Re: The Impossible Rule??? Bug???

[Jonas Eckerman]

On 2010-03-23 12:14, Martin Gregorie wrote:


Is there any possibility that somebody who is more knowledgeable than I
am about images and Perl can extend it to handle BMP and SVG (as a
pre-emptive strike)?


Not exactly that, but I have written a non-image-specific SA plugin that 
can check for mismatches. It's a bit overkill if you only want to check 
for mismatches for images though.


It uses the freedesktop file magic database to recognize file content, 
and provides eval rules to check for file types and mismatches between 
content, mime type and file extension. If the freedesktop database 
contains info for SVG and BMP (it should) it can check for those mismatches.


It's named MimeMagic and is available at


Regards
/Jonas

--
Jonas Eckerman
Fruktträdet & Förbundet Sveriges Dövblinda
http://www.fsdb.org/
http://www.frukt.org/
http://whatever.frukt.org/

Re: Reprocess emails that end up in /var/virusmails

[Mark Martinec]

James,

> I have a few emails from internal servers that got flagged as SPAM.
> I added trusted_networks 10.10.10.0/24 to my local.cf so that emails from
> those servers aren't checked for SPAM. 
> I have the IDs for emails that are in the /var/virusmails directory.
> Is there a way I can reprocess those emails so they are delivered?

Sounds like you are using amavisd-new.
Quarantined mail messages can be either released from a quarantine
and delivered to recipients without re-checking for viruses and spam
by using a command 'amavisd-release', or fed back to mailer's
input side and re-checked for viruses and spam by a 'amavisd-requeue'
command. The only difference between the two commands is a MTA port
number to which a message is delivered: port 10025 ($release_method),
or port 25 ($requeue_method).

  Mark

Re: Reprocess emails that end up in /var/virusmails

[Kai Schaetzl]

James R. Marcus wrote on Tue, 23 Mar 2010 17:22:04 -0400:

> Last email had the wrong subject.

And this one is still incorrect as it is a reply to a thread.
Please use the "new message" button in your client. The "reply" button is 
for, surprise, replies.

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com

Re: lint dostech/SARE errors

[Kai Schaetzl]

Alex wrote on Tue, 23 Mar 2010 17:34:11 -0400:

> Should I not be using:
> 
> *sare*update_dostech_net

correct.


Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com

Re: The Impossible Rule??? Bug???

[David B Funk]

On Tue, 23 Mar 2010, --[ UxBoD ]-- wrote:

> - "corpus.defero"  wrote:
>
> > I was looking at a piece of irritating pill spam this morning
> > ((http://pastebin.com/qzj83QKq)) and noticed this in the body, just
> > after a random excerpt from chapter 58 of 'The Awakening':
> >
> > ---34AD8EF316667417464496762D36F3502061F3
> > Content-Type: image/bmp; name="transistor.jpg"
> > Content-Transfer-Encoding: base64
> > Content-Disposition: inline
> >
> > Having some time to play I was interested to see a slight mismatch
> > there
> > in the content type. Claims to be a bmp, but has a .jpg extension.
> > Feeling it was worthy of a couple of points (it scored 0 when it
> > first
> > arrived) I tried to create a custom rule for it.
[snip..]

> I use this one :-
>
> mimeheader __ANY_IMAGE_ATTACHContent-Type =~ 
> /image\/(?:gif|jpe?g|png|bmp)/
> mimeheader MIME_IMAGE_JPGContent-Type =~ /image\/jpg/
> describe   MIME_IMAGE_JPGContains wrong MIME type image\/jpg
> score  MIME_IMAGE_JPG1.0

Um, that rule will fire on any jpg image attachment, not quite what the
OP was looking for. I think that he wanted a rule that will look for an
implicit mis-match between the declared mime type and the file extension.
You can do that with the mimeheader type but need to be careful. Cannot do
it with METAs w/o risk of FPs, as there could be a message with both a
"bmp" and "jpg" attachment.
So need to do it with one long pattern-match.

Untested but try:

mimeheader MIME_MISMATCH_JPGContent-Type =~ 
m!image/bmp;\s+name="?[^.]{1,40}\.jpg"?$!i
describe MIME_MISMATCH_JPG  Contains wrong MIME type image\/bmp
score MIME_MISMATCH_JPG 1.0


-- 
Dave Funk  University of Iowa
College of Engineering
319/335-5751   FAX: 319/384-0549   1256 Seamans Center
Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527
#include 
Better is not better, 'standard' is better. B{

Re: Reprocess emails that end up in /var/virusmails

[Karsten Bräckelmann]

On Tue, 2010-03-23 at 17:22 -0400, James R. Marcus wrote:
> Last email had the wrong subject.

Has been rejected and won't show up on the list, FWIW, since you're not
(yet!) subscribed anyway.

> I have a few emails from internal servers that got flagged as SPAM.  I
> added trusted_networks 10.10.10.0/24 to my local.cf so that emails
> from those servers aren't checked for SPAM.

That's not what trusted_networks does. Please carefully read the docs
again.

If you want specific mail not being scanned by SA, just don't feed them
to SA in the first place. Not a SA configuration issue, but with the
tool that uses SA as a filter.

> I have the IDs for emails that are in the /var/virusmails directory. 
> Is there a way I can reprocess those emails so they are delivered?

Same. SA does not quarantine mail. You want to check with the tool that
did, based on the SA result.


-- 
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Reprocess emails that end up in /var/virusmails

[James R. Marcus]

Last email had the wrong subject.

I have a few emails from internal servers that got flagged as SPAM.  I added 
trusted_networks 10.10.10.0/24 to my local.cf so that emails from those servers 
aren't checked for SPAM. 
I have the IDs for emails that are in the /var/virusmails directory.  Is there 
a way I can reprocess those emails so they are delivered?

SpamAssassin V. 3.002005

Thanks,
James

Re: [sa] Re: Yahoo/URL spam

[Alex]

Hi,

>> This is what I have:
>> /^[^a-z]{0,10}(http:\/\/|www\.)(\w+\.)+(com|net|org|biz|cn|ru)\/?[^
>> ]{0,20}[a-z]{0,10}$/msi
>
> My bad. I got an option wrong. Please remove the 'm' above.
> I always get it backwards. According to 'man perlre' (the definitive
> resource for SA regexes!) the 'm' makes '^' match every newline!
> We want it to only match the beginning of the body.

Much better. Not sure how I introduced that typo. Thanks so much.

Best,
Alex

lint dostech/SARE errors

[Alex]

Hi all,

Should I not be using:

72_sare_redirect_post3_0_0_cf_sare_sa-update_dostech_net

It generates several dependency problems, including:

 SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_MKSHRT'
 SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_GT'
 SARE_RD_SAFE has undefined dependency 'SARE_RD_SAFE_TINY'
 SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_XMAIL_SUSP2'
 SARE_HEAD_SUBJ_RAND has undefined dependency 'SARE_HEAD_XAUTH_WARN'
 SARE_HEAD_SUBJ_RAND has undefined dependency 'X_AUTH_WARN_FAKED'
 SARE_OBFU_CIALIS has undefined dependency 'SARE_OBFU_CIALIS2'

These are commented out in that channel.

Maybe there's an ifplugin missing in updates_spamassassin_org? I'm not
using PYZOR_CHECK:

 DIGEST_MULTIPLE has undefined dependency 'PYZOR_CHECK'

The MAY_BE_FORGED is from the khopesh channel, referencing
__LAST_EXTERNAL_RELAY_NO_AUTH, which is from the S25R (20_s25r.cf) SVN
rules. Are these safe to use with v3.2.5?

 MAY_BE_FORGED has undefined dependency '__LAST_EXTERNAL_RELAY_NO_AUTH'

Can anyone tell me about:

 RCVD_VIA_APNIC has undefined dependency '__FROM_ISO_2022_JP'

I also have a lot of international email in other languages. Should I
consider lowering these scores or removing these rules? It's published
in the khop-bl_sa_khopesh_com channel, which is otherwise great.

I'm also using an older version of perl, and some of the SOUGHT rules
produce this error:

[32442] warn: config: invalid regexp for rule __SEEK_60GKOS: / The
Corporation \x{b7} Terms of Use/: / The Corporation \x{b7} Terms of
Use/:
Can't use \x{} without 'use utf8' declaration

Perhaps someone has a suggested work-around for this for the time
being until I can upgrade?

Sure appreciate any ideas you may have.

Thanks,
Alex

Re: [sa] Re: Yahoo/URL spam

[Charles Gregory]

On Tue, 23 Mar 2010, Alex wrote:

This is what I have:
/^[^a-z]{0,10}(http:\/\/|www\.)(\w+\.)+(com|net|org|biz|cn|ru)\/?[^
]{0,20}[a-z]{0,10}$/msi


My bad. I got an option wrong. Please remove the 'm' above.
I always get it backwards. According to 'man perlre' (the definitive 
resource for SA regexes!) the 'm' makes '^' match every newline!

We want it to only match the beginning of the body.

So just remove it, and, as noted by others, add the '^' that was 
missing... like so


... ]{0,20}[^a-z]{0,10}$/si

- Charles

thelinktrack.com URL redirect

[neil]

Hi;
   We are noticing a number of phishing mails with a clone of one of our
webmail pages coming in. The interesting thing is the site they bounce
through. The site collects some user info such as OS, browser etc. It
appears an interesting way to obfuscate a url and collect data at the
same time.

Note the Subject is before the From.

Subject: Avoid Deactivation
From: SUPPORT 
Date: Sat, 20 Mar 2010 08:08:48 -0500
To: u...@example.com

You would be required to Log In Again

http://www.thelinktrack.com/linkto.php?in=&v=%n";>Log In
Here


I have changed the user, domain and the tracking numbers for privacy

Any one else seeing these?

Rgds
N

Re: Yahoo/URL spam

[John Horne]

On Tue, 2010-03-23 at 13:18 -0400, Alex wrote:
> Hi Charles,
> 
> >> /^[^a-z]{0,10}(http:\/\/|www\.)(\w+\.)+(com|net|org|biz|cn|ru)\/?[^
> >> ]{0,20}[^a-z]{0,10}$/msi

> 
> This is what I have:
> 
> /^[^a-z]{0,10}(http:\/\/|www\.)(\w+\.)+(com|net|org|biz|cn|ru)\/?[^
> ]{0,20}[a-z]{0,10}$/msi
 ^

The original had [^a-z]



John.

-- 
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287Fax: +44 (0)1752 587001

Re: Yahoo/URL spam

[Alex]

Hi Charles,

>> /^[^a-z]{0,10}(http:\/\/|www\.)(\w+\.)+(com|net|org|biz|cn|ru)\/?[^
>> ]{0,20}[^a-z]{0,10}$/msi
>> This allows for some amount (up to ten chars?) of text before and
>> after the URI if I'm reading that right, correct?
>
> Nope. With the /ms flags ^ and $ at beginning and end match the *whole* body
> as a single 'string' and permit 'any character' (. or [^x]) matches to also
> match newlines. So the above regex translates to:

This was very helpful, thanks. I might be doing something wrong, or
there's a typo somewhere. It seems to catch situations where there's
more than just a URL in the body, such as just additional text.

This is what I have:

/^[^a-z]{0,10}(http:\/\/|www\.)(\w+\.)+(com|net|org|biz|cn|ru)\/?[^
]{0,20}[a-z]{0,10}$/msi

Thanks again,
Alex

Re: Installation error on Windows Server 2008 / 64-bit

[weirdbeardmt]

Daniel - thanks so much for your help. Now all working. Our e-marketing
platform is now correctly processing SA (hence no need for spamc).

Cheers.


Daniel Lemke wrote:
> 
> Nice to hear that ;)
> You won't need a C compiler unless you want to build spamc. 
> If you want to, safest way to do is download Microsoft Virtual Studio
> (Express Edition is free of charge)
> You can install gpg but don't have to. Instead you can just use the
> --nogpg flag.
> As already mentioned a few times, there aren't any rules delivered
> together with SA source since 3.3.
> You have to run sa-update in any case.
> Try this to install the "default" rules:
> sa-update.bat --nogpg -v --channel updates.spamassassin.org --updatedir
> C:\Perl\site\share\spamassassin
> 

-- 
View this message in context: 
http://old.nabble.com/Installation-error-on-Windows-Server-2008---64-bit-tp27950951p28001651.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Rules correct ?

[Benny Pedersen]

On man 22 mar 2010 13:15:36 CET, Ned Slider wrote


header__MY_FILTRAGE_FROM_93  From =~ /txxa\.px...@makk\.fi/
header__MY_FILTRAGE_TO_93  To =~ /\...@exxent\.net/
meta MY_FILTRAGE_93   (__MY_FILTRAGE_FROM_93 && __MY_FILTRAGE_TO_93)
scoreMY_FILTRAGE_93   200




add :addr to From and To

From:addr
To:addr

so it does not match on sender name or recipient name

--
xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: Installation error on Windows Server 2008 / 64-bit

[Daniel Lemke]

Daniel Lemke wrote:
> Microsoft Virtual Studio (Express Edition is free of charge)
> 

argh

I mean Visual Studio Express
-- 
View this message in context: 
http://old.nabble.com/Installation-error-on-Windows-Server-2008---64-bit-tp27950951p28000599.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Installation error on Windows Server 2008 / 64-bit

[Daniel Lemke]

weirdbeardmt wrote:
> 
> Dan - don't tell me how, but I think we're cooking on gas now.
> 
> First off - MinGW was installed to get rid of the error messages I was
> seeing about not having a C compiler installed. Anyway, I uninstalled.
> 
Nice to hear that ;)
You won't need a C compiler unless you want to build spamc. 
If you want to, safest way to do is download Microsoft Virtual Studio
(Express Edition is free of charge)



weirdbeardmt wrote:
> 
> config: no rules were found! Do you need to run sa-update?
> 
> So I ran sa-update and I see
> 
> error: gpg required but not found!
> 
> So is it now just a case of installing gpg? Shouldn't there be some
> default rules somewhere?!
> 

You can install gpg but don't have to. Instead you can just use the --nogpg
flag.
As already mentioned a few times, there aren't any rules delivered together
with SA source since 3.3.
You have to run sa-update in any case.
Try this to install the "default" rules:

sa-update.bat --nogpg -v --channel updates.spamassassin.org --updatedir
C:\Perl\site\share\spamassassin


-- 
View this message in context: 
http://old.nabble.com/Installation-error-on-Windows-Server-2008---64-bit-tp27950951p28000572.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Installation error on Windows Server 2008 / 64-bit

[weirdbeardmt]

Dan - don't tell me how, but I think we're cooking on gas now.

First off - MinGW was installed to get rid of the error messages I was
seeing about not having a C compiler installed. Anyway, I uninstalled.

I then checked the make version as below - and it said
"C:\perl...\dmake.exe". So I removed dmake using PPM.

Check the make again and it said make='nmake'.

Here's the new makefile for your interest in case you can see something that
changed.

http://old.nabble.com/file/p28000348/Makefile Makefile 

I ran Nmake and it works (? - see below). Nmake install also runs without
error.

I can't explain it - but it seems possibly to do with both dmake and nmake
being installed.

I tried to test it though with 


Msg wrote:
> 
> spamassassin --lint and I see
> 


Error wrote:
> 
> config: no rules were found! Do you need to run sa-update?
> 

So I ran sa-update and I see


Error wrote:
> 
> error: gpg required but not found!
> 
So is it now just a case of installing gpg? Shouldn't there be some default
rules somewhere?!


Daniel Lemke wrote:
> 
> Hmm some strange things here...
> 
> What does "perl -V:make" tell you?
> Should be something like "make='nmake';"
> 
> I found some references to MinGW, do you need it for any reason or would
> it be possible to uninstall it?
> 

-- 
View this message in context: 
http://old.nabble.com/Installation-error-on-Windows-Server-2008---64-bit-tp27950951p28000348.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Installation error on Windows Server 2008 / 64-bit

[Daniel Lemke]

Hmm some strange things here...

What does "perl -V:make" tell you?
Should be something like "make='nmake';"

I found some references to MinGW, do you need it for any reason or would it
be possible to uninstall it?
-- 
View this message in context: 
http://old.nabble.com/Installation-error-on-Windows-Server-2008---64-bit-tp27950951p2843.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: The Impossible Rule??? Bug???

[Martin Gregorie]

On Tue, 2010-03-23 at 09:35 +, corpus.defero wrote:
> Having some time to play I was interested to see a slight mismatch there
> in the content type. Claims to be a bmp, but has a .jpg extension.
> Feeling it was worthy of a couple of points (it scored 0 when it first
> arrived) I tried to create a custom rule for it. 
> 
I got one of these a day or three ago and just added a fourth BMP
subrule to the IMAGE_MISMATCH rule.  IMAGE_MISMATCH isn't a standard
rule AFAIK but was discussed here during the image spam spate last June.
A web search on its name soon finds it.

HOWEVER, on scanning the source of the ImageInfo plugin I see that it
can't recognise BMP images, so I just got lucky with my subrule hack and
the particular spam I developed it on. 

Is there any possibility that somebody who is more knowledgeable than I
am about images and Perl can extend it to handle BMP and SVG (as a
pre-emptive strike)?
 

Martin

Re: Installation error on Windows Server 2008 / 64-bit

[weirdbeardmt]

Hah. sorry, too early, not thinking straight. Try again.

http://old.nabble.com/file/p27998910/Makefile Makefile 


Daniel Lemke wrote:
> 
> It's the generated Makefile that is needed ;)
> The Makefile.PL is a perl script which builds a file called Makefile
> (without extension).
> Nmake tries to compile Makefile so your error is likely to be found here.
> 

-- 
View this message in context: 
http://old.nabble.com/Installation-error-on-Windows-Server-2008---64-bit-tp27950951p27998910.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Installation error on Windows Server 2008 / 64-bit

[Daniel Lemke]

weirdbeardmt wrote:
> 
> The Makefile.PL is the stock one from the downloaded ZIP archive. Anyway,
> it's attached. 
> 

It's the generated Makefile that is needed ;)
The Makefile.PL is a perl script which builds a file called Makefile
(without extension).
Nmake tries to compile Makefile so your error is likely to be found here.
-- 
View this message in context: 
http://old.nabble.com/Installation-error-on-Windows-Server-2008---64-bit-tp27950951p27998757.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: The Impossible Rule??? Bug???

[corpus.defero]

On Tue, 2010-03-23 at 10:00 +, --[ UxBoD ]-- wrote:

> mimeheader __ANY_IMAGE_ATTACHContent-Type =~ 
> /image\/(?:gif|jpe?g|png|bmp)/
> mimeheader MIME_IMAGE_JPGContent-Type =~ /image\/jpg/
> describe   MIME_IMAGE_JPGContains wrong MIME type image\/jpg
> score  MIME_IMAGE_JPG1.0

That's just what the doctor ordered! Thank you :-)
> 

Re: The Impossible Rule??? Bug???

[--[ UxBoD ]--]

- "corpus.defero"  wrote:

> I was looking at a piece of irritating pill spam this morning
> ((http://pastebin.com/qzj83QKq)) and noticed this in the body, just
> after a random excerpt from chapter 58 of 'The Awakening':
> 
> ---34AD8EF316667417464496762D36F3502061F3
> Content-Type: image/bmp; name="transistor.jpg"
> Content-Transfer-Encoding: base64
> Content-Disposition: inline
> 
> Having some time to play I was interested to see a slight mismatch
> there
> in the content type. Claims to be a bmp, but has a .jpg extension.
> Feeling it was worthy of a couple of points (it scored 0 when it
> first
> arrived) I tried to create a custom rule for it. 
> 
> Being in the body of the message I thought that 'rawbody' would be a
> good starting point but neither:
> 
> rawbody RB_MFT01 /Content\-Type: image\/bmp(.{1,30})\.jpg/i
> score RB_MFT01 3.0
> 
> OR
> 
> rawbody RB_MFT01 /Content\-Type: image\/bmp/i
> score RB_MFT01 3.0
> 
> Would catch on it.
> 
> Examples found on the 'Content-Type' suggested it was a header, but
> even
> stripping it back to:
> 
> header HD_MFT01 Content-Type =~ /image\/bmp;/
> 
> Would not catch on it.
> 
> Google seemed to offer no clues other than a few suggestions for
> attachment filtering hacks and plugins, but they did not appear to
> offer
> the match (bmp but .jpg) that I was looking to achieve.
> 
> Is this something that can't be done with Spamassassin? Is it an
> 'impossible rule'? Is it a bug? The documentation is not giving me
> any
> obvious tips on this?

I use this one :-

mimeheader __ANY_IMAGE_ATTACHContent-Type =~ /image\/(?:gif|jpe?g|png|bmp)/
mimeheader MIME_IMAGE_JPGContent-Type =~ /image\/jpg/
describe   MIME_IMAGE_JPGContains wrong MIME type image\/jpg
score  MIME_IMAGE_JPG1.0

-- 
Thanks, Phil

Re: Installation error on Windows Server 2008 / 64-bit

[weirdbeardmt]

The Makefile.PL is the stock one from the downloaded ZIP archive. Anyway,
it's attached. 

I tried switching the EOL chars, to no avail. 

http://old.nabble.com/file/p27998442/Makefile.PL Makefile.PL 


Daniel Lemke wrote:
> 
> Acutally, I'm quite sure this is a problem of your makefile. It may be a
> problem with linefeeds which nmake isn't able to handle at this point.
> Please attach your makefile or send it by mail and I'll have a look on it.
> 

-- 
View this message in context: 
http://old.nabble.com/Installation-error-on-Windows-Server-2008---64-bit-tp27950951p27998442.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Any known issues with Razor2?

[Nigel Frankcom]

On Tue, 23 Mar 2010 09:12:16 +, Nigel Frankcom
 wrote:

>Hi All,
>
>Apologies if this has already been asked. A hunt through Google didn't
>help much nor did any digging around the SA site. That's not to say
>it's not there, just that I can't find it :-/
>
>I have Razor2 installed via CPAN, though without a version number.
>
>When I try and install the new SA I get:
>Error: Missing Dependency: perl(Razor2) >= 2.61 is needed by package
>spamassassin
>
>Is this stupidity on my part or, is there a simple work round, or is
>there an updated version of Razor2?
>
>All help gratefully received.
>
>Kind regards
>
>Nigel

Never mind, it appears to have fixed itself not sure how or why,
now I have another mystery.

Any known issues with Razor2?

[Nigel Frankcom]

Hi All,

Apologies if this has already been asked. A hunt through Google didn't
help much nor did any digging around the SA site. That's not to say
it's not there, just that I can't find it :-/

I have Razor2 installed via CPAN, though without a version number.

When I try and install the new SA I get:
Error: Missing Dependency: perl(Razor2) >= 2.61 is needed by package
spamassassin

Is this stupidity on my part or, is there a simple work round, or is
there an updated version of Razor2?

All help gratefully received.

Kind regards

Nigel

This will make you smile

[Per Jessen]

I got an email this morning, quite clearly spam, but I thought I'd check
out the link to the "Email Marketing Privacy Policy" - here are a
couple of snippets:

 is a reputable company who specialise in ... [snip]. 

We adhere closely to the appropriate conditions of the Data Protection
Act and only address email marketing campaigns to businesses and/or
organisations that are listed as such in directories and/or can be
found through Google searches. 

We only ever send marketing mails to:
[snip]
c) organisations & businesses whos contact details can be found on the
internet.

We are an ethical company who are always pleased to take on comments and
feedback and improve our processes, standards and customer service
wherever possible. Please do not hesitate to email us if you are
unhappy with our email marketing and/or would like to raise an issue
with us. You can be assured that your email will receive personal
attention and you will receive a personal reply.

So I emailed them at "ab...@example.com": 

550 Requested action not taken: mailbox unavailable or not local (in
reply to RCPT TO command)


/Per Jessen, Zürich

Re: Installation error on Windows Server 2008 / 64-bit

[Daniel Lemke]

John Hardin wrote:
> 
>>> To be serious, have you considered setting up a Linux VM that is 
>>> dedicated to hosting spamd?
>>
>> If only it was that simple. SA is actually required as a component of a 
>> bigger system which actually has NO business being near a Windows 
>> server, but unfortunately our sys admin team have no experience of 
>> admin-ing Linux... nor any desire to learn.
>>
>> So I'm afraid I'm stuck with it.
>>
>> What is strange is that we had it running perfectly on a Win2K3 32 bit 
>> machine with AP 5.8 / SA 3.2.5.
> 
> How about W2k3 32-bit AP5.8 SA3.3.1 on the VM...
> 

You don't need a VM for this, SpamAssassin and spamd are running fine on a
W2k8. These compile errors are not an issue of SA.

Acutally, I'm quite sure this is a problem of your makefile. It may be a
problem with linefeeds which nmake isn't able to handle at this point.
Please attach your makefile or send it by mail and I'll have a look on it.
-- 
View this message in context: 
http://old.nabble.com/Installation-error-on-Windows-Server-2008---64-bit-tp27950951p27997410.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Bayes is causing MySQL performance issues

[Martin Svensson]

Hi list-users,

I'm having issues with a SA setup's bayes database that some of you
hopefully can help with, it began last Monday.

The setup consists of 2 spam-eating servers running Amavis and one dedicated
server running MySQL and Bind. Bayes, AWL and Amavis are using MySQL with
three separate databases. The problem is that the bayes database usage is
causing our SQL server to have 20%-50% I/O-wait.

As I mentioned the problem began all of sudden last Monday, at roughly the
same time the number of SQL-queries nearly doubled according to our Munin
graphs - from 400/second to 1000/second (it seems unreasonably high). To
resolve the problem we have tried lots of things:

- Dump the database and restore it using mysqldump
- Rebuild the InnoDB config with 3 dedicated ibdataX-files instead of 1
large and restore
- Dump the Bayes content using sa-learn and import it
- 'Truncate table' and start from the beginning - 12hours after the fresh
start the I/O wait came back and processing times increased to 15-60
seconds.

According to the slow-queries log it's inserts into bayes_token that takes
15+ seconds to process, but it's only intermittently. The setup has been
running just fine for the last 16 months without any issues at all with the
database.

We have dedicated 3GB of ram to innodb_buffer_pool_size. According to MySQL
we have between 500-1000 queries/second average (!), we are processing
400,000 emails/day.

The setup in SA:
use_bayes 1
bayes_auto_learn 1
bayes_store_module  Mail::SpamAssassin::BayesStore::MySQL
loadplugin Mail::SpamAssassin::BayesStore::SQL

>From bayes_vars:
Spam_count: 109785
Ham_count: 25320
token_count: 7028976

If I disable bayes the load in MySQL decreases to almost nothing.

Any help is much appreciated, I'm running out of ideas. The server is
restarted, the HW is OK.

Thanks in advance all.

Best regards,
Martin