Re: [SAtalk] strange behavior of Bayesian analyzer in SA 2.6

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 "Ben Wing" writes: >well, i get false positives with an empty body ... Yep, that's a pretty serious sign -- the header data in that message (sent from yourself, to yourself, via your own relays, right?) is being recognised as spam. Try using "spamas

Re: [SAtalk] Re: Swap Space

I'm wondering if maybe this should be default on new versions of SA? Set it by default for, say 25. The user can then set it higher or lower as needed, or to "0" for unlimited. Just a thought? I set both of my spamd machines to -m25 (about 40k messages/wk, 80% spam) and that works fine. Bo

archive or thread as mbox? (RE: [SAtalk] [RD] Popcorn, Backhair, and Weeds)

Hey folks, This may be a unusual request: Can anyone please send me a mail with the entire thread "[RD] Popcorn, Backhair, and Weeds" in mbox format (mh or maildir is fine, too)? I tried the archives, but they are unusable IMHO. Alternatively, is there a "good" archive of this list available, not

Re: [SAtalk] Re: Swap Space

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dan Wilder writes: >On Sun, Oct 19, 2003 at 12:21:52AM +, Daniel M. Drucker wrote: >> > Yes, the situation I'm talking about is lots of spamd processes running at >> > once using lots of memory. (Not to mention the local delivery processes >> > ru

Re: [SAtalk] Spamassassin updates

--On Friday, October 17, 2003 8:48 AM -0400 Chris <[EMAIL PROTECTED]> wrote: perl-Mail-SpamAssassin-2.60-1.i386.rpm spamassassin-tools-2.60-1.i386.rpm spamassassin-2.60-1.i386.rpm What does perl-Mai do? I assume all three need to be installed? SA is essentially a suite of Perl modules, with dr

Re: [SAtalk] strange behavior of Bayesian analyzer in SA 2.6

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Martin Radford writes: >At Fri Oct 17 21:17:54 2003, Ben Wing wrote: >> >> hi. i just upgraded from 2.53 to 2.6 and i'm seeing something >> rather odd about the Bayesian results: nearly every one is almost >> exactly 0%, 50%, or 100%! it's almost a

Re: [SAtalk] bayes learning "To" and "Received" headers?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Keith C. Ivey writes: > Arlo Gilbert <[EMAIL PROTECTED]> wrote: > > > it would appear from the data im seeing that bayes is learning > > the to and received headers on mails... obviously this seems a > > bit redundant and will only add to the size of

[SAtalk] Re: Swap Space

> Have you tried starting spamd with the "-m" flag to limit > the number of copies? Yes, I have -m 10. It doesn't seem to have any effect. > How much RAM are you using? Unfortunately, I wasn't keeping track. Now I am: http://3e.org/perf/ I'm hoping this'll happen again soon so I can actually se

Re: [SAtalk] documentation (was: Using SPAMD ?)

Chris <[EMAIL PROTECTED]> wrote: > Thanks. I just found that this afternoon. Interesting though, I > could have sworn that the site in question used to have a some > text on it saying "this site has been superceded by > news.spamassassin.org".. or something to that effect. I think you're referrin

Re: [SAtalk] Re: Spamassassin and pre-filtering in .procmailrc

Era, Your analysis helped, as the suggestion concerning the space caused me to cast my eye more carefully at the rules - it turned out that the problem was a second form of the address containing "djtaz01" - one that was encapsulated in angle brackets! So, of course it didn't match. I added a

Re: [SAtalk] documentation (was: Using SPAMD ?)

> Fire up a browser. Point it to http://www.spamassassin.org . Look > to the upper right of the screen. Notice it says "documentation". > Follow that link. Thanks. I just found that this afternoon. Interesting though, I could have sworn that the site in question used to have a some text on it sayi

Re: [SAtalk] Re: Swap Space

At Sun Oct 19 10:45:41 2003, Simon Byrnand wrote: > Well, the only problem is that you're allowing too many spamd's to run at > once. "40 or 50" is *WAY* too many. Even on our server with 1GB of ram I > don't allow it to run more than about 30 spamd's at once. > > Probably all thats happening is

Re: [SAtalk] CPAN or RPM's?

--On Thursday, October 16, 2003 9:42 PM -0400 Chris <[EMAIL PROTECTED]> wrote: a) deinstall the CPAN modules currently loaded b) create/install the RPM modules needed for SA, sendmail and procmail? Assuming (a) is successful, grab the distro RPM's for sendmail and procmail and install them using

[SAtalk] Re: Re: Problem with expirying bayes db

On So 19 Okt 2003 05:35:45p Theo Van Dinter wrote: > On Sat, Oct 18, 2003 at 10:23:39PM +0200, Bernd Kuhls wrote: >> The only solution I see is to delete the Bayes database and start >> from scratch:-( > > the real solution is to let more tokens get learned, and then the > expiry code can properl

RE: [SAtalk] Messages without Bayes score

Keith C. Ivey ([EMAIL PROTECTED]) replied: > That happens surprisingly often for me, too. If you look at > the definitions for the BAYES_* rules in 20_bayes.cf, you'll > see that messages with Bayes scores between 0.4999 and 0.5001 > are not tagged. When I've checked the spamd log for messag

[SAtalk] documentation (was: Using SPAMD ?)

On 2003-10-19 11:44:46 -0400, Chris wrote: > What I'm struggling with, and I think others are too, is the lack of > documentation in obvious areas, i.e. on the product homepage. Fire up a browser. Point it to http://www.spamassassin.org . Look to the upper right of the screen. Notice it says "docu

[SAtalk] MSGID_FROM_MTA_SHORT on cgi forms

Hello: The test MSGID_FROM_MTA_SHORT seems to hit on every form received from a cgi form script for all of our users. Here is a sample header it hits on: --- Received: (from [EMAIL PROTECTED]) by xxx.yyy.zzz (8.11.6/8.11.6) id h9JJOMP25529; Sun, 19 Oct 2003 15:24:22 -0400 Date: Su

Re: [SAtalk] Messages without Bayes score

Marc Steuer <[EMAIL PROTECTED]> wrote: > I've got Bayes working with SA 2.60 and occasionally, a scanned > message will not have an entry for its Bayes score in the > detailed listing of pts, rule name and description. Is this > "normal" behavior? That happens surprisingly often for me, too. If

Re: [SAtalk] lint difference in 2.60

Bob Menschel <[EMAIL PROTECTED]> wrote: > BA> /b is a word boundary; like ^ and $, it's a "zero-width > assertion", BA> looking for "a spot between two characters that > has a "\w" on one BA> side of it and a "\W" on the other side of > it" (from `perldoc perlre`) > > As a word boundary, would no

[SAtalk] upgrade to 2.60 broke SA

Hi all: I was running SA 2.5 with kmail and all was well, then I upgraded to version 2.60. Now, SA stopped pocessing incoming mail all togther. How can I correct this. I use RH 9 with all the updates. Thanks for any suggestion, and sorry if this is an FAQ, I looked but could not find the answ

[SAtalk] Messages without Bayes score

Friends, I've got Bayes working with SA 2.60 and occasionally, a scanned message will not have an entry for its Bayes score in the detailed listing of pts, rule name and description. Is this "normal" behavior? Also, some messages are given very low Bayes scores but are assessed as spam by SA wit

RE: [SAtalk] Mistake-based training

Here's the link to that Perl script for fetching spam from an Exchange Public Folder or other IMAP repository: http://marc.theaimsgroup.com/?l=spamassassin-talk&m=104806917615490&w=2 - dan -- Dan Kohn -Original Message- From

Re: [SAtalk] Check whitelist

The permissions most likely aren't OK. Are you running the "check_whitelist" command as root? If not, you probably have no access to the /root directory. Jim Knuth wrote: Hallo SA-List, I wont use the tool "check_whitelist". When I use the command: ./check_whitelist | grep [EMAIL PROTECTED

RE: [SAtalk] Easy way to join two Bayes databases?

I cannot speak as an expert on this score, but my understanding is that a "combination" of such Bayesian databases would likely do more harm than good because the residual spam corpus that would get through the general SA filtering would be very specific to the recipient. That is, combining databa

[SAtalk] Re: Spamassassin and pre-filtering in .procmailrc

On Sat, 18 Oct 2003 09:54:00 -0700, Rob Tow <[EMAIL PROTECTED]> posted to the spamassassin-talk list: > I am trying to pre-filter a bit in .promailrc, to catch some > addressed names within my domain and totally get rid of them (for > test purposes I'm sending them to a file, but really want the

Re: [SAtalk] lint difference in 2.60

Hello Bob, Saturday, October 18, 2003, 9:04:18 AM, you responded to my query: >> > spamassassin --lint >> returns with no errors on the two 2.55 systems. However, starting with >> the migration to 2.60 on the third system, lint with the same user_prefs >> gives: >> > Quantifier unexpected on zero

[SAtalk] Bayes error when running sa-learn - FIXED!

I just thought I'd let you know how I fixed a bayes error that I was getting when running sa-learn --dump Use of uninitialized value in numeric lt (<) at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/BayesStore.pm line 1281. 0.000 0 0 0 non-token data: bayes db versi

Re: [SAtalk] Using SPAMD ?

Dan, > Client/server is a concept it sounds like Chris (apologies if I > attribute part of the above to the wrong person) may not have run into. Thanks for the compliment that I'm too young to have known about client/server, but unfortunately I'm old enough to have been in the industry when the m

Re: [SAtalk] Mistake-based training

> i use postfix with sa and procmail to delivier the mails local to the > outlook 2000 clients. > my problem now is: > how can i report a false negative from an outlook client to sa? > in the faq i've seen the the posibility to forward the message with > If you're using IMAP, you could make each u

Re: [SAtalk] Check whitelist

Hallo und Guten Tag Patrick, am Sonntag, 19. Oktober 2003, 17:27:52, schriebst Du: > The permissions most likely aren't OK. Are you running the > "check_whitelist" command as root? If not, you probably have no access > to the /root directory. I know this: SA Version 2.60 There are 2 files i

Re: [SAtalk] Re: Problem with expirying bayes db

On Sat, Oct 18, 2003 at 10:23:39PM +0200, Bernd Kuhls wrote: > The only solution I see is to delete the Bayes database and start from > scratch:-( the real solution is to let more tokens get learned, and then the expiry code can properly function. the sa-learn "EXPIRATION" section talks about th

Re: [SAtalk] bayes learning "To" and "Received" headers?

I've done a little examination of the Bayes data for my own site (which hasn't built up to full size yet) to see whether "To" and "Received" tokens are useful. "To" tokens that are good spam indicators include "WEBMASTER" (in all caps) and the username for a nonexistent address which has appar

[SAtalk] Check whitelist

Hallo SA-List, I wont use the tool "check_whitelist". When I use the command: ./check_whitelist | grep [EMAIL PROTECTED] than comes: server1:~/tools# ./check_whitelist | grep [EMAIL PROTECTED] Cannot open file /root/.spamassassin/auto-whitelist: The permissions are ok. What`s wrong? -- Vi

RE: [SAtalk] How to filter this?

On Sat, 18 Oct 2003, Dan Kohn wrote: > Of course, if you really just want to stop spam from ournames.com, then > add the line "blacklist_from [EMAIL PROTECTED]" to your user_prefs. Or if you run the mail system, block ournames.com at the MTA level. They seem to be quite relentless. I have them b

Re: [SAtalk] Re: Swap Space

>> Yes, the situation I'm talking about is lots of spamd processes running >> at >> once using lots of memory. (Not to mention the local delivery processes >> running at the same time as well) >> >> Spamd using 800MB of ram is a bug, and one which I've never encountered >> yet in months of using sp

[SAtalk] Mistake-based training

hello; i use postfix with sa and procmail to delivier the mails local to the outlook 2000 clients. my problem now is: how can i report a false negative from an outlook client to sa? in the faq i've seen the the posibility to forward the message with > (double-click to open the mail in its own wi

RE: Re[2]: [SAtalk] BAYES_* no longer appear in logs

Thanks, I got it working. Apparently the files in the .spamassassin directory had their permissions altered. I'm not sure if I or a script did it but it seems to be fixed. Thanks again for helping me. -Original Message- From: Abigail Marshall [mailto:[EMAIL PROTECTED] Sent: Thursday, Octo

Re: [SAtalk] Re: adding SPAM hits score to headers

Nancy McGough <[EMAIL PROTECTED]> wrote: > I have a related question: How can I have _HITS_ display only > one digit after the decimal point. For example, instead of 8.42 > just display 8.4? It's fine if I need to edit the code and > recompile SA. Look in PerMsgStatus.pm for the lines like this (

[SAtalk] Easy way to join two Bayes databases?

My personal Bayes database is more up-to-date than a co-worker's. I'd like to share the database with him, but since he likely also has Bayes entries which are unique to his own mix of ham and spam, I was wondering if there might be some tool/trick for merging the databases? Is this a meaningful o

RE: [SAtalk] Auto learning and manual blacklists

> I have a pretty > comprehensive (and paranoid) list of blacklisted from > addresses that I *know* will only send spam. > > Is there any way I configure SA such that these will be used > to train the bayes? Make a custom header rule for the domain, and score it with a crazy amount of points.

[SAtalk] Auto learning and manual blacklists

I realise that I am not the first to bring this up, however I couldn't find the answer anywhere. I appreciate that this is not the default behaviour (and I know why) but I really want to feed any mails that match a manual blacklist into the bayesian filter. I have a pretty comprehensive (and paran

[SAtalk] child spamds sitting around forever

(Running 2.60) I'm having a problem where sometimes I end up with dozens of spamds taking 100% CPU, driving my load average up to 50 or so. Anyone else see this? -- Daniel Drucker / [EMAIL PROTECTED] --- This SF.net email sponsored by: Enter

[SAtalk] Re: autolearn=no, no awl, no syslog entries

Hi Some follow up: More searching implied that for specifying a global path for auto-whitelist an additional .../auto-whitelist needs to be appended to the path, eg: /root/.spamassassin/auto-whitelist/auto-whitelist and, sure enough, the file is now created. It's still not being used, thoug

Re: [SAtalk] Re: RCVD_IN_DYNABLOCK

>> I wasn't even aware that this notfirsthop argument existed; as far as I can >> tell in a few minutes of testing, the argument has no effect. >> I've had to disable all dynamic-IP RBLs because of this problem... > Out of curiosity, what method do you use to feed your email into > SpamAssassin? D

[SAtalk] Local user rules.

Hi, We are going to support some other small businesses by hosting their email. They are inumdated with spam, and are crying UNCLE!!! What I need to know is, for the whole machine I will probably ratchet down my rules a bit to make certain that most things are being marked correctly and that s

Re: [SAtalk] Re: [AMaViS-user] SA 2.60 and amavisd-new - more bayes issues?

On Fri, 17 Oct 2003 09:44:09 +0200, you wrote: >Stewart, John schrieb am Mittwoch, 15. Oktober 2003 um 14:02:31 -0500: >> >> I finally got around to installing 2.60 today in my system, running it with >> amavisd-new (which I also bumped up to the latest, 20030616. >> >> I'm very happy that the b

Re: [SAtalk] X-Transfer-number and X-Transfer-stamp ?

At Mon Oct 13 22:13:08 2003, Peter Kiem wrote: > > Does ANYONE know if X-Transfer-number and X-Transfer-stamp are > > 1) Valid in normal email use? Their presence doesn't violate any of the standards for mail, however being "X-" headers their meaning is not defined in those standards. > 2) Wort

Re: [SAtalk] Re: Swap Space

On Sun, Oct 19, 2003 at 12:21:52AM +, Daniel M. Drucker wrote: > > Yes, the situation I'm talking about is lots of spamd processes running at > > once using lots of memory. (Not to mention the local delivery processes > > running at the same time as well) > > > > Spamd using 800MB of ram is a b

Re: [SAtalk] strange behavior of Bayesian analyzer in SA 2.6

At Fri Oct 17 21:17:54 2003, Ben Wing wrote: > > hi. i just upgraded from 2.53 to 2.6 and i'm seeing something > rather odd about the Bayesian results: nearly every one is almost > exactly 0%, 50%, or 100%! it's almost as if it's applying an > extreme rounding function to the actual result. now

Re: [SAtalk] Using SPAMD ?

On Sun, Oct 19, 2003 at 05:03:15AM -0300, Marc G. Fournier wrote: > > > On Sat, 18 Oct 2003, Chris wrote: > > > > Then you'll want to change your procmail file to call spamc instead of > > > spamassassin. (It's faster to include the full path to spamc by the way) > > > > OK, so by calling spamc

RE: [SAtalk] Mistake-based training

Simplest thing I've found is to have users move the entire item to a Public Folder, you can then use something like mozilla/netscape to get the folder in mbox format which can be learned quite easily. regards, Paul > -Original Message- > From: Dan Kohn [mailto:[EMAIL PROTECTED] > Sent: 19

Re: [SAtalk] bayes learning "To" and "Received" headers?

Arlo Gilbert <[EMAIL PROTECTED]> wrote: > it would appear from the data im seeing that bayes is learning > the to and received headers on mails... obviously this seems a > bit redundant and will only add to the size of the bayes db, > without contributing anything (maybe even harming the learning?

Re: [SAtalk] Using SPAMD ?

On Sat, 18 Oct 2003, Chris wrote: > > Then you'll want to change your procmail file to call spamc instead of > > spamassassin. (It's faster to include the full path to spamc by the way) > > OK, so by calling spamc does it call the running spamd in the background? > Can someone explain the relati

[SAtalk] Re: adding SPAM hits score to headers

On 17 Oct 2003 Keith C. Ivey ([EMAIL PROTECTED]) wrote: > Diego Puppin <[EMAIL PROTECTED]> wrote: > > > I would like to have my spam emails tagged as: > > > > **SPAM** (score) Subject > > Look at the "tagging" section in the Conf documentation. I use > > subject_tag *SPAM(_HITS_)* > > The score e

RE: [SAtalk] Spamassassin updates

Hi Matt, I really don't know. If you do, you would find them in: /usr/share/doc/spamassassin-tools-2.xx (whatever your vers ## is) --Larry > -Original Message- > From: Matt Van Gordon [mailto:[EMAIL PROTECTED] > Sent: Friday, October 17, 2003 12:55 PM > To: 'Larry Gilson'; '[EMAI

[SAtalk] Mistake-based training

hello together; i use postfix with sa and procmail to delivier the mails local to the outlook 2000 clients. my problem now is: how can i report a false negative from an outlook client to sa? in the faq i've seen the the posibility to forward the message with (double-click to open the mail in it

[SAtalk] SA eating up my headers

I have some strange problem. whenever I run the sendmail command from an php script and have spamassassin activated my email headers get changed to something like this: snip Received: from localhost [127.0.0.1] by mail.server.com with SpamAssassin (2.60 1.212-2003-09-23-exp); Sun,

RE: [SAtalk] Mistake-based training

Outlook (when used with Exchange) sucks in this regard. I wrote up my experiences at . The simple answer is that the training is still useful even with much of the original header being lost. It's just not as effective as it could be. - da

Re: [SAtalk] lint difference in 2.60

Hi, On Fri, 17 Oct 2003 11:00:18 -0700 Robert Menschel <[EMAIL PROTECTED]> wrote: > I manage three domains which are hosted on three different servers by the > same hosting company, all of which use SpamAssassin. Last night, one of > the servers was migrated from SA 2.55 to SA 2.60 > > I am usin

[SAtalk] Mistake-based training

hello together; i use postfix with sa and procmail to delivier the mails local to the outlook 2000 clients. my problem now is: how can i report a false negative from an outlook client to sa? in the faq i've seen the the posibility to forward the message with (double-click to open the mail in its

Re: [SAtalk] Using SPAMD ?

> Looks like you really need to go back and actually read the docs, and > readme file etc, and come back and have another go. spamassassin is > spamassassin. spamc is spamc. That's actually part of the problem. I've had a hard time finding anything I can read except the readme's and the perldoc.

RE: [SAtalk] How to filter this?

After feeding this spam to sa-learn --spam (I got several copies as well), it's now caught solely by Bayes (which is 5.2, plus Spamcop has now blacklisted it for an extra 1.5). For those using procmail to filter and then forwarding to a non-Unix mail reader, I wrote up a short summary of how to se