Re: HEADER_HOST_IN_BLACKLIST

2016-03-13 Thread Matus UHLAR - fantomas

On Sat, 12 Mar 2016 18:18:10 +0100
Reindl Harald wrote:

BTW - what is the purpose of a more then queistionable poison pill
based on URIBL_BLACK for headers but only score URIBL_BLACK in case
of clickable links with 1.7?



On Sat Mar 12 2016 11:04:45 RW   said:

because HEADER_HOST_IN_BLACKLIST is a manual black-list
email.amctheatres.com will be configured somewhere locally.



Am 12.03.2016 um 22:23 schrieb @lbutlr:

Right. My question was not “why does this happen” but “where is this blacklist”

It is not in /usr/local/etc/mail/spamassassin and it is not in 
$HOME/.spamassassin/


On 12.03.16 22:27, Reindl Harald wrote:
what gives "cat /usr/local/etc/mail/spamassassin/* | grep -i 
blacklist" and the same for "cat $HOME/.spamassassin/* | grep -i 
blacklist"


using:
grep -Ri blacklist /usr/local/etc/mail/spamassassin/ $HOME/.spamassassin/ 


would provide the same result, however
- check for _uri_host would find enlist_uri_host and blacklist_uri_host
- should check all HOME directories.

--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Nothing is fool-proof to a talented fool. 


Re: sa-stats log analyzer (RE: Missed spam, suggestions?)

2016-03-13 Thread rob...@chalmers.com.au
The rulesemporium site appears to be down. 
If anyone has a newer version, it might be good to post it somewhere? My site 
for eg?

Robert


Sent from my iPad

> On 11 Mar 2016, at 04:17, David B Funk  wrote:
> 
> That's the output from Dallas Engelken's "sa-stats.pl" log analyzer.
> You feed it a segment of your spamd logs and it gives you
> those rule hit statistics.
> 
> See: http://wiki.apache.org/spamassassin/StatsAndAnalyzers
> 
> Looking at that wiki page, I noticed that the copy available is v0.93.
> I've got v1.03
> Does anybody know what was the newest one last avaialable on the 
> rulesemporium site? Anbody got something newer than v1.03?
> 
> I've done a bit of hacking to my copy (such as adding the S/O ratio stats).
> 
> 
>> On Thu, 10 Mar 2016, Erickarlo Porro wrote:
>> 
>> I would like to know how to get these stats too.
>>  
>> From: Robert Chalmers [mailto:rob...@chalmers.com.au]
>> Sent: Tuesday, March 08, 2016 5:25 AM
>> To: users@spamassassin.apache.org
>> Subject: Re: Missed spam, suggestions?
>>  
>> Can I ask, how are you getting these stats please?
>>  
>> Thanks
>> 
>>  On 8 Mar 2016, at 05:11, David B Funk  
>> wrote:
>>  
>> On Mon, 7 Mar 2016, Charles Sprickman wrote:
>> 
>>  I’ve been running with some daily training for a little over a week and 
>> I’m seeing less spam in my
>>  inbox.  I’ve seen a few things slip through because bayes tipped them 
>> below the default score, these
>>  were two phishing emails.
>> 
>>  Here’s some rule stats for anyone interested:
>> 
>>  TOP SPAM RULES FIRED
>> 
>>  RANK RULE NAMECOUNT %OFRULES %OFMAIL %OFSPAM  
>> %OFHAM
>> 
>>   1 TXREP   13171   8.47   40.38  91.00  
>> 72.91
>>   2 HTML_MESSAGE12714   8.18   38.98  87.85  
>> 90.80
>>   3 DCC_CHECK10593   6.81   32.48  73.19 
>>  33.78
>>   4 RDNS_NONE10269   6.60   31.48  70.95 
>>   5.63
>>   5 SPF_HELO_PASS 10070   6.48   30.87  69.58  
>> 23.41
>>   6 URIBL_BLACK97116.25   29.77  67.10   
>> 1.58
>>   7 BODY_NEWDOMAIN_FMBLA95506.14   29.28   
>> 65.98   1.64
>>   8 FROM_NEWDOMAIN_FMBLA94836.10   29.07   
>> 65.52   1.36
>>   9 BAYES_99 84865.46   26.02  
>> 58.63   1.18
>>  10BAYES_999   81415.24   24.96  
>> 56.25   1.06
>> 
>>  TOP HAM RULES FIRED
>> 
>>  RANK RULE NAMECOUNT %OFRULES %OFMAIL %OFSPAM  
>> %OFHAM
>> 
>>   1 HTML_MESSAGE16473   9.13   50.51  87.85  
>> 90.80
>>   2 DKIM_SIGNED13776   7.64   42.24  13.81  
>> 75.93
>>   3 TXREP   13228   7.33   40.56  91.00  
>> 72.91
>>   4 DKIM_VALID  12962   7.19   39.74  11.93  
>> 71.44
>>   5 RCVD_IN_DNSWL_NONE99415.51   30.48   8.08
>> 54.79
>>   6 DKIM_VALID_AU  87114.83   26.71   7.99   
>> 48.01
>>   7 BAYES_00 83904.65   25.72   
>> 1.84   46.24
>>   8 RCVD_IN_JMF_W   73694.09   22.59   2.54   
>> 40.62
>>   9 RCVD_IN_MSPIKE_WL 67133.72   20.58   
>> 4.3937.00
>>  10BAYES_50 62013.44   19.01  
>> 25.56  34.18
>> Based upon your stats it looks like you need more Bayes training. Your Bayes 
>> 00/99 hits should rank higher in the
>> rules-fired stats and BAYES_50 shouldn't be in the top-10 at all.
>> (of course if you've only been training for a week that would explain it).
>> For example, here's my top-10 hits (for a one month interval).
>> TOP SPAM RULES FIRED
>> --
>> RANKRULE NAME   COUNT  %OFMAIL %OFSPAM  %OFHAM  S/O
>> --
>>   1T__BOTNET_NOTRUST   114907   60.32   86.81   42.66  0.5755
>>   2BAYES_99109138   32.98   82.450.01  0.9998
>>   3BAYES_999   104903   31.70   79.250.01  0.
>>   4HTML_MESSAGE9085079.41   68.63   86.59  0.3456
>>   5URIBL_BLACK 9084527.61   68.630.27  0.9942
>>   6T_QUARANTINE_1  9064027.40   68.470.02  0.9996
>>   7URIBL_DBL_SPAM  7915224.02   59.790.17  0.9956
>>   8KAM_VERY_BLACK_DBL  7430122.45   56.130.00  1.
>>   9L_FROM_SPAMMER1k7366722.26   55.650.00  1.
>>  10T__RECEIVED_1   7241342.60   54.70