Re: [SAtalk] RegEx Question

Robert Menschel <[EMAIL PROTECTED]> wrote: > CE> How can I match the following: "s\.ex" and "se\.x" and > "s\.e\.x" but CE> not "sex" without including all the possible > permutations? Is there CE> an elegant solution? > > Would /\bs\.?e\.?x\b/ work? No, because that matches "sex". But this w

Re: [SAtalk] RegEx Question

My obfuscation script can do the dirty work for ya... http://sandgnat.com/cmos/ . Click the link to the live rule generator and try: BODY /\bsex\b/ Make sure to check "match obfu only". (the trick is the negative look-ahead) HTH, Chris P.S. lotsa Chris's around here,eh? Theo Van Dinter said: > O

Re: [SAtalk] RegEx Question

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Christopher, Tuesday, November 4, 2003, 5:34:53 PM, you wrote: CE> I am pretty good at regex, but am stumped by this seemingly easy problem: CE> How can I match the following: "s\.ex" and "se\.x" and "s\.e\.x" but CE> not "sex" without includi

Re: [SAtalk] RegEx Question

er, I mean you should try... BODY SEX /\bsex\b/ ...if you want it to do stuff (gotta name the rule) Chris Chris Thielen said: > My obfuscation script can do the dirty work for ya... > http://sandgnat.com/cmos/ . > Click the link to the live rule generator and try: > BODY /\bsex\b/ > Make sure to

Re: [SAtalk] Did SA crash? SA 2.60 entirely skipped a few messages.

On Tue, Nov 04, 2003 at 06:13:25PM -0500, David A. Roth is rumored to have said: > > I found several messages today which were entirely skipped by SA 2.60. > The odd thing is, those addresses in the To: line had previously been > blacklisted on my site. So this is very puzzling, and the headers

Re: [SAtalk] Some rules for scoring Bulk Mailers

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Carlos, Tuesday, November 4, 2003, 9:57:12 AM, you wrote: CJS> Hi all, CJS> I'm just a newbie in writing rules for spamassassin, but here are CJS> some rules i've write. CJS> Please give me your feedback, if they're ok, not ok, why... I ran

Re: [SAtalk] Am I nuts

On Mon, Nov 03, 2003 at 04:14:13PM -0600, Chris Barnes is rumored to have said: > > I turned SA off in Mailscanner, letting it handle just > the the running of ClamAV. SA is still being called by procmail. > > Q: Is it just a "wierd way"? Not weird to me - it's how I do it. I prefer separate to

Re: [SAtalk] [RD] excessive table tags

On Tue, 4 Nov 2003, Charles Gregory wrote: > On Tue, 4 Nov 2003, Colin A. Bartlett wrote: > > I have a rule challenge for you all. > > How can we write a rule to catch messages like the one attached? > > body LOC_BRMASK > /( ?|.){1,5}( ?|.){1,5}( ?|.){1,5}/i > describe LOC_BRMASK Masking BR

Re: [SAtalk] [RD] excessive table tags

On Tue, 4 Nov 2003, David B Funk wrote: > > body LOC_BRMASK > > /( ?|.){1,5}( ?|.){1,5}( ?|.){1,5}/i > Um, does the 'body' class work or do you need to use 'rawbody' to > "see" the unprocessed HTML? Heh. Heh. "Oops." (grin) You're quite right. Should be 'rawbody'. I actually had it right in

[SAtalk] Re: Avoid Double check

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tuesday, November 4, 2003, 6:11:18 AM, Colin responded to Carlos Jorge: CAB> That all depends on how you are calling SA. If you are using CAB> procmail, as I and many others are, you could right a simple CAB> procmail recipe that checked for the prese

RE: [SAtalk] Rule Emporium Update!

Chris Santerre Sent: Tuesday, November 04, 2003 3:15 PM > Take a good look at the rules in this update. There are some really great > ones, some that are version specific, and some for antivirus. Also the > evilrules are now SCALABLE!!! Did you really want sourceforge.net in the evil rules? rawb

Re: [SAtalk] Can't get add_header to work in 2.60

At 06:36 PM 11/4/2003, Dennis Duval wrote: I have tried to use the add_header feature in /etc/mail/spamassassin/local.cf with no luck. It does not write the added header at all. However the local.cf file is being processed, because I can change required_hits and it has an effect. This is the con

Re: [SAtalk] RegEx Question

On Tue, Nov 04, 2003 at 05:34:53PM -0800, Christopher Eykamp wrote: > How can I match the following: "s\.ex" and "se\.x" and "s\.e\.x" but not > "sex" without including all the possible permutations? Is there an elegant > solution? Well, I have two thoughts on this. 1) you're trying to do some

Re: [SAtalk] which folder?

Hallo und guten Morgen Edward, danke für die Email, die Du am 05.11.2003 um 02:15 schriebst - you wrote: > Jim Knuth wrote: >> of course, I use Debian too. Why read SA in two folders (configs)? >> What is with /etc/mail/spamassassin/local.cf ? Ignore? Can I delete this? > No, you cannot delete

Re: [SAtalk] How to balance spamd max children?

On Tue, 4 Nov 2003, Steven W. Orr wrote: > My ISP went down, so when it came back up aqnd my secondary mx record > kicked it all back to me I got a lot of messages from sendmail saying > > Nov 4 06:58:26 saturn spamd[952]: hit max-children limit (5): waiting for > some to exit > > I bumped it up

[SAtalk] RegEx Question

I am pretty good at regex, but am stumped by this seemingly easy problem: How can I match the following: "s\.ex" and "se\.x" and "s\.e\.x" but not "sex" without including all the possible permutations? Is there an elegant solution? Thanks, Chris

RE: [SAtalk] Rule Emporium Update!

Chris Santerre Sent: Tuesday, November 04, 2003 4:42 PM > THe idea is that you WILL stop more spam in total if you share them. > Sorry, I got a little excited! Share your rules! My rules are attached. Here's the story behind them. Over the past month I got about 15 FN's in my personal account tha

Re: [SAtalk] which folder?

Jim Knuth wrote: of course, I use Debian too. Why read SA in two folders (configs)? What is with /etc/mail/spamassassin/local.cf ? Ignore? Can I delete this? No, you cannot delete that, since /etc/mail/spamassassin is a symlink to ../spamassassin # ls -l /etc/mail/spamassassin lrwxrwxrwx1 ro

Re: [SAtalk] Can't get add_header to work in 2.60

Dennis Duval wrote: I have tried to use the add_header feature in /etc/mail/spamassassin/local.cf with no luck. It does not write the added header at all. However the local.cf file is being processed, because I can change required_hits and it has an effect. It works absolutely fine here, with SA

[SAtalk] Procmail rule to delete spam on a per user basis.

Change \[Possible Spam\] to whatever the pattern in your spam mail subject should be make sure you escape any special characters. To delete a customers spam automatically create a blank file in the customers home directory. This could be handled via CGI script if necessary. Thanks to John Hardin (

Re: [SAtalk] This may be completely impossible but Its worth a shot.

Paul Hirschorn wrote: > I just completed my full blown install of spam assassasin and was very > happy with the results. I am using it as a mail gateway in front of > my exchange 5.5 server. My problem is that I have a user who > absolutely needs/wants the ability to maintain his own whitelists.

Re: [SAtalk] THIRD request: Someone please help with AWL oddness

> I've read all three of your posts.. and don't have any suggestions to help > you.. it looks like a bug to me. OK, I've opened bug #2734 on it... > What really makes me wonder is why the ip=none entry exists at all. > > Have you been doing something like spamassassin --add-addr-to-whitelist? >

[SAtalk] Problem with SpamAssassin and Postfix 2

Hi: I work with postfix 2.0, RH 8.0, and SpamAssassin 2.60, My master.cf is seeting like this: smtp inet n - n - 1000smtpd -o content_filter=spamfilter: spamfilter unix - n n - - pipe flags=Rq user=spam argv=/usr/sbin/spamfilter.sh ${sender} ${recipient} My script =/usr/sbin/spamfilter.

[SAtalk] Can't get add_header to work in 2.60

I'm a new spamassassin user, and I'm still trying to get the kinks out of my install of spamassassin 2.60. I'm trying to configure it for system-wide treatment of spam only, no individual user_prefs yet. I have tried to use the add_header feature in /etc/mail/spamassassin/local.cf with no luck.

Re: [SAtalk] which folder?

Hallo und guten Morgen Edward, danke für die Email, die Du am 05.11.2003 um 00:16 schriebst - you wrote: > Jim Knuth wrote: >> Hallo und guten Abend SA-List, >> >> which folder to the read the config is used? >> >> local.cf in /etc/mail/spamassassin or >> local.cf in /etc/spamassassin or >>

Re: [SAtalk] This may be completely impossible but Its worth a shot.

Paul Hirschorn wrote: I just completed my full blown install of spam assassasin and was very happy with the results. I am using it as a mail gateway in front of my exchange 5.5 server. My problem is that I have a user who absolutely needs/wants the ability to maintain his own whitelists. Is

Re: [SAtalk] [RD] excessive table tags

I came up with another idea to tackle these, I really liked that spam, you can say it inspired me because it too slipped past my SA rules! full FVGT_rb_WICKED_SPAM_12 /.{1,2}.{1,2}.{1,2}.{0,400}<\/td>/is describe FVGT_rb_WICKED_SPAM_12 Hide message with large complex tables 1-2 score FVGT_rb_WIC

Re: [SAtalk] FW: sa-learn via email

I wrote a little bash script right after I got amavisd+spamassassin running on the system here so I could forward email and have it learned as either spam or ham. I'm the only one that uses it though, I don't trust users on the system here to be able to differentiate between true spam and ham.

[SAtalk] Did SA crash? SA 2.60 entirely skipped a few messages.

I found several messages today which were entirely skipped by SA 2.60. The odd thing is, those addresses in the To: line had previously been blacklisted on my site. So this is very puzzling, and the headers look as though they never went through SA at all. I saved on of the messages raw, then F

Re: [SAtalk] which folder?

Jim Knuth wrote: Hallo und guten Abend SA-List, which folder to the read the config is used? local.cf in /etc/mail/spamassassin or local.cf in /etc/spamassassin or user_prefs in /.spamassassin/ ?? On my system (Debian) the configs are read from: /etc/spamassassin/*.cf ~/.spamassassin/user_pr

[SAtalk] This may be completely impossible but Its worth a shot.

I just completed my full blown install of spam assassasin and was very happy with the results. I am using it as a mail gateway in front of my exchange 5.5 server. My problem is that I have a user who absolutely needs/wants the ability to maintain his own whitelists. Is there any way someone has

Re: [SAtalk] THIRD request: Someone please help with AWL oddness

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: >I'm going to take a wild stab at this, but the AWL is NOT IP specific. It >only goes by the from, not IP. I think it takes the "average" (I know it >isn't an average.) score from all the records it has of it. No, it *is* IP s

[SAtalk] [RD] excessive table tags

On Tue, 4 Nov 2003, Colin A. Bartlett wrote: > I have a rule challenge for you all. > How can we write a rule to catch messages like the one attached? body LOC_BRMASK /( ?|.){1,5}( ?|.){1,5}( ?|.){1,5}/i describe LOC_BRMASK Masking BR tags with 1-5 characters between score LOC_BRMASK (see

Re: [SAtalk] Can you customize the body of a spam message

At Tue Nov 4 21:59:57 2003, Upwood, Jim wrote: > > Can you customize this part? > > "The original message was not completely plain text, and may be unsafe > to > open with some email clients; in particular, it may contain a virus, > or confirm that your address can receive spam. If you wish to

Re: [SAtalk] THIRD request: Someone please help with AWL oddness

On Tue, Nov 04, 2003 at 05:06:06PM -0500, Matt Kettler wrote: > Have you been doing something like spamassassin --add-addr-to-whitelist? > In that case.. don't, because it appears that the no-ip entry added by this > command will over-ride any and all IP address specific entries. At least the l

Re: [SAtalk] tests not updated on the SA website?

At Tue Nov 4 02:10:56 2003, Mairhtin O'Feannag wrote: > > Hi, > > The "tests" page of the spamassassin.org website seems not to be too > up-to-date. A search of the page reveals only three or four tests > based upon the word "outlook" and they all refer to Outlook Express. > YET ... when I get

RE: [SAtalk] Can you customize the body of a spam message

Can you customize this part? "The original message was not completely plain text, and may be unsafe to open with some email clients; in particular, it may contain a virus, or confirm that your address can receive spam. If you wish to view it, it may be safer to save it to a file and open it with

Re: Undeliverable Mail: RE: [SAtalk] What is with all this ()*&(*& in my inbox?

Mike Kuentz (2) wrote: Is there some way to get who ever was registered from thewizard.net off the list? Looks like their domain expired, and I get a bounce from them every time I post to the list. I'm guessing every one else that posts to the list gets the bounce, also. Mike I get this annoyin

Re: [SAtalk] THIRD request: Someone please help with AWL oddness

At 04:26 PM 11/4/2003, Jay Levitt wrote: - Original Message - From: "Jay Levitt" <[EMAIL PROTECTED]> To: "Jay Levitt" <[EMAIL PROTECTED]> Sent: Sunday, November 02, 2003 9:29 AM Subject: Second request: AWL false hits > Hi.. does anyone have any ideas on this? I have read the FAQ, and thi

Re: [SAtalk] spamd using up all system memory and swap space

Dennis Duval wrote: I have to restart spamd within a couple of minutes after restarting syslogd with the init script or it will crash the system. However doing a killall -HUP syslogd has no affect on spamd and it continues logging. I know of no other applications that would crash a system as a r

RE: [SAtalk] THIRD request: Someone please help with AWL oddness

I'm going to take a wild stab at this, but the AWL is NOT IP specific. It only goes by the from, not IP. I think it takes the "average" (I know it isn't an average.) score from all the records it has of it. Make sense? --Chris > -Original Message- > From: Jay Levitt [mailto:[EMAIL PROTE

RE: Undeliverable Mail: RE: [SAtalk] What is with all this ()*&(* & in my inbox?

I've only gotten one. Hmm.. maybe a harvesting engine? Chris > -Original Message- > From: Mike Kuentz (2) [mailto:[EMAIL PROTECTED] > Sent: Tuesday, November 04, 2003 4:04 PM > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: RE: Undeliverable Mail: RE: [SAtalk] What is with a

RE: [SAtalk] Rule Emporium Update!

Chris, They know we are watching them watching us now!! BTW Thanks for the great rules :) Regards, Pete Peter P. Benac, CCNA Emacolet Networking Services, Inc Providing Systems and Network Consulting, Training, Web Hosting Services Phone: 919-847-1740 or 866-701-2345 To have principl

Re: [SAtalk] Can you customize the body of a spam message

At 03:10 PM 11/4/2003, Paul Hirschorn wrote: I want to customize the following: Spam detection software, running on the system "SPAMGW.FILTER.COM", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or block si

RE: [SAtalk] Rule Emporium Update!

> Chris Santerre Sent: Tuesday, November 04, 2003 3:15 PM > > > Finally got another update done. The Emporium is going to > go through some > > MAJOR changes in the coming months. For all of those people > that contacted > > me about mirroring the site, Thank You! I'm all set for > now, secre

Re: [SAtalk] Best Blacklists

At 02:55 PM 11/4/2003, Steve Heggood wrote: Could someone recommend a set of blaclists used in sendmail.mc that are producing good results? Might I suggest looking at the STATISTICS-set1.txt that comes with SA? This will give you the results of testing against 343k spam messages and 151k nonspam

[SAtalk] THIRD request: Someone please help with AWL oddness

- Original Message - From: "Jay Levitt" <[EMAIL PROTECTED]> To: "Jay Levitt" <[EMAIL PROTECTED]> Sent: Sunday, November 02, 2003 9:29 AM Subject: Second request: AWL false hits > Hi.. does anyone have any ideas on this? I have read the FAQ, and this does > not seem to be the usual "why

RE: [SAtalk] [RD] excessive table tags

> I have a rule challenge for you all. Accepted :-) > > How can we write a rule to catch messages like the one > attached? I have had > a few slip through today like this. As did Ray Dzek who > attached a similar > message in his post "What is with all this ()*&(*& in my > inbox?". It seems >

[SAtalk] [RD] excessive table tags

I have a rule challenge for you all. How can we write a rule to catch messages like the one attached? I have had a few slip through today like this. As did Ray Dzek who attached a similar message in his post "What is with all this ()*&(*& in my inbox?". It seems that they are using a lot of sepera

RE: [SAtalk] [RD] excessive table tags

Chris Santerre Sent: Tuesday, November 04, 2003 4:29 PM > maybe something like this: > > rawbody MY_MANY_BR2 /.{6,14}.{6,14}.{6,14}.{6,14}/i > describe MY_MANY_BR2 Tooo many 's! > score MY_MANY_BR2 .45 You are a machine. Thank you much. I sure hope future versions allow compound / additive rules

Re: [SAtalk] Best Blacklists

At 11/4/03 11:55 AM , Steve Heggood wrote: Could someone recommend a set of blaclists used in sendmail.mc that are producing good results? I can recommend *against* spambag.org. They recently decided to block all of Hotmail and MSN. (Then again, if you want to block those places, and don't care t

[SAtalk] sa-learn, Bayes

Title: Nachricht HI to all!!   I have a big problem with sa-learn. In debug-mode sa-learn told me, he can't use Bayes because DB_File is not installed.   DB_File and AnyDBM_File are up to date.   What can I do?   Thanks     debug: Score set 0 chosen.debug: running in taint mode? yesdebug:

[SAtalk] RE: Error in Nov2Rules.

Dang nab it! :-) I fixed it on my linux side, but not my windows side. Fixed now. Thanks! Chris > -Original Message- > From: Robert Leonard III [mailto:[EMAIL PROTECTED] > Sent: Tuesday, November 04, 2003 3:48 PM > To: Chris Santerre > Subject: Error in Nov2Rules. > Importance: High > >

RE: [SAtalk] Can you customize the body of a spam message

An Outlook rule can look at the headers and "do whatever" when it finds "X-Spam-Status: YES" Very easily. But, then I don't pretend to know what management finds easy to do.. :) Steven -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Paul Hirschor

RE: Undeliverable Mail: RE: [SAtalk] What is with all this ()*&(*& in my inbox?

Is there some way to get who ever was registered from thewizard.net off the list? Looks like their domain expired, and I get a bounce from them every time I post to the list. I'm guessing every one else that posts to the list gets the bounce, also. Mike -Original Message- From: [EMAIL P

RE: [SAtalk] Can you customize the body of a spam message

/usr/share/spamassassin/10_misc.cf contains that infobut it will get overwritten if/when you upgrade versions. James Stenglein -Original Message- From: Paul Hirschorn [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 04, 2003 3:10 PM To: '[EMAIL PROTECTED]' Subject: [SAtalk] Can you

Re: [SAtalk] spamd using up all system memory and swap space

Justin Mason wrote: > Dennis Duval writes: >> Morris Jones wrote: >>> I've never had a problem like this, of course. But I >>> wonder what you might discover if you turned debugging >>> on for spamd? Start it with the -D flag? >>> >> Thanks to Justin Mason and Tom Meunier for pointing out >> the

Re: [SAtalk] Best Blacklists

We use the following RBLs. sbl.spamhaus.org blackholes.easynet.nl dynablock.easynet.nl Gary > Could someone recommend a set of blaclists used in > sendmail.mc that are producing good results? > > Thanks, > -steve- > -- > It is easier to make working code elegant than to make elegant code >

Re: [SAtalk] SA 6.0 installed, spamd using 2.5.5 ???

On Tue, 2003-11-04 at 13:34, MIKE YRABEDRA wrote: > I have SA 6.0 installed and running, but my emails say that they were > processed using 2.5.5 (the version I had installed before 6) > > Any ideas? > Not enough information here to be much help. Try http://www.exit0.us/index.php/GettingAdvice -

[SAtalk] Can you customize the body of a spam message

I want to customize the following: Spam detection software, running on the system "SPAMGW.FILTER.COM", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or block similar future email. If you have any questio

[SAtalk] Rule Emporium Update!

Finally got another update done. The Emporium is going to go through some MAJOR changes in the coming months. For all of those people that contacted me about mirroring the site, Thank You! I'm all set for now, secret plans to take over the world have been put into action ;) In the future, you will

Re: [SAtalk] Could not create INET socket... ...Permission denied

At 02:00 PM 11/4/2003, JC wrote: Spamassassin seems to be running fine, except when I go into debug mode, I get an error. Here is some relevant output: [EMAIL PROTECTED] /]$ spamd -c -a -m5 -H -D spamd needs to be started as root, unless you pass it -p to specify a port number > 1024.. by defaul

Re: [SAtalk] Curious about a header.

At 11:44 AM 11/4/2003, Matthew Thomas wrote: It didn't get marked as spam since it appears to come from us, though the IP address is located in Puerto Rico. I was just wondering how they get biocontrolsys.com associated with their IP address. Is it a completely manufactured (not "real") header?

Re: [SAtalk] Could not create INET socket... ...Permission denied

On Tue, 4 Nov 2003 14:00:37 -0500 JC <[EMAIL PROTECTED]> wrote: > Spamassassin seems to be running fine, except when I go into debug mode, I > get an error. Here is some relevant output: > > [EMAIL PROTECTED] /]$ spamd -c -a -m5 -H -D (...) > Could not create INET socket: Permission denied IO::So

Re: [SAtalk] spamd using up all system memory and swap space

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dennis Duval writes: >Morris Jones wrote: >> I've never had a problem like this, of course. But I >> wonder what you might discover if you turned debugging on >> for spamd? Start it with the -D flag? >> >Thanks to Justin Mason and Tom Meunier for po

[SAtalk] Best Blacklists

Could someone recommend a set of blaclists used in sendmail.mc that are producing good results? Thanks, -steve- -- It is easier to make working code elegant than to make elegant code work. --- This SF.net email is sponsored by: SF.net Givebac

Re: [SAtalk] which folder?

At 07:57 PM 11/4/03 +0100, Jim Knuth wrote: which folder to the read the config is used? local.cf in /etc/mail/spamassassin or local.cf in /etc/spamassassin or user_prefs in /.spamassassin/ It's actually parsed from two places: *.cf in /etc/mail spamassassin user_prefs in ~/.spamassassin And note

[SAtalk] which folder?

Hallo und guten Abend SA-List, which folder to the read the config is used? local.cf in /etc/mail/spamassassin or local.cf in /etc/spamassassin or user_prefs in /.spamassassin/ ?? -- Viele Grüße, best regards Jim Knuth [EMAIL PROTECTED] - Zufalls-Zitat - Gegen Angri

[SAtalk] Could not create INET socket... ...Permission denied

Spamassassin seems to be running fine, except when I go into debug mode, I get an error. Here is some relevant output: [EMAIL PROTECTED] /]$ spamd -c -a -m5 -H -D debug: Score set 0 chosen. debug: Running in taint mode, removing unsafe env vars, and resetting PATH debug: PATH included '/usr/local/

[SAtalk] SA 6.0 installed, spamd using 2.5.5 ???

I have SA 6.0 installed and running, but my emails say that they were processed using 2.5.5 (the version I had installed before 6) Any ideas? --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be m

RE: [SAtalk] What is with all this ()*&(*& in my inbox?

Don't see the second one much. Slice and Dice is what this site has it called for that type of message. Do you have net tests disabled? That should have hit since it's a dynamic dial up address. Also, it may be

Re: [SAtalk] What is with all this ()*&(*& in my inbox?

#1: Train a bayes database #2: Enable network tests My $0.02 Chris Ray Dzek said: > SA: 10 Spammers: 7 > > That was the score this morning for my email. There seems to be a lot > more > of this going on. Is there anything I can do to plug these holes? We are > running Postfix + SA 2.6 site-w

Re: [SAtalk] Would this be the best way to turn off AWL?

Thanks to Brian and Pedro who pointed out that it is in the start up call that the AWL is invoked. I have taken out the --whitelist option in the spamd file in init.d and I also commented out the auto_whitelist_path variable in the configuration file. It seems to have done the trick. Though

[SAtalk] spam header not getting written sometimes

(with 2.60) Occasionally (about 1 in 5000) SA recognizes a spam (according to all the other headers), but fails to add the *SPAM* header. As this is so rare, I'm willing to write it off as "just weird", but I'm wondering if anyone else has had this problem. I can reproduce this by sendin

Re: [SAtalk] spamd using up all system memory and swap space

Morris Jones wrote: > I've never had a problem like this, of course. But I > wonder what you might discover if you turned debugging on > for spamd? Start it with the -D flag? > Thanks to Justin Mason and Tom Meunier for pointing out the -m option and the FAQ on this questions. Last night, I remo

[SAtalk] Some rules for scoring Bulk Mailers

Hi all, I'm just a newbie in writing rules for spamassassin, but here are some rules i've write. Please give me your feedback, if they're ok, not ok, why... Thanks Carlos J. Santos (Portugal) # # Custom Rules for Bulk Emailers # 04.Oct.2003 - Carlos J. Santos {cajo (at) box (dot) pt] # # This ru

Re: [SAtalk] RCVD_IN_DYNABLOCK FP?

Brian Sneddon wrote: >... It only seems to occur when the email > is being processed through spamass-milter and spamd; processing it > manually using spamassassin works properly. There was a similar issue with some SA processing through the MIMEDefang milter; the fix was for MIMEDefang's author

[SAtalk] What is with all this ()*&(*& in my inbox?

SA: 10 Spammers: 7 That was the score this morning for my email. There seems to be a lot more of this going on. Is there anything I can do to plug these holes? We are running Postfix + SA 2.6 site-wide as a relay, so we are not running Bayes. I have never had this much trouble with SA before,

RE: [SAtalk] Would this be the best way to turn off AWL?

Lois Bennett Sent: Tuesday, November 04, 2003 11:29 AM > I want to turn off AWL and the only thing I have found so far is to > set the auto_whitelist_factor to 0 but it seems like that might not > really turn it off completely. Can anone suggest a better way? http://www.spamassassin.org/doc/Mail

RE: [SAtalk] Curious about a header.

> -Original Message- > From: Matthew Thomas [mailto:[EMAIL PROTECTED] > Sent: 04 November 2003 16:44 > To: [EMAIL PROTECTED] > Subject: [SAtalk] Curious about a header. > > > I received a spam with the header below. > > Return-Path: <[EMAIL PROTECTED]> > Received: from biocontrolsys.com

[SAtalk] Curious about a header.

I received a spam with the header below. Return-Path: <[EMAIL PROTECTED]> Received: from biocontrolsys.com ([66.50.175.12]) by gateway.biocontrolsys.com (8.12.6/8.12.6) with ESMTP id hA4G6EXp016886 for <[EMAIL PROTECTED]>; Tue, 4 Nov 2003 08:06:16 -0800 Received: from mike [66.50.1

[SAtalk] Would this be the best way to turn off AWL?

Hi, I want to turn off AWL and the only thing I have found so far is to set the auto_whitelist_factor to 0 but it seems like that might not really turn it off completely. Can anone suggest a better way? Thanks, Lois -- Lois B. Bennett - Senior System Administrator Div. of Engineering and Appli

Re: [SAtalk] Resolving and hat-checking spamvertised URLs...

Florian, Thanks for this very cool work. It seems to work great so far... I'm going to run it a while and see what kind of results I get over time. Since I run Debian (and have customized packages before) it was relatively easy for me to install your patch. Any recommendations for those (on thi

RE: [SAtalk] [RD] evil rules holdup. Stupid grep!

Hrm, on second look, my example was inappropriate. In order to demonstrate no sorting, I should have said something like: input.txt: f e d c b a e patternfile.txt: a c e $ cat input.txt | grep -f patternfile.txt e c a e grep will scan the input file line by line. If the current line matches a

Re: [SAtalk] FW: sa-learn via email

Ryan: Learning from forwarding mail is less than ideal. You will need to make sure that your users are forwarding the emails as attachments, then you will need to decode the attachment and learn that. Dedicated shared IMAP folders are generally mentioned as a good alternative. Search the archiv

[SAtalk] FW: sa-learn via email

I would like to have my users be able to forward spam that they receive to an email address like "[EMAIL PROTECTED]". I would then configure my mail server to send this email through "sa-learn -spam". Do I need to worry about first stripping off "FW: ", the from address (this would be my user an

RE: [SAtalk] [RD] evil rules holdup. Stupid grep!

Your example is EXACTLY what was happening to me! I would have expected grep to dump the output in the order of the pattern file. Guess I assumed incorrectly. I tried the "For/do" loops people sent me, but for some reason they didn't run correctly. Most likely my fault. I did use Rick Beebe's pe

RE: [SAtalk] [RD] Weeds changes

Hi Scott I was going to post a change, but you beat me out of the gates. Last night the topiary king showed me a way to do that pruning. If you would like, you can write those this way. /\&\#(?:0*(?:65|97)|x0*[46]1);/i I made the changes on the site if you want to grab them http://spamhammers.

RE: [SAtalk] What is tripping FORGED_MUA_MOZILLA?

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > David B Funk > Sent: Tuesday, November 04, 2003 1:13 AM > To: Robert Kropiewnicki > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] What is tripping FORGED_MUA_MOZILLA? > > > On Mon, 3 Nov 2003, Robert Kr

RE: [SAtalk] [RD] Weeds changes

I'm not sure that this is any better, but here are two alternatives (using [Aa] for example). Note in these that I don't think that the "&" and ";" need to be escaped since they ran through --lint ok. /&\#(0*65|0*97|x0*41|x0*61);/i OR /&\#(0*(65|97)|x0*(41|61));/i TO REPLACE /(\&\#0*65\;|\&\#

Re: [SAtalk] Avoid Double check

Thanks for the reply. We are using Qmail-Scanner (and changed it to deliver mails to a global Spam box instead a per user Spam Box) to call SpamAssassin. Carlos J. Santos (Portugal) Colin A. Bartlett wrote: Carlos Jorge Santos Sent: Tuesday, November 04, 2003 8:14 AM Is there a way to avoid t

RE: [SAtalk] URI Rule

I have a bunch of these show up when I create the evilrules. I mean a BUNCH! But I take them out because Jen's weeds rule does such a fine job. > -Original Message- > From: Andrew [mailto:[EMAIL PROTECTED] > Sent: Monday, November 03, 2003 7:35 PM > To: [EMAIL PROTECTED] > Subject: [SAtal

RE: [SAtalk] Avoid Double check

> -Original Message- > From: Carlos Jorge Santos [mailto:[EMAIL PROTECTED] > Sent: Tuesday, November 04, 2003 8:14 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Avoid Double check > > > Hi all, > > I've searched for this subject in the list archives, but > couldn't find any relevant

Re: [SAtalk] Razor2 patch applied, still getting Bad file descriptor errors

> > So does nobody have an idea for the problem below? > > Have you restarted spamd after patching Razor (assuming you're using > spamc/spamd)? > > -- Bob > Thanks, I have restarted spamd. I have also tried a reinstall of the Razor component and a re-application of the patch, but so far, no lu

RE: [SAtalk] Avoid Double check

Carlos Jorge Santos Sent: Tuesday, November 04, 2003 8:14 AM > Is there a way to avoid this double check ? By checking the > X-Spam-Status tag or something like this ? That all depends on how you are calling SA. If you are using procmail, as I and many others are, you could right a simple procmai

[SAtalk] FW: new pyzor host

In case any one didn't get this message... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frank Tobin Sent: Monday, November 03, 2003 11:17 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: new pyzor host The current pyzor host went down earlier toda

Re: [SAtalk] Sole scanner?

On Mon, 2003-11-03 at 11:21, Angel Gabriel wrote: > I want to setup a machine, with a sole purpose, of scanning email. All > email to be delivered to my domain, will be accepted by this machine, > and then, after scanning delivered to my mail server. > > How can I achieve such a setup? http://www

[SAtalk] Avoid Double check

Hi all, I've searched for this subject in the list archives, but couldn't find any relevant information. Some of our clients already use SpamAssassin on their mail servers and when the mail comes to our servers gets double checked. Is there a way to avoid this double check ? By checking the X-

[SAtalk] How to balance spamd max children?

My ISP went down, so when it came back up aqnd my secondary mx record kicked it all back to me I got a lot of messages from sendmail saying Nov 4 06:58:26 saturn spamd[952]: hit max-children limit (5): waiting for some to exit I bumped it up to 10 (my server can well handle it) but can someon

[SAtalk] AARGGGGG...help needed

Hi List. Trying to install SA 2.60 but getting errors while installing the required modules from CPAN. install ExtUtils::MakeMaker >= 5.45 Running make test PERL_DL_NONLAZY=1 /usr/bin/perl "-Ilib" "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/00compile..

  1   2   >