Re: No scoring because of not beeing tested ?
Le Wed, 20 Feb 2008 14:40:30 -0800, SM [EMAIL PROTECTED] a écrit : At 13:51 20-02-2008, Emmanuel Lesouef wrote: http://pastebin.com/m61564e4 The message hits RDNS_NONE, HTML_MESSAGE, URIBL_WS_SURBL, URIBL_JP_SURBL, URIBL_OB_SURBL, URIBL_SC_SURBL, URIBL_BLACK, URIBL_RHS_DOB. The total score is 12.6. Are you using SURBL ( http://wiki.apache.org/spamassassin/SURBL )? Regards, -sm I am using Spamassassin from debian-volatile (3.2.3-0.volatile1) so I'm using them but I think that's not the point ;) -- Emmanuel Lesouef DSI | CRBN t: 0231069671 e: [EMAIL PROTECTED]
Re: No scoring because of not beeing tested ?
Le Thu, 21 Feb 2008 00:57:55 +0100, Karsten Bräckelmann [EMAIL PROTECTED] a écrit : On Wed, 2008-02-20 at 14:40 -0800, SM wrote: At 13:51 20-02-2008, Emmanuel Lesouef wrote: http://pastebin.com/m61564e4 That's not a default SA header. X-Spam-Checker-Version is missing, and that X-Spam-Status is missing autolearn and version. Whatever calls SA, you want to check with that. Amavisd-new is calling spamassassin. Amavisd-new I assume, looking at the Received header right before the X-Spam stuff. And Amavisd-new is, what inserts these headers, too. It is not SA. But the spamassassin config is read from /etc/spamassassin ? The message hits RDNS_NONE, HTML_MESSAGE, URIBL_WS_SURBL, URIBL_JP_SURBL, URIBL_OB_SURBL, URIBL_SC_SURBL, URIBL_BLACK, URIBL_RHS_DOB. The total score is 12.6. Are you using SURBL ( http://wiki.apache.org/spamassassin/SURBL )? That's rather irrelevant. :) Emmanuel does not get *any* hit, whereas he definitely should have at least HTML_MESSAGE triggering, unless he disabled it. I didn't disabled any SA tests. guenther Thanks. -- Emmanuel Lesouef DSI | CRBN t: 0231069671 e: [EMAIL PROTECTED]
No scoring because of not beeing tested ?
Hi all, Nowadays, I get more and more spam that get these headers : X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 required=5 tests=[none] Is it normal ? How can I make these spams tested ? Thanks. -- Emmanuel Lesouef DSI | CRBN t: 0231069671 e: [EMAIL PROTECTED]
Re: No scoring because of not beeing tested ?
Le Wed, 20 Feb 2008 09:19:06 -0800, SM [EMAIL PROTECTED] a écrit : Hi, At 08:01 20-02-2008, Emmanuel Lesouef wrote: Nowadays, I get more and more spam that get these headers : X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 required=5 tests=[none] Is it normal ? How can I make these spams tested ? It's not normal. Upload a sample of the spam including the headers to a website and post a link. Regards, -sm http://pastebin.com/m61564e4 Hope this helps... Thanks. -- Emmanuel Lesouef DSI | CRBN t: 0231069671 e: [EMAIL PROTECTED]
Debian and sa-update
Hi, I'm planning to use sa-update for my SA installation to be updated. I ran sa-update and it downloaded the updated rulesets in /var/lib/spamassassin/3.001007 along with some other files. In the previous directory, I found some configuration files : updates_spamassassin_org.cf which point to the rule sets. But, the problem is to add these rulesets to /etc/spamassassin/local.cf. Do I nedd to just : include /var/lib/spamassassin/3.001007/updates_spamassassin_org.cf in local.cf ? More infos : I use Amavis to check emails incoming. Thanks for your help. -- Emmanuel Lesouef CRBN | DSI t : 0231069671 m : [EMAIL PROTECTED]
Re: Debian and sa-update
Sounds great. I'm currently using 3.1.7 version as I upgraded the server to Debian 4.0. How can I be sure Spamassassin and Amavis are using the updated rulesets ? Thanks for you help. Le mercredi 11 juillet 2007 à 10:12 +0100, Adam Wilbraham a écrit : You shouldn't need to add anything, it will pay attention to them automatically once they've downloaded. However, make sure you're using a new enough version of SpamAssassin that supports sa-update - the version in the standard Sarge repository doesn't, you'll have to get 3.1.7 from Backports. On Wed, 11 Jul 2007 09:22:08 +0200 Emmanuel Lesouef [EMAIL PROTECTED] wrote: Hi, I'm planning to use sa-update for my SA installation to be updated. I ran sa-update and it downloaded the updated rulesets in /var/lib/spamassassin/3.001007 along with some other files. In the previous directory, I found some configuration files : updates_spamassassin_org.cf which point to the rule sets. But, the problem is to add these rulesets to /etc/spamassassin/local.cf. Do I nedd to just : include /var/lib/spamassassin/3.001007/updates_spamassassin_org.cf in local.cf ? More infos : I use Amavis to check emails incoming. Thanks for your help. -- Emmanuel Lesouef CRBN | DSI t : 0231069671 m : [EMAIL PROTECTED]
Troubles writing rules
Dear list, I'm trying to add my own rules to spamassassin. I put them in /etc/spamassassin/local.cf as it is explained in http://wiki.apache.org/spamassassin/WritingRules I'm testing with the default newbie rule : body LOCAL_DEMONSTRATION_RULE /test/ score LOCAL_DEMONSTRATION_RULE 1.000 describe LOCAL_DEMONSTRATION_RULE This is a simple test rule The problem is that the rule doesn't seems to be parsed. For example, here are the spamassassin headers for an email that contains test in the subject : X-Spam-Score: -0.167 X-Spam-Level: X-Spam-Status: No, score=-0.167 required=5 tests=[AWL=0.386, BAYES_00=-2.599, RCVD_IN_SORBS_DUL=2.046] Any good advices on this ? Thanks. -- Emmanuel Lesouef CRBN | DSI t : 0231069671 m : [EMAIL PROTECTED]
Re: Troubles writing rules
Le lundi 18 juin 2007 à 10:37 +0200, Arne Hoffmann a écrit : Emmanuel Lesouef wrote: body LOCAL_DEMONSTRATION_RULE /test/ score LOCAL_DEMONSTRATION_RULE 1.000 describe LOCAL_DEMONSTRATION_RULE This is a simple test rule The problem is that the rule doesn't seems to be parsed. For example, here are the spamassassin headers for an email that contains test in the subject : X-Spam-Score: -0.167 X-Spam-Level: X-Spam-Status: No, score=-0.167 required=5 tests=[AWL=0.386, BAYES_00=-2.599, RCVD_IN_SORBS_DUL=2.046] Any good advices on this ? Yes, if you want to match 'test' in the Subject, you need a header rule: header LOCAL_DEMONSTRATION_RULE/test/ score LOCAL_DEMONSTRATION_RULE1.000 describeLOCAL_DEMONSTRATION_RULEThis is a simple test rule AFAIK there are four different types of rules: body, rawbody, header and full. In fact, I already tested that. It doesn't work either. I'm thinking about my local.cf is not read. Does it helps if I say I'm using Amavis ? -- Emmanuel Lesouef CRBN | DSI t : 0231069671 m : [EMAIL PROTECTED]
Re: Troubles writing rules
Le lundi 18 juin 2007 à 10:49 +0200, Arne Hoffmann a écrit : Emmanuel Lesouef wrote: Yes, if you want to match 'test' in the Subject, you need a header rule: header LOCAL_DEMONSTRATION_RULE/test/ score LOCAL_DEMONSTRATION_RULE1.000 describeLOCAL_DEMONSTRATION_RULEThis is a simple test rule AFAIK there are four different types of rules: body, rawbody, header and full. In fact, I already tested that. It doesn't work either. Well, I was too fast and didn't think. Sorry. It has to be: header LOCAL_DEMONSTRATION_RULESubject =~ /test/ score LOCAL_DEMONSTRATION_RULE0.001 describeLOCAL_DEMONSTRATION_RULEThis is a simple test rule I'm thinking about my local.cf is not read. Try with: spamassassin -D --local testmail.txt 21 | grep local.cf Ok, moving forward ;) Thanks for your help. Here is more infos : adele:~# spamassassin -D --local testmail.txt 21 | grep local.cf [1875] dbg: config: read file /etc/spamassassin/local.cf So, when invoking spamassassin from the command line, the local.cf is read. Let's try another command : adele:~# spamassassin -D --local testmail.txt 21 | grep LOCAL_DEMONSTRATION_RULE [1892] dbg: rules: ran header rule LOCAL_DEMONSTRATION_RULE == got hit: test [1892] dbg: check: tests=AWL,BAYES_00,LOCAL_DEMONSTRATION_RULE,NO_RECEIVED,NO_RELAYS LOCAL_DEMONSTRATION_RULE,NO_RECEIVED,NO_RELAYS autolearn=unavailable So, the local.cf file is read when using the CLI but not when Amavis invokes SA. -- Emmanuel Lesouef CRBN | DSI t : 0231069671 m : [EMAIL PROTECTED]
Re: Troubles writing rules
Le lundi 18 juin 2007 à 03:45 -0700, Loren Wilton a écrit : header LOCAL_DEMONSTRATION_RULE/test/ score LOCAL_DEMONSTRATION_RULE1.000 describeLOCAL_DEMONSTRATION_RULEThis is a simple test rule AFAIK there are four different types of rules: body, rawbody, header and full. Yes, if you want to match 'test' in the Subject, you need a header rule: Generally true, but not in this case. The subject is prepended to the body, so either a header rule for Subject or a body rule will hit on it. (But not a rawbody rule, I believe.) To the OP: did you restart SA so it will pick up the new rules you wrote? In your case that would probably mean restarting Amvis, unless it has some command to restart SA internally. Loren Great ! Works like a charm. I had to restart amavis in order to force the local.cf rules to be taken care of. Thanks all. -- Emmanuel Lesouef CRBN | DSI t : 0231069671 m : [EMAIL PROTECTED]
Re: Errors in logs after upgrade from debian sarge to etch
Ok, I saw the upgrade file. I've done quite a bit of modifications on the local.cf file. But I still get a bunch of errors when restarting spamd. Any help ? Le mardi 12 juin 2007 à 21:06 +0200, LESOUEF Emmanuel a écrit : Hello, After upgrading SA from 3.0 to 3.1, I get the attached logs when I restart spamd. This seems to be a configuration error. In fact, the local.cf file has been wrote for the 3.0 version. Can someone help me with it ? Thanks. -- Emmanuel Lesouef DSI | CRBN t : 0231069671 m : [EMAIL PROTECTED] -- Emmanuel Lesouef CRBN | DSI t : 0231069671 m : [EMAIL PROTECTED]
[OT] Re: ORDB.org is shutting down
Thanks Ian, I didn't know rbl-plus.mail-abuse.ja.net. I therefore added rbl-plus.mail-abuse.org as I'm outside of Janet. This gives me for my postfix based installlation : reject_rbl_client sbl-xbl.spamhaus.org, reject_rbl_client list.dsbl.org, reject_rbl_client rbl-plus.mail-abuse.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client dnsbl.sorbs.net Thanks a lot. Ian Eiloart a écrit : --On 19 December 2006 18:01:31 +0100 Emmanuel Lesouef [EMAIL PROTECTED] wrote: I was using it but with postfix checking sender restrictions. I think it is not used in SA but by mail servers. Anyone got a replacement ? We've been using this list of RBLs: sbl-xbl.spamhaus.org list.dsbl.org rbl-plus.mail-abuse.ja.net relays.ordb.org In that order, and get just a few emails a day that get as far as the last check, with tens of thousands rejected by the earlier tests. -- Emmanuel Lesouef
Synchronizing two Bayes database
Dear List, This is sort of a repost of a previous email I sent to this list. I have two mailserver acting as mail proxies for ou main mailserver. These two servers have the same sitewide configuration for Spamassassin and they use site-wide bayes databases. For a reason I don't really know, the 2 bayes database are not the same. And the one of the second MX isn't really good at detecting spam. I suppose I forgot to do a sa-learn someday... My question is : what can I do to have the same database on the two mailserver ? Is there a procedure to dump the database from the best mailserver and import it on the second ? Thanks for your attention and help you can give. -- Emmanuel Lesouef
Re: Synchronizing two Bayes database
Yes, I was thinking about this solution. But isn't it network ressource hungry ? And if I would like to keep a files based bayes db, what should be the good manner to migrate one to another server ? Thanks Sietse for the advice. Sietse van Zanen a écrit : Sure, use MySQL for bayes storage and have both servers use that DB. Then you could be fairly sure, both use the same bayes. I think it should even be possible to dump both databases and migrate into one SQL db. But I don't use MySQL myself, so I would not know how. -Sietse *From:* Emmanuel Lesouef *Sent:* Thu 07-Dec-06 17:28 *To:* Spamassassin Mailing-List *Subject:* Synchronizing two Bayes database Dear List, This is sort of a repost of a previous email I sent to this list. I have two mailserver acting as mail proxies for ou main mailserver. These two servers have the same sitewide configuration for Spamassassin and they use site-wide bayes databases. For a reason I don't really know, the 2 bayes database are not the same. And the one of the second MX isn't really good at detecting spam. I suppose I forgot to do a sa-learn someday... My question is : what can I do to have the same database on the two mailserver ? Is there a procedure to dump the database from the best mailserver and import it on the second ? Thanks for your attention and help you can give. -- Emmanuel Lesouef -- Emmanuel Lesouef
Migration Bayes Db from one server to another
Dear List, I would like to synchronize my bayes db from one server to another. Server A has bayes db A which is more effective than server B's bayes db. I read the following page : http://wiki.apache.org/spamassassin/BayesMigration But, do I have to erase B's bayes db before running sa-learn --restore backup.txt ? And if yes, how ? Is it the good manner to procede ? Thanks for the help. -- Emmanuel Lesouef
Re: HTML spam not detected
Emmanuel Lesouef a écrit : Hi all, I get several spam that are HTML but they are not detected. In fact, they use the span mark out such as in this example : This one is also not detected : n V c a n I p i o u e m $ n 105 30 lp j p y i g l j l k s c C g i j a c I i i r s $9 n 9 10 1j o p r i a l s l a s d V d i y a e g k r a a $6 h 9 10 U9 a p y i g l m l v s n V c a n I p i o u e m $ n 105 30 lp j p y i g l j l k s c C g i j a c I i i r s $9 n 9 10 1j o p r i a l s l a s d V d i y a e g k r a a $6 h 9 10 U9 a p y i g l m l v o V b a x I w i l u w m $ v 105 30 tF l p w i u l b l a s t C x i a a z I z i c s $ i 99 10 8h r p d i j l n l r s s V h i f a p g m r p a $ j 69 1 u5 0 m p u i v l a l f s This one is very strange, as I cannot understand the meaning of it... Anyone got a trick ? PS : Thank you Jeremy for the HTML trick. :) -- Emmanuel Lesouef
HTML spam not detected
Hi all, I get several spam that are HTML but they are not detected. In fact, they use the span mark out such as in this example : DIVFONT face=3DArial size=3D2Do you want to span style=3D float : right l /spanOspan style=3D float : right u /spanVspan style=3D float : right u /spanEspan style=3D float : right u /spanRspan style=3D float : right m /spanPspan style=3D float : right b /spanAspan style=3D float : right y /spanY for your span style=3D float : right j /spanMspan style=3D float : right How can I modify the rules of spamassassin to deal with it ? Thank you. -- Emmanuel Lesouef
Double checking ?
Hello, I just configured a postfix mail server. Amavis with spamassassin and clamav is installed on it. I have some emails that get checked two times. And amavis seems to add the two scores. Here is an example : X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on guillaume.crbn.fr X-Spam-Level: ** X-Spam-Status: No, score=2.3 required=5.0 tests=HTML_50_60,HTML_MESSAGE, HTML_TAG_EXIST_MARQUEE,INFO_TLD,NO_RDNS2 autolearn=no version=3.0.3 X-Spam-Status: Yes, hits=6.0 tag1=1.0 tag2=5.0 kill=5.0 tests=HTML_50_60, HTML_MESSAGE, HTML_TAG_EXIST_MARQUEE, INFO_TLD, MISSING_SUBJECT X-Spam-Level: ** Any idea ? Thanks in advance. Emmanuel
