trying (3) apache.org...
Mar  4 21:14:52.176 [4180] dbg: dns: looking up NS for 'apache.org'
Mar  4 21:14:52.177 [4180] dbg: dns: providing a callback for id:
16745/apache.org/NS/IN
Mar  4 21:14:52.177 [4180] dbg: dns: no packet! err=Connection refused
packet=undef
Mar  4 21:14:55.196 [4180] dbg: dns: NS lookup of apache.org using
127.0.0.1 failed, no results found
Mar  4 21:14:55.196 [4180] dbg: dns: trying (2) gmx.net...
Mar  4 21:14:55.196 [4180] dbg: dns: looking up NS for 'gmx.net'
Mar  4 21:14:55.196 [4180] dbg: dns: providing a callback for id:
48738/gmx.net/NS/IN
Mar  4 21:14:55.196 [4180] dbg: dns: no packet! err=Connection refused
packet=undef
Mar  4 21:14:58.214 [4180] dbg: dns: NS lookup of gmx.net using
127.0.0.1 failed, no results found
Mar  4 21:14:58.214 [4180] dbg: dns: trying (1) msn.com...
Mar  4 21:14:58.214 [4180] dbg: dns: looking up NS for 'msn.com'
Mar  4 21:14:58.215 [4180] dbg: dns: providing a callback for id:
51608/msn.com/NS/IN
Mar  4 21:14:58.215 [4180] dbg: dns: no packet! err=Connection refused
packet=undef
Mar  4 21:15:01.234 [4180] dbg: dns: NS lookup of msn.com using
127.0.0.1 failed, no results found
Mar  4 21:15:01.235 [4180] dbg: dns: name server: 127.0.0.1, LocalAddr: 0.0.0.0
Mar  4 21:15:01.235 [4180] dbg: dns: resolver socket rx buffer size is
42080 bytes
Mar  4 21:15:01.235 [4180] dbg: dns: all NS queries failed => DNS
unavailable (set dns_available to override)
Mar  4 21:15:01.235 [4180] dbg: dns: is DNS available? 0

As I already said, dig is working:

marvin% dig -t NS apache.org @127.0.0.1

; <<>> DiG 9.6.1-P3 <<>> -t NS apache.org @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58735
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;apache.org.IN  NS

;; ANSWER SECTION:
apache.org. 1800IN  NS  ns1.us.bitnames.com.
apache.org. 1800IN  NS  ns2.no-ip.com.
apache.org. 1800IN  NS  ns2.surfnet.nl.
apache.org. 1800IN  NS  ns1.eu.bitnames.com.

;; Query time: 522 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Mar  4 21:17:39 2010
;; MSG SIZE  rcvd: 134


-- 
Luigi Lauro

Weird problem with Spamassassin and Net::DNS, using ipv6 and failing

[Luigi Lauro]

My spamassassin is failing DNS query with a very curious output, as if
he's trying ipv6 despite the fact my resolv.conf give a correct
127.0.0.1 nameserver (im running I'm running a local resolver on
127.0.0.1 and an authorative nameserver on public IPs)

Some info

marvin% uname -a
FreeBSD marvin.luigilauro.it 8.0-STABLE FreeBSD 8.0-STABLE #6 r204039:
Thu Feb 18 13:42:04 CET 2010
r...@marvin.luigilauro.it:/usr/obj/usr/src/sys/MARVIN  amd64

marvin% spamassassin -V
SpamAssassin version 3.3.0
 running on Perl version 5.10.1

marvin% sockstat -4 -l
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
bind     zoneserver 8257  5  tcp4   78.46.56.157:53       *:*
bind     zoneserver 8256  3  tcp4   78.46.56.144:53       *:*
bind     maradns.au 8228  3  udp4   78.46.56.144:53       *:*
bind     maradns.au 8228  5  udp4   78.46.56.157:53       *:*
Gdnscache dnscache  1060  3  udp4   127.0.0.1:53          *:*
Gdnscache dnscache  1060  4  tcp4   127.0.0.1:53          *:*

marvin% sockstat -6 -l
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
bind     maradns.au 8228  6  udp6   2002:4e2e:3890::1:53  *:*

marvin% cat /etc/resolv.conf
domain luigilauro.it
nameserver 127.0.0.1

marvin% sudo spamassassin -D < /home/omero/sample-spam.txt
Mar  4 20:58:03.718 [2784] dbg: logger: adding facilities: all
Mar  4 20:58:03.718 [2784] dbg: logger: logging level is DBG
Mar  4 20:58:03.718 [2784] dbg: generic: SpamAssassin version 3.3.0
Mar  4 20:58:03.718 [2784] dbg: generic: Perl 5.010001,
PREFIX=/usr/local, DEF_RULES_DIR=/usr/local/share/spamassassin,
LOCAL_RULES_DIR=/usr/local/etc/mail/spamassassin,
LOCAL_STATE_DIR=/var/db/spamassassin
Mar  4 20:58:03.718 [2784] dbg: config: timing enabled
Mar  4 20:58:03.719 [2784] dbg: config: score set 0 chosen.
Mar  4 20:58:03.720 [2784] dbg: util: running in taint mode? yes
Mar  4 20:58:03.720 [2784] dbg: util: taint mode: deleting unsafe
environment variables, resetting PATH
Mar  4 20:58:03.720 [2784] dbg: util: PATH included
'/usr/local/libexec/ccache', keeping
Mar  4 20:58:03.720 [2784] dbg: util: PATH included
'/usr/local/libexec/ccache', keeping
Mar  4 20:58:03.720 [2784] dbg: util: PATH included '/sbin', keeping
Mar  4 20:58:03.720 [2784] dbg: util: PATH included '/bin', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/usr/sbin', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/usr/bin', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/usr/games', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/usr/local/sbin', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/usr/local/bin', keeping
Mar  4 20:58:03.721 [2784] dbg: util: PATH included '/home/omero/bin',
which is unusable, dropping: No such file or directory
Mar  4 20:58:03.721 [2784] dbg: util: final PATH set to:
/usr/local/libexec/ccache:/usr/local/libexec/ccache:/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin
Mar  4 20:58:03.725 [2784] dbg: dns: is Net::DNS::Resolver available? yes
Mar  4 20:58:03.725 [2784] dbg: dns: Net::DNS version: 0.66
Mar  4 20:58:03.725 [2784] dbg: config: using
"/usr/local/etc/mail/spamassassin" for site rules pre files
Mar  4 20:58:03.726 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/init.pre
Mar  4 20:58:03.726 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/v310.pre
Mar  4 20:58:03.726 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/v312.pre
Mar  4 20:58:03.726 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/v320.pre
Mar  4 20:58:03.726 [2784] dbg: config: using
"/var/db/spamassassin/3.003000" for sys rules pre files
Mar  4 20:58:03.726 [2784] dbg: config: using
"/var/db/spamassassin/3.003000" for default rules dir
Mar  4 20:58:03.726 [2784] dbg: config: read file
/var/db/spamassassin/3.003000/updates_spamassassin_org.cf
Mar  4 20:58:03.727 [2784] dbg: config: using
"/usr/local/etc/mail/spamassassin" for site rules dir
Mar  4 20:58:03.727 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/FuzzyOcr.cf
Mar  4 20:58:03.727 [2784] dbg: config: read file
/usr/local/etc/mail/spamassassin/local.cf
Mar  4 20:58:03.727 [2784] dbg: config: using
"/home/omero/.spamassassin" for user state dir
Mar  4 20:58:03.727 [2784] dbg: config: using
"/home/omero/.spamassassin/user_prefs" for user prefs file
Mar  4 20:58:03.727 [2784] dbg: config: read file
/home/omero/.spamassassin/user_prefs
Mar  4 20:58:03.728 [2784] dbg: plugin: loading
Mail::SpamAssassin::Plugin::RelayCountry from @INC
Mar  4 20:58:03.729 [2784] dbg: plugin: loading
Mail::SpamAssassin::Plugin::URIDNSBL from @INC
Mar  4 20:58:03.732 [2784] dbg: plugin: loading
Mail::SpamAssassin::Plugin::Hashcash from @INC
Mar  4 20:58:03.738 [2784] dbg: plugin: loading
Mail::SpamAssassin::Plugin::SPF from @INC
Mar  4 20:58:03.741 [2784] dbg: plugin: loading
Mail::SpamAssassin::Plugin::DCC from @INC
Mar  4 20:58:03.746 [2784] dbg: dcc: network tests on, registering D

Re: About Training ( sa-learn )

[Bowie Bailey]

Right.

Henrique Fernandes wrote:
> It was wht i asked, sorry i am not fluent in english
>
> It is the score that the bayes add to the final scores right ?
>
>
> []'sf.rique
>
>
> On Thu, Mar 4, 2010 at 4:36 PM, Bowie Bailey  > wrote:
>
> Henrique Fernandes wrote:
> > Thanks!
> >
> > I will discuss here and find out with one is better.
> >
> > What are the weight of the bayser score after they well trained
> ? Have
> > any ideas about it ?
>
> I'm not sure what you are asking.  What do you mean by "weight"?
>
> The default scores (as of 3.2.5) are:
>
> BAYES_00-2.599
> BAYES_05-1.110
> BAYES_20-0.740
> BAYES_40-0.185
> BAYES_500.001
> BAYES_601.0
> BAYES_802.0
> BAYES_953.0
> BAYES_993.5
>
> Take a look at
> /var/lib/spamassassin//updates_spamassassin_org/50_scores.cf
>  to
> see the scores on your system.
>
> --
> Bowie
>
>

Re: About Training ( sa-learn )

[Henrique Fernandes]

It was wht i asked, sorry i am not fluent in english

It is the score that the bayes add to the final scores right ?


[]'sf.rique


On Thu, Mar 4, 2010 at 4:36 PM, Bowie Bailey  wrote:

> Henrique Fernandes wrote:
> > Thanks!
> >
> > I will discuss here and find out with one is better.
> >
> > What are the weight of the bayser score after they well trained ? Have
> > any ideas about it ?
>
> I'm not sure what you are asking.  What do you mean by "weight"?
>
> The default scores (as of 3.2.5) are:
>
> BAYES_00-2.599
> BAYES_05-1.110
> BAYES_20-0.740
> BAYES_40-0.185
> BAYES_500.001
> BAYES_601.0
> BAYES_802.0
> BAYES_953.0
> BAYES_993.5
>
> Take a look at
> /var/lib/spamassassin//updates_spamassassin_org/50_scores.cf to
> see the scores on your system.
>
> --
> Bowie
>

Re: Is there any Plugin to parse the “quoted email text” part in a mail (replied mail part)

[Karsten Bräckelmann]

Do keep list posts on-list.  Reply to the list, not me personally.

On Wed, 2010-03-03 at 13:14 +0530, subbi.red...@gmail.com wrote:
> If we give a reply to the mail,  the  replied mail contains the
> original message and replied message as we already know.
> 
> Here I want to retrieve only original message. 

Well, what for?

Is this even a SA question? If so, please do explain what you really
want to do, and what you want to solve by this. No, "retrieve original
message" is not sufficient.


> I can easily identify the replied part  for Gmail since they appends
> the “<” character prefix to each line for a replied mail.
> 
> but each mail client is having their own pattern to distinguish the
> replied part. 
> 
> 
> So please help me to get the regular-expression(s) required to parse
> the replied part of a mail for different mail clients.

[ Bad HTML formatted foll-quote under -- snipped. ]

-- 
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: About Training ( sa-learn )

[Bowie Bailey]

Henrique Fernandes wrote:
> Thanks!
>
> I will discuss here and find out with one is better.
>
> What are the weight of the bayser score after they well trained ? Have
> any ideas about it ?

I'm not sure what you are asking.  What do you mean by "weight"?

The default scores (as of 3.2.5) are:

BAYES_00-2.599
BAYES_05-1.110
BAYES_20-0.740
BAYES_40-0.185
BAYES_500.001
BAYES_601.0
BAYES_802.0
BAYES_953.0
BAYES_993.5

Take a look at
/var/lib/spamassassin//updates_spamassassin_org/50_scores.cf to
see the scores on your system.

-- 
Bowie

RE: 90_sare_freemail.cf.sare.sa-update.dostech.net

[Rosenbaum, Larry M.]

> -Original Message-
> From: Karsten Bräckelmann [mailto:guent...@rudersport.de]
> Sent: Wednesday, March 03, 2010 6:19 PM
> To: users@spamassassin.apache.org
> Subject: Re: 90_sare_freemail.cf.sare.sa-update.dostech.net
> 
> On Thu, 2010-03-04 at 00:12 +0100, Yet Another Ninja wrote:
> > On 3/3/2010 10:09 PM, Karsten Bräckelmann wrote:
> > > On Wed, 2010-03-03 at 15:38 -0500, Rosenbaum, Larry M. wrote:
> > >> Is there still a reason for this update channel?
> > >>
> > >> 90_sare_freemail.cf.sare.sa-update.dostech.net
> > >>
> > >> Or is it now built in to SA v3.3.0?
>   ^
> > > 20_freemail.cf and 20_freemail_domains.cf ?
> >
> > 90_sare_freemail.cf is still supported by for ppl who haven't
> upgraded
> > to SA 3.3.x
> 
> Thanks for that addition and confirmation of status. :)
> 
> The original question and hence my answer was specifically about 3.3.x,
> though, and whether it still is needed from external sources with that
> version.
> 
> > I'm doing the same additions to 20_freemail_domains.cf
> >
> > Later this year, 90_sare_freemail.cf, will become unsupported.
> >
> > Anybody using SA 3.3.x should drop 90_sare_freemail.cf usage.

Thanks, but I'm confused, as there are domains in 90_sare_freemail.cf that are 
not currently in 20_freemail_domains.cf.

L

Re: About Training ( sa-learn )

[Henrique Fernandes]

Thanks!

I will discuss here and find out with one is better.

What are the weight of the bayser score after they well trained ? Have any
ideas about it ?

[]'sf.rique


On Thu, Mar 4, 2010 at 2:41 PM, Bowie Bailey  wrote:

> (Please send replies to the list)
>
> Henrique Fernandes wrote:
> >
> > On Thu, Mar 4, 2010 at 2:22 PM, Bowie Bailey  > > wrote:
> >
> > Henrique Fernandes wrote:
> > > Nops, i wnat that after i trained, the same email, should get a
> > higher
> > > score cause the spamassassin was trained that is a spam, so when it
> > > comes again , it should look in the database and add some extra
> > point
> > > on the score right ?
> >
> > That is a fairly common misconception.  When you learn an email as
> > spam,
> > the Bayes system breaks it into tokens (words/character strings) and
> > then makes a note that each of those tokens was seen in a spam.
> >  When an
> > email comes in, it breaks up the new email into tokens and then
> checks
> > to see how frequently each of those tokens was previously seen in
> spam
> > or ham.  Based on what it finds, it ranks the email from BAYES_00
> > (very
> > unlikely to be spam) to BAYES_99 (almost certainly spam).
> >
> > Since learning from a single email only adds one data point to each
> > token, it is unlikely to make a major difference on its own.  The
> > value
> > comes in learning from lots of spam and ham.  This is why the Bayes
> > rules will not run until you have learned from at least 200 ham
> > and 200
> > spam.
> >
> >
> > hmm
> >
> > Thanks, so ech individual user has to have learned lots of emails so
> > after that they will start to have an difference on score ?
>
> Yes. Each individual user will need to learn at least 200 ham and 200
> spam (manually or via auto-learn) before Bayes will start scoring.  The
> more they learn, the better the accuracy.
>
> > So is better to just traing one database to all user instead one base
> > for each user ?
> >
> > Making just one base i am afraid of getting to many false-positives.
> > Cause sometimes Viagra is not spam for some one that researhc it, but
> > if it is in the same base, it will be marked as spam...
>
> Depends on your users.  Unless they are wildly different, a single
> database should work fairly well.  Individual databases can be more
> accurate in some instances, but a single well-trained database will
> probably work better than a bunch of individual databases that are not
> trained consistently.
>
> --
> Bowie
>

Re: About Training ( sa-learn )

[Bowie Bailey]

(Please send replies to the list)

Henrique Fernandes wrote:
>
> On Thu, Mar 4, 2010 at 2:22 PM, Bowie Bailey  > wrote:
>
> Henrique Fernandes wrote:
> > Nops, i wnat that after i trained, the same email, should get a
> higher
> > score cause the spamassassin was trained that is a spam, so when it
> > comes again , it should look in the database and add some extra
> point
> > on the score right ?
>
> That is a fairly common misconception.  When you learn an email as
> spam,
> the Bayes system breaks it into tokens (words/character strings) and
> then makes a note that each of those tokens was seen in a spam.
>  When an
> email comes in, it breaks up the new email into tokens and then checks
> to see how frequently each of those tokens was previously seen in spam
> or ham.  Based on what it finds, it ranks the email from BAYES_00
> (very
> unlikely to be spam) to BAYES_99 (almost certainly spam).
>
> Since learning from a single email only adds one data point to each
> token, it is unlikely to make a major difference on its own.  The
> value
> comes in learning from lots of spam and ham.  This is why the Bayes
> rules will not run until you have learned from at least 200 ham
> and 200
> spam.
>
>
> hmm
>
> Thanks, so ech individual user has to have learned lots of emails so
> after that they will start to have an difference on score ?

Yes. Each individual user will need to learn at least 200 ham and 200
spam (manually or via auto-learn) before Bayes will start scoring.  The
more they learn, the better the accuracy.

> So is better to just traing one database to all user instead one base
> for each user ?
>
> Making just one base i am afraid of getting to many false-positives.
> Cause sometimes Viagra is not spam for some one that researhc it, but
> if it is in the same base, it will be marked as spam...

Depends on your users.  Unless they are wildly different, a single
database should work fairly well.  Individual databases can be more
accurate in some instances, but a single well-trained database will
probably work better than a bunch of individual databases that are not
trained consistently.

-- 
Bowie

Re: About Training ( sa-learn )

[Bowie Bailey]

Henrique Fernandes wrote:
> Nops, i wnat that after i trained, the same email, should get a higher
> score cause the spamassassin was trained that is a spam, so when it
> comes again , it should look in the database and add some extra point
> on the score right ?

That is a fairly common misconception.  When you learn an email as spam,
the Bayes system breaks it into tokens (words/character strings) and
then makes a note that each of those tokens was seen in a spam.  When an
email comes in, it breaks up the new email into tokens and then checks
to see how frequently each of those tokens was previously seen in spam
or ham.  Based on what it finds, it ranks the email from BAYES_00 (very
unlikely to be spam) to BAYES_99 (almost certainly spam).

Since learning from a single email only adds one data point to each
token, it is unlikely to make a major difference on its own.  The value
comes in learning from lots of spam and ham.  This is why the Bayes
rules will not run until you have learned from at least 200 ham and 200
spam.

-- 
Bowie

Re: About Training ( sa-learn )

[Henrique Fernandes]

Nops, i wnat that after i trained, the same email, should get a higher score
cause the spamassassin was trained that is a spam, so when it comes again ,
it should look in the database and add some extra point on the score right ?



[]'sf.rique


On Thu, Mar 4, 2010 at 1:31 PM, Kai Schaetzl wrote:

> Henrique Fernandes wrote on Thu, 4 Mar 2010 11:45:38 -0300:
>
> > But if i send the same email that was autolearned it does not get an
> higher
> > score..  it should be lik eit or it shoul get higher ?
>
> I if understand you correctly you want to learn a message twice. sa-learn
> won't do this. And the docs tell.
>
> Kai
>
> --
> Get your web at Conactive Internet Services: http://www.conactive.com
>
>
>
>

Re: error closing STDOUT

[Kai Schaetzl]

Blake101 wrote on Thu, 4 Mar 2010 07:25:00 -0800 (PST):

> I used sendmail

There is normally no connection between sendmail and SA.
Describe your setup and exactly what you are doing and what happens when.

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com

Re: About Training ( sa-learn )

[Kai Schaetzl]

Henrique Fernandes wrote on Thu, 4 Mar 2010 11:45:38 -0300:

> But if i send the same email that was autolearned it does not get an higher
> score..  it should be lik eit or it shoul get higher ?

I if understand you correctly you want to learn a message twice. sa-learn 
won't do this. And the docs tell.

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com

Re: error closing STDOUT

[Mark Martinec]

On Thursday 04 March 2010 16:25:00 Blake101 wrote:
> >> When trying to send a test message, I get the following error.
> >> error closing STDOUT: Broken pipe at /usr/bin/spamassassin line 409.
> I used sendmail

Tell us exactly how you invoke the spamassassin command.

As the error message says, looks like the program you are feeding
stdout of spamassassin into, terminates (or closes its stdin)
before spamassassin does.

  Mark

Re: error closing STDOUT

[Blake101]

I used sendmail

line 408 is 

close STDOUT  or die "error closing STDOUT: $!";



Jari Fredriksson wrote:
> 
> On 4.3.2010 17:07, Blake101 wrote:
>> 
>> Sorry if there is already a tread about this.
>> 
>> When trying to send a test message, I get the following error.
>> 
>> error closing STDOUT: Broken pipe at /usr/bin/spamassassin line 409.
>> 
>> any ideas why I get this 
> 
> "Sending a message" is an alien concept to SpamAssassin. You probably
> send a message using some tool or command, but you do not tell what
> those are.
> 
> Your tool, or integration with SpamAssassin may be broken, but it's hard
> to tell when we do not know.
> 
> -- 
> http://www.iki.fi/jarif/
> 
> Q:What is green and lives in the ocean?
> A:Moby Pickle.
> 
> 
>  
> 

-- 
View this message in context: 
http://old.nabble.com/error-closing-STDOUT-tp27781963p27782212.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: error closing STDOUT

[Jari Fredriksson]

On 4.3.2010 17:07, Blake101 wrote:
> 
> Sorry if there is already a tread about this.
> 
> When trying to send a test message, I get the following error.
> 
> error closing STDOUT: Broken pipe at /usr/bin/spamassassin line 409.
> 
> any ideas why I get this 

"Sending a message" is an alien concept to SpamAssassin. You probably
send a message using some tool or command, but you do not tell what
those are.

Your tool, or integration with SpamAssassin may be broken, but it's hard
to tell when we do not know.

-- 
http://www.iki.fi/jarif/

Q:  What is green and lives in the ocean?
A:  Moby Pickle.



signature.asc
Description: OpenPGP digital signature

error closing STDOUT

[Blake101]

Sorry if there is already a tread about this.

When trying to send a test message, I get the following error.

error closing STDOUT: Broken pipe at /usr/bin/spamassassin line 409.

any ideas why I get this 
-- 
View this message in context: 
http://old.nabble.com/error-closing-STDOUT-tp27781963p27781963.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

About Training ( sa-learn )

[Henrique Fernandes]

I have set up my spamassassin to traing individual database (mysql ) with
this filter in postfix

spamassassin unix - n   n   -   -   pipe
flags=Rq user=spamassassin argv=/usr/bin/spamc -u ${recipient} -f -e
/usr/sbin/sendmail -oi -f ${sender} -- ${recipient}

as this filter works it auto learn in the database to individual user it
gets learn!

But if i send the same email that was autolearned it does not get an higher
score..  it should be lik eit or it shoul get higher ?

and how do i know if the training is working ?

thanks!


[]'sf.rique