spamd and spamd child

2004-11-04 Thread Greg Ennis
I just installed 3.0.1 to replace 2.63 and have noticed a tremendous
improvement in speed.  I am using a RH 8.0 system with spamc being
executed by /etc/procmailrc.

I have limited the child processes to 3, and noticed that the child
processes do not appear to die although their time and dates do appear
to change.

root 19782 1  0 Nov02 ?   00:00:21 /usr/bin/spamd -d -c -m 3
root  6162 19782  2 Nov03 ?   00:29:07 spamd child
root 15840 19782  2 09:11 ?   00:04:08 spamd child
root 16425 19782  2 09:51 ?   00:03:41 spamd child

Is this a normal function of 3.0.1 or do I need to be concerned?

Thanks,

Greg Ennis




Re: PRocmail recipe problem and spamassassin not filtering correctly

2004-11-04 Thread Greg Ennis
On Thu, 2004-11-04 at 09:53, [EMAIL PROTECTED] wrote:
 Hi all,
 
 I use spamassassin 2.63 on fedora core 2.
 I have two problems :
 
 1. Spamassassin does not flag all spam, although muy level is at 3. Sometimes 
 he
 doesn't even have ONE hit on a spam message !!!.
 
 2. I want to move the spam messages to a specific folder, how to do that ?.
 
 
 My procmail.log says :
 
 ==
 From [EMAIL PROTECTED]  Thu Nov  4 09:57:10 2004
  Subject: A SPECIFIC SUBJECT
   Folder: /var/spool/mail/THE USER'S LOGIN
 procmail: Incomplete recipe
 ==
 
 
 My local.cf in spamassassin folder is like this :
 ==
 rewrite_subject 1
 subject_tag [*ATTENTION SPAM*]
 report_safe 0
 
 use_bayes 1
 auto_learn 1
 
 # Spam domains
 
 blacklist_from [EMAIL PROTECTED]
 blacklist_from [EMAIL PROTECTED]
 blacklist_from [EMAIL PROTECTED]
 blacklist_from [EMAIL PROTECTED]
 blacklist_from [EMAIL PROTECTED]
 blacklist_from [EMAIL PROTECTED]
 
 ==
 
 Here is my procmailrc file :
 
 ==
 LOGFILE=/var/log/procmail.log
 
 :0 fw
 *  256000
 | /usr/bin/spamc -f
 
 :0:
 * ^X-Spam-Level: \*\*\*
 
 ==
 Can someone help me out ?.
 
 
 /hitete

I have been doing this and it works like a charm even with 2.63.  I
would advise you to use 3.0.1 it is much much faster.  Some things you
need to consider are the following:

1. When you set up your local.cf file you must rewrite the Subject line
to identify the message as spam.  

In the SA 3.0.1 local.cf file Located in /etc/mail/spamassassin/ I use
the following two lines  (check the syntax in 2.63 becuase it is a
little differnt)

required_hits 5
rewrite_header Subject [SPAM]


In the /etc/procmailrc file I use the following entries:

MAILDIRLOG=/smile$HOME/Mail
DROPPRIVS=YES

:0fw
 *  256000
 | spamc

 # This routine will dump your spam
 :0 H
 * ^Subject:.*\[SPAM\]
 $MAILDIRLOG/spam.log

Please note that the directory you want to save the spam in must have
proper user protections and you must drop to user privileges within
procmail before you activate spamc. spamc of course requires the use of
the spamd daemon.

These suggestions are basic things for most on this list, but if you are
new to using these tools it will save you some look up and experimenting
time.

Good Luck!!!

Greg




Re: Frustration...

2004-11-04 Thread Greg Ennis
On Thu, 2004-11-04 at 13:15, Lisa Casey wrote:
 Hi Folks,
 
.
.
 There has to be a easy way to learn to use this and get it to do what I want
 but I can't really figure it out. Surely there are some other ISP's on these
 lists who might be willing to tell me  how they use it.
 
 Thanks,
 
 Lisa Casey
 
Lisa,

I have been using procmail along with spamassassin and clamav to do
exactly what you want.  It might be a little less elegant than using a
milter but it is working perfectly so I am reluctant to change.  

I dump the viruses, and save all of the spam to a user file and give the
user a daily report of the Subject lines and From Lines.  If the user
wants the spam all he has to do is send an e-mail to a designated
address on our system and I have a script that digs up the spam and
sends it to him.  I rotate the spam files daily, and keep them for 8
days which gives the user a week or so to request the spam.

There are false positives, and if you dump the spam you will dump wanted
mail for sure.  I would also suggest that you not bounce the spam
because much of it has faulty addresses.  

If you want to go the procmail route let me know and I will give you the
particulars that I use.  

You are close to a solution  :)

Greg