RE: [SAtalk] Scaling problem FreeBSD 4.4

2002-01-18 Thread Matt Sergeant
> -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] > > Matt Sergeant said: > > > > Basically a spam-check may take up to 10 seconds per mail, so > > > sendmail should run only a certain number of concurrent deliveries > > > (20 or so?) and wait for them to complete

[SAtalk] Problems installing Spamassassin 1.5

2002-01-18 Thread Chris Visser
Hi, I'm trying to install Spamassassin on my linux box and get this error message. I searched the archives for this error and found that someone suggested that you delete the spamassassin.cf file, but I don't have one. So if anybody knows how to get around this any help would be appreciated. mk

Re: [SAtalk] Counting the spam filtered

2002-01-18 Thread Craig Hughes
Assuming you're using spamd, and have syslogging ending up in /var/log/mail/info, and you're smart enough to deal with rotating logfiles, etc: fgrep -c 'identified spam' /var/log/mail/info for the number of spams identified and fgrep -c 'clean message' /var/log/mail/info for the num

RE: [SAtalk] Scaling problem FreeBSD 4.4

2002-01-18 Thread Charlie Watts
On Fri, 18 Jan 2002, Matt Sergeant wrote: > Yes, it was the network accesses. We've re-done Razor in-house anyway > (sorry, but we can't release that code, which is a shame because it > kicks razor's butt - does n-way replication and multi-tiered servers), > and will be removing all the DNS check

[SAtalk] latest 2.0 broke this morning?

2002-01-18 Thread Jason
I updated this morning and hit a snag. The top most from in the mail header isn't being passed through now. For example this is the complete header... Return-Path: <[EMAIL PROTECTED]> Received: from wkrp.com (wkrp.com [199.6.32.180]) by wkrp.com (8.11.6/8.11.6) with ESMTP id g0IE5r3246

[SAtalk] procmail, vpopmail, site-wide spam to a single folder

2002-01-18 Thread Andrew Kohlsmith
I'm setting up another mail system and I'd like to be able to deliver the site-wide spam to a single maildir, while letting everything else get delivered by vpopmail. So far I've been unsuccessful because Procmail seems to want to either deliver everything or nothing; it doesn't (or rather I d

RE: [SAtalk] procmail, vpopmail, site-wide spam to a single folder

2002-01-18 Thread CertaintyTech - Ed Henderson
> I'm setting up another mail system and I'd like to be able to deliver the > site-wide spam to a single maildir, while letting everything else get > delivered by vpopmail. > > So far I've been unsuccessful because Procmail seems to want to > either deliver > everything or nothing; it doesn't (or

RE: [SAtalk] procmail, vpopmail, site-wide spam to a single folder

2002-01-18 Thread CertaintyTech - Ed Henderson
> First make sure you have added the "seek.diff" patch to vpopmail so that > vdeliver can accept multiple pipes. Next change bottom of procmailrc to: > Forgot to mention the link to the vpopmail seek patch: http://www.thesafebox.com/ Here is the discussion regarding it: http://bluedot.net/m

Re: [SAtalk] procmail, vpopmail, site-wide spam to a single folder

2002-01-18 Thread Andrew Kohlsmith
> I have been using this for about a week now and it works fine. Thank you, this works beautifully. I had failed to mention that I did have the seek patch already too. :-) Now to get the SQL implementation going with my modified spamc and a quick CGI for the users to turn on/off their filter

RE: [SAtalk] procmail, vpopmail, site-wide spam to a single folder

2002-01-18 Thread CertaintyTech - Ed Henderson
> Thank you, this works beautifully. I had failed to mention that > I did have > the seek patch already too. :-) > > Now to get the SQL implementation going with my modified spamc > and a quick CGI > for the users to turn on/off their filtering. Oh yes, and a cron > job so that > we only keep t

[SAtalk] Latest CVS Broken

2002-01-18 Thread Michael Huttinger
Hello, Apparently the latest CVS snapshot I got (as of 8:00 AM CST this morning) is broken. Any mails processed by SA are getting the initial From clause (not the From: part of the mail message) stripped out from it, causing grief in our mailboxes. I have rolled back to the last CVS I was using

RE: [SAtalk] Bug in NoMailAudit.pm for Spamassassin 2.0

2002-01-18 Thread thelton
Title: RE: [SAtalk] Bug in NoMailAudit.pm for Spamassassin 2.0 This is on a spamd/spamc setup using qmail and qmail scanner, which then forwards the mail to a mirapoint virus scanning server, which if it finds a "From" header at the beginning of the line, will MANGLE the header. Thanks --

[SAtalk] Custom Spam rules

2002-01-18 Thread thelton
We have writing some custom spam rules, and would like your input   We originally wrote some of these when a blatantly obvious spam came in with a score of 0   If you could, run them against your mail, and see if it triggers any false positives..     Thanks   header CUSTOM_FREE_HD 

[SAtalk] repeated-scanning

2002-01-18 Thread Olivier M.
Hello and thanks for spamassassin! :) I discovered your package yesterday on the vmailmgr mailing list, and I'm now using it with qmail+qmail-scanner: works great! Now a little suggestion (but maybe it's already corrected): I have messages which are travelling twice on the server, and it's then

Re: [SAtalk] repeated-scanning

2002-01-18 Thread Theo Van Dinter
On Fri, Jan 18, 2002 at 08:42:30PM +0100, Olivier M. wrote: > Now a little suggestion (but maybe it's already corrected): > I have messages which are travelling twice on the server, > and it's then scanned twice, so spams are getting two or event > three *SPAM* in their Subject. Shouldn't

Re: [SAtalk] repeated-scanning

2002-01-18 Thread Olivier M.
On Fri, Jan 18, 2002 at 02:53:09PM -0500, Theo Van Dinter wrote: > On Fri, Jan 18, 2002 at 08:42:30PM +0100, Olivier M. wrote: > > three *SPAM* in their Subject. Shouldn't SA check if > > there is already a "X-Spam-Flag" line in the headers, and > > skip the mail if it's the case ? :) > >

Re: [SAtalk] repeated-scanning

2002-01-18 Thread dman
On Fri, Jan 18, 2002 at 02:53:09PM -0500, Theo Van Dinter wrote: | On Fri, Jan 18, 2002 at 08:42:30PM +0100, Olivier M. wrote: | > Now a little suggestion (but maybe it's already corrected): | > I have messages which are travelling twice on the server, | > and it's then scanned twice, so spams are

[SAtalk] detecting faked headers pretending to be from Hotmail

2002-01-18 Thread Jim Meyering
Thanks for spamassassin! Has anyone begun converting the procmail rules here http://alcor.concordia.ca/topics/email/auto/procmail/spam/reasons/ In particular, there is one that just got through spamassassin-2.0 but that was caught by this rule from the tag-radical set at the above URL: [FYI,

Re: [SAtalk] Scaling problem FreeBSD 4.4

2002-01-18 Thread Justin Mason
Charlie Watts said: > If we can't get RMS, we can just send the .mp3 of him singing. They'll > cave in, I'm sure ... Oh my ghod, the GNU Song. Anything but that! ;) --j. ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforg

Re: [SAtalk] Bug in NoMailAudit.pm for Spamassassin 2.0

2002-01-18 Thread Justin Mason
[EMAIL PROTECTED] said: > This is on a spamd/spamc setup using qmail and qmail scanner, which then > forwards the mail to a mirapoint virus scanning server, which if it finds a > "From" header at the beginning of the line, will MANGLE the header. OK -- we have several people using spamc/spamd w

Re: [SAtalk] repeated-scanning

2002-01-18 Thread Justin Mason
"Olivier M." said: > not if a md5 hash or any ID field that identify a spamassassin copy > would be added to the X-Spam-Flag field or anywhere... What do you > think? wouldn't work -- the spammers could just run SpamAssassin, get the hash, and then do the mail-out. However it would be possible

Re: [SAtalk] detecting faked headers pretending to be from Hotmail

2002-01-18 Thread Bob Proulx
> # Hotmail messages have Originating-IP, except mail from abuse/policy. > :0 Hf > * ^From:.*@hotmail\.com\> > * ! ^From:.*\<(postmaster|abuse|policy)@hotmail\.com\> > * ! ^X-Originating-IP: \[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\] > | formail -b -f -A "$trash_header ordinary hotmail invalid

Re: [SAtalk] Bug in NoMailAudit.pm for Spamassassin 2.0

2002-01-18 Thread Craig Hughes
That sounds emminently reasonable, since it's easier to delete the line (with formail or tail +2 or whatever) than add it, and we didn't have enough command line options in spamc anyway :) C On Fri, 2002-01-18 at 19:35, Justin Mason wrote: [EMAIL PROTECTED] said: > This is on a spam

Re: [SAtalk] detecting faked headers pretending to be from Hotmail

2002-01-18 Thread Thomas Hurst
* Bob Proulx ([EMAIL PROTECTED]) wrote: > > # Hotmail messages have Originating-IP, except mail from abuse/policy. > > :0 Hf > > * ^From:.*@hotmail\.com\> > > * ! ^From:.*\<(postmaster|abuse|policy)@hotmail\.com\> > > * ! ^X-Originating-IP: \[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\] > > | for

[SAtalk] why did this trigger?

2002-01-18 Thread dman
A legit message triggered the FROM_FORGED_HOTMAIL test. The header is From: Linda Macdonald <[EMAIL PROTECTED]> What properites of it make you think it is forged? The test appears to match any hotmail address, legit or not (though I don't really know what the "=~" operator does). -D

Re: [SAtalk] why did this trigger?

2002-01-18 Thread Jason Kohles
On Fri, Jan 18, 2002 at 11:20:29PM -0500, dman wrote: > > A legit message triggered the > FROM_FORGED_HOTMAIL > test. The header is > From: Linda Macdonald <[EMAIL PROTECTED]> > > What properites of it make you think it is forged? The test appears > to match any hotmail address, legit

Re: [SAtalk] why did this trigger?

2002-01-18 Thread dman
On Fri, Jan 18, 2002 at 11:22:30PM -0500, Jason Kohles wrote: | On Fri, Jan 18, 2002 at 11:20:29PM -0500, dman wrote: | > | > A legit message triggered the | > FROM_FORGED_HOTMAIL | > test. The header is | > From: Linda Macdonald <[EMAIL PROTECTED]> | > | > What properites of it make y

[SAtalk] added -F flag

2002-01-18 Thread Justin Mason
This controls whether (1) or not (0) a "From " line is required in the output. Default is 1, because that seems to work better for a greater number of people ;) Added to both spamd and spamassassin. --j. -- 'Justin Mason' => { url => 'http://jmason.org/', blog => 'http://taint.org/' } __

Re: [SAtalk] why did this trigger?

2002-01-18 Thread Jason Kohles
On Fri, Jan 18, 2002 at 11:38:48PM -0500, dman wrote: > On Fri, Jan 18, 2002 at 11:22:30PM -0500, Jason Kohles wrote: > | On Fri, Jan 18, 2002 at 11:20:29PM -0500, dman wrote: > | > > | > A legit message triggered the > | > FROM_FORGED_HOTMAIL > | > test. The header is > | > From: Linda

[SAtalk] false positives

2002-01-18 Thread mike castleman
I installed SpamAssassin about a week ago and really love it. However, I seem to be getting a (presumably) unusally high number of false positives. I'm up to 21 in the past week, on an input of 1540 messages. (Damn, I am on too many mailing lists.) This is about 1.3%, which is almost an order of m

Re: [SAtalk] false positives

2002-01-18 Thread Bob Proulx
> I seem to be getting a (presumably) unusally high number of false > positives. I'm up to 21 in the past week, on an input of 1540 > messages. (Damn, I am on too many mailing lists.) This is about 1.3%, I think the list wisdom goes with whitelisting mailing lists. But then you lose the ability