Unsubscribe
unsubscribe
Google link spam?
Is anyone else getting these google link spams? They all seem to be endowment ad. Like this... Is it small? http://www.gooogle.com/search? Anyone got a rule to kill these? -- Mike B^)
Rule for this kind of spam?
Anyone have a rule that will kill this type of spam? H,E_R-E WE GO A'GAIN! T.H-E B'I'G O N*E BEFO RE T*H*E SEPTEMBE_+R.RALLY! T_H'E MAR KET IS A BOUT TO P'O-P_, A N D SO IS E,X+M*T,! Ti ck: E-X M'T 5--day po.tentia'l: 0.._4+0 Fir_m: EXCHA'*NGE M OBILE T,E.L+E (.Other O'T_C : EX'MT.PK) A's.k*: 0_.'1 0 ( .+25.00%) UP TO 2-5*% in 1 day N'o+t o+n-l_y d-o e's t+h i.s f+i-r_m h+a*v+e gr,eat fundamen,ta_ls, b+u+t gettin_g t h*i.s oppor+tu+nity at t+h+e rig*ht t_i,m_e , It gets a score of 4, not 5 -- Mike Yrabedra B^)
Re: A rule for empty body and pdf attachment??
Probably a stupid question, but where do I put the PDFInfo.pm file? I put it is /etc/mail/plugins/... But that does not work. I will continue googling in the meantime on 8/2/07 5:09 AM, Michael W Cocke at [EMAIL PROTECTED] wrote: Thanks, both of you. Looks like an update to pdfinfo snuck out while I wasn't looking. I've made the adjustments. Mike- On Thu, 2 Aug 2007 10:39:20 +0200, you wrote: Michael W Cocke [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] These blasted PDF spams are driving me mad! Any ideas for a rule that would trip if there's no text in the body, just a PDF attachment ? (I'm using the PDFinfo plugin now, but I don't really understand it) Thanks! Mike- -- If you're not confused, you're not trying hard enough. -- Please note - Due to the intense volume of spam, we have installed site-wide spam filters at catherders.com. If email from you bounces, try non-HTML, non-encoded, non-attachments, If you're using the PDFinfo plugin, you should see a rule called GMD_PDF_EMPTY_BODY on those spams - it should fire on any message containing a PDF and a blank body. Obviously you can modify that rule's score if you want to make it higher, or meta it with other rules. Also make sure you're using the latest version of the plugin and the associated .cf file from www.rulesemporium.com/plugins.htm. Cheers, Jeremy -- If you're not confused, you're not trying hard enough. -- Please note - Due to the intense volume of spam, we have installed site-wide spam filters at catherders.com. If email from you bounces, try non-HTML, non-encoded, non-attachments, -- Mike Yrabedra B^)
Re: A rule for empty body and pdf attachment??
on 8/2/07 5:55 AM, Justin Mason at [EMAIL PROTECTED] wrote: In my Debian etch installation it's /usr/share/perl5/Mail/SpamAssassin/Plugin/ actually, it's better not to use that location. That's where SpamAssassin installs its distribution-packaged modules, and it may delete the contents during upgrades etc. Better to store local plugins in /etc/mail or somewhere under /usr/local. As long as the loadplugin line indicates where to look, SpamAssassin will load plugins from anywhere. If I was to use /usr/local/saplugins, then how would I reference that in the cf and init? -- Mike Yrabedra B^)
Re: A rule for empty body and pdf attachment??
Answer to my own question... #PDFInfo - tags pdf based spam # loadplugin Mail::SpamAssassin::Plugin::PDFInfo /usr/local/saplugins/PDFInfo.pm :-) on 8/2/07 6:30 AM, MIKE YRABEDRA at [EMAIL PROTECTED] wrote: on 8/2/07 5:55 AM, Justin Mason at [EMAIL PROTECTED] wrote: In my Debian etch installation it's /usr/share/perl5/Mail/SpamAssassin/Plugin/ actually, it's better not to use that location. That's where SpamAssassin installs its distribution-packaged modules, and it may delete the contents during upgrades etc. Better to store local plugins in /etc/mail or somewhere under /usr/local. As long as the loadplugin line indicates where to look, SpamAssassin will load plugins from anywhere. If I was to use /usr/local/saplugins, then how would I reference that in the cf and init? -- Mike Yrabedra B^)
3.2.2 finally on CPAN
For all interested, 3.2.2 is available via cpan now. :-) -- Mike Yrabedra B^)
How long before 3.2.2 is in cpan?
Anxious to upgrade ;-) -- Mike Yrabedra B^)
Where is 3.2.2?
I have been waiting to install SA on my xserve, but cannot until 3.2.2 is released with the 'tests' fix. Anyone force install without problems? -- Mike Yrabedra B^)
Re: SA on iPhone yet?
on 7/2/07 10:08 PM, Robert - eLists at [EMAIL PROTECTED] wrote: Anyone get Spamassassin installed on their iPhone yet? :-) - rh What are you talking about? SA is a server level tool. Why, if it was even possible, would you install it on a phone? -- Mike Yrabedra B^)
Re: Errors in CPAN test
Force install or wait for 3.2.2 on 7/3/07 10:46 AM, Jonathan Allen at [EMAIL PROTECTED] wrote: Hi List, So what's with 3.2.1 ? I'm running 3.1.8 and did the standard: cpan Mail::SpamAssassin and got: t/spamc_optCFAILED tests 2, 4, 6, 8 Failed 4/9 tests, 55.56% okay t/spamc_optLFAILED tests 1-16 Failed 16/16 tests, 0.00% okay t/spamd_allow_user_rulesFAILED test 4 Failed 1/5 tests, 80.00% okay t/spamd_plugin..FAILED tests 2, 4, 6 Failed 3/6 tests, 50.00% okay Failed TestStat Wstat Total Fail List of Failed -- - t/spamc_optC.t94 2 4 6 8 t/spamc_optL.t 16 16 1-16 t/spamd_allow_user_rules.t51 4 t/spamd_plugin.t 63 2 4 6 23 tests skipped. Failed 4/129 test scripts. 24/1924 subtests failed. Not found: reported spam = Message successfully reported/revoked # Failed test 2 in t/SATest.pm at line 635 Output can be examined in: log/d.spamc_optC/out.1 Not found: revoked ham = Message successfully reported/revoked # Failed test 4 in t/SATest.pm at line 635 fail #2 Output can be examined in: log/d.spamc_optC/out.1 log/d.spamc_optC/out.3 Not found: failed to report spam = Unable to report/revoke message # Failed test 6 in t/SATest.pm at line 635 fail #3 Output can be examined in: log/d.spamc_optC/out.1 log/d.spamc_optC/out.3 log/d.spamc_optC/out.5 Not found: failed to revoke ham = Unable to report/revoke message # Failed test 8 in t/SATest.pm at line 635 fail #4 Output can be examined in: log/d.spamc_optC/out.1 log/d.spamc_optC/out.3 log/d.spamc_optC/out.5 log/d.spamc_optC/out.7 # Failed test 1 in t/spamc_optL.t at line 20 Not found: learned spam = Message successfully un/learned # Failed test 2 in t/SATest.pm at line 635 Output can be examined in: # Failed test 3 in t/spamc_optL.t at line 24 Not found: already learned spam = Message was already un/learned # Failed test 4 in t/SATest.pm at line 635 fail #2 Output can be examined in: ERROR: Bayes dump returned an error, please re-run with -D for more information # Failed test 5 in t/spamc_optL.t at line 28 Not found: spam in database = 1 0 non-token data: nspam # Failed test 6 in t/SATest.pm at line 635 fail #3 Output can be examined in: # Failed test 7 in t/spamc_optL.t at line 32 Not found: forget spam = Message successfully un/learned # Failed test 8 in t/SATest.pm at line 635 fail #4 Output can be examined in: # Failed test 9 in t/spamc_optL.t at line 36 Not found: learned ham = Message successfully un/learned # Failed test 10 in t/SATest.pm at line 635 fail #5 Output can be examined in: # Failed test 11 in t/spamc_optL.t at line 40 Not found: already learned ham = Message was already un/learned # Failed test 12 in t/SATest.pm at line 635 fail #6 Output can be examined in: ERROR: Bayes dump returned an error, please re-run with -D for more information # Failed test 13 in t/spamc_optL.t at line 44 Not found: ham in database = 1 0 non-token data: nham # Failed test 14 in t/SATest.pm at line 635 fail #7 Output can be examined in: # Failed test 15 in t/spamc_optL.t at line 48 Not found: learned ham = Message successfully un/learned # Failed test 16 in t/SATest.pm at line 635 fail #8 Output can be examined in: Not found: myfoo = 1.0 MYFOO # Failed test 4 in t/SATest.pm at line 635 Output can be examined in: log/d.spamd_allow_user_rules/out.2 log/d.spamd_allow_user_rules/spamd.err.1 Not found: called1 = test: called myTestPlugin, round 1 # Failed test 2 in t/SATest.pm at line 635 Output can be examined in: log/d.spamd_plugin/out.1 log/d.spamd_plugin/spamd.err.1 Not found: called2 = called myTestPlugin, round 2 # Failed test 4 in t/SATest.pm at line 635 fail #2 Output can be examined in: log/d.spamd_plugin/out.1 log/d.spamd_plugin/spamd.err.1 log/d.spamd_plugin/out.3 log/d.spamd_plugin/spamd.err.1 Not found: called3 = called myTestPlugin, round 3 # Failed test 6 in t/SATest.pm at line 635 fail #3 Output can be examined in: log/d.spamd_plugin/out.1 log/d.spamd_plugin/spamd.err.1 log/d.spamd_plugin/out.3 log/d.spamd_plugin/spamd.err.1 log/d.spamd_plugin/out.5 log/d.spamd_plugin/spamd.err.1 Failed 4/129 test programs. 24/1924 subtests failed. make: *** [test_dynamic] Error 255 What do I do next ? Jonathan -- Mike Yrabedra B^)
Re: SA on iPhone yet?
on 7/3/07 2:01 PM, John Rudd at [EMAIL PROTECTED] wrote: MIKE YRABEDRA wrote: on 7/2/07 10:08 PM, Robert - eLists at [EMAIL PROTECTED] wrote: Anyone get Spamassassin installed on their iPhone yet? :-) - rh What are you talking about? SA is a server level tool. Why, if it was even possible, would you install it on a phone? SA is not necessarily a server level tool. You can run it client side, as well. Yes, I stand corrected. Thanks John :-) Still, it is not possible to install any third party software on the iPhoneyet. Apple will eventually allow this, I am sure. -- Mike Yrabedra B^)
Installing 3.2.1 fails
Hello, I just tried to install 3.2.1 on Mac OS X Panther, but it had issues building. Has anyone else had a simialr issue(s)? BTW, I already have have 3.1.8 running just fine. --- Failed TestStat Wstat Total Fail Failed List of Failed --- t/spamc_optC.t94 44.44% 2 4 6 8 t/spamc_optL.t 16 16 100.00% 1-16 t/spamd_allow_user_rules.t51 20.00% 4 t/spamd_plugin.t 63 50.00% 2 4 6 23 tests skipped. Failed 4/129 test scripts, 96.90% okay. 24/1924 subtests failed, 98.75% okay. make: *** [test_dynamic] Error 255 /usr/bin/make test -- NOT OK Running make install make test had returned bad status, won't install without force -- Mike Yrabedra B^)
Anti-drug rules breaking things?
Anyone else seeing this? Has it been mentioned yet and I missed it? My rulesdujour script has been failing the past few days due to this rule package. Matt Kettler's AntiDrug has changed on email.macdock.com. Version line: # rev 0.65 10/01/2006 - updated URL, etc ***WARNING***: /usr/local/bin/spamassassin -x --lint failed. Rolling configuration files back, not restarting SpamAssassin. Rollback command is: mv -f /etc/mail/spamassassin/antidrug.cf /etc/mail/spamassassin/RulesDuJour/antidrug.cf.2; mv -f /etc/mail/spamassassin/RulesDuJour/antidrug.cf.20070129-0526 /etc/mail/spamassassin/antidrug.cf; -- Mike Yrabedra B^)
Re: Anti-drug rules breaking things?
Matt, Thanks. Sorry I missed that. I only recently started getting theses errors. I have turned them off in RDJ. That should fix it :-) on 1/29/07 9:32 AM, Matt Kettler at [EMAIL PROTECTED] wrote: MIKE YRABEDRA wrote: Anyone else seeing this? Has it been mentioned yet and I missed it? Yes, please read the file itself. Antidrug moved to a new home back in SEPTEMBER. I've made NUMEROUS posts to this list warning people they need to reconfigure their RDJ's. Also, for what it's worth, the current version of RDJ doesn't support antidrug anymore, as updating it is pointless. Antidrug is now (as of 3.0.0) a part of SA's official ruleset, and any updates will be posted there, not to antidrug.cf. Loading antidrug.cf on SA 3.0.0 or higher is a downgrade. Please see also: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200701.mbox/%3c45B [EMAIL PROTECTED] And the text from the file itself at: http://mywebpages.comcast.net/mkettler/sa/antidrug.cf -- README: WARNING: YOU HAVE DOWNLOADED THIS RULESET from COMCAST. I am TERMINATING THIS ACCOUNT. Someone else will eventually have control of this webspace, possibly a malicious spammer. STOP using RDJ on this file *NOW* Also, make note of the fact that this file is for users of SA 2.64 and below. If you are running SA 3.0.0 or higher, you already have antidrug and this file will merely downgrade any improvements made by the SA devs. Antidrug now lives at: http://mysite.verizon.net/mkettler_sa/antidrug.cf - My rulesdujour script has been failing the past few days due to this rule package. Yes, quite intentionally. Matt Kettler's AntiDrug has changed on email.macdock.com. Version line: # rev 0.65 10/01/2006 - updated URL, etc ***WARNING***: /usr/local/bin/spamassassin -x --lint failed. Rolling configuration files back, not restarting SpamAssassin. Rollback command is: mv -f /etc/mail/spamassassin/antidrug.cf /etc/mail/spamassassin/RulesDuJour/antidrug.cf.2; mv -f /etc/mail/spamassassin/RulesDuJour/antidrug.cf.20070129-0526 /etc/mail/spamassassin/antidrug.cf; -- Mike Yrabedra B^)
Block wrote: spams
I am getting a lot of these Bob wrote: spams Anyone know a way to write the rule so if the subject has wrote: in the subject, tag it? Here is what I have? header WROTE_SUB Subject =~ /\bwrote\:\b/i describe WROTE_SUB Wrote in Subject score WROTE_SUB 3.0 -- Mike Yrabedra B^)
Sa stats using rrdtool?
Hello, I have googled far and wide and kind not find an answer. Does anyone know of a solution that will process a spamd log and then output the stats using rrdtool? There are tons of things using mrtg, but even by the developers opinion, mrtg is dead, rrd will take it's place.
Re: Sa stats using rrdtool?
on 6/13/05 6:07 AM, Bart Verwilst at [EMAIL PROTECTED] wrote: Hi Try MailGraph :) That's what I'm using for my servers.. Google for mailgraph, first hit :) See ya Looks good, but I think I passed it over because I am not using postfix. I am using Communigate Pro. However, my spamd writes to it's own log so maybe it will still work. Only one way to find out ;-) -Original Message- From: MIKE YRABEDRA [mailto:[EMAIL PROTECTED] Sent: Monday, June 13, 2005 12:04 PM To: users@spamassassin.apache.org Subject: Sa stats using rrdtool? Hello, I have googled far and wide and kind not find an answer. Does anyone know of a solution that will process a spamd log and then output the stats using rrdtool? There are tons of things using mrtg, but even by the developers opinion, mrtg is dead, rrd will take it's place.
Re: Sa stats using rrdtool?
on 6/13/05 8:01 AM, Ronan McGlue at [EMAIL PROTECTED] wrote: MIKE YRABEDRA wrote: on 6/13/05 6:07 AM, Bart Verwilst at [EMAIL PROTECTED] wrote: Hi Try MailGraph :) That's what I'm using for my servers.. Google for mailgraph, first hit :) See ya Looks good, but I think I passed it over because I am not using postfix. I am using Communigate Pro. However, my spamd writes to it's own log so maybe it will still work. Only one way to find out ;-) you could also try gnu plot... i was also looking for a 'drop in' graphing program and found GNUplot was exactly what i wanted... i use sa-stats.pl to read the log file then simply grep on the day pipe to a file and plot on the basis of that. v simple, clean and pretty :) ill show u the script if u want.. its only 10 or so lines long :) easy Ronan That would be awesome! Feel free to contact me off-list if you want. :-) -Mike
Re: Sa stats using rrdtool?
Ronan,
Do you have a sample of what they look like, the graphs?
on 6/13/05 8:01 AM, Ronan McGlue at [EMAIL PROTECTED] wrote:
MIKE YRABEDRA wrote:
on 6/13/05 6:07 AM, Bart Verwilst at [EMAIL PROTECTED] wrote:
Hi
Try MailGraph :) That's what I'm using for my servers..
Google for mailgraph, first hit :)
See ya
Looks good, but I think I passed it over because I am not using postfix. I
am using Communigate Pro.
However, my spamd writes to it's own log so maybe it will still work.
Only one way to find out ;-)
you could also try gnu plot... i was also looking for a 'drop in'
graphing program and found GNUplot was exactly what i wanted...
i use sa-stats.pl to read the log file then simply grep on the day
pipe to a file and plot on the basis of that. v simple, clean and pretty :)
ill show u the script if u want.. its only 10 or so lines long :)
easy
Ronan
-Original Message-
From: MIKE YRABEDRA [mailto:[EMAIL PROTECTED]
Sent: Monday, June 13, 2005 12:04 PM
To: users@spamassassin.apache.org
Subject: Sa stats using rrdtool?
Hello,
I have googled far and wide and kind not find an answer.
Does anyone know of a solution that will process a spamd log and then
output
the stats using rrdtool?
There are tons of things using mrtg, but even by the developers opinion,
mrtg is dead, rrd will take it's place.
++
Mike Yrabedra (President) :-)
323 Inc.
Our Sites:
MacDock.com
MacAgent.com
++
W: http://www.323inc.com/
P: 770.382.1195
F: 734.448.5164
E: [EMAIL PROTECTED]
I: ichatmacdock
++
Whatever you do, work at it with all your heart,
as working for the Lord, not for men.
~Colossians 3:23 {{{
++
Scanned by the MPP v2.1, http://www.messagepartners.com
Dump stats into mysql?
Hello, I am running a couple stats scripts that output info every day. Does anyone have a script that ( or know of one ) that will dump the info in a mysql database for later processing? TIA :-) Mike
SARE / RDJ failing on both servers?
Anyone else seeing this today? Connecting to www.rulesemporium.com[67.67.32.207]:80... failed: Connection refused. Connecting to www.rulesemporium.com[209.218.125.117]:80... failed: Connection refused.
Spamd -S option in 3.x?
Is there a way to stop processing once the message is seen as spam? Version 2.6 had the -S option, but that no longer works.
Re: A good stats script?
on 1/18/05 6:12 PM, MIKE YRABEDRA at [EMAIL PROTECTED] wrote:
What is a good script that folks are using to generate SA stats off a mail
log?
I am mainly looking for one that reports on the rulesets that are catching
the spam too. I don't think sa-stats.pl does that?
++
Mike Yrabedra (President)
323 Incorporated
Our Sites:
MacDock.com
MacAgent.com
iTuneAgent.com
MacSurfShop.com
++
W: http://www.323inc.com/
P: 770.382.1195
F: 734.448.5164
E: [EMAIL PROTECTED]
I: ichatmacdock
++
Whatever you do, work at it with all your heart,
as working for the Lord, not for men.
~Colossians 3:23 {{{
++
A good stats script?
What is a good script that folks are using to generate SA stats off a mail log?
SARE rules timing out?
Does anyone know if any of the SARE rules are causing timeouts? My server was bogging down really bad. I removed the custom rules and that seems to have fixed it. Only thing is, I don't know which one is causing the problem. Here is what I have: SARE_ADULT SARE BIZ/Marketing/Learning Ruleset SARE Fraud Detection EvilNumber SARE_HTML_ENG SARE_HEADER_ENG SARE Specific SARE Spoof SARE Random SARE OEM SARE_GENLSUBJ SARE Abused Redirect Subject SARE_GENLSUB_ENGJ SARE UNSUB SARE uri TripWire Mangled Words Any way to trim this list down and still see good effects? Thanks.
Re: SARE rules timing out?
I am using SA 3.0.2, CGPSA 1.4, CommunigatePro, Mac OS X
When the custom rules are present, process times are ranging from 12-45
seconds per message. This is causing a bottleneck.
It looks like it may be a DNS lookup issue, but I can't be sure.
on 1/6/05 2:06 PM, Chris Santerre at [EMAIL PROTECTED] wrote:
Are you saying that using spamd/c gives you problems for users who have
their own local rules? Just curious as to what problem?
--Chris
-Original Message-
From: jdow [mailto:[EMAIL PROTECTED]
Sent: Thursday, January 06, 2005 1:19 PM
To: users@spamassassin.apache.org
Subject: Re: SARE rules timing out?
The usual solution is more memory.
You need to tell us what version of SpamAssassin you are running, how
much memory you have in the machine, and how you are using SpamAssassin
including the options. Your mail load will also make a difference.
The SARE rules do consume a lot of memory. But they do not cause the
machine to bog down terribly. A typical spamassassin -t run here is
about 2.7 seconds on a 2G Athlon with a gig of memory. That is one of
the more brutal ways to run spamassassin, though. spamc-spamd was
under half that time. (I have a peculiar problem with per user rules
with that configuration so I do not use it.)
{^_^}
- Original Message -
From: MIKE YRABEDRA [EMAIL PROTECTED]
Does anyone know if any of the SARE rules are causing
timeouts? My server
was bogging down really bad. I removed the custom rules and
that seems to
have fixed it. Only thing is, I don't know which one is causing the
problem.
++
Mike Yrabedra (President)
323 Incorporated
Our Sites:
MacDock.com
MacAgent.com
iTuneAgent.com
MacSurfShop.com
++
W: http://www.323inc.com/
P: 770.382.1195
F: 734.448.5164
E: [EMAIL PROTECTED]
I: ichatmacdock
++
Whatever you do, work at it with all your heart,
as working for the Lord, not for men.
~Colossians 3:23 {{{
++
Journal?
For a while now (years) I have employed a single bayes db for my entire
server of users. It used bayes and kept three files; bayes_seen, bayes_toks
and bayes_journal. All of these files had current creation(modification)
dates so I know they were being used. Thing is, I never used the rebuild
feature to sync the journal, it just happened. Is that normal?
But on to my question...
I recently started allowing the use of user_prefs for individual users.
Everything is working , but only 2 files are being added to the user home
folders; bayes_toks and bayes_seen (no journal).
Is this something I should be concerned about?
The accounts are fairly light, not high traffic, is there even a need to use
journaling on the individual accounts?
Thanks for any help.
++
Mike Yrabedra (President)
323 Incorporated
Our Sites:
MacDock.com
MacAgent.com
iTuneAgent.com
MacSurfShop.com
++
W: http://www.323inc.com/
P: 770.382.1195
F: 734.448.5164
E: [EMAIL PROTECTED]
I: ichatmacdock
++
Whatever you do, work at it with all your heart,
as working for the Lord, not for men.
~Colossians 3:23 {{{
++
Learn from another bayes db?
I have a very old and established bayes db. I want to have newly created user bayes files 'learn' from it. Is there a way to do this? And if so, is it recommended I do so?
User_prefs or sql prefs, faster?
Which is faster? Using the standard SA setup or using Mysql prefs and databases?
Scan time?
What is an acceptable scan time for SA? Mine on average runs between 1-6 seconds, shouldn't it be more like 1-3 seconds?
