Good rules for SA
Dear List How to determine good rules for SA, I am using following rules. 70_sare_adult.cf 70_sare_html2.cf 70_sare_uri.cf FuzzyOcr.old 70_sare_bayes_poison_nxm.cf 70_sare_html3.cf 70_sare_uri_eng.cf FuzzyOcr.pm 70_sare_evilnum0.cf 70_sare_html4.cf 70_sare_uri_x31.cf FuzzyOcr.preps 70_sare_evilnum0.cf.sig 70_sare_html.cf 70_sare_whitelist.cf FuzzyOcr.scansets 70_sare_evilnum1.cf 70_sare_html_eng.cf 70_sare_whitelist_pre30.cf FuzzyOcr.words 70_sare_evilnum2.cf 70_sare_html_x30.cf 70_sare_whitelist_rcvd.cf init.pre 70_sare_genlsubj0.cf 70_sare_obfu0.cf 70_sare_whitelist_spf.cf INSTALL 70_sare_genlsubj1.cf 70_sare_obfu1.cf 71_sare_redirect_pre3.0.0.cf local.cf 70_sare_genlsubj2.cf 70_sare_obfu2.cf 72_sare_redirect_post3.0.0.cf Logging.pm 70_sare_genlsubj3.cf 70_sare_obfu3.cf 88_FVGT_Bayes_Poison.cfmangled.cf 70_sare_genlsubj4.cf 70_sare_obfu4.cf 88_FVGT_body.cfRelayChecker.cf 70_sare_genlsubj.cf 70_sare_obfu.cf 88_FVGT_headers.cf RelayChecker.pm 70_sare_genlsubj_eng.cf 70_sare_obfu_x31.cf 88_FVGT_rawbody.cf RelayChecker.tar 70_sare_genlsubj_x30.cf 70_sare_oem.cf 88_FVGT_subject.cf RelayChecker.txt 70_sare_header0.cf 70_sare_random.cf 88_FVGT_Tripwire.cfRulesDuJour 70_sare_header2.cf 70_sare_ratware.cf 88_FVGT_uri.cf sa-update-keys 70_sare_header3.cf 70_sare_specific.cf backhair.cfspamassassin-default.rc 70_sare_header4.cf 70_sare_specific_rolex.cf Botnet-0.6.tar spamassassin-helper.sh 70_sare_header.cf70_sare_spoof.cf Botnet.cf spamassassin-spamc.rc 70_sare_header_eng.cf70_sare_stocks.cf Botnet.pm tripwire.cf 70_sare_header_x264_x30.cf 70_sare_unsub.cf Botnet.txt v310.pre 70_sare_header_x30.cf70_sare_uri0.cf chickenpox.cf v312.pre 70_sare_header_x31.cf70_sare_uri1.cf COPYINGv320.pre 70_sare_highrisk.cf 70_sare_uri2.cf FuzzyOcr weeds_2.cf 70_sare_html0.cf 70_sare_uri3.cf fuzzyocr-3.5.1-devel.tar.gzweeds.cf 70_sare_html1.cf 70_sare_uri4.cfFuzzyOcr.cf = Please identify which rules are bad? -- Regards, Shahzad Abid
SA gets slow.
Dear List I am running qmail + SA + Clamav on FC 5, my problem is when ever concurrent smtp connections cross 30+ SA gets slow and take too much time to process mails through qmailscaner qmail-queue.log === Fri, 29 Feb 2008 09:51:50 PKT:8005: +++ starting debugging for process 8005 (ppid=8002) by uid=508 Fri, 29 Feb 2008 10:11:50 PKT:8005: w_c: elapsed time from start 1199.846234 secs Fri, 29 Feb 2008 10:11:50 PKT:8005: g_e_h: no sender and no recips, from via SMTP from 202.76.109.59. Dropping. Fri, 29 Feb 2008 10:11:50 PKT:8005: -- Process 8005 finished. Total of 1199.88143 secs = To remove this problem I kill all qmail-smtp processes. I need its permanent solution. -- Regards, Shahzad Abid
Re: FuzzyOCR not working.
Matt Kettler wrote: Shahzad Abid wrote: Olivier Nicole wrote: I am getting FuzzyOCS related errors in my mail.log I have search the web but unable to find proper solution for this problem, details are given below; [...] /etc/mail/spamassassin/FuzzyOcr.pm line 24. [21809] warn: BEGIN failed--compilation aborted at /etc/mail/spamassassin/FuzzyOcr.pm line 24. [21809] warn: plugin: failed to create instance of plugin FuzzyOcr: This is a wild guess, but what do you have in /etc/mail/spamassassin/FuzzyOcr/ directory? Bests, Olivier [EMAIL PROTECTED] ~]# ls -l /etc/mail/spamassassin/ can you post an ls -l /etc/mail/spamassassin/FuzzyOcr/ , which is what Oliver was asking for, ie: not an ls of /etc/mail/spamassassin that proves the directory exists, but the actual contents of the FuzzyOcr directory itself.. [EMAIL PROTECTED] ~]# ls -l /etc/mail/spamassassin/ total 3184 -rw-r--r-- 1 root root 53828 Oct 27 01:40 70_sare_adult.cf -rw-r--r-- 1 root root 53932 Oct 27 01:40 70_sare_adult.cf.1 -rw-r--r-- 1 root root3839 Oct 27 01:40 70_sare_bayes_poison_nxm.cf -rw-r--r-- 1 root root 24298 Oct 27 01:40 70_sare_evilnum0.cf -rw-r--r-- 1 root root 66 Oct 27 01:40 70_sare_evilnum0.cf.sig -rw-r--r-- 1 root root1574 Oct 27 01:40 70_sare_evilnum1.cf -rw-r--r-- 1 root root6970 Oct 27 01:40 70_sare_evilnum2.cf -rw-r--r-- 1 root root 45933 Oct 27 01:40 70_sare_genlsubj0.cf -rw-r--r-- 1 root root 75181 Oct 27 01:40 70_sare_genlsubj1.cf -rw-r--r-- 1 root root 17533 Oct 27 01:40 70_sare_genlsubj2.cf -rw-r--r-- 1 root root 49125 Oct 27 01:40 70_sare_genlsubj3.cf -rw-r--r-- 1 root root 23857 Oct 27 01:40 70_sare_genlsubj4.cf -rw-r--r-- 1 root root 187772 Oct 27 01:40 70_sare_genlsubj.cf -rw-r--r-- 1 root root 31990 Oct 27 01:40 70_sare_genlsubj_eng.cf -rw-r--r-- 1 root root4295 Oct 27 01:40 70_sare_genlsubj_x30.cf -rw-r--r-- 1 root root 123406 Oct 27 01:40 70_sare_header0.cf -rw-r--r-- 1 root root 109764 Oct 27 01:40 70_sare_header2.cf -rw-r--r-- 1 root root 86471 Oct 27 01:40 70_sare_header3.cf -rw-r--r-- 1 root root 23037 Oct 27 01:40 70_sare_header4.cf -rw-r--r-- 1 root root 384645 Oct 27 01:40 70_sare_header.cf -rw-r--r-- 1 root root8139 Oct 27 01:40 70_sare_header_eng.cf -rw-r--r-- 1 root root5708 Oct 27 01:40 70_sare_header_x264_x30.cf -rw-r--r-- 1 root root6422 Oct 27 01:40 70_sare_header_x30.cf -rw-r--r-- 1 root root5087 Oct 27 01:40 70_sare_header_x31.cf -rw-r--r-- 1 root root4448 Oct 27 01:40 70_sare_highrisk.cf -rw-r--r-- 1 root root 28066 Oct 27 01:40 70_sare_html0.cf -rw-r--r-- 1 root root 39625 Oct 27 01:40 70_sare_html1.cf -rw-r--r-- 1 root root 21296 Oct 27 01:40 70_sare_html2.cf -rw-r--r-- 1 root root 17773 Oct 27 01:40 70_sare_html3.cf -rw-r--r-- 1 root root 39898 Oct 27 01:40 70_sare_html4.cf -rw-r--r-- 1 root root 106760 Oct 27 01:40 70_sare_html.cf -rw-r--r-- 1 root root3159 Oct 27 01:40 70_sare_html_eng.cf -rw-r--r-- 1 root root2780 Oct 27 01:40 70_sare_html_x30.cf -rw-r--r-- 1 root root 51886 Oct 27 01:40 70_sare_obfu0.cf -rw-r--r-- 1 root root 106627 Oct 27 01:40 70_sare_obfu1.cf -rw-r--r-- 1 root root6129 Oct 27 01:40 70_sare_obfu2.cf -rw-r--r-- 1 root root 13766 Oct 27 01:40 70_sare_obfu3.cf -rw-r--r-- 1 root root4900 Oct 27 01:40 70_sare_obfu4.cf -rw-r--r-- 1 root root 158513 Oct 27 01:40 70_sare_obfu.cf -rw-r--r-- 1 root root2755 Oct 27 01:40 70_sare_obfu_x31.cf -rw-r--r-- 1 root root 12739 Oct 27 01:40 70_sare_oem.cf -rw-r--r-- 1 root root 18190 Oct 27 01:40 70_sare_random.cf -rw-r--r-- 1 root root 373 Oct 27 01:40 70_sare_ratware.cf -rw-r--r-- 1 root root 97820 Oct 27 01:40 70_sare_specific.cf -rw-r--r-- 1 root root9850 Oct 27 01:40 70_sare_specific_rolex.cf -rw-r--r-- 1 root root 20301 Oct 27 01:40 70_sare_spoof.cf -rw-r--r-- 1 root root 59593 Oct 27 01:40 70_sare_stocks.cf -rw-r--r-- 1 root root 25124 Oct 27 01:40 70_sare_unsub.cf -rw-r--r-- 1 root root 17879 Oct 27 01:40 70_sare_uri0.cf -rw-r--r-- 1 root root 24248 Oct 27 01:40 70_sare_uri1.cf -rw-r--r-- 1 root root4597 Oct 27 01:40 70_sare_uri2.cf -rw-r--r-- 1 root root8502 Oct 27 01:40 70_sare_uri3.cf -rw-r--r-- 1 root root4547 Oct 27 01:40 70_sare_uri4.cf -rw-r--r-- 1 root root 55227 Oct 27 01:40 70_sare_uri.cf -rw-r--r-- 1 root root5053 Oct 27 01:40 70_sare_uri_eng.cf -rw-r--r-- 1 root root1722 Oct 27 01:40 70_sare_uri_x31.cf -rw-r--r-- 1 root root 49617 Oct 27 01:40 70_sare_whitelist.cf -rw-r--r-- 1 root root 40022 Oct 27 01:40 70_sare_whitelist_pre30.cf -rw-r--r-- 1 root root 36610 Oct 27 01:40 70_sare_whitelist_rcvd.cf -rw-r--r-- 1 root root 31789 Oct 27 01:40 70_sare_whitelist_spf.cf -rw-r--r-- 1 root root 17992 Jun 2 2005 71_sare_redirect_pre3.0.0.cf -rw-r--r-- 1 root root 15481 May 16 2006 72_sare_redirect_post3.0.0.cf -rw-r--r-- 1 root root 651 Oct 27 01:42 88_FVGT_Bayes_Poison.cf -rw-r--r-- 1
Re: FuzzyOCR not working.
Rob Sterenborg wrote: This is a wild guess, but what do you have in /etc/mail/spamassassin/FuzzyOcr/ directory? [EMAIL PROTECTED] ~]# ls -l /etc/mail/spamassassin/ And what is the output of: ls -al /etc/mail/spamassassin/FuzzyOcr/ [EMAIL PROTECTED] /]# ls -l /etc/mail/spamassassin/FuzzyOcr/ total 88 -rw-r--r-- 1 1000 users 122 Jan 7 2007 CHANGES drwxr-xr-x 2 1000 users 4096 Jan 7 2007 FuzzyOcr -rw-r--r-- 1 1000 users 11008 Jan 7 2007 FuzzyOcr.cf -rw-r--r-- 1 1000 users 1194 Jan 7 2007 FuzzyOcr.mysql -rw-r--r-- 1 1000 users 38440 Jan 7 2007 FuzzyOcr.pm -rw-r--r-- 1 1000 users 697 Jan 7 2007 FuzzyOcr.preps -rw-r--r-- 1 1000 users 1495 Jan 7 2007 FuzzyOcr.scansets -rw-r--r-- 1 1000 users 440 Jan 7 2007 FuzzyOcr.words -rw-r--r-- 1 1000 users 124 Jan 7 2007 INSTALL drwxr-xr-x 2 1000 users 4096 Jan 7 2007 samples drwxr-xr-x 2 1000 users 4096 Jan 7 2007 Utils -- Regards, Shahzad Abid Network Engineer OCS Pakistan (Pvt.) Ltd. Worldwide House, C -17, D.H.A. Phase II Extension, Karachi, Pakistan. Tel #: +92 21 5803201-10, 5389901-5 DIRECT: +92 21 5888331 FAX: +92 21 5880606 CELL:+92 333 3400424
Re: FuzzyOCR not working.
root root 51200 Oct 27 01:43 Botnet-0.6.tar -r--r--r-- 1 root mail3134 Dec 7 2006 Botnet.cf -r--r--r-- 1 root mail 14030 Dec 7 2006 Botnet.pm -r--r--r-- 1 root mail6120 Dec 7 2006 Botnet.txt -r--r--r-- 1 root mail 18118 Nov 13 2006 COPYING drwxr-xr-x 5 1000 users 4096 Nov 7 12:03 FuzzyOcr -rw-r--r-- 1 root root 124418 Jan 7 2007 fuzzyocr-3.5.1-devel.tar.gz -rw-r--r-- 1 1000 users 11060 Nov 7 11:42 FuzzyOcr.cf -rw-r--r-- 1 1000 users 38440 Jan 7 2007 FuzzyOcr.pm -rw-r--r-- 1 1000 users697 Jan 7 2007 FuzzyOcr.preps -rw-r--r-- 1 1000 users 1495 Jan 7 2007 FuzzyOcr.scansets -rw-r--r-- 1 1000 users440 Jan 7 2007 FuzzyOcr.words -rw-r--r-- 1 root root 948 Jun 13 01:28 init.pre -r--r--r-- 1 root mail 256 Nov 13 2006 INSTALL -rw-r--r-- 1 root root 276 Oct 25 00:09 local.cf -r--r--r-- 1 root mail1320 Nov 13 2006 RelayChecker.cf -r--r--r-- 1 root mail 10601 Nov 13 2006 RelayChecker.pm -rw-r--r-- 1 root root 40960 Oct 27 01:44 RelayChecker.tar -r--r--r-- 1 root mail3790 Nov 13 2006 RelayChecker.txt drwx-- 2 root root4096 Oct 25 06:31 sa-update-keys -rw-r--r-- 1 root root 62 Jun 13 01:28 spamassassin-default.rc -rwxr-xr-x 1 root root 35 Jun 13 01:28 spamassassin-helper.sh -rw-r--r-- 1 root root 55 Jun 13 01:28 spamassassin-spamc.rc -rw-r--r-- 1 root root2179 Jun 13 01:28 v310.pre -rw-r--r-- 1 root root 806 Jun 13 01:28 v312.pre [EMAIL PROTECTED] ~]# ps aux | grep spamd root 29342 0.1 2.6 58732 54136 ?Ss 12:04 0:04 /usr/bin/spamd -x -u spamd -H /home/spamd -d -r /var/run/spamd.pid spamd 7552 2.4 2.9 66052 61444 ?S12:29 0:46 spamd child spamd14473 0.5 2.7 62116 57608 ?S12:41 0:06 spamd child -- Regards, Shahzad Abid Network Engineer OCS Pakistan (Pvt.) Ltd. Worldwide House, C -17, D.H.A. Phase II Extension, Karachi, Pakistan. Tel #: +92 21 5803201-10, 5389901-5 DIRECT: +92 21 5888331 FAX: +92 21 5880606 CELL:+92 333 3400424
Re: FuzzyOCR not working.
Olivier Nicole wrote: I am getting FuzzyOCS related errors in my mail.log I have search the web but unable to find proper solution for this problem, details are given below; [...] /etc/mail/spamassassin/FuzzyOcr.pm line 24. [21809] warn: BEGIN failed--compilation aborted at /etc/mail/spamassassin/FuzzyOcr.pm line 24. [21809] warn: plugin: failed to create instance of plugin FuzzyOcr: This is a wild guess, but what do you have in /etc/mail/spamassassin/FuzzyOcr/ directory? Bests, Olivier Yes . I have /etc/mail/spamassassin/FuzzyOcr/ directory -
FuzzyOCR not working.
dVCckUlKGKWFckPpGIyqsSYVFQ62aWN XZbcoGSmAKo9iRqa50hFNOVTrL2tOmqhTQ4kl46c2tqoWpseRdleStVllG2PrSqrp//AyfqRZlgm 6RiBx6JZFhRwnfrppdea+qimCfY67a+7/rqXpKWKG6pH2JJ6FbVe9YMpYJg+cdGXxGZK5kaBhakn Tg9ZNm5d9+Y4qbrWbvapsGEV3C0x+TpKML0xZVXvep2GyuJvPL4YW8cXxSYjlhnSejCvlgRsMluQ ZKRyjRnzRo8kIWepmM0rQ0nbmSpR+WRqhOFM0rIfathDiEWbh3R4SyfttBc9szDl0yBGTV/TVGet 9dZcd+3112CHLfbYZJdt9tlop6322l1PXdV3Ih4tYHUP9kVe3SuUmPeF+WENL4kYRhh34BizZ3ff e8vLBN9o+01DysSlnPOVphVUcJX/AXd5Fm6U6zIlIbXqjNrOnfNo5JYii+6itCPbqMPHnz955c87 Gwe7wz1zOdDgcy9aMbqcVYyZr/YiRGhQhD58J67YwIlnN/6mOumhKHGTbPOSPnz8wNDIwqrcEMkj Pqiax8XuXxVyK7HE4nMP8MUIu6s4w9Pnpb2n2voab+YcwR2+s9syVrE4UylnGTB9xlofoIBisdzA yjEAFJ4CHXgoUdDvfpVLILJeRyvrqU9otnnKFsxiE3TdioDn+034JsatiJWwNu+L17CY979ItVCA ARwa72TovnDZqmkkVJOrXChEbbGwBPpzU5sAEzzyGQ9+/IpezJbnRBwmEX89vGL9+GTjt44hKTWu Kw2raEah4xCJTx7zIEeylRHnfDFaJoiR7P4RGhptDC2KilaSchY5mNUsjndsjQVrV6zZ7JBt6HEc dhSpQkT2h5GOHOF+FEm0SPIHkpbMpCY3yclOevKToAylKEW5IL0ZbWajTKUqT9Q775hylbCMZR+A 9EZALImDj7ASFwkpRtRhUpbAjE/yFAYx6OXJMBI8ZqGCycysTYVfWCTiDBt2w2ZaM2nIiGDCUCVN mYAwV267pjgvaa5tequbNdzi/sbJTv84L2bExOC40nXBdtpTP1wyJAOHljoX9Uk1SPQj6e5JULX9 sqAIDWYlE8pQVSYAACH5BAXYWQcALA8ADwFvAS4AAAP/SLp8ejDCJ6slkV5su5fal3EgOS0l04Ri 675wLM90bd/4raqOWcYa1ig3hAmDO04SJSQ6n9CodEptsZo0ZFXn6xVPmwp2Sy6bz2jZFdMAn1Di FRvu9bZH8/C7eVR213FpgoOEhVVrO25JcUyLdUt4d0WOP4F1lV9uhpucnZ6WeJN+mZp0FKdaPX5/ o5qRiZekgJ+0tbZks4qrXV8hqK6/pI90G5Cxrsdjt8vMzSK5w68dqbrArciXPHqVfaDYzuDhztDB kdu+rejW23vs1d7JvOLz9J3k6STd69Giq3rUwgDqq0ewIK17urSlyCNqnypJCSEey0ZJljyDGDNG QUiR/1iKWMHUhRqoEJNFLNA0qlzJ0ogJZS1jypxZyxjNmzhzGoKls6fPn0CDCh1KtKjRo0iTKl3K tKnTp1CjSp1KtarVq1izat3KtavXr2DDih1LtqzZs2jTql3Ltq3bt3Djyp1Lt67du2UH4K0wQG+E vn/9ahQM2EJhKIfTFE5cpq9jCY4F840MmTHkmJZvLCa8eeXhzDI7nwGsdzNlw6cPRJYcGDNrHKJV x049OXFq0plp635cG7dszhBoVy7t93Zx4pIf2z7e+jdw2R1OLw/OG/p01rErT6be+/hn4twDf7cO 3nn48b2bm+deff157+WdW14N37Rw+tSlr+4uvzP+7v/1MddfgNtBZ+B/2eWn3HMItuceaqhVl+B+ DdJnn30KKujbga81qGGABBpI3ogiMsbbfN6Fp56KG4qo3onMgfYbe6KZRqOArcFYooAm+scjg69l WFt0FD6n3YwcIkfej0ci6ZuOH/j4Y4xAXvakePcF6aGKGn6InHA7Noebg2GiN1t8Pc54YY3YAcfm fi6mN1wLLaLIIpMkctjkeGPG+SGNYrq5ZX5C+tlkoC9quSCEIqCnZ6F3hvlonvOpZmmC7xV4oKSa GuanjIAaemamlOLI6WKXfopjnavGd9mcSEZ6JJuyesAqp7VimqaaKY6aZISx8mnqeykmKmppj9rJ K5eQsi6abK/JRUsor4qSaqOZRmra3n/DwajfigP292d62Ibb7ZqkJknmr+PqCmes4h57aX2B6rcu ZVu+CSWX3NoYIZSDohuno1jaum15BHcJKZiElisfkRJGnCvDE0p87HRyGvpwwXcuF+S0xqUbMri7 MavdmY5+l/BVK8vQckEf78UytzVYKPPNm7yrGcM4a5QAADs= --=_NextPart_000_0005_B9B571F3.BB2896EE-- Spam detection software, running on the system "mail2.ocs.com.pk", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: of the tournament to add to its illustrious squad, who would it choose? McClaren was a key coaching figure, and to suggest Eriksson ignored all his advice is His last act as a footballer was to shove his head into the chest of Marco Materazzi,Ricardo did well to keep out, with Lennon scuffing his attempt to put in the rebound. [...] Content analysis details: (5.1 points, 9.0 required) pts rule name description -- -- 0.3 HELO_EQ_DE HELO_EQ_DE 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.6 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words 0.8 SARE_GIF_ATTACHFULL: Email has a inline gif 0.7 MY_CID_AND_STYLE SARE cid and style 1.7 SARE_GIF_STOX Inline Gif with little HTML 1.0 AWLAWL: From: address is in the auto white-list === -- Regards, Shahzad Abid
Problem after update SA
Dear List After updating spamassassin to version SpamAssassin version 3.1.9 running on Perl version 5.8.8, I am getting following mesg in log file. # Jul 16 11:38:14 mail2 spamd[11475]: Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 2669, line 23. Jul 16 11:38:14 mail2 last message repeated 2 times Jul 16 11:38:14 mail2 spamd[11475]: Number found where operator expected at (eval 2403) line 10, near "} Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1" Jul 16 11:38:14 mail2 spamd[11475]: (Missing operator before Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1?) Jul 16 11:38:14 mail2 spamd[11475]: rules: failed to run header tests, skipping some: syntax error at (eval 2403) line 11, near "; Jul 16 11:38:14 mail2 spamd[11475]: }" Jul 16 11:38:14 mail2 spamd[11475]: Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 2669, line 23. Jul 16 11:38:14 mail2 last message repeated 2 times Jul 16 11:38:14 mail2 spamd[11475]: Number found where operator expected at (eval 2404) line 10, near "} Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1" Jul 16 11:38:14 mail2 spamd[11475]: (Missing operator before Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1?) Jul 16 11:38:14 mail2 spamd[11475]: rules: failed to run header tests, skipping some: syntax error at (eval 2404) line 11, near "; Jul 16 11:38:14 mail2 spamd[11475]: }" Jul 16 11:38:14 mail2 spamd[11475]: Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 2669, line 23. Jul 16 11:38:14 mail2 last message repeated 2 times Jul 16 11:38:14 mail2 spamd[11475]: Number found where operator expected at (eval 2405) line 10, near "} Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1" Jul 16 11:38:14 mail2 spamd[11475]: (Missing operator before Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1?) Jul 16 11:38:14 mail2 spamd[11475]: rules: failed to run header tests, skipping some: syntax error at (eval 2405) line 11, near "; Jul 16 11:38:14 mail2 spamd[11475]: }" Jul 16 11:38:14 mail2 spamd[11475]: Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 2669, line 23. Jul 16 11:38:14 mail2 last message repeated 2 times Jul 16 11:38:14 mail2 spamd[11475]: Number found where operator expected at (eval 2406) line 10, near "} Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1" Jul 16 11:38:14 mail2 spamd[11475]: (Missing operator before Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1?) Jul 16 11:38:14 mail2 spamd[11475]: rules: failed to run header tests, skipping some: syntax error at (eval 2406) line 11, near "; Jul 16 11:38:14 mail2 spamd[11475]: }" Jul 16 11:38:14 mail2 spamd[11475]: Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 2669, line 23. Jul 16 11:38:14 mail2 last message repeated 2 times Jul 16 11:38:14 mail2 spamd[11475]: Number found where operator expected at (eval 2407) line 10, near "} Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1" Jul 16 11:38:14 mail2 spamd[11475]: (Missing operator before Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1?) Jul 16 11:38:14 mail2 spamd[11475]: rules: failed to run header tests, skipping some: syntax error at (eval 2407) line 11, near "; Jul 16 11:38:14 mail2 spamd[11475]: }" Jul 16 11:38:14 mail2 spamd[11475]: Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 2669, line 23. Jul 16 11:38:14 mail2 last message repeated 2 times Jul 16 11:38:14 mail2 spamd[11475]: Number found where operator expected at (eval 2408) line 10, near "} Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1" Jul 16 11:38:14 mail2 spamd[11475]: (Missing operator before Jul 16 11:38:14 mail2 spamd[11475]: Jul 16 11:38:14 mail2 spamd[11475]: 1?) Jul 16 11:38:14 mail2 spamd[11475]: rules: failed to run header tests, skipping some: syntax error at (eval 2408) line 11, near "; Jul 16 11:38:14 mail2 spamd[11475]: }" Jul 16 11:38:14 mail2 spamd[11475]: Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm line 2669, line 23. Jul 16 11:38:14 mail2 last message repeated 2 times Jul 16 11:38:14 mail2 spamd[11475]: Number found where operator expected at (eval 2409) li
How to exempt I.P. address in SA.
Dear All Some of my known clients IP address got banned in some database like CBL and DNSBLNETAUT1. I want to allow this particular client's IP address in ALLOW list of SA. What should I do to achieve this task as I am newbie to SA. Thanks in advance. Shahzad Abid
Spam from local users.
Dear All Some emails from local users are getting MARKED as (S.P.A.M.) as shown in following log. === Dec 5 17:02:57 mail spamd[355]: spamd: identified spam (8.6/2.5) for [EMAIL PROTECTED]:510 in 1.9 seconds, 2862 bytes. Dec 5 17:02:57 mail spamd[355]: spamd: result: Y 8 - AWL,BAYES_00,DEAR_SOMETHING,FH_RELAY_NODNS,FM_NO_STYLE,HTML_MESSAGE,JR_RCVD_HOST_PROBS1,JR_RCVD_HOST_PROBS2,JR_RCVD_TOO_FEW_HOPS,MISSING_SUBJECT,RELAY_CHECKER,RELAY_CHECKER_NORDNS scantime=1.9,size=2862,[EMAIL PROTECTED],uid=510,required_score=2.5,rhost=mail.ocs.com.pk,raddr=127.0.0.1,rport=52373,mid=<[EMAIL PROTECTED]>,bayes=0.00139389667305584,autolearn=no Dec 5 17:02:57 mail spamd[3573]: prefork: child states: II Dec 5 17:02:57 mail qmail-scanner[6079]: Clear:RC:0(61.5.138.198):SA:1(8.6/2.5): 2.240486 2830 [EMAIL PROTECTED] [EMAIL PROTECTED] <> <[EMAIL PROTECTED]> 1165320175.6092-0.mail.ocs.com.pk:446 1165320175.6092-1.mail.ocs.com.pk:1366 orig-mail.ocs.com.pk11653201754926079:2830 == Only differance is that user comming from outside LAN. How can I resolve this problem. Regards, Shahzad Abid
Negetive Points by SA.
Dear All My quetion to the list is that SA in my email server giving negetive points to spam mails example is given below. == Return-Path: <[EMAIL PROTECTED]> Delivered-To: [EMAIL PROTECTED] Received: (qmail 12486 invoked by uid 509); 14 Nov 2006 19:29:54 +0500 Received: from 80.137.13.171 by mail.ocs.com.pk (envelope-from <[EMAIL PROTECTED]>, uid 508) with qmail-scanner-1.25 (clamdscan: 0.83/1891. spamassassin: 3.0.4. Clear:RC:0(80.137.13.171):SA:0(-1.1/2.5):. Processed in 11.977306 secs); 14 Nov 2006 14:29:54 - X-Spam-Status: No, hits=-1.1 required=2.5 Received: from p50890dab.dip0.t-ipconnect.de (80.137.13.171) by mail.ocs.com.pk with SMTP; 14 Nov 2006 19:29:42 +0500 Message-ID: <[EMAIL PROTECTED]> From: Concetta Love <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: I as despotic Date: Tue, 14 Nov 2006 15:20:28 +0100 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="=_NextPart_000_000B_01C70800.6A86CD70" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2969 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.1106 === What should I do to over come this problem. Regards, Shahzad Abid
SA -D --lint Result.
==> got hit [7918] dbg: rules: running raw-body-text per-line regexp tests; score so far=-1.111 [7918] dbg: rules: running full-text regexp tests; score so far=-1.111 [7918] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xb2a644c) implements 'check_tick' [7918] dbg: check: running tests for priority: 500 [7918] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xb2a644c) implements 'check_post_dnsbl' [7918] dbg: rules: running meta tests; score so far=-1.111 [7918] info: rules: meta test VIRUS_WARNING_DOOM_BNC has undefined dependency 'VIRUS_WARNING_MYDOOM4' [7918] info: rules: meta test DRUGS_ERECTILE has undefined dependency '__DRUGS_ERECTILE7' [7918] dbg: rules: running header regexp tests; score so far=1.046 [7918] dbg: rules: running body-text per-line regexp tests; score so far=1.046 [7918] dbg: uri: running uri tests; score so far=1.046 [7918] dbg: rules: running raw-body-text per-line regexp tests; score so far=1.046 [7918] dbg: rules: running full-text regexp tests; score so far=1.046 [7918] dbg: check: running tests for priority: 900 [7918] dbg: rules: running meta tests; score so far=1.046 [7918] dbg: rules: running header regexp tests; score so far=1.046 [7918] dbg: rules: running body-text per-line regexp tests; score so far=1.046 [7918] dbg: uri: running uri tests; score so far=1.046 [7918] dbg: rules: running raw-body-text per-line regexp tests; score so far=1.046 [7918] dbg: rules: running full-text regexp tests; score so far=1.046 [7918] dbg: check: running tests for priority: 1000 [7918] dbg: rules: running meta tests; score so far=1.046 [7918] dbg: rules: running header regexp tests; score so far=1.046 [7918] dbg: rules: running body-text per-line regexp tests; score so far=1.046 [7918] dbg: uri: running uri tests; score so far=1.046 [7918] dbg: rules: running raw-body-text per-line regexp tests; score so far=1.046 [7918] dbg: rules: running full-text regexp tests; score so far=1.046 [7918] dbg: check: is spam? score=1.046 required=2.5 [7918] dbg: check: tests=BAYES_05,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS,TO_CC_NONE [7918] dbg: check: subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__NONEMPTY_BODY,__SANE_MSGID,__UNUSABLE_MSGID [7918] warn: lint: 10 issues detected, please rerun with debug enabled for more information = Thanks in advance. Shahzad Abid
Re: Delete all emails tagged by SA.
Dear Ed Kasky Thanks for such a nice suggetion and guidance currently I am using qtrap for my Qmail Server. Is there any other tool available ? Shahzad Abid Ed Kasky > At 09:15 AM Tuesday, 10/3/2006, Shahzad Abid wrote -=> >>I have SpamAssassin version 3.1.5 running on Perl version 5.8.5 on FC3. >> >>I want to delete all emails tagged by SA as spam. > > So what's stopping you? Do know however that SA will not "process" > your mail in any way - all it is intended to do is identify > spam. You will need to use something else in your arsenal to accomplish > this. > > You should read this before you just start deleting unread emails: > > http://wiki.apache.org/spamassassin/DeletingAllMailsMarkedSpam > > Ed Kasky > ~ > Randomly Generated Quote (442 of 515): > The best thing about the future is that it comes only > one day at a time. -Abraham Lincoln (1809-1865) > >
Delete all emails tagged by SA.
Dear All I have SpamAssassin version 3.1.5 running on Perl version 5.8.5 on FC3. I want to delete all emails tagged by SA as spam. Shahzad Abid
