[SAtalk] Domain Name Starts With Numbers - exception

2004-01-14 Thread Roger Merchberger
I've noticed a few false positives in one of the extended rulesets, the file is /etc/mail/spamassassin/90_FVGT.cf, and the rule is FVGT_u_DOM_START_NUM. Unforch, our domain (valid for 7 years now) is 30below.com, and a few people who like to send jokes to one another are getting flagged (the th

Re: [SAtalk] Continuing saga of runaway spamd

2004-01-07 Thread Roger Merchberger
Rumor has it that Eric W. Bates may have mentioned these words: We experienced a similar problem on FreeBSD. The problem was addressed when we upgraded perl from 5.5 to 5.8. As a workaround until we managed to upgrade we launched spamd under the control of Dan Bernstein's Daemontools which can

RE: [SAtalk] Spell Checking the Subject Header (RESULTS)

2003-12-31 Thread Roger Merchberger
Rumor has it that Jennifer Wheeler may have mentioned these words: > On 12/31/03, Casper Gasper wrote: > > > >Things like, '4 consonants in a row are not an English word'. > > Shortstop? Matchstick? :) > > Seriously, though, looking for patterns is an interesting idea. For > instance, English si

Re: [SAtalk] REQUEST TO SPAMASSASSIN AUTHORS

2003-12-31 Thread Roger Merchberger
Rumor has it that Charles Gregory may have mentioned these words: [snippety] Rule: BODY RULENAME /a string/i Coded Rule: BODY RULENAME /a{1,3} s{1,3}t{1,3}r{1,3}i{1,3}n{1,3}g{1,3}/i You get the idea. This could be quite burdensome to implement manually, but an easy enough thing to automate 'behind

Re: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!

2003-12-04 Thread Roger Merchberger
At 19:13 12/3/2003 -0600, mikea wrote: On Wed, Dec 03, 2003 at 07:17:28PM -0500, Rick Macdougall wrote: > Peter P. Benac wrote: > > > I have been using Emacs for almost 20 years. Is there any other editor :) > > > > :s/old stuff/newstuff/g only works if you only have one instance of "old > >

[SAtalk] Re: A faster and more scalable matching engine.

2003-11-25 Thread Roger Merchberger
Rumor has it that Scott A Crosby may have mentioned these words: On Tue, 25 Nov 2003 13:11:10 -0500, Roger Merchberger <[EMAIL PROTECTED]> writes: The response was that at a half-second a message is enough. You prolly didn't get many qmailers to respond, then... If it wasn't fo

Re: [SAtalk] A faster and more scalable matching engine.

2003-11-25 Thread Roger Merchberger
At 03:27 11/25/2003 -0600, Scott A Crosby wrote: I mentioned this about a year ago, but now that people are starting to write rulesets with hundreds to thousands of new rules, I thought I'd bring it up again. How happy are people with the performance of SA, especially with all of thee new rules? Th

Re: [SAtalk] SA load crashing server?

2003-10-28 Thread Roger Merchberger
At 08:24 10/28/2003 -0500, [EMAIL PROTECTED] wrote: [[ Dude! Long time, no read... but who could forget an email address like yours... ;-) ]] For the past couple of weeks or so, like most of you, I've seen total spam volume almost double again. At this point, the server in question (dual PIII-5

Re: [SAtalk] [RD] Domain has digits - test rules

2003-10-24 Thread Roger Merchberger
At 15:24 10/23/2003 -0400, Fred I-IS.COM wrote: I'll have to admin, I was bored this morning... I had to admin this morning as well... ;-) I created a set of rules to look for domains that include numbers. IE: www.domain3.com IE: www.domain3domain.com Etc.. Take a look at the attachment, I'm

RE: [SAtalk] [OT] What is next step?

2003-10-22 Thread Roger Merchberger
Rumor has it that Stewart, John may have mentioned these words: [snippety] One thing that might be very useful is for every email coming through that is scanned, to log not only the spam level (which is already done with amavisd-new, and I would assume for those using spamd) but the previous hop of

Re: [SAtalk] [OT] What is next step?

2003-10-20 Thread Roger Merchberger
At 15:37 10/20/2003 -0400, Chris Santerre wrote: [snip] What is the next step? We have all posted stats that prove that over 50% of email is spam. Now that we can tag or block (to user), it doesn't stop the traffic. I still have 50% traffic on the server as useless. What do we do? Get rid of SMTP.

Re: [SAtalk] Spamassassin updates

2003-10-16 Thread Roger Merchberger
At 12:45 10/16/2003 -0400, Terry Milnes wrote: Hold it a sec, not all rpms contain the source, in fact unless things have changed I thought that most contained precompiled binaries, and that was the problem with them. Correct. Source RPMS (.src.rpm) have the source; otherwise (unless it's a perl

Re: [SAtalk] Re: Too many rules?

2003-10-15 Thread Roger Merchberger
At 18:35 10/15/2003 -0400, [EMAIL PROTECTED] wrote: But the way qmail-rbl works it will deny the mail based on the lookup, not weight it appropiatly. Then put the more 'sane' rbls[1] in your run script which will reduce a bit of your incoming spam (that SA won't have to scan), and the ones you wi

Re: [SAtalk] [RD] Smaller and slightly better Evilrules!!!

2003-10-15 Thread Roger Merchberger
At 13:18 10/15/2003 -0400, Chris Santerre wrote: Ok, I just did another update. I took the spamtrap for the last 15 days and got this down to 944 rules. This should be much better and fresher. I also edited the reg2rule.pl script to include the trailing 'i' so case doesn't matter anymore. I also sa

Re: [SAtalk] Too many rules?

2003-10-15 Thread Roger Merchberger
At 21:43 10/14/2003 -0400, Paul Farber wrote: I tried the evilrules.cf on my dual AMD 1Gb 2 Ultra-SCSI qmail server and it died in minutes. I run 100K+ emails in a 24 hour period. (98+% are tagged as spam) After reboot I see that spamd takes a while to catch up... avg is 30+ seconds per msg (all r

RE: [SAtalk] [RD] Evil rules HUGE update!

2003-10-14 Thread Roger Merchberger
At 15:39 10/14/2003 -0500, Stewart, John wrote: Okay, I wanted to drop in your evilrules.cf file into my SA setup, and I did so using (in /etc/mail/spamassassin/): lynx -dump http://www.merchantsoverseas.com/wwwroot/gorilla/evilrules.cf > evilrules.cf However, this seems to cause problems. After t

RE: [SAtalk] Automatic Unsubscribe

2003-10-14 Thread Roger Merchberger
At 14:06 10/14/2003 -0400, Colin A. Bartlett wrote: Leon Oosterwijk Sent: Tuesday, October 14, 2003 12:45 PM > I'd like to set up a couple such honeypots and see what the level of > attraction is they get. Perhaps this would make a good research project. I was curious as to how many spams actually

[SAtalk] SA memory utilization (Was: Evil rules HUGE update!

2003-10-11 Thread Roger Merchberger
At 17:35 10/9/2003 -0400, Chris Santerre wrote: Well I got around to updating my evilrules.cf file. Ummm.are you sitting down? The first version had 274 rules for spam hosts. This version has 1758 rules!! Yup! I went thru it by hand 3 times before running the reg2ule.pl script. I also posted a

[SAtalk] Solved! (Was: spamd & qmail, round 2...

2003-10-02 Thread Roger Merchberger
[[ Dangit -- I hate Eudora's "CTRL-E" for Send Immediately! It clashes *really hard* with *nix's Go To End Of Line! Sorry Everybody!!! ]] Just to let everyone know - I did fix my problem - by killing the patient! I basically rewrote ifspamh in Python, and included a basic Maildir delivery mecha

[SAtalk] Solved! (Was: spamd & qmail, round 2...

2003-10-02 Thread Roger Merchberger
. Icberg computers sounds kinda cool. Thanks You seem to know some German? If you want to learn some more, feel free to mail me off-list Tschuess Ralf G. Original Message - From: "Roger Merchberger" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, Octob

Re: [SAtalk] Re: spamd & qmail, round 2...

2003-10-01 Thread Roger Merchberger
Rumor has it that Ralf Guenthner may have mentioned these words: I'm also running spamd under supervise and just recently I asked this list why I couldn't get the -D option to work. Where were you guys then? ;-) I wasn't here yet... so I have an excuse! ;-) I solved it in the meantime by sending

Re: [SAtalk] Re: spamd & qmail, round 2...

2003-10-01 Thread Roger Merchberger
Rumor has it that Klaus Alexander Seistrup may have mentioned these words: On Roger Merchberger wrote: > 1) Is anyone else running spamd from tcpserver? I've been running spamd under dæmontools/supervise with a run file similar to yours for months -- works like a charm. (You did mean s

[SAtalk] spamd & qmail, round 2...

2003-09-30 Thread Roger Merchberger
How-doo! ... Awrighty ... let's keep it a bit simpler... ;-) I've changed how spamassassin is started - instead of using: /etc/rc.d/init.d/spamassassin start I have now created a run file using qmail's tcpserver & friends, here: /service/smtpd/run and this file contains: #!/bin/sh exec /usr/

[SAtalk] qmail, ifspamh, ksh & "Out of Memory"

2003-09-29 Thread Roger Merchberger
How-doo! New to the list, but not new to computers. Been running qmail for almost a decade, spamassassin for about 1 year, but I seem to have hit a stumper... My setup: Was running spamassassin 2.55, upgraded to 2.6 (just in case); in daemon mode, "several different versions" of ifspamh [1], q