Re: [SAtalk] Really bad Infoworld article

2003-11-24 Thread Terry Milnes
The company I did this for is a small company, a large user base doesn't mean a large company. The same can be said for the larger companies, they may have an admin who makes 20 bucks an hour so their costs would be in the $30 an hour range. There were other considerations I didn't even

Re: [SAtalk] Really bad Infoworld article

2003-11-24 Thread Terry Milnes
Some companies are on a small budget and can't afford the extra monies involved, and I don't see how it's possible to determine a rate beforehand. We don't know what may be involved in the upgrade until it happens. For example in the scenario I gave as an example, to perform the two upgrades

[SAtalk] SA 2.55 running sweet, upgrade to 2.60 and no workie =(

2003-11-24 Thread James Nonya
Hey all! I'm running Slackware 8.1 which comes with perl 5.6.1. I've been running spamd just fine since 2.55 was released. I compile and install SA 2.60 and all goes well. When I try to start spamd here's what I get: Insecure directory in $ENV{PATH} while running with -T switch at

[SAtalk] Re: Really bad Infoworld article

2003-11-24 Thread Nancy McGough
On 24 Nov 2003 Fred ([EMAIL PROTECTED]) wrote: [...] SpamAssassin 2.4 is really out-dated, it's missing Bayes and thousands of other fixes that make it a better product. I had a good laugh on your article, you say Spend the 10 or 20 per month per year for one of the commercial services,

[SAtalk] KMail filter

2003-11-24 Thread Clive Dove
I am using spamassassin with KMail. I pipe messages through spamassassin with a starting filter with this rule: any header matches regular expr. (dot) This was followed by a filter with this rule: X-Spam-Status contains Yes This worked fine under spamassassin 2.44. About a week ago I

Re: [SAtalk] KMail filter

2003-11-24 Thread Josh Endries
Clive Dove wrote: On the assumption that the kmail filter was picking up the string BAYES in the X-Spam-Status header, I changed the rule to this: X-Spam-Statuscontains Yes, hits= Can I rely on the changed rule or should I use some other rule instead? I had this problem too and realized

Re: [SAtalk] SA 2.55 running sweet, upgrade to 2.60 and no workie =(

2003-11-24 Thread William Stearns
Good morning, James, On Mon, 24 Nov 2003, James Nonya wrote: I'm running Slackware 8.1 which comes with perl 5.6.1. I've been running spamd just fine since 2.55 was released. I compile and install SA 2.60 and all goes well. When I try to start spamd here's what I get: Insecure

RE: [SAtalk] Re: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Mike Schrauder
I hardly ever post like this, but I just had to share that I thought this post was spot-on target w/ regards to certain magazines being anti-opensource and a bad source of objective information. Thanks Bryan. Always remember, buyer beware. Whoops, this mag is fully paid for through advertising,

Re: [SAtalk] SA 2.55 running sweet, upgrade to 2.60 and no workie =(

2003-11-24 Thread Bill Goudie
On Mon, Nov 24, 2003 at 06:17:54AM -0800, James Nonya wrote: I'm running Slackware 8.1 which comes with perl 5.6.1. I've been running spamd just fine since 2.55 was released. I compile and install SA 2.60 and all goes well. When I try to start spamd here's what I get: Insecure directory

Re: [SAtalk] Double bounce sa-learn

2003-11-24 Thread Adam D. Lopresto
No. I guess I didn't convey my meaning very well. My situation: I have a box called postal receives all incoming mail for a few domains, runs SpamAssassin on it, and then sends it on to the real mailserver for intended domain. The problem is that postal can't know what users are valid on the

Re: [SAtalk] Another plea...

2003-11-24 Thread Lyle Evans
At 10:40 PM 11/23/03, you wrote: Dear list... (See what happens when I get a question answered? I come up with more...) Is there (I hope!!!) a way to tell spamd not to accept connections if the system load is at or above a certain threshold? (i.e. if the system load is currently 30, don't spawn

[SAtalk] Bayes not available through amavisd?!?!

2003-11-24 Thread David Meier
Hi list, I hope this is not another RTFM-Question... My site-wide setup calls SA v2.60 from amavisd (amavisd-new-20030616-p5). Spam gets caught however, bayes tests are not included although they should. Here's what I have in my local.cf: use_bayes 1 bayes_path /var/amavis/.spamassassin/bayes

Re: [SAtalk] SA 2.55 running sweet, upgrade to 2.60 and no workie =(

2003-11-24 Thread James Nonya
On Mon, 24 Nov 2003 10:15:35 -0500 (EST) William Stearns [EMAIL PROTECTED] wrote: Good morning, James, On Mon, 24 Nov 2003, James Nonya wrote: I'm running Slackware 8.1 which comes with perl 5.6.1. I've been running spamd just fine since 2.55 was released. I compile and install SA

Re: [SAtalk] Letter

2003-11-24 Thread Matt Kettler
At 01:16 PM 11/22/2003, Jack Gostl wrote: I thought I saw a reference to a letter that SA could automatically generate upon encountering spam. I've got 2.60 installed, could someone give me a pointer on how to create this letter. -- SA itself can't generate email, period. Lots of tools that use

Re: [SAtalk] SA 2.55 running sweet, upgrade to 2.60 and no workie =(

2003-11-24 Thread William Stearns
Good morning, James, On Mon, 24 Nov 2003, James Nonya wrote: On Mon, 24 Nov 2003 10:15:35 -0500 (EST) William Stearns [EMAIL PROTECTED] wrote: On Mon, 24 Nov 2003, James Nonya wrote: I'm running Slackware 8.1 which comes with perl 5.6.1. I've been running spamd just fine since

[SAtalk] RBL Test Run?

2003-11-24 Thread Dan Spray
Hello, How do I know if I am running through the RBL lists? I turned sa_local_tests_only to 0 and I have skip_rbl_checks 0 and I get this for a transaction in the log: Nov 21 16:51:13 nabu amavis[6216]: (06216-21) ESMTP::10024 /var/amavisd/tmp/amavis-20031121T164659-06216: [EMAIL

Re: [SAtalk] Letter

2003-11-24 Thread Jack Gostl
No... it was something during the install. I remember the question about who to notify. I guess I could work out a procmail recipe. I got onto this track because of false positives. 2.60 is pretty agressive about spam catching, and every now and then it nails a real message. If I could kick

RE: [SAtalk] Re[2]: http://www.infoworld.com/article/03/11/14/45F Espam_1.html?s=tc

2003-11-24 Thread Chris Santerre
Well, I decided to reply this to everyone as well. I'm sure Logan has been taking a beating on this, so I'll be gentle :) I run a patched version of SA 2.43 and I catch 99% of the spam for our company! (The patch was a simple security issue.) This is WITHOUT Bayes OR Net tests!! Yes, you read

[SAtalk] [OT] FW: MEDIA: Spam Rage Vigilante

2003-11-24 Thread Chris Santerre
This is from another list, for those of you not on SPAM-L, this is very interesting. I guess SA could have kept this guy out of jail :) No registration required. http://www.thescotsman.co.uk/international.cfm?id=1295402003 http://www.siliconvalley.com/mld/siliconvalley/7326032.htm

[SAtalk] 'Windows-1251' in subject line.

2003-11-24 Thread Charles Gregory
Hello! Okay, not to pick on Miroslav, but, here is a case where a legitimate English language e-mail has 'Windows-1251' embedded in the subject line. So I don't think it would be fair to filter on this alone. So I ask again, is there a way to identify when the contents are going to be a jumble

[SAtalk] RCVD_IN_DYNABLOCK changes

2003-11-24 Thread Todd Schuldt
Am I right in assuming that the only place that needs the score set to 0 is RCVD_IN_DYNABLOCK when easynet.nl goes offline Dec 1? Todd --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more

Re: [SAtalk] Re: Really bad Infoworld article

2003-11-24 Thread Terry Milnes
Nancy McGough wrote: On 24 Nov 2003 Fred ([EMAIL PROTECTED]) wrote: [...] SpamAssassin 2.4 is really out-dated, it's missing Bayes and thousands of other fixes that make it a better product. I had a good laugh on your article, you say Spend the 10 or 20 per month per year for one of the

RE: [SAtalk] Why Bayes is so essential

2003-11-24 Thread Stewart, John
Some time ago, there was an announcement of patches to SA to allow for SQL-stored Bayes databases. I haven't seen word of this being integrated in to the main tree since then, but it's possible I've missed it. Hmm... I don't recall seeing this at all; does anyone have any info on this,

Re: [SAtalk] Double bounce sa-learn

2003-11-24 Thread Ryan Moore
We have the same setup here, with the same problem of course. One thing we started doing a few months ago was start using a milter to limit the incoming garbage: http://www.snert.com/Software/milter-sender/ It basically verifies the sender address before allowing it through. It is fairly

[SAtalk] Another dufus who cant configure their spam software

2003-11-24 Thread SpamTalk
Some content was [SNIP]ped to a) hide our interior routing b) to remove references to what they were touting. Note the Sender: ydcC:\messages\names_a.txt [EMAIL PROTECTED] where a random sender names would have been inserted. ===headers== Received: from [SNIP] by [SNIP] with SMTP

Re: [SAtalk] Letter

2003-11-24 Thread Jack Gostl
No... it was something during the install. I remember the question about who to notify. That's not for email generation.. It's part of the tags added to spam messages. When SA tags a message as spam, it adds a bit to the body of the tagged spam, which basically says if you have

RE: [SAtalk] Re: Really bad Infoworld article

2003-11-24 Thread Chris Santerre
*snip* for free on our own in our spare time? I agree with you Fred that there's plenty to criticize about that article, but your last paragraph is not one of them. For the vast majority of people it is well worth $10-20 per month for spam and virus protection. Most people would much

Re: [SAtalk] bayes learning

2003-11-24 Thread Casper Gasper
debug: bayes: no dbs present, cannot scan: /root/.spamassassin/bayes_toks Have you got the DB_File module installed? You need it for bayes. I take it you're running Amavisd-new as a non-root user? That user has to be able to read bayes_toks and bayes_seen. What's your $MYHOME var set to

Re: [SAtalk] Letter

2003-11-24 Thread Matt Kettler
At 11:26 AM 11/24/2003, Jack Gostl wrote: No... it was something during the install. I remember the question about who to notify. That's not for email generation.. It's part of the tags added to spam messages. When SA tags a message as spam, it adds a bit to the body of the tagged spam, which

Re: [SAtalk] Why Bayes is so essential

2003-11-24 Thread Michael Parker
On Mon, Nov 24, 2003 at 11:14:40AM -0600, Stewart, John wrote: Some time ago, there was an announcement of patches to SA to allow for SQL-stored Bayes databases. I haven't seen word of this being integrated in to the main tree since then, but it's possible I've missed it.

RE: [SAtalk] Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Bill
I've read numerous antispam articles, and NONE have given SA justice. I think the main reason for the poor reporting of SA is mainly due to the fact that every one of the reviews has been done by a company that has an agenda. That agenda being, collecting advertising funding from commercial

[SAtalk] spamd/spamc questions

2003-11-24 Thread Danny Chen
Hi, I have couple of questions regarding spamc/spamd. Our email server has very heavy traffic each day (several hundred per minute in peak time). So we are running spamd/spamc. We have noticed some problems: we are using sendmail. In sendmail.cf we set the local mailer

Re: [SAtalk] RE: *.easynet.nl DNSBL's ceasing on Dec 1, 2003 [OT]

2003-11-24 Thread Scott Rothgaber
Gary Carr wrote: This is a shame. The guy should do it for a fee and make it a small business. They are the most affective RBLs we have used to date. Ditto. DynaBlock is my most effective list. I would be glad to pay an annual fee. --- This

RE: [SAtalk] 'add_header' ignored? (SA 2.60 on FreeBSD 4.7)

2003-11-24 Thread Bret Miller
The messages processed by SpamAssassin come through with a header that says something like: X-Spam-Status: Yes, hits=5.5 required=5.0 My problem is that I'd like to change this header so that it includes a list of the tests that matched - but nothing I change in the configuration

Re: [SAtalk] 'add_header' ignored? (SA 2.60 on FreeBSD 4.7)

2003-11-24 Thread Angus McIntyre
At 23:55 -0500 23.11.2003, Matt Kettler wrote: At 10:52 PM 11/23/03 -0500, Angus McIntyre wrote: Can anyone tell me what I'm overlooking? Is there some magic switch required to get SpamAssassin to honor 'add_header' instructions? First, run spamassassin --lint.. just as a sanity check ... Check

RE: [SAtalk] Re[2]: http://www.infoworld.com/article/03/11/14/45F Espam_1.html?s=tc

2003-11-24 Thread Chris Santerre
Title: RE: [SAtalk] Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc Last I knew, there were versions of SA that ran on Windows and Mac. :-) You can't please everyone, we understand that. CIO/CTOs look for FAST, CHEAP, and RELIABLE, and never understand they can have

Re: [SAtalk] KMail filter

2003-11-24 Thread Clive Dove
On Monday 24 November 2003 10:23, Josh Endries wrote: Clive Dove wrote: On the assumption that the kmail filter was picking up the string BAYES in the X-Spam-Status header, I changed the rule to this: X-Spam-Statuscontains Yes, hits= Can I rely on the changed rule or should I use

RE: [SAtalk] Another dufus who cant configure their spam software

2003-11-24 Thread SpamTalk
Next time I snip the SA version too ;) I've posted my moans on this before. It was initially a test setup that worked so well it was deemed production. This a personal time project with no budget or resource allocation. I have managed to co-opt another server and am building a new setup, but it

RE: [SAtalk] Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Simon Byrnand
I've read numerous antispam articles, and NONE have given SA justice. I think the main reason for the poor reporting of SA is mainly due to the fact that every one of the reviews has been done by a company that has an agenda. That agenda being, collecting advertising funding from commercial

Re: [SAtalk] bayes.lock problem

2003-11-24 Thread Chip Paswater
I've had this problem randomly. Bayes tends to lock itself for some sort of DB operation, dies midway, and then dosen't clear the lock. I've disabled my bayes in the meantime until I move over to spamd or amavisd-new. On Mon, Nov 24, 2003 at 06:33:25AM -0500, MIKE YRABEDRA wrote: I had

RE: [SAtalk] Why Bayes is so essential

2003-11-24 Thread Chris Santerre
-Original Message- From: Dan Kohn [mailto:[EMAIL PROTECTED] Sent: Thursday, November 20, 2003 2:35 PM To: [EMAIL PROTECTED] Subject: [SAtalk] Why Bayes is so essential Here is a spam that should convince people to turn on Bayes. This Nigerian spam was almost certainly

Re: [SAtalk] bayes learning

2003-11-24 Thread Chip Paswater
So amavisd-new does use bayes, you just need to set the perms right? On Mon, Nov 24, 2003 at 05:22:09PM +, Casper Gasper wrote: debug: bayes: no dbs present, cannot scan: /root/.spamassassin/bayes_toks Have you got the DB_File module installed? You need it for bayes. I take it

RE: [SAtalk] Spam filtering for an ISP

2003-11-24 Thread Chris Santerre
-Original Message- From: Brook Humphrey [mailto:[EMAIL PROTECTED] Sent: Saturday, November 22, 2003 10:28 PM To: ML-spamassassin-talk Subject: Re: [SAtalk] Spam filtering for an ISP On Saturday 22 November 2003 02:52 pm, William Stearns wrote: SpamAssassin 2.55

[SAtalk] bayes over NFS locking

2003-11-24 Thread Adam Denenberg
Hey, How are people handling the locking issues with Bayes over NFS on a high traffic mail server? Currently i have bayes_learn_to_journal 1 turned on, but an sa-learn --rebuild seems to be taking quite some time (i have about a million tokens in my DB). Has anyone had a better success rate

[SAtalk] Score

2003-11-24 Thread Alan Munday
Just had a mail in which had different *'s and score. I was expecting these to be the same as I egrep the file and count the stars in post processing. X-Spam-Level: X-Spam-Status: No, hits=5.0 required=5.0 tests=BAYES_20,HTML_30_40,

RE: [SAtalk] Rules, rules and more rules

2003-11-24 Thread Alan Munday
Jennifer Thanks for the response. A good point with respect to the on/off nature of some of the rule sets. More info for the FAQ? I had been directed at your site and have installed those rules recommended by Bob Menschel. I wish to say a thank you to all the sa rules contributors for your

[SAtalk] Your infoworld Article

2003-11-24 Thread Evan Platt
Logan: I read with great displeasure your InfoWorld article on Fighting Spam, and felt the need to make a few corrections, which unfortunately will never be updated on your article, but perhaps point you in the direction of doing a bit more homework next time. Your article may look 'good' to a

[SAtalk] RD: make your own RBL

2003-11-24 Thread Regis Wilson
This may or may not be of use to people. I don't have access to the RBLs due to firewall configuration. The firewall doesn't give any lookups in the received line, so I have to extract the IPs and then count them up. This script will spit out a set of rules for the largest offenders. Some

Re: [SAtalk] Really bad Infoworld article

2003-11-24 Thread Jeremy Dold
It gets even funnier, because according to this article, http://www.infoworld.com/article/03/07/18/28FEspamassassin_1.html?s=feature , InfoWorld uses Spamassassin for themselves! According to InforWorld, SpamAssassin is easy to install and customize. Do they even proofread the articles before

RE: [SAtalk] Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Logan Harbaugh
Title: RE: [SAtalk] Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc I didn't have any agenda while writing the article. I'm sure I wouldn't have gotten as many objections to my review if I'd used the latest release of SA, and I'm sure filtering performance would have

[SAtalk] RE: Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Logan Harbaugh
Title: RE: Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc I don't have control over how articles are edited. As it was, there were six software packages in the original test, and they pulled one out because there wasn't as much room as they'd originally thought. The

[SAtalk] install problem

2003-11-24 Thread Frederick M Avolio
Trying to build SA on a RedHat Linux system via CPAN. In the install I get this: t/spamd_allow_user_rulesok t/spamd_hup.NOK 5 Not found: flag = X-Spam-Flag: YES t/spamd_hup.FAILED tests 3-5, 8 Failed 4/8 tests, 50.00% okay

Re: [SAtalk] RE: Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Dan Wilder
On Sun, Nov 23, 2003 at 04:19:56PM -0800, Logan Harbaugh wrote: I don't have control over how articles are edited. As it was, there were six software packages in the original test, and they pulled one out because there wasn't as much room as they'd originally thought. Perhaps the Editors of

Re: [SAtalk] bayes over NFS locking

2003-11-24 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Adam Denenberg writes: Thanks justin. is there a way to prevent the rebuild (or expire) from happening on the nfs client side? i would rather script a frequent rebuild/expire on the nfs server side, and just let the clients do their thing. I get

Re: [SAtalk] bayes over NFS locking

2003-11-24 Thread Adam Denenberg
Thanks justin. is there a way to prevent the rebuild (or expire) from happening on the nfs client side? i would rather script a frequent rebuild/expire on the nfs server side, and just let the clients do their thing. I get the following error if a mail has not been seen in a while, just want to

Re: [SAtalk] bayes over NFS locking

2003-11-24 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Adam Denenberg writes: Hey, How are people handling the locking issues with Bayes over NFS on a high traffic mail server? Currently i have bayes_learn_to_journal 1 turned on, but an sa-learn --rebuild seems to be taking quite some time (i have

Re: [SAtalk] RE: Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Ken Bass
While I do consider myself pretty technical, after reading the article I don't think it is fair to spamassassin, but I dont think it was libelous as one person suggested. I was able to get SA installed in less than 1 hour. I downloaded the tarball, installed it, created a .procmailrc file to

[SAtalk] Re: Really bad Infoworld article

2003-11-24 Thread Chris Barnes
Given that the date of the article is November, 2003 and probably was written months in advance to make the deadlines he should at the very least have used 2.55 -- which was a darned good product. But, the insisitence of using a year-old (at least) release seems, to me at least, to point up

RE: [SAtalk] Your infoworld Article

2003-11-24 Thread Jennifer Fountain
Bravo! Well Said! -Original Message- From: Evan Platt [mailto:[EMAIL PROTECTED] Sent: Monday, November 24, 2003 2:46 PM To: [EMAIL PROTECTED] Cc: SpamAssassin Logan: I read with great displeasure your InfoWorld article on Fighting Spam, and felt the need to make a few corrections,

RE: [SAtalk] Really bad Infoworld article

2003-11-24 Thread Mark Spieth
The cost here is the key, If you have only a few users, that's one thing. I manage 10,000 users, so those services would cost me between 70k and 150k a year... That's 3-4 good admins worth of salary for what the yearly subscription would cost, Since using SA I have only 1 technician doing the

[SAtalk] Re: Really bad Infoworld article

2003-11-24 Thread Chris Barnes
Martin Radford [EMAIL PROTECTED] wrote: At Fri Nov 21 23:34:35 2003, Jeremy Dold wrote: Does someone want to respond to this guy and point out the obvious? http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc It's a bit embarrassing for the journalist that he was happy to contact

RE: [SAtalk] Really bad Infoworld article

2003-11-24 Thread Chris Santerre
OMG! That is funny as hell! :-) Kevin Railsback is Test Center operations manager at InfoWorld. Maybe he doesn't work there anymore! Did you email that to the author? --Chris -Original Message- From: Jeremy Dold [mailto:[EMAIL PROTECTED] Sent: Sunday, November 23, 2003 2:32 PM

RE: [SAtalk] Score

2003-11-24 Thread Mike Kuentz (2)
http://spamassassin.taint.org/faq/index.cgi?req=showfile=faq04.017.htp -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Alan Munday Sent: Sunday, November 23, 2003 4:57 PM To: [EMAIL PROTECTED] Subject: [SAtalk] Score Just had a mail in

Re: [SAtalk] RE: Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Ken Bass
I think a correction should be printed saying that they tested an old version and that even Infoworld uses spamassassin internally on its own servers. See the 7/18/2003 article written by Kevin Railsback, IT guy at Infoworld. Perhaps some insights from Mr. Railsback would highlight why After

[SAtalk] turning off RBL's

2003-11-24 Thread Adam Denenberg
How do i check verbosely which RBLs are gettting called? I have the following in my local.cf file, however the -D output shows 11 RBL's getting queried. can someone advise whats going on here? thanks -D output -- @40003fc27bed0f8bddb4 debug: RBL: success for 10 of 11 queries

[SAtalk] Evil rules, popcorn, etc too much?

2003-11-24 Thread Matt Van Gordon
I run the spam filtering system at my company and I have been reluctant to add the new evil rules or any new rules since about a month ago when I changed the system so that spams where bounced rather than tagged. If I added the new rules would I likely increase my false positives? Right

[SAtalk] Re: Really bad Infoworld article

2003-11-24 Thread Chris Barnes
Chris Santerre [EMAIL PROTECTED] wrote: Kevin Railsback is Test Center operations manager at InfoWorld. Maybe he doesn't work there anymore! Did you email that to the author? OMG! I know him! He used to be one of the help desk guys here at Texas AM back when he was an undergrad!. (if it's

[SAtalk] what's up with spamassassin ?!

2003-11-24 Thread Ricki
Hi I have redhat 7.3 with two 600 processors I recently upgraded from 2.54 to 2.6 and i use perl 5.6.1 and sendmail. It works great to filter the spam ! but.. The system load seems to be very high! At times the load is over 25, goin to the most i have seen 50.02 I use the

Re: [SAtalk] sa-learn crash and coredump

2003-11-24 Thread Simon Byrnand
At 10:58 21/11/2003 -0800, Ted Cabeen wrote: I'm getting a crash and core-dump when I try to run sa-learn -D --force-expire on my sizeable bayes database. Here's the output I get, and the backtrace from the core file. debug: Score set 0 chosen. debug: running in taint mode? no debug: using

RE: [SAtalk] Evil rules, popcorn, etc too much?

2003-11-24 Thread Chris Santerre
The FP rate for all of these is just about zero. I recommend popcorn, weeds, and backhair and see how it goes from there. Then take evilrules, cut the bottom half off, and see how it goes. Then try the whole evilrules. How many emails do you get a day on the system? How much memory? CPU?

RE: [SAtalk] Evil rules, popcorn, etc too much?

2003-11-24 Thread Matt Van Gordon
The system is a P2-266 with 256 megs of ram and it handles ~2250 emails a day. -Original Message-From: Chris Santerre [mailto:[EMAIL PROTECTED]Sent: Monday, November 24, 2003 2:39 PMTo: 'Matt Van Gordon'; [EMAIL PROTECTED] Sourceforge. Net (E-mail)Subject: RE: [SAtalk]

RE: [SAtalk] Evil rules, popcorn, etc too much?

2003-11-24 Thread Chris Thielen
Chris Santerre said: The FP rate for all of these is just about zero. I recommend popcorn, weeds, and backhair and see how it goes from there. Then take evilrules, cut the About zero, sure, but definately not zero :) The only false positive I've had so far was pushed over the threshold (5.0)

[SAtalk] Where is spamassassin?

2003-11-24 Thread TUNC ERESEN
Nov 24 20:12:16 ns3 MailScanner[2953]: SpamAssassin installation could not be found Mailscanner could not find spamassasin, So how could I tell it find it? Tunc --- This SF.net email is sponsored by: SF.net Giveback

Re: [SAtalk] v0 Bayes expiry run (Was: sa-learn crash and coredump)

2003-11-24 Thread Theo Van Dinter
On Mon, Nov 24, 2003 at 02:49:10PM -0800, Ted Cabeen wrote: to my v0 bayes database. Is there any way to do an expiry run on a v0 database with 2.60 without upgrading the DB to v2? I'd like to pare down the size of the DB before I upgrade. Nope. 2.60 can only write v2. Can it be done with

Re: [SAtalk] v0 Bayes expiry run (Was: sa-learn crash and coredump)

2003-11-24 Thread Ted Cabeen
Simon Byrnand [EMAIL PROTECTED] writes: I could be wrong, but I'd say that bus error means your system either ran right out of memory (including virtual memory) during the execution of sa-learn (and sa-learn using extremely large amounts of memory is possible in some circumstances) or the

RE: [SAtalk] What level to delete at?

2003-11-24 Thread Richard Bewley
What are some of the setups out there? What score do you delete at? I don't delete them either. What happens on our setup, is that anything that scores over 5.0 gets moved to an automatic SPAM queue, where are users can go to check which messages were caught, and choose to send them to their

RE: [SAtalk] what's up with spamassassin ?!

2003-11-24 Thread Richard Bewley
and how can i throttling the number of simultaneous instances. In postfix, you can specify local_destination_concurrency_limit and default_destination_concurrency_limit, which will control how many are delivered to spamd at any given time. I am using a setup by which I'm specifying the content

Re: [SAtalk] v0 Bayes expiry run

2003-11-24 Thread Ted Cabeen
Theo Van Dinter [EMAIL PROTECTED] writes: On Mon, Nov 24, 2003 at 02:49:10PM -0800, Ted Cabeen wrote: to my v0 bayes database. Is there any way to do an expiry run on a v0 database with 2.60 without upgrading the DB to v2? I'd like to pare down the size of the DB before I upgrade. Nope.

RE: [SAtalk] What level to delete at?

2003-11-24 Thread Alan Munday
I tag at 5.0 and delete (don't deliver) at 10.0 I see false positives between 5.0 and 9.9 but not over 10.0 Alan -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Chapman Sent: 24 November 2003 21:58 To: [EMAIL PROTECTED] Subject: [SAtalk] What

Re: [SAtalk] v0 Bayes expiry run

2003-11-24 Thread Ted Cabeen
Simon Byrnand [EMAIL PROTECTED] writes: At 14:49 24/11/2003 -0800, Ted Cabeen wrote: Fair enough. I have been having problems with having enough memory for bayes operations. In an attempt to resolve them, I've gone back to my v0 bayes database. Is there any way to do an expiry run on a v0

Re: [SAtalk] v0 Bayes expiry run (Was: sa-learn crash and coredump)

2003-11-24 Thread Simon Byrnand
At 14:49 24/11/2003 -0800, Ted Cabeen wrote: Simon Byrnand [EMAIL PROTECTED] writes: I could be wrong, but I'd say that bus error means your system either ran right out of memory (including virtual memory) during the execution of sa-learn (and sa-learn using extremely large amounts of memory

Re: [SAtalk] v0 Bayes expiry run

2003-11-24 Thread Theo Van Dinter
On Mon, Nov 24, 2003 at 03:55:51PM -0800, Ted Cabeen wrote: expired old Bayes database entries in 894 seconds 5264 entries kept, 2169216 reprieved, 0 deleted token frequency: 1-occurence tokens: 0.04% token frequency: less than 8 occurrences: 0.02% What does is mean for entries to be

[SAtalk] How can I test my local.cf ????

2003-11-24 Thread Mairhtin O'Feannag
Hello, I made changes to my local.cf file, and they don't seem to be taken. I modified the lines to : # Whether to change the subject of suspected spam rewrite_subject 1 # Text to prepend to subject if rewrite_subject is used subject_tag ##SPAM## and yet, STILL I get

RE: [SAtalk] paris hilton

2003-11-24 Thread ian douglas
Anyone have any good obfuscation rules for p4r1s h1|+0n spam? I'm getting a ton of these every day... http://sandgnat.com/cmos/cmos.jsp gave me a good result, but will not match a plus sign to substitue for a 't' character. -id --- This

Re: [SAtalk] RE: Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Evan Platt
--On Sunday, November 23, 2003 4:19 PM -0800 Logan Harbaugh [EMAIL PROTECTED] wrote: The article as I originally wrote it wasn't intended to be anti-SpamAssassin, but I'd still have to say that even if the performance at catching spam and false positives were comparable to the other

RE: [SAtalk] RE: Re[2]: http://www.infoworld.com/article/03/11/14/45FEspam_1.html?s=tc

2003-11-24 Thread Evan Platt
--On Monday, November 24, 2003 4:24 PM -0800 Logan Harbaugh [EMAIL PROTECTED] wrote: The point of using the old version of SpamAssassin was to show how much the technology has changed in the last few years. That was stated in my original article but edited out of the final version. (I love

RE: [SAtalk] What level to delete at?

2003-11-24 Thread Richard Bewley
Well, I wrote that part of it myself. Basically, after SA tags the message as [SPAM], a header check on Postfix HOLDs the message to /usr2/spool/postfix/hold/*/*. At regular intervals (once every 15 minutes), my script runs and pulls apart those held messages, and extracts the To, From, Date,

Re: [SAtalk] v0 Bayes expiry run

2003-11-24 Thread Ted Cabeen
Theo Van Dinter [EMAIL PROTECTED] writes: On Mon, Nov 24, 2003 at 03:55:51PM -0800, Ted Cabeen wrote: expired old Bayes database entries in 894 seconds 5264 entries kept, 2169216 reprieved, 0 deleted token frequency: 1-occurence tokens: 0.04% token frequency: less than 8 occurrences: 0.02%

Re: [SAtalk] How can I test my local.cf ????

2003-11-24 Thread Kai MacTane
At 11/24/03 04:21 PM , Mairhtin O'Feannag wrote: I made changes to my local.cf file, and they don't seem to be taken. If you're using spamd, did you turn off spamd and restart it? It only reads its config on startup. --Kai MacTane

RE: [SAtalk] paris hilton

2003-11-24 Thread Yackley, Matt
Haven't seen the spam but one of these should work if your example text is always the same: headerYM_HS_OBFU_PARIS Subject =~ /\bp4r1s\b/i describe YM_HS_OBFU_PARIS Subject contains p4r1s score YM_HS_OBFU_PARIS 10.0 body YM_B_OBFU_PARIS /\bp4r1s\b/i describe YM_B_OBFU_PARIS

RE: [SAtalk] paris hilton

2003-11-24 Thread ian douglas
Haven't seen the spam but one of these should work if your example text is always the same: No, it's different... started out being non-obfuscated, but has gradually gotten more and more l337. -id --- This SF.net email is sponsored by:

[SAtalk] SpamAssassin/Milter not scan outgoing emails

2003-11-24 Thread Chris Cook
Hello, We are currently using Spamassassin + sendmail + spamass-milter to tag our mail, but we would like to not have outgoing mail scanned. lda and outgoing mail are on the same box. I have tried to just use spamassassin+procmail but the load spawned a million procmail instances and

Re: [SAtalk] paris hilton

2003-11-24 Thread Greg Cirino - Cirelle Enterprises
Here is a net block of a spammer in training and had the misfortune (on our network at least) to hit one of our control addresses (repeatedly) inetnum: 203.192.162.192 - 203.192.162.255 netname: HAN-SERVER-KR-NETBLK1 country: KR descr:Hanserver.Net The following is the

Re: [SAtalk] SpamAssassin/Milter not scan outgoing emails

2003-11-24 Thread Chris Cook
Yes, this would give the message a 100+ score but what I want to do is reduce load on the box and not scan outgoing mail at all. Thanks, Chris Stevens, John wrote: I have a line like this in my local.cf: whitelist_from *my.domain.name TUSC

[SAtalk] Re: What level to delete at?

2003-11-24 Thread Scott A Crosby
On Mon, 24 Nov 2003 16:58:19 -0500, Matt Chapman [EMAIL PROTECTED] writes: Hello, I have been deleting at a score of 5 via Mimedefang. I notice that some spam is scoring at 3.5 and 4ish. Is is better to tag at say 3-4.9 and delete if it is any higher? What are some of the setups out

RE: [SAtalk] What level to delete at?

2003-11-24 Thread Richard Bewley
Hello, We get approximately 1 gig of mail per day, and our system catches (yesterday at least) 41,185 spam messages per day. This setup, too, is used as simply a relay to an IMail server running on a Windows machine. Our SPAM queue works independent of the Windows pop3 mailserver. Richard

[SAtalk] report_safe attatches all mail?

2003-11-24 Thread Adam Denenberg
Hey, I have 2.55 and 2.60 running. I would like to use report_safe 2, to attach any mime dangerous spam messages. This seems to work in 2.55, however in 2.6, every spam message appears to be getting attached as an attachment with the message saying Spam software has detected. Shouldnt

Re: [SAtalk] Re: What level to delete at?

2003-11-24 Thread Greg Cirino - Cirelle Enterprises
Scott wrote: | Having a single spam folder is a very bad decision | I never delete automatically, but the high catagory gets a 10 second | glance every week, medium gets 20 seconds every week, and low gets 10 | seconds a day. Even when I 'delete', I am archiving it for my own spam | processing

Re: [SAtalk] What level to delete at?

2003-11-24 Thread Simon Byrnand
At 16:58 24/11/2003 -0500, Matt Chapman wrote: Hello, I have been deleting at a score of 5 via Mimedefang. I notice that some spam is scoring at 3.5 and 4ish. Is is better to tag at say 3-4.9 and delete if it is any higher? What are some of the setups out there? What score do you delete at?

Re: [SAtalk] report_safe attatches all mail?

2003-11-24 Thread Adam Denenberg
ok scratch this, appears every message with report_safe 0 does this. thats fine. however, i also notice that report_safe seems to be removing (or not preserving) the headers when the message gets re-written. The headers in the report are correct (bottom part of the message), however they

  1   2   >