how do you turn _off_ AWL ?
also, where would one put sitewide whitelists ? (assuming
/etc/mail/spamassassin as default directory)
thanks in advanced
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools
Did it change the spam message over the 5.0 threshold? or did it just
reduce the score of some insanely high scoring spam by 4.5?
Read the very fine FAQ on this matter...
http://wiki.spamassassin.org/w/AwlWrongWay
It explains what the AWL REALLY is, which is not what you might think it is.
At
I've seen several instanaces where the AWL mechanism has cause non-spam
email to be classed as spam. Here is example report from one of these:
Content analysis details: (50.7 points, 5.0 required)
pts rule name description
--
Peter McGarvey Sent: Friday, December 12, 2003 8:46 AM
I've seen several instanaces where the AWL mechanism has cause non-spam
email to be classed as spam. Here is example report from one of these:
-4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
56 AWL
At 01:46 PM 12/12/03 +, Peter McGarvey wrote:
pts rule name description
-- --
-4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.]
56 AWL
At 10:10 AM 12/12/2003, Colin A. Bartlett wrote:
I have found that AWL works quite well and I keep it enabled. The only time
that it is a pain is if I send myself or someone else a test using GTUBE.
That f's up the AWL until I send a few hams. There's a way to remove the
sender from the AWL but I
Matt Kettler Sent: Friday, December 12, 2003 11:16 AM
At 10:10 AM 12/12/2003, Colin A. Bartlett wrote:
I have found that AWL works quite well and I keep it enabled. The only
time
that it is a pain is if I send myself or someone else a test using GTUBE.
That f's up the AWL until I send a few
At 08:13 PM 10/30/03 -0800, Jeremy Hein wrote:
I added use_auto_whitelist 0 to
/etc/mail/spamassassin/local.cf
but it still subtracts AWL in my report.
Maybe I'm writing to the wrong config file? How do I find out where the
right one is and how do I find out if spamassassin is using that option.
Thanks, but I realized that I was using redhat's service spamassassin
start command and the script sent spamd the -a command. Thanks again for
your help.
Jeremy
On Thu, 2003-10-30 at 23:10, Matt Kettler wrote:
At 08:13 PM 10/30/03 -0800, Jeremy Hein wrote:
I added use_auto_whitelist 0 to
Hi,
Does anyone know what this is and how to configure it? It seems to be
subtracting from the score different amounts each time. I can't figure
out why or what to do about it.
AWL: Auto-whitelist adjustment
Thanks,
Jeremy
---
This SF.net
At 08:00 PM 10/30/2003, Jeremy Hein wrote:
Hi,
Does anyone know what this is and how to configure it? It seems to be
subtracting from the score different amounts each time. I can't figure
out why or what to do about it.
Read the FAQ.. the AWL is a score averager, and it's supposed to vary in
I added use_auto_whitelist 0 to
/etc/mail/spamassassin/local.cf
but it still subtracts AWL in my report.
Maybe I'm writing to the wrong config file? How do I find out where the
right one is and how do I find out if spamassassin is using that option.
Thanks for your help,
Jeremy
On Thu,
The last little bit of configuration is at hand.. SA 2.6 is running, on RH9,
Qmail, Qmail-Scanner.. Sitewide Bayes.. Works wonderfully!!!
But I can't get the AWL running! I have enabled it in the local.cf and
given it a directory with the correct permissions.. But I see no evidence
that it is
!
- Original Message -
From: Robert Leonard III [EMAIL PROTECTED]
To: 'Spamassassin-Talk (E-mail)' [EMAIL PROTECTED]
Sent: Thursday, October 16, 2003 10:56 PM
Subject: [SAtalk] AWL not running... Or is it?? Please help.
The last little bit of configuration is at hand.. SA 2.6 is running, on
RH9
All the documentation for version 2.60 says that autowhitelist is turned on
by default and that by default the autowhitelist is stored in each users
config directory (e.g. ~/.spamassassin/autowhitelist)
When I installed spamassissin, it installed with no problem and is doing a
great job of
Friends,
I'm new to SA and have two questions to pose to the group.
1. Is it possible to re-set AWL scores to 0 for particular e-mail
addresses?
2. is there a Win32 version of an Outlook to RFC822 mailbox converter, (to
use with messages destined for sa-learn).
Thanks,
Marc
At 04:44 PM 10/8/2003, Marc Steuer wrote:
1. Is it possible to re-set AWL scores to 0 for particular e-mail
addresses?
Yep, see the manpage for spamassassin:
spamassassin --remove-addr-from-whitelist
---
This SF.net email is sponsored by:
Howdy,
Just upgraded to 2.60, seems to work great for the most part! Catching
even more spam than before (as to be expected).
One thing which has become a bit of a problem - AWL seem to be much slower
in some cases, although I'm not sure why. My AWL is currently 146M, so
it's pretty hefty.
Hi,
How can I tweak or turn off (0.0) the
AWL automatic whitelist adjustment, that in effect gives a credit towards the
5.0 points necessary to trigger a SPAM message?
In the long list of tests, I can find
no protocol for a rule to accomplish this.
Thanks, rf
At 12:44 PM 8/18/2003 -0400, rf wrote:
Hi,
How can I tweak or turn off (0.0) the AWL automatic whitelist adjustment,
that in effect gives a credit towards the 5.0 points necessary to trigger
a SPAM message?
In the long list of tests, I can find no protocol for a rule to accomplish
this.
Don't
Ok, USER_IN_WHITELIST has nothing to do with the AWL, but yes, it does look
at Sender:
Snipping from EvalTests.pm's subroutine all_from_addrs, which is used in
check_from_in_whitelist:
return $self-{main}-find_all_addrs_in_line
($self-get ('From') . # std
debug: lock: created /home/harvey/.spamassassin/auto-whitelist.lock.penguin.3452
debug: lock: 3452 trying to get lock on /home/harvey/.spamassassin/auto-whitelis
t pass 0
debug: lock: link to /home/harvey/.spamassassin/auto-whitelist.lock ok
debug: lock: unlinked
Tom Allison said:
debug: lock: created /home/harvey/.spamassassin/auto-whitelist.lock.penguin.3
452
debug: lock: 3452 trying to get lock on /home/harvey/.spamassassin/auto-white
lis
t pass 0
debug: lock: link to /home/harvey/.spamassassin/auto-whitelist.lock ok
debug: lock: unlinked
Yes, I know about that issue with a global AWL. I've even authored some of
the posts discussing how horribly the AWL performs when there's a global
database.
So yes, I understand how the AWL smears your all_spam_to scores all over
the place and causes problems. I understand this and the
Ok, I don't know the answer to your question, but I'm wondering why you're
even asking it.
By default if you have different user_prefs files, then you don't have a
global AWL database.
The global AWL case only happens if SA is always run as one user, such as
root when run from a milter. In
Matt,
did you ever deploy SA system-wide and have all_spam_to for
some user set? In the case where you scan a mail once before any
delivering, SPAM comes through if only one receiver is in
all_spam_to and the spammers address goes into your central AWL
file with a very low score. The next SPAM
Hi,
what is the reason for auto_whitelist_path being privileged? I want to
overwrite the setting from the global local.cf file in the user_prefs
file. Otherwise whitelist_to will lower scores for SPAM and this will
poison my global AWL.
cu,
Jan
Matt Kettler said:
From what I can tell very few, if any at all, of the SpamAssassin
developers use a global AWL. The fact that the severe 2.42 white listing
spammers using dictionary attacks against sites with global AWLs wasn't
caught prior to release strongly suggests they don't.
On
Over the last week I've started receiving more and more spam with negative
scores
due to the AWL. About half an hour ago I reset the AWL be sure (I also did
this
when installing 2.43). check_whitelist is already showing the AWL
whitelisting
spam:
tmh@betty:~/spamassassin-2.41/tools$
Well, this sounds reasonable, unfortunately I suspect it would be rather
difficult and kludgey for the AWL to be able to tell the difference. The
AWL operates as a score averager, nothing more, nothing less.
Personally, I think the AWL is in general a fundamentally broken concept,
however
Personally, I think the AWL is in general a fundamentally broken concept,
however there are people out there who think otherwise. I will
likely never use the AWL feature of SA in any form of production
environment.
I see very minimal benefit from it's use, and a very long history of
severe
Hi!
Using 2.42 (Debian testing package on woody)
AWL seems not to work the way it supposed to be:
I have removed the AWL files in order to reset the AWL data.
Than I have piped through the same spam message (9.50 hits, 5 required)
several times with 'spamassassin -a spam-mail
On Wed, Oct 23, 2002 at 03:08:47AM +0200, Steffen Evers wrote:
But it does exactlly the opposite: AWL gives -5.0 points, so it is no
longer recognized as spam!
Is this an intended behaviour?
Yes... sort of. It WAS intended behaviour at the time. But we are
wiser now, and that change was
On October 22, 2002 06:26 pm, Duncan Findlay wrote:
On Wed, Oct 23, 2002 at 03:08:47AM +0200, Steffen Evers wrote:
But it does exactlly the opposite: AWL gives -5.0 points, so it is
no longer recognized as spam!
Is this an intended behaviour?
Yes... sort of. It WAS intended behaviour at
On Tue, Oct 22, 2002 at 06:58:31PM -0700, joe wrote:
On October 22, 2002 06:26 pm, Duncan Findlay wrote:
On Wed, Oct 23, 2002 at 03:08:47AM +0200, Steffen Evers wrote:
But it does exactlly the opposite: AWL gives -5.0 points, so it is
no longer recognized as spam!
Is this an
Hmm? I upgraded to 2.43 the day it was released and noticed all my
spam email was being let through after about 2 weeks. I run spamd with
the -a (autowhitelist optio) on. I have since turned off the
auto-whitelist option and everything works fine since.
Version 2.43 definitely fixed
On October 22, 2002 07:17 pm, Michael Moncur wrote:
Hmm? I upgraded to 2.43 the day it was released and noticed all
[snip]
It sounds like your particular situation isn't one where
autowhitelisting will do much good.
My conclusion too. I use tmda to handle my 1-1 type correspondence and
] at 172.1.1.1? If
it's [EMAIL PROTECTED] at 172.1.1.1, then AWL would be basically saying
[EMAIL PROTECTED] is a spammer which he's not.
-Original Message-
From: Lars Hansson [mailto:lars;unet.net.ph]
Sent: Saturday, October 19, 2002 1:34 AM
To: [EMAIL PROTECTED]
Subject: Re: [SAtalk] AWL issue
On 19 Oct 2002, Lars Hansson moaned:
On Sat, 2002-10-19 at 01:22, Matt Kettler wrote:
if it's 2.43, the AWL tracks both the from address AND the orginating IP.
Uh, I do hope it's the IP that actually delivered the mesage to you that
is being tracked and not the originating one?
I hope it's
On a related issue, I just upgraded to 2.43 primarily because of the
earlier AWL problems.
My question is, how long will it take for the erroneous AWL entries
to work their way out of my AWL db?
Would I be better off deleting the AWL db and letting it start over?
Thanks,
Ollie
On Fri, Oct
.
-Original Message-
From: Ollie Acheson [mailto:oacheson;acheson.org]
Sent: Saturday, October 19, 2002 10:34 AM
To: [EMAIL PROTECTED]
Subject: Re: [SAtalk] AWL issue
On a related issue, I just upgraded to 2.43 primarily because of the
earlier AWL problems.
My question is, how long
Should SA have a minimum message size check to counter an AWL score. I
had someone sending test messages, but because their AWL score was 23.5
it was tagged as spam. I'm still scratching my head on how they got
such a high AWL score.
My thought on that matter is that if a spammer was to send
What version of SA are we talking about?
if it's 2.43, the AWL tracks both the from address AND the orginating IP.
it would be highly unlikely that a spammer could forge such a thing and
drive their score up.
Can you provide some more detail about which SA you are running? there's
major
: Matt Kettler [mailto:mkettler;evi-inc.com]
Sent: Friday, October 18, 2002 1:23 PM
To: Rose, Bobby; [EMAIL PROTECTED]
Subject: Re: [SAtalk] AWL issue
What version of SA are we talking about?
if it's 2.43, the AWL tracks both the from address AND the orginating
IP.
it would be highly unlikely
Hi everyone. I've looked through the archives and couldn't find a solution.
I see other people have had this problem though so I thought I'd post.
Here's the situation. I'm sure everyone has seen the spam that comes in
looking like you sent it to yourself. I get spam sent to me from me...
Same here. Lots of obvious spam, many rules invoked, but AWL letting
the dirt in. Very disappointing.
Ollie
On Mon, Oct 07, 2002 at 12:07:36PM -0500, Rob.Remus wrote:
Since upgrading from 2.40 to 2.42 we have been seeing some strange stuff
with the AWL. We're getting obvious spam matching
Yes, the 2.42 AWL had a new feature that turned out to be a bug. It's also
a problem that's already been recognized and is already fixed in CVS.
http://www.hughes-family.org/bugzilla/show_bug.cgi?id=1071
Relevant quotes:
--- Additional Comments From [EMAIL PROTECTED] 2002-10-08 06:51
Great. I will look for 2.43. In the meantime, off goes AWL.
Ollie
On Sat, Oct 12, 2002 at 05:15:10PM -0400, Matt Kettler wrote:
Yes, the 2.42 AWL had a new feature that turned out to be a bug. It's also
a problem that's already been recognized and is already fixed in CVS.
OK, I've made the AWL now gradually lower scores for a From/IP address
combo over time (in HEAD); I reckon this should be safe, now that we track
IPs and the forged-From thing is not a problem any more.
--j.
---
This sf.net email is sponsored
I am running spamd with the -a flag. I was under the impression that
turning on the auto-whitelisting feature was a good thing, until I received
an email from a friend with the following score:
SPAM: Content analysis details: (13.3 hits, 9 required)
SPAM: IN_REP_TO (-3.4 points)
On Mon, 15 Jul 2002 the voices made Stacey Conrad write:
Does the auto whitelisting work against you if, say, a user forwards you
their spam for blocking?
The name is confusing, because it's more of an auto white or black
list-thing; sliding the scores up or down to even the average score
Read the README :) It explains how the AWL works in detail. What's happened is
probably that you've only recently joined the list, and the only mail you'd
previously seen from Olivier was his 30_text_fr.cf posting, which scores
somewhere in the region of 60, polluting his AWL listing.
C
Olivier, I think it's probably only for recent subscribers that you're now in
the toilet:
[craig@belphegore spamassassin]$ tools/check_whitelist |fgrep ait.ac
-3.8 (-118.8/31) -- [EMAIL PROTECTED]
-2.3 (-207.9/91) -- [EMAIL PROTECTED]
Anyone who's seen 120-odd messages from you will
I was surprised to see that the AWL: Auto-whitelist
adjustment rule added 31.1 (thirty-one point one!) to
the score of the following email from this very list
server.
I hope I will not get white/blak listed on this answer...
The previous mail I sent had a very very bad score, so I got myself
I am trying to deploy spamassassin site-wide on a Sun/Solaris machine but am
having a few difficulties.
[a.] I can't get spamd to run. I am using 'perl spamd' (because perl isn't
in the /usr/perl5/5.00503/bin/perl path) and get the error:
Can't locate syslog.ph in @INC (did you run h2ph?) (@INC
On Thu, 2002-05-02 at 19:31, Neulinger, Nathan wrote:
The biggest problem with -S is due to the ordering of the rule checks.
If all of the negative rules (or at least the _large_ negative rules)
were processed first, it would probably be ok
All the large negative rules *are* processed first,
Matt Sergeant wrote:
On Thu, 2002-05-02 at 19:31, Neulinger, Nathan wrote:
The biggest problem with -S is due to the ordering of the rule checks.
If all of the negative rules (or at least the _large_ negative rules)
were processed first, it would probably be ok
All the large negative
Nathan Neulinger wrote:
Matt Sergeant wrote:
On Thu, 2002-05-02 at 19:31, Neulinger, Nathan wrote:
The biggest problem with -S is due to the ordering of the rule checks.
If all of the negative rules (or at least the _large_ negative rules)
were processed first, it would probably be ok
All
Well, AWL can't really run first. It more or less *has* to run last. But
there's no reason it can't run last, after the early-terminate has terminated:
while(early-terminate condition not met)
{
step through some rules
}
check awl here
as opposed to treating AWL as just another rule.
C
Nathan Neulinger wrote:
NN Was this changed recently? Cause it most definately did not work for me
I definitely think there's something weird going on in the short-circuit code.
I'll take a look at it and it'll probably be pretty clear what's up.
C
Matt Sergeant wrote:
MS Personally I think the implementation of whitelisting is broken - if
MS it's whitelisted or blacklisted we should be scanning period. But our
MS white/blacklisting is implemented separately here, so you're unlikely to
MS see a fix coming direct from me, I'm afraid (unless
I've been running with the site-wide AWL and the spamd -S early-terminate
option.
It has just occured to me that this will adjust the AWL math because I
won't be getting big positive numbers into the AWL any more.
And I suppose this makes it more of an Auto-WHITE-list than an Auto-WHITE
On Thu, 2002-05-02 at 09:16, Charlie Watts wrote:
It has just occured to me that this will adjust the AWL math because
I won't be getting big positive numbers into the AWL any more.
The fact that the -S option is reasonable points out that the scoring is
not a linear measure of spamminess. The
- Rolla Phone: (573) 341-4841
Computing Services Fax: (573) 341-4216
-Original Message-
From: Sidney Markowitz [mailto:[EMAIL PROTECTED]]
Sent: Thursday, May 02, 2002 1:11 PM
To: [EMAIL PROTECTED]
Subject: Re: [SAtalk] AWL verses early-terminate
On Thu
Sidney Markowitz wrote:
SM The fact that the -S option is reasonable points out that the scoring is
SM not a linear measure of spamminess. The function P(s) of the probability
SM that a message with score s is spam stays near 0 until some small
SM positive s, then asymptotically approaches 1
Neulinger, Nathan wrote:
NN The biggest problem with -S is due to the ordering of the rule checks.
NN If all of the negative rules (or at least the _large_ negative rules)
NN were processed first, it would probably be ok, but right now (or at
NN least with 2.20) - if you enabled it, the
And, hey, if you've got ESP math working even to the point of a test
release, you can quit your day job.
I haven't actually noticed it to be a useful blacklisting tool, anyway.
I've had it in my head that it could be useful as both, but haven't seen
it dragging otherwise-uncaught spam across the
Charlie Watts wrote:
CW And, hey, if you've got ESP math working even to the point of a test
CW release, you can quit your day job.
CW
CW I haven't actually noticed it to be a useful blacklisting tool, anyway.
CW I've had it in my head that it could be useful as both, but haven't seen
CW it
Charlie Watts wrote:
CW Date: Tue, 9 Apr 2002 10:31:02 -0600 (Mountain Daylight Time)
CW From: Charlie Watts [EMAIL PROTECTED]
CW To: [EMAIL PROTECTED]
CW Subject: [SAtalk] AWL as loophole
CW
CW I may have posted about this yesterday, but if so - I don't see that I
CW did.
CW
CW I'm starting
69 matches
Mail list logo
