Hi!,
Im sure y'all have covered this before :) Though I might ask cause I cant
seem to find an answer.
I have a sparc 5 running Qmail/Cyrus/Procmail/OpenBSD 3.5 on a sparc 5
/100 MHZ and Spamassassin(Is this or is this not a testament to how well
this software is written!) . The problem is if I
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hi,
I have just upgraded to spamassassin 3.0 from the 2.64 and I have realized
that there is a new format for the auto-whitelist. Before it was a GNU DBM
file (files named auto-whitelist.pag and auto-whitelist.dir) and now it is a
berkeley DB
Ryan Dlugosz said:
Michele Neylon : Blacknight Solutions said:
Which version of MailScanner are you using?
The more recent releases have been patched to address this anomaly
Hm... I've got mailscanner-4.31.6-1
FYI - upgrading to the latest stable MailScanner (4.33.1) resolved my issues.
The headers show this:
list-unsubscribe: mailto:[EMAIL PROTECTED]
On Wed, 29 Sep 2004, SME Server Admin wrote:
Can someone give me the unsubscribe information for this mailing list please?
I've followed the info in the headers but I just get a failure notice
Hi. This is the
So I've been doing some more reading, and I guess I should be stopping
SA before I run sa-learn --sync. How do I stop it form the shell
prompt? I am somewhat of a newbiew to linux administration
Thanks!
On Tue, 28 Sep 2004 15:04:34 -0400, David Modoski
[EMAIL PROTECTED] wrote:
I don't
You don't say what version of SA you are running.
On 2.63/2.64 you need a rewrite_subject blah blah in your local.cf.
On 3.0 it has become rewrite_header Subject blah blah.
Also note that _HITS_ on 2.64 becomes _SCORE_ on 3.0.
The report_safe [0|1] variable could also be of interest to you.
As
Hello Khalid,
Tuesday, September 28, 2004, 2:05:51 AM, you wrote:
KW Dear all,
KW What is the importance of bayes filter in spamassassin? it takes
KW a lot of CPU resource so I have disabled it and have not
KW felt much difference.
IMO Bayes is the most important of the many tools found within
Hello Martin,
Tuesday, September 28, 2004, 4:29:30 AM, you wrote:
M Loren Wilton wrote:
There are SARE rules for stock scams. Don't recall which file they are in.
M That's ok Loren :). Does anyone else recall which SARE-rule Loren is
M thinking of?
Several.
bml is the most directed, but
Hi All,
Just wanted to get your opinion on whether or not I should have RBL
activated? I have read some mixed opinions so far. Does it create
alot of false positives (vice versa)?
Thanks,
Erik
On Wed, Sep 29, 2004 at 01:46:24AM +0200, Daniel Olmedilla wrote:
I have just upgraded to spamassassin 3.0 from the 2.64 and I have realized
that there is a new format for the auto-whitelist. Before it was a GNU DBM
file (files named auto-whitelist.pag and auto-whitelist.dir) and now it is
On Tue, Sep 28, 2004 at 11:53:36AM -0700, Justin Mason wrote:
There's a new fix, which needs some testing in the bugzilla,
at http://bugzilla.spamassassin.org/show_bug.cgi?id=3649 .
If it fixes the issue, it'll go into 3.0.1. please test ;)
I tried this fix and it doesn't work, why I don't
Hi All
I am new to this mailing list.
I am currently trying to write in a .procmailrc some logic to add to a
log file some details about spam that has been caught and it's header
tagged. I am currently running Spamassassin 2.6.3. Is there a simple
way to do this?
Regards, Noel
Here is what my mail logs look like.
Sep 28 23:26:43 maximus spamd[12292]: server hit by SIGCHLD Sep 28 23:26:43 maximus spamd[12292]: handled cleanup of child pid 22323 Sep 28 23:26:43 maximus spamd[12292]: server successfully spawned child process, pid 22349 Sep 28 23:26:43 maximus
It ran fine for about 20 minutes then .
CPU load averages: 5.99
(1 mins) , 6.08
(5 mins) , 6.18
(15 mins)
Skips a lot of spam now I had no problem with v2.64
I have read all your literature and I guess I am missing something.
Sincerely,
Tye Gaddis Ô¿Ô¬
Watchout your syslog, you may have problem with you bayes db.
If you can efford, the workaround is just to remove bayes db and restart server.
Tye Gaddis wrote:
It ran fine for about 20
minutes then .
CPU load averages:
5.99
(1 mins) , 6.08
(5 mins) , 6.18
(15 mins)
At 08:43 PM 9/28/2004 -0700, Erik Wickstrom wrote:
Just wanted to get your opinion on whether or not I should have RBL
activated? I have read some mixed opinions so far. Does it create
alot of false positives (vice versa)?
My opinion is that RBLs are lousy as a single-point criteria for spam if
On Tuesday, September 28, 2004, 8:43:14 PM, Erik Wickstrom wrote:
Just wanted to get your opinion on whether or not I should have RBL
activated? I have read some mixed opinions so far. Does it create
alot of false positives (vice versa)?
It may be worth pointing out that there are a couple
Hi Matt
I did read the UPGRADE file for the sa-learn.
It has been performed but is still showing the same error:
Running as the SA user, not root, I get
snip
$ sa-learn --sync
bayes: bayes db version 2 is not able to be used, aborting! at
On Wed, Sep 29, 2004 at 07:28:34AM +0200, Thomas Kinghorn wrote:
I did read the UPGRADE file for the sa-learn.
It has been performed but is still showing the same error:
$ sa-learn --sync
bayes: bayes db version 2 is not able to be used, aborting! at
There's a new fix, which needs some testing in the bugzilla,
at http://bugzilla.spamassassin.org/show_bug.cgi?id=3649 .
If it fixes the issue, it'll go into 3.0.1. please test ;)
- --j.
After applying the above patch to Util.pm I encountered the following errors
with amavisd-new
I don't really see what your point was in attributing something to me that I
never said.
If you are complaining that they aren't removing you from the list,
that's because there is no they. YOU have to remove yourself from the
list. See the message headers on any RECENT list message on how to
Loren Wilton wrote:
Let's see. One I just got hit:
pts rule name description
--
--
1.0 NO_REAL_NAME From: does not include a real name
1.1 RATWR12_MESSID Message-ID has ratware pattern
Robert Menschel wrote:
Several.
bml is the most directed, but genlsubj has some subject headings that
will help, and header will add points to a lot of these.
Unfortunately i did not get any hits with bml and genlsubj on this
message. Any clues?
/ Martin
Loren Wilton wrote:
Martin, could you post (or better, put some place as a text file) a full
spam with headers? I'd like to run one of yours here and see what I get.
Maybe there is something different about them.
Loren,
I have no webbserver to put the file, but i will attach it to i private
mail
-Oorspronkelijk bericht-
Van: Edward Shornock [mailto:[EMAIL PROTECTED]
Verzonden: woensdag 29 september 2004 12:05
Aan: users@spamassassin.apache.org
Onderwerp: Re: AW: Version 3.0.0-r1 won't work with DCC
Pyzor amavisd
Michael Hall wrote:
On Wed, Sep 29, 2004 at
I'm sorry that you don't want my mail, but I'm not sure I understand the
problem here.
Over the weekend, I travelled...in order to not have a build up of mail
from the list, I sent a blank email to the address below:
[EMAIL PROTECTED]
The listserv sent me a confirmation email...to which I
--On Tuesday, September 28, 2004 8:43 PM -0700 Erik Wickstrom
[EMAIL PROTECTED] wrote:
Just wanted to get your opinion on whether or not I should have RBL
activated? I have read some mixed opinions so far. Does it create
alot of false positives (vice versa)?
To see an example of why using an
Hi!
Thanks. I've tried all of Fred's rules. Got no scoring from those rules
at all. Currently im using the following rules:
I just looked up a few of the rules I show above from the spam I had, and I
found them in
ratware.cf (now changed to another file, I'm a bit behind on rule
updates)
On Sun, Sep 26, 2004 at 05:03:34PM -0700, Jeff Chan wrote:
Stop using BigEvil if you're using SA 3 with network tests.
More efficiently? What if you are on a slow network connection? Should
you use the network tests?
-chuck
On 9/27/04 10:09 PM, Josh Trutwin wrote:
For me (install 3.0 from source) theyare in
/usr/share/spamassassin/25_uribl.cf. There is a score file as well. The new
JP list is not there, so you could add to local.cf until 3.1 released.
Jumping in late here as we just installed SA 3.0 on Debian
Why are we not supposed to just add it to
/usr/share/spamassassin/25_uribl.cf? As apposed to local.cf?
Because this file will be overwritten on the next update of SA.
bye,
Chris
Hi,
I want to set up a whitelist_to for my abuse@ address, but the problem
is that it only kicks the score down by six, and when people are
forwarding spam to it, well, the score's still WAY too high.
Is there some setting that will just say don't even scan it or
something?
-Dan
--
I want to
On 9/29/04 8:55 AM, Christiaan den Besten wrote:
Why are we not supposed to just add it to
/usr/share/spamassassin/25_uribl.cf? As apposed to local.cf?
Because this file will be overwritten on the next update of SA.
Ah so I see said the blind man. Understood, so this is something that is
-Original Message-
From: Noel Saliba [mailto:[EMAIL PROTECTED]
Subject: Logging for Spam Mail Caught
Hi All
I am new to this mailing list.
I am currently trying to write in a .procmailrc some logic to
add to a
log file some details about spam that has been caught and it's
On Wed, Sep 29, 2004 at 10:03:59AM -0400, Dan Mahoney, System Admin wrote:
Is there some setting that will just say don't even scan it or
something?
Try all_spam_to.
--
Randomly Generated Tagline:
double value;/* or your money back! */
short changed; /* so
When I run SA 3.0 from a command line on win32 with perl 5.6.1 build 638 I
get a message at the end of the SA output file, (no report template found), you
can see it below. I'm using the following options to launch SA.
spamassassin -D -t mime.822 test.txt
Has something changed with SA 3.0
On Wednesday, September 29, 2004, 7:02:50 AM, David Thurman wrote:
On 9/29/04 8:55 AM, Christiaan den Besten wrote:
Why are we not supposed to just add it to
/usr/share/spamassassin/25_uribl.cf? As apposed to local.cf?
Because this file will be overwritten on the next update of SA.
Ah so
On Wednesday, September 29, 2004, 6:46:00 AM, Chuck Campbell wrote:
On Sun, Sep 26, 2004 at 05:03:34PM -0700, Jeff Chan wrote:
Stop using BigEvil if you're using SA 3 with network tests.
More efficiently? What if you are on a slow network connection? Should
you use the network tests?
At 10:03 AM 9/29/2004, Dan Mahoney, System Admin wrote:
I want to set up a whitelist_to for my abuse@ address, but the problem is
that it only kicks the score down by six, and when people are forwarding
spam to it, well, the score's still WAY too high.
Is there some setting that will just say
What was the reason WS got such a low score in SA 3.0??? .5 is a joke! Hell
BigEvil was scored a 3 and now one complained, and it is the same data!! I
don't understand. Did the mass check not go well?
Chris Santerre
System Admin and SARE Ninja
http://www.rulesemporium.com
http://www.surbl.org
-Original Message-
From: Jeff Chan [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September 29, 2004 10:31 AM
To: SpamAssassin Users
Subject: Re: SA 3.0 and Bigevil
On Wednesday, September 29, 2004, 6:46:00 AM, Chuck Campbell wrote:
On Sun, Sep 26, 2004 at 05:03:34PM -0700, Jeff Chan
At 10:55 AM 9/29/2004, Chris Santerre wrote:
What was the reason WS got such a low score in SA 3.0??? .5 is a joke! Hell
BigEvil was scored a 3 and now one complained, and it is the same data!! I
don't understand. Did the mass check not go well?
Chris... Calm down a sec.
The score assigned by the
-- Forwarded Message ---
From: Jeff Chan [EMAIL PROTECTED]
To: David Brodbeck [EMAIL PROTECTED]
Sent: Wed, 29 Sep 2004 08:07:05 -0700
Subject: Re: SA 3.0 and Bigevil
On Wednesday, September 29, 2004, 7:42:04 AM, David Brodbeck wrote:
On Wed, 29 Sep 2004 07:30:51 -0700, Jeff Chan
At 10:55 AM 9/29/2004, Chris Santerre wrote:
What was the reason WS got such a low score in SA 3.0??? .5 is a joke! Hell
BigEvil was scored a 3 and now one complained, and it is the same data!! I
don't understand. Did the mass check not go well?
Upon closer inspection, the WS mass-check went
OK, I'm officially running 3.0 in production now. The upgrade was
miraculously easy. Despite my paranoia that something was going to bite me
in the behind, it went so smooth I was still worried.
Reading all the docs was a HUGE help. Especially the Prereq's for it! That
was great documentation.
-Original Message-
From: Raymond Dijkxhoorn [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September 29, 2004 11:10 AM
To: Chris Santerre
Cc: SURBL Discussion list (E-mail); Spamassassin-Talk (E-mail)
Subject: Re: Why such a low score?
Chris,
What was the reason WS got such a low score
At 11:04 AM 9/29/2004, Dan Mahoney, System Admin wrote:
Aah, yes, but this is called from a system-wide procmail file.
Yeah? so? Set up a procmail rule to bypass the call to spamc when the
recipient is the user you don't want scanned.
System wide vs per-user calls of procmail does not matter
I'm running spamassassin on win32 and want to change the location of the
bayes database to another drive/folder. Any suggestions?
Thanks,
Israel
I'm using SpamAssassin 3.0.0 on Debian unstable.
The docs recommend invoking spamassassin via procmail like this:
:0fw: spamassassin.lock
* 256000
| spamassassin
And to simply replace 'spamassassin' with 'spamc' when using the spamd
setup. I just noticed that spamd preforks, so
I almost spent 2 days on exactly that problem since some 3.0.0-pre
release. Yesterday I gave it another try and installed a fresh cygwin on
my computer, added the necessary perl modules and installed SpamAssassin
3.0.0. I tried one mail that definitely failed on previous versions and
suddenly it
Hi Matt,
Matt Kettler wrote:
Yeah? so? Set up a procmail rule to bypass the call to spamc when the
recipient is the user you don't want scanned.
I'm very intereseted in this, since i have one user that is constantly
throwing my server down due to the amount and size of the mail she receives.
I need to create a custom rule to imitate the action of whitelist_from_rcvd.
The reason I need to do this is because I have several networks where mail
originates for the same domain before it is received at our internal mail
server.
Originally, I tried to use multiple whitelist_from_rcvd
Title: Bayes not working
I've deleted all my bayes databases and am trying to start the database from scratch.. I auto-learn..
For some reason SA sees 8 spams in the database but won't learn any more...
What files does bayes need? I have the bayes_toks and bayes_seen files, but nothing
At 01:31 PM 9/29/2004, Chris Santerre wrote:
Any chance of getting a run for rescoring of the SURBL lists?
--Chris (Perceptron is on my list of things to master.)
In order to get a significantly different result, they'd need to re-run
mass-checks with network tests enabled... That's a pretty
At 01:49 PM 9/29/2004, Robert Leonard wrote:
I've deleted all my bayes databases and am trying to start the database
from scratch.. I auto-learn..
For some reason SA sees 8 spams in the database but won't learn any more...
What files does bayes need? I have the bayes_toks and bayes_seen files,
BTW, something else to keep in mind. There is a gotcha for sa-learn.
If you happened to be logged in as root when training then the journal
file is owned by root and SA can no longer entries in bayes. Check the
ownership of the file. If it's not owned by the same user.group as SA
needs then
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Christopher X. Candreva writes:
On Wed, 29 Sep 2004, Chris Santerre wrote:
OK, I'm officially running 3.0 in production now. The upgrade was
miraculously easy. Despite my paranoia that something was going to bite me
in the behind, it went so
On Wed, 29 Sep 2004, Keith Hackworth wrote:
I ran into this too and I emailed the developer for this module about
this. I haven't seen a response yet. I fixed it by modifying his perl
Well, he responded to almost immediately when I mailed him ast night
(actually about 2:00 AM EDT ), and I
-Original Message-
From: Matt Kettler [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September 29, 2004 1:56 PM
To: users@spamassassin.apache.org
Subject: RE: Why such a low score?
At 01:31 PM 9/29/2004, Chris Santerre wrote:
Any chance of getting a run for rescoring of the SURBL lists?
Hi!
In order to get a significantly different result, they'd need
mass-checks with network tests enabled... That's a pretty
CPU time just to try to get the score of the WS list up.
Uhm we also did put in, not only CPU time, but human cycles to clean out
the list. So i think effords are made on
On Wed, Sep 29, 2004 at 02:40:35PM -0400, Christopher X. Candreva wrote:
However, perhaps given the importance of SA and the symplicity of what this
does, SA might want to just not use this module and do something else --
even ask for the FQDN in the configure part, when it asks for the
On Wed, 29 Sep 2004 14:12:48 -0400 (EDT)
Christopher X. Candreva [EMAIL PROTECTED] wrote:
Sys-Hostname-Long is majorly broken on Solaris. It assumes a gnu
hostname command and issues 'hostname --fqdn' to get the hostname,
resorting to an IP method if this returns an error.
hostname on
At 02:15 PM 9/29/2004, Gary Smith wrote:
BTW, something else to keep in mind. There is a gotcha for sa-learn.
If you happened to be logged in as root when training then the journal
file is owned by root and SA can no longer entries in bayes. Check the
ownership of the file. If it's not owned by
Michael Parker suggested I post this here on users@ since most of the
Wiki work is not actually done by SVN committers. I was tempted to
actually just post this to the Wiki changes list, but that just seemed
wrong. :-)
Anyway, I think we need to pay attention to the overall organization of
wiki
On Wed, Sep 29, 2004 at 02:40:46PM -0400, Dan Mahoney, System Admin wrote:
I notice several people here use PGP. If anyone wants to exchange PGP/GPG
key signatures (i.e. I'll sign yours if you sign mine) feel free to
contact me via IM as GushiDotOrg or via phone at 1-866-LI-GUSHI (have
David Thurman wrote:
Excuse, must you not do how in the /usr/share/spamassassin/score.cf
add this 2 lines:
I added this to our local.cf
ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
score URIBL_JP_SURBL4.0
endif # Mail::SpamAssassin::Plugin::URIDNSBL
Why are we not supposed to just add
On 29 Sep 2004, at 04:27, Moshe Gurvich wrote:
Hi, most of the spam that gets through spamassassin has this kind of
header:
Received: from 64.239.129.105 ([:::219.144.149.91])
From: Trina Parr [EMAIL PROTECTED]
where in Received: 1st ip is my mx, but 2nd is spammers host
and in From: name is
Hi John,
I had a similar problem, and with the help of the list, I was able to
resolve it. Here is what you have to do.
FIRST kill spamd - if the process is running, it will mess everything up!
Second: run sa-learn --sync -D
this may take a little while, but it will upgrade your database
Owen, please don't copy messages to both dev@ and [EMAIL PROTECTED]
Anyway, this like the same problem described in bug 3838. Please
follow-up at:
http://bugzilla.spamassassin.org/show_bug.cgi?id=3838
I have no idea what the cause is -- we really need someone to work
through this and figure
I decided not to go, because Gary wouldn't bunk with me :) Well, then there
is the whole bail money thing..
For those of you going, remember to bring your airhorns to heckle with! ;)
--Chris
-Original Message-
From: Gary Smith [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September
Here is an example of one:
A message was scored with bayes only and it gave it 0.1. So it was
auto-learned as ham. Then I did an sa-learn --spam on it. I re-ran
spamassassin on it to see the value. Bayes gave it a 5.1 score (I changed it
from the default value, I believe) and when AWL came in, it
Hi!
I looked thru the mailing list archives and read a few emails that stated
that in 3.0.0 SURBL (specifically, multi) was automatically
installed/invoked, however I am not seeing this in the headers when spam is
processed.
I've looked at a few spams that I have received today, and compared
I am working to upgrade spamassassin, from 2.60 to 3.0, on my RedHat 8
Mailserver.
I'm currently running mimedefang 2.37. I have found no references to a
required version of Mimedefang in the docs, and would like to avoid changing
the entire world at once.
Does anyone know of any problems
Jay Hall wrote:
I am experiencing a problem with one of my rules that I
cannot seem to find.
I have the following rules defined.
rawbody __RAW_EXE_ATTACHMENT /filename=\.*\.exe\/i
rawbody __RAW_VBS_ATTACHMENT /filename=\.*\.exe\/i
rawbody __RAW_COM_ATTACHMENT
At 05:44 PM 9/29/2004, Nick Stephens wrote:
I've looked at a few spams that I have received today, and compared the
URL's found in them with those listed on SURBL+ Checker. Even though some
of the domains are listed in those lists (eg, URIBL: multi.surbl.org:
listed [Blocked,
Hi All,
I guess this is for info really, as I couldn't find anything in the
archives. When I upgraded to SA3 I lost all my bayes entries. Basically
sa-learn --dump magic returned nham nspam as zero despite the original
2.63 db's having over 13k of each.
I found that restoring the bayes files
On Wed, 2004-09-29 at 16:52 -0500, Larry Starr wrote:
I am working to upgrade spamassassin, from 2.60 to 3.0, on my RedHat 8
Mailserver.
I'm currently running mimedefang 2.37. I have found no references to a
required version of Mimedefang in the docs, and would like to avoid changing
Larry Starr wrote:
I'm currently running mimedefang 2.37. I have found no references to a
required version of Mimedefang in the docs, and would like to avoid changing
the entire world at once.
The UPGRADE file goes into this to some extent. It doesn't mention
MIMEDefang by name, but the
On Wed, Sep 29, 2004 at 03:07:08PM -0700, Kelson wrote:
(Developers: It might be worth mentioning the minimum 3.0-compatible
versions for MD, Amavis, and other popular things-that-call-SA.)
Why?
How are developers supposed to know what popular versions of
software support/use SpamAssassin
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Michael Parker writes:
On Wed, Sep 29, 2004 at 03:07:08PM -0700, Kelson wrote:
(Developers: It might be worth mentioning the minimum 3.0-compatible
versions for MD, Amavis, and other popular things-that-call-SA.)
Why?
How are developers
On Wed, Sep 29, 2004 at 06:01:05PM -0400, Ben Rosengart wrote:
1. Deprecated directives. If a configuration includes the
deprecated rewrite_subject directive, will spamd barf? Or
ignore it? Or something else? What about spamassassin?
Heya Ben.. long time no speak :
I have a bunch
On Wed, Sep 29, 2004 at 03:21:44PM -0700, Justin Mason wrote:
Well, it would be *nice*. I think it's reasonable to assume
that MIMEDefang and amavisd certainly need this, given the very
large amount of bug reports we've been getting.
So long as our notes state that we don't actively follow
On Wed, Sep 29, 2004 at 03:30:53PM -0700, Bill Landry wrote:
Anyone have an idea why I would be getting the following output when I run
sa-learn --dump magic:
error: rule 'DNS_FROM_RFCI-PIGS' has invalid characters (not Alphanumeric +
Underscore)
These entries were all updated (converted
My slides from the presentation I gave at Toorcon 2004, 'Spam Forensics:
Reverse-Engineering Spammer Tactics', are now up, if anyone's interested
in having a read ;)
http://spamassassin.apache.org/presentations/2004-09-Toorcon/html
--j.
[EMAIL PROTECTED] wrote:
Jay Hall wrote:
I am experiencing a problem with one of my rules that I
cannot seem to find.
I have the following rules defined.
rawbody __RAW_EXE_ATTACHMENT/filename=\.*\.exe\/i
rawbody __RAW_VBS_ATTACHMENT/filename=\.*\.exe\/i
rawbody __RAW_COM_ATTACHMENT
Okay, so I'm at a loss. I'm reasonably new to SpamAssassin and dealing
with spam filters in general, but I've tried to do my homework and I'm
still having some trouble. If I look at all my headers, I never see the
autolearning work. Often it gets autolearn=unavailable. I figure that
I need to
- Original Message -
From: Theo Van Dinter [EMAIL PROTECTED]
On Wed, Sep 29, 2004 at 03:30:53PM -0700, Bill Landry wrote:
Anyone have an idea why I would be getting the following output when I
run
sa-learn --dump magic:
error: rule 'DNS_FROM_RFCI-PIGS' has invalid characters
87 matches
Mail list logo
