SA not picking up rules from /var/lib/spamassassin/
I'm using SA 3.2.5 and sa-update but SA doesn't seem to be picking rules up from /var/lib/spamassassin/ The rules are present: -bash-3.2$ ls -Rl1h /var/lib/spamassassin/ /var/lib/spamassassin/: total 4.0K drwxr-xr-x 3 root root 4.0K Jan 2 04:40 3.002005 /var/lib/spamassassin/3.002005: total 8.0K drwxr-xr-x 2 root root 4.0K Jan 6 07:05 updates_spamassassin_org -rw-r--r-- 1 root root 2.4K Jan 2 04:40 updates_spamassassin_org.cf /var/lib/spamassassin/3.002005/updates_spamassassin_org: total 1.4M -rw-r--r-- 1 root root 5.6K Jan 2 04:40 10_default_prefs.cf -rw-r--r-- 1 root root 7.4K Jan 2 04:40 20_advance_fee.cf -rw-r--r-- 1 root root 6.7K Jan 2 04:40 20_body_tests.cf -rw-r--r-- 1 root root 1.9K Jan 2 04:40 20_compensate.cf -rw-r--r-- 1 root root 14K Jan 2 04:40 20_dnsbl_tests.cf -rw-r--r-- 1 root root 15K Jan 2 04:40 20_drugs.cf -rw-r--r-- 1 root root 11K Jan 2 04:40 20_dynrdns.cf -rw-r--r-- 1 root root 8.1K Jan 2 04:40 20_fake_helo_tests.cf -rw-r--r-- 1 root root 25K Jan 2 04:40 20_head_tests.cf -rw-r--r-- 1 root root 11K Jan 2 04:40 20_html_tests.cf -rw-r--r-- 1 root root 5.2K Jan 2 04:40 20_imageinfo.cf -rw-r--r-- 1 root root 3.3K Jan 2 04:40 20_meta_tests.cf -rw-r--r-- 1 root root 2.5K Jan 2 04:40 20_net_tests.cf -rw-r--r-- 1 root root 8.0K Jan 2 04:40 20_phrases.cf -rw-r--r-- 1 root root 2.1K Jan 2 04:40 20_porn.cf -rw-r--r-- 1 root root 16K Jan 2 04:40 20_ratware.cf -rw-r--r-- 1 root root 5.4K Jan 2 04:40 20_uri_tests.cf -rw-r--r-- 1 root root 19K Jan 2 04:40 20_vbounce.cf -rw-r--r-- 1 root root 2.6K Jan 2 04:40 23_bayes.cf -rw-r--r-- 1 root root 1.6K Jan 2 04:40 25_accessdb.cf -rw-r--r-- 1 root root 1.6K Jan 2 04:40 25_antivirus.cf -rw-r--r-- 1 root root 1.6K Jan 2 04:40 25_asn.cf -rw-r--r-- 1 root root 1.3K Jan 2 04:40 25_dcc.cf -rw-r--r-- 1 root root 2.2K Jan 2 04:40 25_dkim.cf -rw-r--r-- 1 root root 2.1K Jan 2 04:40 25_domainkeys.cf -rw-r--r-- 1 root root 2.9K Jan 2 04:40 25_hashcash.cf -rw-r--r-- 1 root root 1.3K Jan 2 04:40 25_pyzor.cf -rw-r--r-- 1 root root 3.4K Jan 2 04:40 25_razor2.cf -rw-r--r-- 1 root root 7.5K Jan 2 04:40 25_replace.cf -rw-r--r-- 1 root root 2.9K Jan 2 04:40 25_spf.cf -rw-r--r-- 1 root root 1.8K Jan 2 04:40 25_textcat.cf -rw-r--r-- 1 root root 7.5K Jan 2 04:40 25_uribl.cf -rw-r--r-- 1 root root 29K Jan 2 04:40 30_text_de.cf -rw-r--r-- 1 root root 22K Jan 2 04:40 30_text_fr.cf -rw-r--r-- 1 root root 1.9K Jan 2 04:40 30_text_it.cf -rw-r--r-- 1 root root 23K Jan 2 04:40 30_text_nl.cf -rw-r--r-- 1 root root 19K Jan 2 04:40 30_text_pl.cf -rw-r--r-- 1 root root 3.3K Jan 2 04:40 30_text_pt_br.cf -rw-r--r-- 1 root root 46K Jan 2 04:40 50_scores.cf -rw-r--r-- 1 root root 1.3K Jan 2 04:40 60_awl.cf -rw-r--r-- 1 root root 2.8K Jan 2 04:40 60_shortcircuit.cf -rw-r--r-- 1 root root 4.9K Jan 2 04:40 60_whitelist.cf -rw-r--r-- 1 root root 2.5K Jan 2 04:40 60_whitelist_dk.cf -rw-r--r-- 1 root root 2.6K Jan 2 04:40 60_whitelist_dkim.cf -rw-r--r-- 1 root root 3.6K Jan 2 04:40 60_whitelist_spf.cf -rw-r--r-- 1 root root 1.9K Jan 2 04:40 60_whitelist_subject.cf -rw-r--r-- 1 root root 53K May 21 2007 70_sare_adult.cf -rw-r--r-- 1 root root 45K Dec 27 2005 70_sare_genlsubj0.cf -rw-r--r-- 1 root root 376K Oct 27 2008 70_sare_header.cf -rw-r--r-- 1 root root 8.0K May 21 2006 70_sare_header_eng.cf -rw-r--r-- 1 root root 28K Jun 4 2006 70_sare_html0.cf -rw-r--r-- 1 root root 3.1K Jun 4 2006 70_sare_html_eng.cf -rw-r--r-- 1 root root 51K Jun 4 2007 70_sare_obfu0.cf -rw-r--r-- 1 root root 13K Dec 27 2005 70_sare_oem.cf -rw-r--r-- 1 root root 18K Dec 12 2005 70_sare_random.cf -rw-r--r-- 1 root root 96K May 28 2006 70_sare_specific.cf -rw-r--r-- 1 root root 62K Jan 1 07:00 70_sare_stocks.cf -rw-r--r-- 1 root root 25K Nov 12 2005 70_sare_unsub.cf -rw-r--r-- 1 root root 95K Jan 2 04:40 72_active.cf -rw-r--r-- 1 root root 831 Jan 2 04:40 72_removed.cf -rw-r--r-- 1 root root 13K May 21 2007 72_sare_bml_post25x.cf -rw-r--r-- 1 root root 16K May 16 2006 72_sare_redirect_post3.0.0.cf -rw-r--r-- 1 root root 1.4K Jan 2 04:40 72_scores.cf -rw-r--r-- 1 root root 5.2K Jan 2 04:40 80_additional.cf -rw-r--r-- 1 root root 10K Jun 2 2005 99_sare_fraud_post25x.cf -rw-r--r-- 1 root root 187 Jan 2 04:40 MIRRORED.BY -bash-3.2$ Can anyone advise what the problem might be and what diagnosis I can perform? Thanks, Geoff
Re: SA not picking up rules from /var/lib/spamassassin/
geoff.spamassass...@alphaworks.co.uk wrote: I'm using SA 3.2.5 and sa-update but SA doesn't seem to be picking rules up from /var/lib/spamassassin/ Can anyone advise what the problem might be and what diagnosis I can perform? The output of 'spamassassin --lint -D' might shed some light.
Re: SA not picking up rules from /var/lib/spamassassin/
geoff.spamassass...@alphaworks.co.uk wrote on Wed, 13 Jan 2010 11:59:11 +: I'm using SA 3.2.5 and sa-update but SA doesn't seem to be picking rules up from /var/lib/spamassassin/ Well, you listed a lot, but not any proof for what you think it *seems* not to do. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com
Re: SA not picking up rules from /var/lib/spamassassin/
On Wed, Jan 13, 2010 at 8:53 AM, Geoff Soper geoff.m...@alphaworks.co.uk wrote: I've now added the saupdates.openprotect.com channel which contains recommended SAREs rules and all is working! I thought I read that no one should be using openprotect as it's hoplessly out of date. ?? -- -ste
Re: SA not picking up rules from /var/lib/spamassassin/
On 13/01/2010 13:46, Jason Bertoch wrote: geoff.spamassass...@alphaworks.co.uk wrote: I'm using SA 3.2.5 and sa-update but SA doesn't seem to be picking rules up from /var/lib/spamassassin/ Can anyone advise what the problem might be and what diagnosis I can perform? The output of 'spamassassin --lint -D' might shed some light. I was a little ahead of you there, I noticed that only the default rules from /var/lib/spamassassin/3.002005/updates_spamassassin_org were being loaded; the SAREs rules were not. I then realised this was because the SAREs rules were not included in /var/lib/spamassassin/3.002005/updates_spamassassin_org.cf which makes sense as the SAREs rules would not be published via the updates.spamassassin.org channel. It seems that the person who set this up has manually put the SAREs rules in the /var/lib/spamassassin/3.002005/updates_spamassassin_org directory without realising how it all worked. I've now added the saupdates.openprotect.com channel which contains recommended SAREs rules and all is working! Thanks, Geoff
Re: SA not picking up rules from /var/lib/spamassassin/
On 13/01/2010 14:02, Shaun T. Erickson wrote: On Wed, Jan 13, 2010 at 8:53 AM, Geoff Soper geoff.m...@alphaworks.co.uk wrote: I've now added the saupdates.openprotect.com channel which contains recommended SAREs rules and all is working! I thought I read that no one should be using openprotect as it's hoplessly out of date. ?? Ah, is there a better way to get SARE rules? I note the the SARE site says they are no longer published but I'm not sure if that just relates to that site's action of collating them or whether it means all the authors no longer publish their rules. Thanks, Geoff
Re: SA not picking up rules from /var/lib/spamassassin/
geoff.spamassass...@alphaworks.co.uk wrote: On 13/01/2010 14:02, Shaun T. Erickson wrote: On Wed, Jan 13, 2010 at 8:53 AM, Geoff Soper geoff.m...@alphaworks.co.uk wrote: I've now added the saupdates.openprotect.com channel which contains recommended SAREs rules and all is working! I thought I read that no one should be using openprotect as it's hoplessly out of date. ?? Ah, is there a better way to get SARE rules? I note the the SARE site says they are no longer published but I'm not sure if that just relates to that site's action of collating them or whether it means all the authors no longer publish their rules. No, that's the best way to get SARE rules. However, most are either outdated or already incorporated into SA. My update channels currently include: updates.spamassassin.org sought.rules.yerp.org 90_2tld.cf.sare.sa-update.dostech.net /Jason
Re: SA not picking up rules from /var/lib/spamassassin/
Jason Bertoch wrote: geoff.spamassass...@alphaworks.co.uk wrote: On 13/01/2010 14:02, Shaun T. Erickson wrote: On Wed, Jan 13, 2010 at 8:53 AM, Geoff Soper geoff.m...@alphaworks.co.uk wrote: I've now added the saupdates.openprotect.com channel which contains recommended SAREs rules and all is working! I thought I read that no one should be using openprotect as it's hoplessly out of date. ?? Ah, is there a better way to get SARE rules? I note the the SARE site says they are no longer published but I'm not sure if that just relates to that site's action of collating them or whether it means all the authors no longer publish their rules. No, that's the best way to get SARE rules. However, most are either outdated or already incorporated into SA. My update channels currently include: updates.spamassassin.org sought.rules.yerp.org 90_2tld.cf.sare.sa-update.dostech.net Apologies, I was confusing openprotect with dostech. It's my understanding that the dostech servers are most appropriate for SARE rules.
Re: SA not picking up rules from /var/lib/spamassassin/
Thanks for that, can you point me in the direction of some info on the 90_2tld.cf.sare.sa-update.dostech.net channel? I found http://taint.org/2007/08/15/004348a.html in relation to sought.rules.yerp.org Thanks, Geoff On 13/01/2010 14:35, Jason Bertoch wrote: Jason Bertoch wrote: geoff.spamassass...@alphaworks.co.uk wrote: On 13/01/2010 14:02, Shaun T. Erickson wrote: On Wed, Jan 13, 2010 at 8:53 AM, Geoff Soper geoff.m...@alphaworks.co.uk wrote: I've now added the saupdates.openprotect.com channel which contains recommended SAREs rules and all is working! I thought I read that no one should be using openprotect as it's hoplessly out of date. ?? Ah, is there a better way to get SARE rules? I note the the SARE site says they are no longer published but I'm not sure if that just relates to that site's action of collating them or whether it means all the authors no longer publish their rules. No, that's the best way to get SARE rules. However, most are either outdated or already incorporated into SA. My update channels currently include: updates.spamassassin.org sought.rules.yerp.org 90_2tld.cf.sare.sa-update.dostech.net Apologies, I was confusing openprotect with dostech. It's my understanding that the dostech servers are most appropriate for SARE rules.
Re: SA not picking up rules from /var/lib/spamassassin/
geoff.spamassass...@alphaworks.co.uk wrote: Thanks for that, can you point me in the direction of some info on the 90_2tld.cf.sare.sa-update.dostech.net channel? I found http://taint.org/2007/08/15/004348a.html in relation to sought.rules.yerp.org Info is included in the file itself: # util_rb_2tld 2tld-1.tld 2tld-2.tld ... # This option allows the addition of new 2nd-level TLDs (2TLD) to # the RegistrarBoundaries code. Updates to the list usually happen # when new versions of SpamAssassin are released, but sometimes # it's necessary to add in new 2TLDs faster than a release can # occur. 2TLDs include things like co.uk, fed.us, etc.
Re: SA not picking up rules from /var/lib/spamassassin/
On Wed 13 Jan 2010 02:53:13 PM CET, Geoff Soper wrote saupdates.openprotect.com channel which contains recommended SAREs rules and all is working! outdated sare rules is not recommended, and openprotect do care ? :) if you update sare rules via sa-update it would work, if you do some other bad things you are on your own -- xpoint http://www.unicom.com/pw/reply-to-harmful.html
Re: SA not picking up rules from /var/lib/spamassassin/
On 13/01/2010 15:03, Benny Pedersen wrote: On Wed 13 Jan 2010 02:53:13 PM CET, Geoff Soper wrote saupdates.openprotect.com channel which contains recommended SAREs rules and all is working! outdated sare rules is not recommended, and openprotect do care ? :) if you update sare rules via sa-update it would work, if you do some other bad things you are on your own OK, I'm slightly confused as to what the advice is here. Is there consensus on SAREs? Should I still use them (via the channel list described at http://wiki.apache.org/spamassassin/SareChannels ) or is it better not to use them? I get the impression that there is consensus on the OpenProtect channel being a bad thing. I'll certainly add sought.rules.yerp.org and 90_2tld.cf.sare.sa-update.dostech.net to updates.spamassassin.org as suggested by Jason. Thanks, Geoff
Re: SA not picking up rules from /var/lib/spamassassin/
Geoff Soper wrote: OK, I'm slightly confused as to what the advice is here. Is there consensus on SAREs? Should I still use them (via the channel list described at http://wiki.apache.org/spamassassin/SareChannels ) or is it better not to use them? I get the impression that there is consensus on the OpenProtect channel being a bad thing. I'll certainly add sought.rules.yerp.org and 90_2tld.cf.sare.sa-update.dostech.net to updates.spamassassin.org as suggested by Jason. I don't believe the general consensus is that SARE rules are *bad*, they are just outdated or already incorporated, and may cause unnecessary additional overhead or false positives. Your best bet is to look at the rule list [1], note the last modified date, and see if any of them might still apply to your spam. You can always add rules, adjust the scores, and see what happens but I think most people don't use them anymore. [1] http://rulesemporium.com/rules/?C=M;O=A
Re: SA not picking up rules from /var/lib/spamassassin/
On Wed 13 Jan 2010 04:11:45 PM CET, Geoff Soper wrote I'll certainly add sought.rules.yerp.org and 90_2tld.cf.sare.sa-update.dostech.net to updates.spamassassin.org as suggested by Jason. delete all files in the 3.2.5 sa update dir, use sa-update again so all sa-update rules gets loaded, problem you see it mostly that openprotect did not delete the old rules in the sa-update dir, if you want to use them move them to /etc/maail/spamassassin never touch sa-update files otherwise, if you find thay dont work delete the sa-update dir and redo a new sa-update to get latest rules from the channel(s) again but life continues as seen on http://www.rulesemporium.com/ :) -- xpoint http://www.unicom.com/pw/reply-to-harmful.html
Re: SA not picking up rules from /var/lib/spamassassin/
On Wed, Jan 13, 2010 at 10:11 AM, Geoff Soper geoff.m...@alphaworks.co.uk wrote: OK, I'm slightly confused as to what the advice is here. Is there consensus on SAREs? Should I still use them (via the channel list described at http://wiki.apache.org/spamassassin/SareChannels ) or is it better not to use them? I get the impression that there is consensus on the OpenProtect channel being a bad thing. I have been using the list here, with good results. Of the two groups of rules he lists, I regularly update the first group and only updated the second group once (just to get them - they aren't updated any more, so no point in pulling them regularly): http://khopesh.com/wiki/Anti-spam -- -ste