Re: Testing SpamAssassin
gayle...@eircom.net schrieb am 13. Mai 2014 um 12:56 +0200: >When I send email from my laptop (using KMail) >containing the string in the above URL, >I simply get a message saying >- >Failed to transport message. >The message content was not accepted. >The server responded: "Message refused" >- > Hi. This means your outgoing mailserver rejects the email because it is classified as spam. Try to send directly to your own mailserver. gtube is just a string that SA will always consider as Spam and score your mail as spam - so you can see if your SA installation works. kind regards, Toni Schornboeck
Re: Testing SpamAssassin
On Wed, 2014-05-14 at 11:38 +0100, Timothy Murphy wrote:
> [tim@grover ~]$ sa-learn --dump magic
>
> 0.000 0 3 0 non-token data: bayes db version
> 0.000 0 25758 0 non-token data: nspam
> 0.000 0 36434 0 non-token data: nham
> 0.000 0 144860 0 non-token data: ntokens
That sure is sufficient training (number of spam and ham messages, and
individual tokens learned).
The amount of ham might possibly skew results. But to see weather bayes
scores are biased towards hamminess, we'd need the X-Spam headers --
which I will not ask you a third time for.
> 0.000 0 1390675205 0 non-token data: oldest atime
> 0.000 0 1400062502 0 non-token data: newest atime
> 0.000 0 1400049904 0 non-token data: last journal sync atime
Last db access and journal sync times are recent, from today. Everything
looking fine.
If you still suspect Bayes to not work properly, you'll have to provide
more details.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Testing SpamAssassin
On Mon, 2014-05-12 at 11:33 +0100, Timothy Murphy wrote:
> I'm not sure if SA is working properly on my CentOS-6.5 server.
> :0fw:spamassassin.lock
> * < 256000
> | /usr/bin/spamc
This adds some X-Spam headers to all messages less than 256 kByte in
size, both spam and ham. The headers include details like SA version
(primarily meant for debugging), as well as overall score and a list of
SA rules hit, besides some more info.
These headers should tell you if (and how) SA is working. If you need
assistance interpreting them, feel free to paste a few sample headers.
> :0:
> * ^X-Spam-Status: Yes
> /home/tim/Maildir/.Spam/new
This delivery recipe works, if it is an existing directory, though the
preferred way of specifying a maildir directory is to end the path with
a "/" slash. Procmail will take care about using tmp/ and new/ itself.
> I'm assuming that this is sufficient?
Looks fine, yes.
> But how can I check that SA is working properly?
Your question is slightly confusing. Does spam get delivered to your
dedicated spam maildir? If so, wouldn't that qualify for "working
properly"?
To differentiate various shades of "properly", the X-Spam headers will
show some details. Those headers also can be used to verify SA being
called without waiting for spam, since they are added to ham, too.
> Any and all advice or suggestions gratefully received,
> including pointers to helpful documentation.
man procmailrc, last paragraph of section "Recipe action line" for the
maildir delivery bit. ;)
Official documentation, in particular the Conf document, as well as
spamc and sa-learn docs in this specific case.
http://spamassassin.apache.org/full/3.3.x/doc/
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Testing SpamAssassin
> On Tuesday, May 13, 2014 12:56:45 AM Karsten Bräckelmann wrote: On the server run the following command as user tim, to get some details about number of messages learned and if it has been learned recently. sa-learn --dump magic Thanks again for your response. I get the following: - [tim@grover ~]$ sa-learn --dump magic 0.000 0 3 0 non-token data: bayes db version 0.000 0 25758 0 non-token data: nspam 0.000 0 36434 0 non-token data: nham 0.000 0 144860 0 non-token data: ntokens 0.000 0 1390675205 0 non-token data: oldest atime 0.000 0 1400062502 0 non-token data: newest atime 0.000 0 1400049904 0 non-token data: last journal sync atime 0.000 0 1395943229 0 non-token data: last expiry atime 0.000 05529600 0 non-token data: last expire atime delta 0.000 0 23237 0 non-token data: last expire reduction count -- Timothy Murphy e-mail: gayleard /at/ eircom.net School of Mathematics, Trinity College, Dublin 2, Ireland
Re: Testing SpamAssassin
On Tue, 2014-05-13 at 12:22 +0100, Timothy Murphy wrote:
> On Tuesday, May 13, 2014 12:56:45 AM Karsten Bräckelmann wrote:
> Thanks for your response.
> I think my problem lies with sa-learn, not with SpamAssassin itself.
On the server run the following command as user tim, to get some details
about number of messages learned and if it has been learned recently.
sa-learn --dump magic
> Some email is sent to my spam folder ~/Maildir/.Spam .
> But I also send email that gets through but which I don't want
^^
> to the same folder, and I see no evidence that sa-learn
> learns anything from this.
>
> The two sources of email in the .Spam folder are roughly equal in
> number.
Wait, by you "sending email" to that spam folder, you are referring to
moving or copying mail on your IMAP server, right? Point being, actual
sending (read forwarding or replying) will alter the message in ways it
becomes useless for Bayes training.
Regarding evidence that sa-learn is correctly learning from your corpus,
the above command's output will be helpful.
As would be the X-Spam headers I pointed out before. In particular the
Status one will show the Bayesian classifier result and auto-learning
information. (Hint: paste a few samples.)
Given this thread so far, my gut feeling is insufficient training. Is
this a new setup? By default, bayes needs to be trained a minimum of 200
spam and ham messages each, to kick in. Again, the output of the above
command will tell us.
> > Those headers also can be used to verify SA being
> > called without waiting for spam, since they are added to ham, too.
>
> I'm not sure what you mean here.
> Where is ham stored, or used?
In your Inbox. Ham refers to non-spam, wanted mail.
> Incidentally, am I alone if thinking the ezmlm program
> used by this mailing list is manifestly inferior to mailman?
> Eg it does not seem possible to reply on the gmane newsgroup
> as it is with mailman lists.
> Or have I misunderstood this in some way?
As an ASF project, I'll gladly take the service the ASF infra team
offers, instead of hosting my own list and SMTP server...
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Testing SpamAssassin
On 5/13/2014 6:56 AM, Timothy Murphy wrote: On Monday, May 12, 2014 11:13:53 AM Bowie Bailey wrote: > Send a gtube message to one of your email addresses. If SA is working > properly, it should be delivered to your spam folder. > > http://spamassassin.apache.org/gtube/ I'm sorry, I have no idea what this test does, or is supposed to do. When I send email from my laptop (using KMail) containing the string in the above URL, I simply get a message saying - Failed to transport message. The message content was not accepted. The server responded: "Message refused" - As far as I can see this message was never seen, or processed, by SpamAssassin (running on my server, not my laptop). It does not appear in the spam folder on my server. What you are doing is sending a message with a string that will cause SA to flag it as spam. This is a standard test to determine if SA is working properly. SA should mark the message as spam. What happens to it after that depends on your setup. If I read your config correctly, it looks like it is supposed to be sent to a spam folder. Based on the error message you copied, it looks like something else in the mail stream caught the string and refused the email before it made it to SA. Try sending the message directly to the server if possible. What I do for testing is set up a new mail account with the outgoing server set to send directly to the new server. Then send a message from that account. You can use this same setup with the EICAR string to test your anti-virus program as well. -- Bowie
Re: Testing SpamAssassin
On Monday, May 12, 2014 11:13:53 AM Bowie Bailey wrote: > Send a gtube message to one of your email addresses. If SA is working > properly, it should be delivered to your spam folder. > > http://spamassassin.apache.org/gtube/ I'm sorry, I have no idea what this test does, or is supposed to do. When I send email from my laptop (using KMail) containing the string in the above URL, I simply get a message saying - Failed to transport message. The message content was not accepted. The server responded: "Message refused" - As far as I can see this message was never seen, or processed, by SpamAssassin (running on my server, not my laptop). It does not appear in the spam folder on my server. -- Timothy Murphy e-mail: gayleard /at/ eircom.net School of Mathematics, Trinity College, Dublin 2, Ireland
Re: Testing SpamAssassin
On Tue, 13 May 2014, Timothy Murphy wrote: On Monday, May 12, 2014 11:13:53 AM Bowie Bailey wrote: Send a gtube message to one of your email addresses. If SA is working properly, it should be delivered to your spam folder. http://spamassassin.apache.org/gtube/ I'm sorry, I have no idea what this test does, or is supposed to do. The GTUBE string is always given a very high score. If your antispam system is working, any message containing that string should always be treated as spam. When I send email from my laptop (using KMail) containing the string in the above URL, I simply get a message saying - Failed to transport message. The message content was not accepted. The server responded: "Message refused" - That looks like you've configured your system for SMTP-time scanning and rejection if the score is high enough. This is different than accepting all messages, scanning them, and then deciding which mailbox to deliver them to based on their score. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- Rights can only ever be individual, which means that you cannot gain a right by joining a mob, no matter how shiny the issued badges are, or how many of your neighbors are part of it. -- Marko --- 712 days since the first successful private support mission to ISS (SpaceX)
Re: Testing SpamAssassin
On Tuesday, May 13, 2014 12:56:45 AM Karsten Bräckelmann wrote:> On Mon, > > I'm not sure if SA is working properly on my CentOS-6.5 server. > > > But how can I check that SA is working properly? > > Your question is slightly confusing. Does spam get delivered to your > dedicated spam maildir? If so, wouldn't that qualify for "working > properly"? Thanks for your response. I think my problem lies with sa-learn, not with SpamAssassin itself. Some email is sent to my spam folder ~/Maildir/.Spam . But I also send email that gets through but which I don't want to the same folder, and I see no evidence that sa-learn learns anything from this. The two sources of email in the .Spam folder are roughly equal in number. > Those headers also can be used to verify SA being > called without waiting for spam, since they are added to ham, too. I'm not sure what you mean here. Where is ham stored, or used? > > Any and all advice or suggestions gratefully received, > > including pointers to helpful documentation. > > man procmailrc, last paragraph of section "Recipe action line" for the > maildir delivery bit. ;) Thanks, that was useful. > Official documentation, in particular the Conf document, as well as > spamc and sa-learn docs in this specific case. > > http://spamassassin.apache.org/full/3.3.x/doc/ I'll look at that, but it is a bit excessive. Incidentally, am I alone if thinking the ezmlm program used by this mailing list is manifestly inferior to mailman? Eg it does not seem possible to reply on the gmane newsgroup as it is with mailman lists. Or have I misunderstood this in some way? -- Timothy Murphy e-mail: gayleard /at/ eircom.net School of Mathematics, Trinity College, Dublin 2, Ireland
Testing SpamAssassin
I'm not sure if SA is working properly on my CentOS-6.5 server. I've a rather old setup on the machine, not using postfix, but running dovecot to read the mail on laptop or android. I collect email with fetchmail from various servers. My .procmailrc ends with -- :0fw:spamassassin.lock * < 256000 | /usr/bin/spamc :0: * ^X-Spam-Status: Yes /home/tim/Maildir/.Spam/new -- I run sa-learn daily with the setting: -- #!/bin/sh /usr/bin/sa-learn --spam /home/tim/Maildir/.Spam/cur /bin/rm -f /home/tim/Maildir/.Spam/cur/* -- I'm assuming that this is sufficient? But how can I check that SA is working properly? [I should mention that this is on a remote server. I actually run amavis + postfix + SA on my home server, and this is working fine. But I don't want to set this up in absentia on the remote server.] Any and all advice or suggestions gratefully received, including pointers to helpful documentation. -- Timothy Murphy e-mail: gayleard /at/ eircom.net School of Mathematics, Trinity College, Dublin 2, Ireland
Re: Testing SpamAssassin
On 5/12/2014 6:33 AM, Timothy Murphy wrote: I'm not sure if SA is working properly on my CentOS-6.5 server. I've a rather old setup on the machine, not using postfix, but running dovecot to read the mail on laptop or android. I collect email with fetchmail from various servers. My .procmailrc ends with -- :0fw:spamassassin.lock * < 256000 | /usr/bin/spamc :0: * ^X-Spam-Status: Yes /home/tim/Maildir/.Spam/new Send a gtube message to one of your email addresses. If SA is working properly, it should be delivered to your spam folder. http://spamassassin.apache.org/gtube/ -- Bowie
Re: Testing SpamAssassin
gayle...@eircom.net schrieb am 12. Mai 2014 um 12:33 +0200: >But how can I check that SA is working properly? Spamassassin and ClamAV for that matter have Test Signatures you can use to test the setup. For Spamassasin see http://spamassassin.apache.org/gtube/ kind regards, Toni Schornboeck
Re: Testing SpamAssassin
On Mon, 2014-05-12 at 11:33 +0100, Timothy Murphy wrote: > Any and all advice or suggestions gratefully received, > including pointers to helpful documentation. > I use a similar mail collection chain to your remote set-up except that: - I use getmail rather than fetchmail to collect email from my ISP. Unlike fetchmail, getmail doesn't leave read but undeleted mail to fester in the ISP's mailbox. Its only drawback, if it is one, is that getmail is run periodically as a cronjob while fetchmail has a built-in wait loop. - I use an MDA script that is basically a pipeline. Its content is: spamc | spamkiller --> sendmail to filter the incoming mail and deliver the ham to Postfix for distribution. The same MDA script worked without modification when I replaced fetchmail with getmail. The '-->' is meant to show that spamkiller executes sendmail each time it has a piece of ham to deliver, rather than using a simple pipeline. - spamkiller is mine: a C program that accepts spamc output and, depending on the score, stuffs it into a quarantine directory or hands it to sendmail for delivery to Postfix. As the program spamkiller uses for onward delivery is specified and configured as part of the spamkiller command line in the MDA script, anything else is easily substituted. Quarantining spam is optional: it can also be configured to discard spam. Either way, it logs the fate of each message. - spamkiller 1.3.4 is available as a tarball that also includes a variety of support scripts should you want to try it. These include quarantine management scripts and logwatch extensions for spam reporting. The tarball is downloadable from the 'Free' page at www.libelle-systems.com - if it looks old that's because I haven't needed to make changes for some time. Martin
Re: testing spamassassin,sa-learn not work
On Thu, 17 Dec 2009, Khanh Truong wrote: I created a sample message, then tell spamassassin to learn it as spam with the command #sa-learn --spam spamtest.txt then I tried the command #spamc < spamtest.txt but spamassassin still scored it as non-spam. Am I doing something wrong? Please help! Training a message as spam does not guarantee the next time the exact same message is seen that it will be scored as spam. It's not a "poison pill" tool. Training a message as spam tells SA that messages that look similar to the trained messages will be scored "more spammy" than they otherwise would be. This may push the overall score past a threshold. Three things you need to look at: (1) Have you trained enough spam _and_ ham messages to give the bayes database enough to work with to make decisions? Run "sa-learn --dump magic" and verify that you have at least 200 spam _and_ 200 ham tokens. (2) What was the bayes score on the message the first time you passed it through SA for scoring, _before_ using it for training? (3) What was the bayes score on the message when you passed it through SA for scoring _after_ training? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never does quite what I want. I wish Christopher Robin was here." -- Peter da Silva in a.s.r --- 8 days until Christmas
testing spamassassin,sa-learn not work
Hi, I created a sample message, then tell spamassassin to learn it as spam with the command #sa-learn --spam spamtest.txt then I tried the command #spamc < spamtest.txt but spamassassin still scored it as non-spam. Am I doing something wrong? Please help! Here is my spamtest.txt (based on GTUBE): Subject: Test spam mail (GTOBE) Message-ID: Date: Wed, 23 Jul 2003 23:30:00 +0200 From: Sender To: Recipient Precedence: junk MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit rwo*moiseimfos.oiamf*ifomie*ioefs-fnoianee-fpqo-noi-afes-afesf*e.34rm http://www.cometomystore.com
RE: Testing Spamassassin with the mail command
StarkRavingCalm wrote: > Bowie, > Thank you for the reply. What I would like to do is to test it by > letting it pass thru so I can see how it would arrive in the user's > inbox. Then configure the MTA to accept and deliver mail for a test user and send him some mail. You can send the mail either using the "mail" command line utility or by connecting directly to the server from Thunderbird or some other mail program. As long as your DNS servers don't have any (non-test) MX records pointing to your new mail server, it won't affect your real mail traffic. -- Bowie
RE: Testing Spamassassin with the mail command
Vince, Thanks for your reply. Here is what I am looking for: I have built a new server to replace one of our internal mail relays, it is configured to use ClamAV and Spamassassin. Before I make the switch, I want to make sure that everything is working as I would like it and the switch will be transparent to users. Now, I am not very familiar with SA, but examples I have seen so a lot of re-writing in the subject etc... I would like to test it so that I can see a piece of mail marked as Spam but delivered to a user so that I can see what the email will look like when it comes thru. This way I can tweak it if I need to. Ultimately using the mail command would be best. Rich -Original Message- From: Vincent Fleming [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 24, 2007 1:54 PM To: StarkRavingCalm; Subject: RE: Testing Spamassassin with the mail command OK Everyone - Send him your SPAM!!! ;-) Just kidding... I'm not sure what you're looking for from us. Please be more specific. By the way, I use Sendmail as well, and find the spamass-milter to be a great way to link in spamassassin. Also, the blacklists are very effective. If you need any assistance with the sendmail.mc entries required, email me back. Regards, Vince -Original Message- From: StarkRavingCalm [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 24, 2007 11:23 AM To: users@spamassassin.apache.org Subject: Testing Spamassassin with the mail command Hello. I am new to SpamAssasin. I have configured my new Sendmail server to use Spamassassin and have tested with the usual commands: spamassassin -D < /usr/share/doc/spamassassin-3.1.8/sample-spam.txt I want to test how the messages will look when delivered, so I can tweak that. Thanks in advance! -- View this message in context: http://www.nabble.com/Testing-Spamassassin-with-the-mail-command-tf36393 90.html#a10163382 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
RE: Testing Spamassassin with the mail command
OK Everyone - Send him your SPAM!!! ;-) Just kidding... I'm not sure what you're looking for from us. Please be more specific. By the way, I use Sendmail as well, and find the spamass-milter to be a great way to link in spamassassin. Also, the blacklists are very effective. If you need any assistance with the sendmail.mc entries required, email me back. Regards, Vince -Original Message- From: StarkRavingCalm [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 24, 2007 11:23 AM To: users@spamassassin.apache.org Subject: Testing Spamassassin with the mail command Hello. I am new to SpamAssasin. I have configured my new Sendmail server to use Spamassassin and have tested with the usual commands: spamassassin -D < /usr/share/doc/spamassassin-3.1.8/sample-spam.txt I want to test how the messages will look when delivered, so I can tweak that. Thanks in advance! -- View this message in context: http://www.nabble.com/Testing-Spamassassin-with-the-mail-command-tf36393 90.html#a10163382 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
RE: Testing Spamassassin with the mail command
Bowie, Thank you for the reply. What I would like to do is to test it by letting it pass thru so I can see how it would arrive in the user's inbox. Thanks Bowie Bailey wrote: > > StarkRavingCalm wrote: >> Hello. >> I am new to SpamAssasin. I have configured my new Sendmail server to >> use Spamassassin and have tested with the usual commands: >> spamassassin -D < /usr/share/doc/spamassassin-3.1.8/sample-spam.txt >> >> I want to test how the messages will look when delivered, so I can >> tweak that. > > spamassassin < testmessage.txt > or > spamc < testmessage.txt > > Output will be the modified message. > > -- > Bowie > > -- View this message in context: http://www.nabble.com/Testing-Spamassassin-with-the-mail-command-tf3639390.html#a10165180 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
RE: Testing Spamassassin with the mail command
StarkRavingCalm wrote: > Hello. > I am new to SpamAssasin. I have configured my new Sendmail server to > use Spamassassin and have tested with the usual commands: > spamassassin -D < /usr/share/doc/spamassassin-3.1.8/sample-spam.txt > > I want to test how the messages will look when delivered, so I can > tweak that. spamassassin < testmessage.txt or spamc < testmessage.txt Output will be the modified message. -- Bowie
Testing Spamassassin with the mail command
Hello. I am new to SpamAssasin. I have configured my new Sendmail server to use Spamassassin and have tested with the usual commands: spamassassin -D < /usr/share/doc/spamassassin-3.1.8/sample-spam.txt I want to test how the messages will look when delivered, so I can tweak that. Thanks in advance! -- View this message in context: http://www.nabble.com/Testing-Spamassassin-with-the-mail-command-tf3639390.html#a10163382 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: testing spamassassin
Steven Lamb wrote: > I have a corpus of email and have been trying to get good metrics on it. I > have run the messages through with spamassassin -t but this only adds stuff > onto the ends of all of my messages. is there any way to get a summary of > the test. i.e. how many are spam how many are ham average score so on so > forth. or ever have it separate my messages into different folders. I know > this is a newbie-ish question but I am indeed a newbie. If you unpack the source tarball, there's a directory called "masses". This contains the tools used by the developers to perform mass-checks. You'll want to use mass-check first. http://wiki.apache.org/spamassassin/MassCheck from there, feed the spam.log and ham.log files to "hit-frequencies" which will generate a table just like the STATISTICS-*.txt files that come with SA (check the rules subdir of the tarball). http://wiki.apache.org/spamassassin/HitFrequencies
testing spamassassin
I have a corpus of email and have been trying to get good metrics on it. I have run the messages through with spamassassin -t but this only adds stuff onto the ends of all of my messages. is there any way to get a summary of the test. i.e. how many are spam how many are ham average score so on so forth. or ever have it separate my messages into different folders. I know this is a newbie-ish question but I am indeed a newbie. I am running spamassassin version 3.0.4-1.fc4, on redhat fedora core 4 with amavisd-new and clam-av thanks in advance for any help you can provide
