RE: OS X Server spam still getting through :-(

2006-09-05 Thread Bowie Bailey
mikemacfr wrote:
 OK, but isn't spamd the settings file for spamassassin?
 How does spamassassin know how to work if spamd is not used when
 amavis is doing the routing?

The way it works is that Amavis uses SpamAssassin routines to score
the mail and then uses its own settings to decide what to do with the
mail based on the SA score.

/etc/mail/spamasassin/local.cf is the main settings file for SA
(along with other stuff in that directory).  This tells SA how to
process the mail.

/etc/amavisd.conf is the settings file for Amavis.  It tells Amavis
what to do with the mail that SA has processed.

Anything having to do with rules and plugins is done with the SA
configuration files.  Anything having to do with required scores and
message markup/rejection is done with the Amavis config file.

Note that these directories may be slightly different depending on
your distribution and installation method.

-- 
Bowie


Re: OS X Server spam still getting through :-(

2006-09-04 Thread mikemacfr

I don't really have the background to understand it properly I'm afraid. I
had someone else
install and setup this for me but he's no longer available to check this out
for me.

Sorry to be a pain. Answering is not compulsery and I understand your
frustration at my incompetence.

If I could find someone willing to check out my system for a fee I'd be
happy but don't know where 
or who to ask?

I hope I'm not stepping over the line mentioning that here.


Mike


John Andersen wrote:
 
 On Sunday 03 September 2006 01:14, mikemacfr wrote:
 OK, but isn't spamd the settings file for spamassassin?
 
 No.  
 
 
 How does spamassassin know how to work if spamd is not used when amavis
 is
 doing the routing?
  
 Amavis calls spamassassin directly.
 
 Mike, with all due respect, these questions show you have not
 read one word of the documentation.
 
 -- 
 _
 John Andersen
 
 

-- 
View this message in context: 
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6130515
Sent from the SpamAssassin - Users forum at Nabble.com.



Re: OS X Server spam still getting through :-(

2006-09-03 Thread mikemacfr

OK, but isn't spamd the settings file for spamassassin?
How does spamassassin know how to work if spamd is not used when amavis is
doing the routing?

And if spamassissin is still the anti-spammer where do I tell it that it's
not doing
it's job properly?

Thanks by the way for all the feedback so far. It's really encouraging to
see people engaged
and trying to help

Mike


John Andersen wrote:
 
 On Saturday 02 September 2006 15:18, mikemacfr wrote:
 I'm a bit confused?

 I thought amavis was the virus scanner bit? And spamassassin took care of
 the spam bit?
 
 Amavis is a router sort of.  
 
 It takes mail from your mta, sends it thru one or more engines
 (spamassassin, 
 antivirus, and some other more rarely used options) and then (optionally) 
 hands it back to your MTA for delivery via yet another engine, procmail, 
 cyrus, etc.
 
 Its glue-ware.
 -- 
 _
 John Andersen
 
 

-- 
View this message in context: 
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6120705
Sent from the SpamAssassin - Users forum at Nabble.com.



Re: OS X Server spam still getting through :-(

2006-09-03 Thread mikemacfr

John, I was just in on your post about spam levels.

Do this stats from our server give you (or anyone else) any clue about whats
causing
spam to get through?

http://65.170.183.59:16080/amavis-stats/


Mike


John Andersen wrote:
 
 On Saturday 02 September 2006 15:18, mikemacfr wrote:
 I'm a bit confused?

 I thought amavis was the virus scanner bit? And spamassassin took care of
 the spam bit?
 
 Amavis is a router sort of.  
 
 It takes mail from your mta, sends it thru one or more engines
 (spamassassin, 
 antivirus, and some other more rarely used options) and then (optionally) 
 hands it back to your MTA for delivery via yet another engine, procmail, 
 cyrus, etc.
 
 Its glue-ware.
 -- 
 _
 John Andersen
 
 

-- 
View this message in context: 
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6120810
Sent from the SpamAssassin - Users forum at Nabble.com.



Re: OS X Server spam still getting through :-(

2006-09-03 Thread Loren Wilton

OK, but isn't spamd the settings file for spamassassin?
How does spamassassin know how to work if spamd is not used when amavis is
doing the routing?

And if spamassissin is still the anti-spammer where do I tell it that 
it's

not doing


SA is a really big bunch of perl modules that process one mail message at a 
time.


spamassassin is simply a perl wrapper script that will cause all of these 
modules to come into existance and filter exactly one message.


Amvis-New, and several other tools, are also either written in perl or can 
call perl modules directly.  So what Amvis-New does is it internally 
instantiates all of the perl modules that comprise the guts of spamassassin. 
It then takes a mail message, hands it to the SA modules, tells the modules 
to do their thing, and then pulls the result back out of the modules.  It 
looks at the result (spam/not spam and the hit level) compares that to 
Amvis' internal setting for spam level, and based on that decides whether to 
send the original message through and discard the SA result, or whether to 
discard the original and use the SA result.


Now, instantiating all of the perl modules that make up SA is a 
resource-consuming activity, and if you have a lot of mail it will eat your 
server alive.  So spamc and spamd came into existance. Spamd is a perl 
script that instantiates an instance of SA as a server of sorts.  You can 
pass it a mail message, it will process it and return the results to you. 
But it keeps the SA instance around to process another message, just like 
Amvis is doing internally.  Spamc is the client that passes a mail message 
to spamd and gets the results back.


The end result in this case is you would either be using spamc/spamd, or you 
would be using Amvis-New, but typically not both.  In either case you are 
using the perl modules that comprise SA, but they are instantiated in 
different processes.


SA uses a number of configuration files, and they can live in several 
places.  There are two main default locations, but these locations can be 
overridden by passing paths to SA when it is instantiated.


These locations contain a number of *.cf files and several *.pre files. 
There might also be some user_prefs files around.


Most of the pre and cf files are part of the SA install and contain the 
stock rules and settings.  There is local.cf and possibly some others that 
contain the local tuning settings.  Typcailly when installing SA you need to 
look at the *.pre files that contain LoadPlugin lines, and make sure that 
the ones you want are uncommented.  Many tests will be disabled if the 
plugins that implement them are commented out.  Then you also need to set up 
some basic configuration in local.cf.


That will configure SA itself.  As you have already found though, Amvis 
itself has some configuration lines that ALSO control how SA will work in 
that environment.  I suspect many of these options are equivalent to the 
command line options on spamd.


So the long answer to your question is there are several places to look. 
The main ones will be local.cf, *.pre, and whatever settings Amvis has.


   Loren



Re: OS X Server spam still getting through :-(

2006-09-03 Thread Loren Wilton
Do this stats from our server give you (or anyone else) any clue about 
whats

causing
spam to get through?

http://65.170.183.59:16080/amavis-stats/


This can only be a guess without more data.  However it is obvious your mail 
volume is up greatly in the past two months, and the spam detection rate is 
also down.


Now your previous volume indicates that something like 80% of the mail is 
ham.  I don't know if that is true, or if SA has been missing 50% of the 
spam all along.  In any case SA is now only catching about 50% of what it 
was before, and probably a bunch of that increased mail volume is also spam.


Assuming no other system changes, this tells me that the makeup of the spam 
has changed and your SA hasn't kept up with those changes.


The two major changes in spam recently have been a huge increase in stock 
spams, and a huge increase in image spams, most of which are also stock 
spams.  The stock SA rules aren't real good at catching either of these.


Some addon rulesets from www.rulesemproium.com will catch a good many of the 
stock (and other) spams quite well.  There is a new OCR plugin for SA, 
FuzzyOCR, that is still somewhat experimental, but the few dozen people 
using it are really happy with the results for the most part.  It is a 
little bit of work to install because it requires a number of pieces to 
work.  The rulesemporium rules are easy to install.


You might also have some other problems with your configuration and trust 
paths that could really be hurting SA's detection rate.  We can't tell that 
without seeing some actual hit information from a few mails that made it 
through.


   Loren



Re: OS X Server spam still getting through :-(

2006-09-03 Thread John Andersen
On Sunday 03 September 2006 01:14, mikemacfr wrote:
 OK, but isn't spamd the settings file for spamassassin?

No.  


 How does spamassassin know how to work if spamd is not used when amavis is
 doing the routing?
 
Amavis calls spamassassin directly.

Mike, with all due respect, these questions show you have not
read one word of the documentation.

-- 
_
John Andersen


pgpDqaG32SQtl.pgp
Description: PGP signature


Re: OS X Server spam still getting through :-(

2006-09-02 Thread Magnus Holmgren
On Saturday 02 September 2006 12:31, mikemacfr took the opportunity to say:
 I'm completely new to this list and am not a UNIX person.

 I have SpamAssassin 3.1.4 installed on our mail server together with
 Squirrel and Amavis-new.

 Spam is still getting through at an unacceptable rate and I haven't got a
 clue how fault find
 what's going wrong?

Have you checked out http://wiki.apache.org/spamassassin/UsingSpamAssassin 
(Spam getting through?)?

If you need more help you can attach one or two spam mails for us to analyze.

-- 
Magnus Holmgren[EMAIL PROTECTED]
   (No Cc of list mail needed, thanks)


pgpFBKlq4EeGv.pgp
Description: PGP signature


Re: OS X Server spam still getting through :-(

2006-09-02 Thread mikemacfr

OK, I'll take a look!


In the meantime ere is the mail I got based on your reply!

(By the way er du Norsk?)


Mike

Return-Path: [EMAIL PROTECTED]
Received: from murder ([unix socket])
 by powerconsult.no (Cyrus v2.2.12-OS X 10.4.0) with LMTPA;
 Sat, 02 Sep 2006 13:54:16 +0200
X-Sieve: CMU Sieve 2.2
Received: from localhost (localhost [127.0.0.1])
by powerconsult.no (Postfix) with ESMTP id 8EB27AB131B
for [EMAIL PROTECTED]; Sat,  2 Sep 2006 13:54:16 +0200 (CEST)
Received: from powerconsult.no ([127.0.0.1])
 by localhost (mail.powerconsult.no [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id 25230-12 for [EMAIL PROTECTED];
 Sat,  2 Sep 2006 13:54:04 +0200 (CEST)
Received: from talk.nabble.com (www.nabble.com [72.21.53.35])
by powerconsult.no (Postfix) with ESMTP id 04BEEAB12FB
for [EMAIL PROTECTED]; Sat,  2 Sep 2006 13:54:04 +0200 (CEST)
Received: from [72.21.53.38] (helo=jubjub.nabble.com)
by talk.nabble.com with esmtp (Exim 4.50)
id 1GJU4Z-00054X-Jb
for [EMAIL PROTECTED]; Sat, 02 Sep 2006 04:54:03 -0700
Message-ID: [EMAIL PROTECTED]
Date: Sat, 2 Sep 2006 04:54:03 -0700 (PDT)
From: Nabble Alerts [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Re: OS X Server spam still getting through :-(
MIME-Version: 1.0
Content-Type: multipart/alternative; 
boundary==_Part_543_9535095.1157198043606
MTA-Interface: amavisd-new-2.3.3 (20050822) at mail.powerconsult.no
X-Spam-Scanned: using SpamAssassin 3.1.4 (2006-07-25) at
mail.powerconsult.no
X-Virus-Scanned: using Clamav 0.87.0 (2005-09-16) at mail.powerconsult.no

--=_Part_543_9535095.1157198043606
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit


Nabble email alert: 
New reply to your post OS X Server spam still getting through :-(
Re: OS X Server spam still getting through :-( - 3 star
On Saturday 02 September 2006 12:31, mikemacfr took the opportunity to say:
 I'm completely new to this list and am not a UNIX person.

 I have ...
by Magnus Holmgren on 2006-09-02 in the SpamAssassin - Users forum:
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6111933

Delete this alert:
http://www.nabble.com/alerts/DeleteReplyAlert.jtp?post=6111393p=1511302

---
DO NOT REPLY TO THIS E-MAIL.

Replies sent to this address are not read or processed.
If you want to respond to a Nabble post for which you received this alert,
please go to the Nabble website:
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6111933


--=_Part_543_9535095.1157198043606
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit


h2Nabble email alert/h2
New reply to your post OS X Server spam still getting through :-(br
p
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6111933
Re: OS X Server spam still getting through :-(  - 3 starbr
On Saturday 02 September 2006 12:31, mikemacfr took the opportunity to say:
gt; I'm completely new to this list and am not a UNIX person.
gt;
gt; I have ...br
smallby Magnus Holmgren on 2006-09-02 in the SpamAssassin - Users
forum/smallbr/p
br /
http://www.nabble.com/alerts/DeleteReplyAlert.jtp?post=6111393p=1511302
Delete  this alert.
br /
hr noshade=noshade size=1 color=#cc /
div style=color:#66; font: 11px
tahoma,geneva,helvetica,arial,sans-serif;
DO NOT REPLY TO THIS E-MAIL.br /br /
Replies sent to this address are not read or processed.
If you want to respond to a Nabble post for which you received this alert,
please go to the 
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6111933
Nabble website .
/div


--=_Part_543_9535095.1157198043606--




Magnus Holmgren wrote:
 
 On Saturday 02 September 2006 12:31, mikemacfr took the opportunity to
 say:
 I'm completely new to this list and am not a UNIX person.

 I have SpamAssassin 3.1.4 installed on our mail server together with
 Squirrel and Amavis-new.

 Spam is still getting through at an unacceptable rate and I haven't got a
 clue how fault find
 what's going wrong?
 
 Have you checked out http://wiki.apache.org/spamassassin/UsingSpamAssassin 
 (Spam getting through?)?
 
 If you need more help you can attach one or two spam mails for us to
 analyze.
 
 -- 
 Magnus Holmgren[EMAIL PROTECTED]
(No Cc of list mail needed, thanks)
 
 

-- 
View this message in context: 
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6112023
Sent from the SpamAssassin - Users forum at Nabble.com.



Re: OS X Server spam still getting through :-(

2006-09-02 Thread Loren Wilton

In the meantime ere is the mail I got based on your reply!



MTA-Interface: amavisd-new-2.3.3 (20050822) at mail.powerconsult.no
X-Spam-Scanned: using SpamAssassin 3.1.4 (2006-07-25) at
 mail.powerconsult.no


It looks like you are using amvis-new to integrate SA in to the mail chain. 
One of its unfortunate effects for debugging is that it doesn't actually 
include the mail output from SA if SA decides that it isn't spam.  So we 
have lost all indications of which rules hit and what didn't hit on the 
mail, and are only left with Amvis' indication that the mail was in fact 
scanned.


There is a way to change the amvis config to get around this, but I'm not an 
Amvis person and can't help you.  You could probably find it with 
considerable effort searching the archives, but someone else that knows 
amvis will likely respond soon.


What sort of spams are making it through?  Stock spams?  Or just all the 
usual stuff?  You may not be running any addon rule sets, and SA out of the 
box isn't as good as it could be against stock spams.


   Loren



Re: OS X Server spam still getting through :-(

2006-09-02 Thread Bill Randle
On Sat, 2006-09-02 at 09:59 -0700, Loren Wilton wrote:
  In the meantime ere is the mail I got based on your reply!
 
  MTA-Interface: amavisd-new-2.3.3 (20050822) at mail.powerconsult.no
  X-Spam-Scanned: using SpamAssassin 3.1.4 (2006-07-25) at
   mail.powerconsult.no
 
 It looks like you are using amvis-new to integrate SA in to the mail chain. 

 There is a way to change the amvis config to get around this, but I'm not an 
 Amvis person and can't help you.  You could probably find it with 
 considerable effort searching the archives, but someone else that knows 
 amvis will likely respond soon.

Change $sa_tag_level_deflt to -99 in /etc/amavisd/amavisd.conf, or
where ever the amavisd config file is located. This will report the
SA info in the mail logs for any mail scored greater than -99.

-Bill




Re: OS X Server spam still getting through :-(

2006-09-02 Thread mikemacfr

This is a typical spam mail:

Return-Path: [EMAIL PROTECTED]
Received: from murder ([unix socket])
 by powerconsult.no (Cyrus v2.2.12-OS X 10.4.0) with LMTPA;
 Sat, 02 Sep 2006 15:15:19 +0200
X-Sieve: CMU Sieve 2.2
Received: from localhost (localhost [127.0.0.1])
by powerconsult.no (Postfix) with ESMTP id 9EFEAAB1DCA;
Sat,  2 Sep 2006 15:15:19 +0200 (CEST)
Received: from powerconsult.no ([127.0.0.1])
 by localhost (mail.powerconsult.no [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id 26144-09; Sat,  2 Sep 2006 15:15:07 +0200 (CEST)
Received: from aley.net (unknown [219.146.60.254])
by powerconsult.no (Postfix) with SMTP id 9E801AB1DB3;
Sat,  2 Sep 2006 15:14:57 +0200 (CEST)
Message-ID: [EMAIL PROTECTED]
Date: Sat, 02 Sep 2006 03:18:58 +0100
Reply-To: jeane nelson [EMAIL PROTECTED]
From: jeane nelson [EMAIL PROTECTED]
User-Agent: QUALCOMM Windows Eudora Version 6.0.0.22
X-Accept-Language: en-us
MIME-Version: 1.0
To: Jesse Gonzalez [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: FW:Do away with all you are indebted for without mailing another
cent
Content-Type: text/plain;
charset=us-ascii
Content-Transfer-Encoding: 7bit
MTA-Interface: amavisd-new-2.3.3 (20050822) at mail.powerconsult.no
X-Spam-Scanned: using SpamAssassin 3.1.4 (2006-07-25) at
mail.powerconsult.no
X-Virus-Scanned: using Clamav 0.87.0 (2005-09-16) at mail.powerconsult.no


Clear of card bills immediately not even spending an other dime.  See the
details when ever you want.

P H O N E
1 314- 4--1--4--4 0 0 1

Meticulous info or to being to a standstill getting or to  postal address

it's all right! said hermione kindly, hurrying forward to help her. here
..   .it is called hogwarts, said dumbledore. 
well, there they go, and i think we're all surprised to see the team that
potter's put together this year. many thought, given ronald weasley's patchy
performance as keeper last year, that he might be off the team, but of
course, a close personal friendship with the captain does help. . . . m1



What sort of spams are making it through?  Stock spams?  Or just all the 
usual stuff?  You may not be running any addon rule sets, and SA out of the 
box isn't as good as it could be against stock spams.

Loren



Mike
-- 
View this message in context: 
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6115054
Sent from the SpamAssassin - Users forum at Nabble.com.



Re: OS X Server spam still getting through :-(

2006-09-02 Thread mikemacfr

This reads $sa_tag_level_deflt  = 2.0; # add spam info headers if at, or
above that level;

at the moment, so you want me to change 2.0 to -99?


Mike



Bill Randle wrote:
 
 
 Change $sa_tag_level_deflt to -99 in /etc/amavisd/amavisd.conf, or
 where ever the amavisd config file is located. This will report the
 SA info in the mail logs for any mail scored greater than -99.
 
   -Bill
 
 
 
 

-- 
View this message in context: 
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6115089
Sent from the SpamAssassin - Users forum at Nabble.com.



Re: OS X Server spam still getting through :-(

2006-09-02 Thread Bill Randle
On Sat, 2006-09-02 at 10:59 -0700, mikemacfr wrote:
 This reads $sa_tag_level_deflt  = 2.0; # add spam info headers if at, or
 above that level;
 
 at the moment, so you want me to change 2.0 to -99?

Yes. At 2.0, it means that a spam will have to score 2.0 or greater
before amavis logs the spam detection info.

-Bill





Re: OS X Server spam still getting through :-(

2006-09-02 Thread mikemacfr

OK, I've done that now and restarted the mail server and postfix.

What next?

Mike


Bill Randle wrote:
 
 On Sat, 2006-09-02 at 10:59 -0700, mikemacfr wrote:
 This reads $sa_tag_level_deflt  = 2.0; # add spam info headers if at, or
 above that level;
 
 at the moment, so you want me to change 2.0 to -99?
 
 Yes. At 2.0, it means that a spam will have to score 2.0 or greater
 before amavis logs the spam detection info.
 
   -Bill
 
 
 
 
 

-- 
View this message in context: 
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6115563
Sent from the SpamAssassin - Users forum at Nabble.com.



RE: OS X Server spam still getting through :-(

2006-09-02 Thread Michael Scheidell

 -Original Message-
 From: mikemacfr [mailto:[EMAIL PROTECTED] 
 Sent: Saturday, September 02, 2006 1:55 PM
 To: users@spamassassin.apache.org
 Subject: Re: OS X Server spam still getting through :-(


 (amavisd-new, port 10024)  with ESMTP id 26144-09; Sat,  2 

Another option, is there is an 'amavis-user@lists.sourceforge.net' list
just for amavisd-new.

Since there are subtle differences in setup, debugging, etc, you might
bring your questions there.

Main web site (with faq's, etc):

http://www.ijs.si/software/amavisd/
Sign up here:
https://lists.sourceforge.net/lists/listinfo/amavis-user



Re: OS X Server spam still getting through :-(

2006-09-02 Thread Loren Wilton
Assuming you also restarted amvis so it will see  the change, you should now 
be getting some more headers in your mail messages.  You should see headers 
similar to the following in a typical non-spam mail:


X-Spam-Virus: No
X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on
morticia.wizardess.wiz
X-Spam-Level:
X-Spam-Status: No, score=-95.6 required=4.6 
tests=BAYES_50,DK_POLICY_SIGNSOME,

FM_NO_STYLE,HELO_EQ_DSL,HOST_EQ_DSL,HTML_10_20,HTML_FONT_BIG,
HTML_MESSAGE,SPF_PASS,USER_IN_WHITELIST autolearn=disabled
version=3.1.4

From the above you can see which tests hit on the mail. By implication you 
can see what tests are running, and possibly which rules you have loded on 
the system.  You can also detect some configuration errors that can lead to 
spam leaking through.


When you see some of these for a spam that leaks through, post the full 
thing including the headers and body.  I have a hunch you may not be running 
network tests, and either aren't running Bayes or it is mistrained.  It is 
possible you have a problem with the trust path, since that is a common 
misconfiguration.  We will be able to tell that from the headers.


   Loren



Re: OS X Server spam still getting through :-(

2006-09-02 Thread mikemacfr

Ok, one of the first replies to this thread pointed to:

Have you checked out http://wiki.apache.org/spamassassin/UsingSpamAssassin 
(Spam getting through?)? 


Which I have looked at and saw the following there:

Edit your spamd start-up script, or start-up options file (depending on
which OS you're running, these may be different). There should be a -L or
--local switch in that file. Remove it to enable network tests.

I have commented out this line in the spamd file and done a restart. So this
may have already helped some?


Mike



Loren Wilton wrote:
 
 Assuming you also restarted amvis so it will see  the change, you should
 now 
 be getting some more headers in your mail messages.  You should see
 headers 
 similar to the following in a typical non-spam mail:
 
 X-Spam-Virus: No
 X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on
  morticia.wizardess.wiz
 X-Spam-Level:
 X-Spam-Status: No, score=-95.6 required=4.6 
 tests=BAYES_50,DK_POLICY_SIGNSOME,
  FM_NO_STYLE,HELO_EQ_DSL,HOST_EQ_DSL,HTML_10_20,HTML_FONT_BIG,
  HTML_MESSAGE,SPF_PASS,USER_IN_WHITELIST autolearn=disabled
  version=3.1.4
 
 From the above you can see which tests hit on the mail. By implication you 
 can see what tests are running, and possibly which rules you have loded on 
 the system.  You can also detect some configuration errors that can lead
 to 
 spam leaking through.
 
 When you see some of these for a spam that leaks through, post the full 
 thing including the headers and body.  I have a hunch you may not be
 running 
 network tests, and either aren't running Bayes or it is mistrained.  It is 
 possible you have a problem with the trust path, since that is a common 
 misconfiguration.  We will be able to tell that from the headers.
 
 Loren
 
 
 

-- 
View this message in context: 
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6115926
Sent from the SpamAssassin - Users forum at Nabble.com.



Re: OS X Server spam still getting through :-(

2006-09-02 Thread Bill Randle
On Sat, 2006-09-02 at 12:49 -0700, mikemacfr wrote:
 Ok, one of the first replies to this thread pointed to:
 
 Have you checked out http://wiki.apache.org/spamassassin/UsingSpamAssassin 
 (Spam getting through?)? 
 
 
 Which I have looked at and saw the following there:
 
 Edit your spamd start-up script, or start-up options file (depending on
 which OS you're running, these may be different). There should be a -L or
 --local switch in that file. Remove it to enable network tests.
 
 I have commented out this line in the spamd file and done a restart. So this
 may have already helped some?

Except if you're using amavisd-new, you don't use spamd unless you
have some strange configuration. You usually use one or the other
but not both.

-Bill




Re: OS X Server spam still getting through :-(

2006-09-02 Thread Loren Wilton

Edit your spamd start-up script, or start-up options file (depending on
which OS you're running, these may be different). There should be a -L or
--local switch in that file. Remove it to enable network tests.

I have commented out this line in the spamd file and done a restart. So 
this

may have already helped some?


I'm not sure Amvis actually uses spamd, I think it calls the SA routines 
directly.  If so there is no actual reason to run spamc/spamd on your 
system.  Again, one of the Amivs people will know this for sure.  There may 
be an equivalent local only setting for amvis in one of its config files.


If you start seeing hit information in your messages they will show 
moderately well whether you are using network tests, since typically some of 
the network test rule anmes should show up on almost any spam.


   Loren



Re: OS X Server spam still getting through :-(

2006-09-02 Thread mikemacfr

I'm a bit confused?

I thought amavis was the virus scanner bit? And spamassassin took care of
the spam bit?

Mike


Loren Wilton wrote:
 
 Edit your spamd start-up script, or start-up options file (depending on
 which OS you're running, these may be different). There should be a -L or
 --local switch in that file. Remove it to enable network tests.

 I have commented out this line in the spamd file and done a restart. So 
 this
 may have already helped some?
 
 I'm not sure Amvis actually uses spamd, I think it calls the SA routines 
 directly.  If so there is no actual reason to run spamc/spamd on your 
 system.  Again, one of the Amivs people will know this for sure.  There
 may 
 be an equivalent local only setting for amvis in one of its config
 files.
 
 If you start seeing hit information in your messages they will show 
 moderately well whether you are using network tests, since typically some
 of 
 the network test rule anmes should show up on almost any spam.
 
 Loren
 
 
 

-- 
View this message in context: 
http://www.nabble.com/OS-X-Server-spam-still-getting-through-%3A-%28-tf2206629.html#a6117499
Sent from the SpamAssassin - Users forum at Nabble.com.



Re: OS X Server spam still getting through :-(

2006-09-02 Thread John Andersen
On Saturday 02 September 2006 15:18, mikemacfr wrote:
 I'm a bit confused?

 I thought amavis was the virus scanner bit? And spamassassin took care of
 the spam bit?

Amavis is a router sort of.  

It takes mail from your mta, sends it thru one or more engines (spamassassin, 
antivirus, and some other more rarely used options) and then (optionally) 
hands it back to your MTA for delivery via yet another engine, procmail, 
cyrus, etc.

Its glue-ware.
-- 
_
John Andersen


pgprbiHuFQguI.pgp
Description: PGP signature