Re[8]: [Declude.JunkMail] declude / spamassassin

> Ah! I was thinking of your manual. SPAMC32 -? is it, plus the archives of this list. > Well, anyhow, I couldn't get the 'returnvalue' to work. only nonzero > seams to work. any ideas? 'returnvalue' would be better written , i.e. it's a variable -- the the return value you're watching

Re: Re[6]: [Declude.JunkMail] declude / spamassassin

Take a look: http://www.declude.com/Version/Manuals/2.0.6.asp Ah! I was thinking of your manual. Well, anyhow, I couldn't get the 'returnvalue' to work. only nonzero seams to work. any ideas? I used the following without success: SPAMASSASSIN externalreturnvalue "e:\imail\declude

Re[6]: [Declude.JunkMail] declude / spamassassin

> Can you point me to the manual please? :) I would like to see what > else can be done besides the nonzero (ham or spam). I would like to > rate how smelly the spam is :) Take a look: http://www.declude.com/Version/Manuals/2.0.6.asp --Sandy Sanford

Re: Re[4]: [Declude.JunkMail] declude / spamassassin

Sandy; There should be no _addition_ of Declude-defined weights to external test result codes! I don't even know how your test definition could be doing that. Certainly, that's not the intended use of SPAMC32. Yes, another mistake on my part. Sorry :( What's confusing you seems to be the

Re[4]: [Declude.JunkMail] declude / spamassassin

> A few more tests later, I have found the SA results of 1 to be spam, > and my global.cfg line scores a hit at 3, this 3 gets added to the > result of SA's 1 and therefore I get 4 points. There should be no _addition_ of Declude-defined weights to external test result codes! I don't even know

Re[2]: [Declude.JunkMail] declude / spamassassin

> Of course SpamAssassin has a multitude of different tests and scores > within those tests, and it isn't practical to do everything in > bitmask fashion, but I could see some utility in separating out a > bayesian test as BAYESIAN-LOW, BAYESIAN-MED and BAYESIAN-HIGH for > instance, or

Re: Re[2]: [Declude.JunkMail] declude / spamassassin

The best config I have set is: SPAMASSASSIN externalnonzero "e:\imail\declude\spamd\spamc32.exe -d 209.215.97.193 -r -lt 4 -et 6 -f" 3 0 I 'think' so far that spamassassin only reports if SA's score is 4 or more, if so, I score it a 3 on the email test. I am still playing with the values

Re: [Declude.JunkMail] declude / spamassassin

Sandy, The utility in this is that the tests failed would be centralized in one application, Delude, and available for combo tests and easier diagnosis within that framework. Of course SpamAssassin has a multitude of different tests and scores within those tests, and it isn't practical to do

Re: Re[2]: [Declude.JunkMail] declude / spamassassin

I think your external test's behavior won't be what you expect. The -et switch won't be used without the -e switch, the -lt switch won't be used without the -ht switch, and the -r switch report isn't parsed by Declude, so what you're saying is the same as if you had no special switches at

Re[2]: [Declude.JunkMail] declude / spamassassin

> I have 3k plus users getting 300k emails per day... my SA is running > on a linux server, P4 2ghz... no increase in load when I started > using SA with declude today. Well, there had to be _some_ increase -- though you may not notice it depending on your sampling interval -- since you're

Re: [Declude.JunkMail] declude / spamassassin

keith wrote: In your setup, your Declude is running on a Windows 2k/2003 box calling your SA server on a Linux box on the same local network? I guess the speeds are much the same as quering a local DNS server for lookups. Sounds great, I will have look into this, my loads are around the s

Re[2]: [Declude.JunkMail] declude / spamassassin

> I guess the speeds are much the same as quering a local DNS server > for lookups. SA advocate though I am, I can't say that's the case. The speed of a UDP DNS lookup is far faster than a SPAMC32/SPAMD TCP connection for even a tiny message, due both to UDP vs. TCP differences and th

Re[2]: [Declude.JunkMail] declude / spamassassin

> The latest Declude's support bitmasked result codes. You might > consider creating a user maintained map from tests failed in SA to > bitmapped result codes returned to Declude. I'm not sure what the > limit might be in Declude for the number of unique tests, but I have > managed to

RE: [Declude.JunkMail] declude / spamassassin

Travis, In your setup, your Declude is running on a Windows 2k/2003 box calling your SA server on a Linux box on the same local network? I guess the speeds are much the same as quering a local DNS server for lookups. Sounds great, I will have look into this, my loads are around the same f

Re[2]: [Declude.JunkMail] declude / spamassassin - topic change

> Well since you are working on the code - something that for me would > be nice is a modification to your "-e" switch. What I would like to > have happen is return the SA weight only after a threshold is met. > For example with a setting of 5 an email of 4.99 would not be > considered s

[Declude.JunkMail] critique my global.cfg file with regards to blacklist use

DSBL ip4r list.dsbl.org * 3 0 ORDB ip4r relays.ordb.org * 3 0 SPAMCOP ip4r bl.spamcop.net 127.0.0.2 3 0 SERVICESNET ip4r korea.services.net* 3 0 ORID ip4r dnsbl.antispam.or.id127.0.0.2 3 0 FABELSOURCES ip4r spamsources.fabel.dk127.0.0.2 3 0 AHBL ip4r

re: [Declude.JunkMail] Foreign Language Spam

I've seen very little specific to blocking Spanish spam. There is a blacklist at http://www.emailbasura.org/ but its effectiveness is somewhat limited. Original Message > From: "A. Clausen" <[EMAIL PROTECTED]> > Sent: Tuesday, September 20, 2005 12:48 PM > To: "Declude JunkMa

Re: [Declude.JunkMail] declude / spamassassin

Hi Keith, Keith Johnson wrote: Nick, If you don't mind, is SA heavy on the CPU? What kinda load are you running with SA? First I am no authority here but am willing to share my experience. Sandy's spamd32 seems to be no issue as near as I can tell. The cpu issue is with spamd. .I have

Re: [Declude.JunkMail] declude / spamassassin

Nick, If you don't mind, is SA heavy on the CPU? What kinda load are you running with SA? I have 3k plus users getting 300k emails per day... my SA is running on a linux server, P4 2ghz... no increase in load when I started using SA with declude today. The best config I have set is: S

Re: [Declude.JunkMail] declude / spamassassin - topic change

Anyway, the next version of SPAMC32 is coming out very soon with the ability to consult a local SPAMC32 log file (rather than the main SPAMD log file) to check which individual SA rules failed for each message; this is a definite need. Hi Sandy, Well since you are working on the co

RE: [Declude.JunkMail] declude / spamassassin

Nick, If you don't mind, is SA heavy on the CPU? What kinda load are you running with SA? We are wanting to pursue it, however, Sanford had mentioned awhile back it would be heavy on the CPU. Thanks again, Keith -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED

Re: [Declude.JunkMail] declude / spamassassin

Travis Sullivan wrote: So, the only thing I will see in the headers is the total score SA results: X-RBL-Warning: SPAMASSASSIN: Message failed SPAMASSASSIN: 3. And declude scores only for the test group, like other tests in the global.cfg file? Correct. Very slick huh? And good job gettin

Re: [Declude.JunkMail] declude / spamassassin

Sandy, The latest Declude's support bitmasked result codes.  You might consider creating a user maintained map from tests failed in SA to bitmapped result codes returned to Declude.  I'm not sure what the limit might be in Declude for the number of unique tests, but I have managed to use 16 so

Re: Re[2]: [Declude.JunkMail] declude / spamassassin

Anyway, the next version of SPAMC32 is coming out very soon with the ability to consult a local SPAMC32 log file (rather than the main SPAMD log file) to check which individual SA rules failed for each message; this is a definite need. Thanks Sandy, I just wanted to make sure I wasn't

Re[2]: [Declude.JunkMail] declude / spamassassin

> Thanks guys, I have it working now! BTW... any way to retrieve any > info from SA with regards to test failed or weight? This info is not currently used by Declude, though it is accessible when you run SPAMC32 against a message from the command line. Declude Junkmail doesn't support the us

Re: [Declude.JunkMail] Foreign Language Spam

With Declude Pro you could create a custom filter that looked for common Spanish words and triggered a failure after hitting say 5 of these words. Be careful to include spaces after each word when doing this so that they don't hit on base64 encoded content. # SPAMISH MINWEIGHTTOFAIL 5 BODY

Re: [Declude.JunkMail] declude / spamassassin

Thanks guys, I have it working now! BTW... any way to retrieve any info from SA with regards to test failed or weight? This is what I have in my logs: Msg failed SPAMASSASSIN (Message failed SPAMASSASSIN: 1.). Action=WARN All I have is a 1, that is the score I have set as the test weight, for

Re: [Declude.JunkMail] declude / spamassassin

Travis Sullivan wrote: SPAMASSASSINexternalnonzero "c:\imail\declude\spamc32.exe -cw %WEIGHT% -sw 10 -f" 0 -f is supposed to be the filename... but the example doesn't give one. So, how does spamc send a file name to spamd? Declude hands it off to it. Actually I believe the e

Re: [Declude.JunkMail] declude / spamassassin

SPAMASSASSINexternalnonzero "c:\imail\declude\spamc32.exe -cw %WEIGHT% -sw 10 -f" 0 -f is supposed to be the filename... but the example doesn't give one. So, how does spamc send a file name to spamd? Travis --- This E-mail came from the Declude.JunkMail mailing list. To un

Re: [Declude.JunkMail] declude / spamassassin

Hi Travis - [I just saw Bill Landry's post - my suggestions here relate to calling spamd with an external test. If you have spamassassin in front of imail and its tagging email forget my suggestions.. - no need to do it twice!] Travis Sullivan wrote: EXTERNAL.SPAMASSASSIN_v3.04extern

Re: [Declude.JunkMail] declude / spamassassin

The SA server is not inline with my declude server. My SA server runs on our unix machines. I want to take advantage of that system as another test for declude to score against spam. So, in order to access it, I need to know how to setup declude to use this external feature. I exported the

Re: [Declude.JunkMail] declude / spamassassin

Why would you want to do this and send the message through SA again if it's already running on your gateway? Bill - Original Message - From: "Travis Sullivan" <[EMAIL PROTECTED]> To: Sent: Tuesday, September 20, 2005 11:24 AM Subject: Re: [Declude.JunkMail] declude / spamassassin T

Re[2]: [Declude.JunkMail] declude / spamassassin

> I have spamassasin running on my unix servers. I want to use this as > an external test for my imail/declude system as an external test. A Declude external test uses filtering logic outside Declude: it sends raw envelope and/or header data to a separate filtering system from Declude and ret

Re: [Declude.JunkMail] declude / spamassassin

These are the columns in my global.cfg file, can you help me plug this in? SECURITYSAGE rhsbl blackhole.securitysage.com 127.0.0.5 3 0 (minus the word wrap, is this exactly as it needs to be entered?) what are these flags? spamc32.exe -D -d 12.152.254.3 -a 16000 -lt 4 ht 100 -f EXTERNAL.SPA

Re: [Declude.JunkMail] declude / spamassassin

Hi Travis - Sandy's plugin does the 'somehow' part. Simply have it point to your spamd. Here is the line from my global.cfg that may help - EXTERNAL.SPAMASSASSIN_v3.04externalNONZERO "e:\imail\declude\spamd\spamc32.exe -D -d 12.152.254.3 -a 16000 -lt 4 ht 100 -f" 6

Re: [Declude.JunkMail] declude / spamassassin

I have spamassasin running on my unix servers. I want to use this as an external test for my imail/declude system as an external test. Thanks, Travis - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Tuesday, September 20, 2005 12:29 PM Subject: RE: [Declude.Ju

Re: [Declude.JunkMail] declude / spamassassin

Sorry, that was a typo, remove = remote :) I am looking into your plugin now, is this plug in the only way? I simply can't just use the IP of my spamassasin server somehow? - Original Message - From: "David Barker" <[EMAIL PROTECTED]> To: Sent: Tuesday, September 20, 2005 12:29 PM S

RE: [Declude.JunkMail] declude / spamassassin

Travis not sure what you are asking with "how to use a remove" :) 1. To remove the external test just # comment out the test in your global.cfg 2. To use spamassassin I would suggest using this plugin SPAMC32 http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release / David B

[Declude.JunkMail] declude / spamassassin

I can't find documentation with regards to how to use a remove spamassassin server as an external test in declude v 1.81. Any help will be much appreciated. Thanks! Travis --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED]

[Declude.JunkMail] Foreign Language Spam

We have a customer who is getting significant amounts of Spanish spam slipping through, and I was wondering if there was any particular means of filtering this out. -- A. Clausen --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED

Re: [Declude.JunkMail] Blackholes.us Dead

You could accomplish much of the same with Junkmail Pro and COUNTRY or COUNTRIES filter. - Original Message - From: "Don Brown" <[EMAIL PROTECTED]> To: Sent: Tuesday, September 20, 2005 11:05 AM Subject: [Declude.JunkMail] Blackholes.us Dead Blackholes.us no longer resolves and it

RE: [Declude.JunkMail] Declude Beta Experience update

John, 1. I posted to let others know my experience. 2. Declude has been in touch with me regarding this. . Any other questions? Sincerely, Support Department Global Web SolutionsR, Inc. 804-346-5300 x112 877-800-GLOBAL (4562) x112 http://globalweb.net --- This E-mail came from the Declude.J

Re: [Declude.JunkMail] Blackholes.us Dead

Hi, Our public RBL doesn't provide this, but our MXRate product does allow you to get results based off the IP's country of origin. Check out http://www.mxrate.com for more information. Best Wishes, Chris Kuske Solid Oak Software www.alligate.com www.mxrate.com www.winlocate.com Don Brow

[Declude.JunkMail] Blackholes.us Dead

Blackholes.us no longer resolves and it looks like it is dead. I picked up this msg, among others, from google. Okean.com and br.countries.nerd.dk, cn.countries.nerd.dk and kr.countries.nerd.dk have been suggested. Anyone know

RE: [Declude.JunkMail] Declude Beta Experience update

Hate to be the bearer of bad news, but participating in a Beta requires active participation, meaning if you notice a problem, you need to take steps to gather information surrounding that problem. Did you read my posts about the beta, and did you take any steps that I did? The point of a public

RE: [Declude.JunkMail] Declude Beta Experience update

Let me add my specs - sorry, forgot to add on first post Windows 2000, all SP's Dual Xeon processors 2GB ram Imail 8.21 HF2 Declude Virus Std, JM Pro, & Hijack Sniffer F-Prot -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of GlobalWeb.net Webmaster S

[Declude.JunkMail] Declude Beta Experience update

After previous failed attempts to install the new beta, we waited awhile this time after the last release of the decludeproc; we tried to re-install this morning and as soon as we did, the decludeproc service jumped to 90%+ consistantly; I tried adjusting the THREADS value in the declude.cfg file,