SpamAssassin score factors?

2005-03-30 Thread Lisheng Sun
Could anyone here tell me how many different factors that will involve with SA? Say, IP is belong to blacklist, URL is belong to blacklist, etc. What else? Not include user-defined one. Thanks.

Re: SpamAssassin score factors?

2005-03-30 Thread Tim B
Lisheng Sun wrote: Could anyone here tell me how many different factors that will involve with SA? Say, IP is belong to blacklist, URL is belong to blacklist, etc. What else? Not include user-defined one. Thanks. You should probably visit http://spamassassin.apache.org/tests_3_0_x.html

Config Error

2005-03-30 Thread Norman Zhang
Hi, I'm seeing the following error in amavisd debug-sa. May I ask how can I correct this? config: SpamAssassin failed to parse line, skipping: auto_learn 1 Regards, Norman Zhang required_hits 5 rewrite_header Subject [SPAM] report_safe 0 skip_rbl_checks 0 dns_available yes use_bayes 1 auto_learn

Re: Config Error

2005-03-30 Thread JamesDR
Norman Zhang wrote: Hi, I'm seeing the following error in amavisd debug-sa. May I ask how can I correct this? config: SpamAssassin failed to parse line, skipping: auto_learn 1 Regards, Norman Zhang required_hits 5 rewrite_header Subject [SPAM] report_safe 0 skip_rbl_checks 0 dns_available yes

Re: Config Error

2005-03-30 Thread Matt Kettler
Norman Zhang wrote: Hi, I'm seeing the following error in amavisd debug-sa. May I ask how can I correct this? config: SpamAssassin failed to parse line, skipping: auto_learn 1 The correct option is bayes_auto_learn, not auto_learn. The old auto_learn was correct in the 2.50 version, but

Re: Problems with latest SA upgrade

2005-03-30 Thread Steve Lake
CC'ing this to the list. I replied from the wrong address. heh. ^_^ --- I think I found the issue. Went and did spamassassin --lint as user and it hurled its cookies. But if I did it under root, it didn't. So somewhere I've

Re: Problems with latest SA upgrade

2005-03-30 Thread Steve Lake
Well, I'm now up and running...somewhat. I opened up a whole lotta permissions on the server and it's now letting mail be filtered, but the --lint command still renders errors on the user level. But at the same time I'm finding some really nasty problems with the box itself at this point.

Sender Base

2005-03-30 Thread martin smith
Hi, I have been playing about with senderbase a bit and have noticed that SB_NSP_VOLUME_SPIKE is looking for S5 to be NSP but have also noticed that they use unknown and in the case of my provider NTL the field is blank. I tried: header SB_NSP_VOLUME_SPIKE eval:check_rbl_sub('sb', 'sb:S5 =~

spamassassin does not rewrite headers

2005-03-30 Thread Neil Watson
I've installed Spamassassin and configured Postfix to use it as a mail filter. The log reports show that SPAM is being reported correctly. However, header rewrites configured in /etc/spamassassin/local.cf seem to be ignored.: local.cf: rewrite_header Subject SPAM(_SCORE_) report_safe 1

Re: spamassassin does not rewrite headers

2005-03-30 Thread Theo Van Dinter
On Wed, Mar 30, 2005 at 09:49:49AM -0500, Neil Watson wrote: I am using a filter as suggested by the Postfix documentation: [...] cat in.$$ || { echo Cannot save mail to file; exit $EX_TEMPFAIL; } Put the message in a file ... # Specify your content filter here. /usr/bin/spamc in.$$ || {

Re: Config Error

2005-03-30 Thread Jim Maul
Matt Kettler wrote: Norman Zhang wrote: Hi, I'm seeing the following error in amavisd debug-sa. May I ask how can I correct this? config: SpamAssassin failed to parse line, skipping: auto_learn 1 The correct option is bayes_auto_learn, not auto_learn. The old auto_learn was correct in the 2.50

Help Razor

2005-03-30 Thread John Fleming
Newbie question - Saw the following in log - Does this represent a temporary inability to connect or a more basic configuration problem on my end? Thanks Mar 30 10:01:28 Luke spamd[27283]: razor2 check skipped: Transport endpoint is not connected Died at

Bigevil file is gone.

2005-03-30 Thread Chris Santerre
Too much traffic used for a file no longer updated. BigEvil has been removed. I shall replace it with our newest ruleset soon. Its a real corker ;) Chris Santerre System Admin and SARE/SURBL Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that

Anyway to have SA drop high spam tag other?

2005-03-30 Thread Bill
Hi, I'm running Spamassassin 3.0.2 on Linux in front of Oracle Collaboration Suite. I am using proxsmtp(http://memberwebs.com/nielsen/software/proxsmtp/) to scan mail and then pass it along to oracle. My question is... I know that you can have spamassassin exit with a non-zero code if it

Re: Broken Pipe

2005-03-30 Thread Norman Zhang
Kevin W. Gagel wrote: I've SA calling DCC, and I see the following error message in /var/log/mail/errors. May I ask is this serious? If so how can I fix it? dccifd[8282]: write(MTA socket,79): Broken pipe Its a miss-communication between spamassassin and dccifd. I found that the spamassassin code

3.0.2 and SARE

2005-03-30 Thread Webmaster
I am thinking of downloading rules from SARE. However, I am told that some or many of the rules have already been incorporated into 3.0.2 Can someone recommend the best approach to avoid duplicates ? Thanks. Lu

negative score from ALL_TRUSTED

2005-03-30 Thread ROY,RHETT G
I just had a spam get through with a negative score from ALL_TRUSTED. # The message was never sent via an untrustworthy host.header ALL_TRUSTED eval:check_all_trusted()describe ALL_TRUSTED Did not pass through any untrusted hoststflags ALL_TRUSTED nice Can someone tell me what that

HUMOR: 419 pic

2005-03-30 Thread Chris Santerre
For those of you who don't know, there is a group of ppl that lead 419 scammers on wild goose chases. One of the things they do is request pics for proof. THey have them do some funny stuff. (Bread and fish on head) This came accross my mail today. Pretty funny! (Contains the word p enis.)

bayes database merge?

2005-03-30 Thread Rich Winkel
Hi, I was wondering how one might go about merging two or more bayes databases into one? I have a user who for various reasons can't save his spam back to the server, so I thought I'd create a database for him by averaging others' data. I know there are problems with this, but it's better than

Re: bayes database merge?

2005-03-30 Thread Michael Parker
On Wed, Mar 30, 2005 at 02:22:34PM -0600, Rich Winkel wrote: Hi, I was wondering how one might go about merging two or more bayes databases into one? I have a user who for various reasons can't save his spam back to the server, so I thought I'd create a database for him by averaging others'

Re: Phishing attempts getting through.

2005-03-30 Thread Joe Young
Can someone expand on the ClamAV detecting phishing attempts. Or direct me some where? Thank you, --Joe Matt Kettler wrote: Sunny Forro wrote: Hello, I've got a problem. I've got a lot of phishing attacks making it through my mailscanner setup. I do have phishing fraud detection

Re: Phishing attempts getting through.

2005-03-30 Thread Matt Kettler
Joe Young wrote: Can someone expand on the ClamAV detecting phishing attempts. Or direct me some where? Thank you, It just detects the message itself as a virus. Here's a sample report generated when MailScanner fed a phishing email to our virus scanners: The following e-mails were found

my girlfriend is getting ticked :)

2005-03-30 Thread Matthew Lenz
my girlfriend has been bitching at me for quite some time now to figure out why spamassassin isn't catching the spam like it used to. I'm using 3.0.2 on a debian woody box. Its from www.backports.org (great site). Here is an example of the X-Virus/Spam headers from a spam that was caught:

Re: negative score from ALL_TRUSTED

2005-03-30 Thread Matt Kettler
ROY,RHETT G wrote: I just had a spam get through with a negative score from ALL_TRUSTED. # The message was never sent via an untrustworthy host. header ALL_TRUSTED eval:check_all_trusted() describe ALL_TRUSTEDDid not pass through any untrusted hosts tflags ALL_TRUSTED nice

Re: my girlfriend is getting ticked :)

2005-03-30 Thread Tim Donahue
On Wed, 2005-03-30 at 15:27 -0600, Matthew Lenz wrote: [snip spam info] Ideas where to start (other than having her change her email address hehe) It doesn't look like you are using any of the SARE rulesets. There are 3 things I would do to start off... First, assuming that the 5000 messages

increasing children

2005-03-30 Thread Steve Lake
Ok, been through the man file already and I didn't see anything apparently obvious on how to increase the number of child processes for SA. I know that the default is 5, but is this a command line config I need to change to bump it to 10 or 15? Or do I need to edit a config file? This new

Re: my girlfriend is getting ticked :)

2005-03-30 Thread Matthew Lenz
On Wed, 2005-03-30 at 16:45 -0500, Tim Donahue wrote: On Wed, 2005-03-30 at 15:27 -0600, Matthew Lenz wrote: [snip spam info] Ideas where to start (other than having her change her email address hehe) It doesn't look like you are using any of the SARE rulesets. There are 3 things I

Re: increasing children

2005-03-30 Thread Chris Stone
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wednesday 30 March 2005 03:10 pm, Steve Lake wrote: Ok, been through the man file already and I didn't see anything apparently obvious on how to increase the number of child processes for SA. I know that the default is 5, but is this a

Re: my girlfriend is getting ticked :)

2005-03-30 Thread Matthew Lenz
I just installed backports perl-libnet-dns (.48, hope that is new enough .49 is the newest). Is there anywhere I can check to see if 'network tests' (what the SURBL says needs to be enabled) are enabled? On Wed, 2005-03-30 at 14:15 -0800, Morris Jones wrote: Matthew Lenz wrote: my girlfriend

Re: my girlfriend is getting ticked :)

2005-03-30 Thread Mike Jackson
Your bayes database looked to be reasonably trained. The false-negative was labeled 99% spam by Bayes. I don't see any RBL checks, which might have made the difference on this one, if it's already been seen and flagged. Do you have Net::DNS installed and the RLB tests enabled? What happens

Re: my girlfriend is getting ticked :)

2005-03-30 Thread Morris Jones
Run an email through spamassassin with the -D debug flag and it will tell you eerything. Mojo Matthew Lenz wrote: I just installed backports perl-libnet-dns (.48, hope that is new enough .49 is the newest). Is there anywhere I can check to see if 'network tests' (what the SURBL says needs

Re: my girlfriend is getting ticked :)

2005-03-30 Thread Morris Jones
Mike Jackson wrote: In my experience, it's more efficient to let the MTA handle the RBL checks instead of Spamassassin. I can't remember what MTA the OP was using, but it's trivial to set them up in Sendmail. On my employer's boxes, I use the spamhaus.org lists, but on my personal box (where I

Re: my girlfriend is getting ticked :)

2005-03-30 Thread Nels Lindquist
On 30 Mar 2005 at 15:27, Matthew Lenz wrote: snip here is an example of the headers from an spam that wasn't caught X-Spam-Status: No, score=4.1 required=5.0 tests=BAYES_99,HTML_80_90, HTML_FONT_BIG,HTML_MESSAGE,HTML_TITLE_EMPTY,MIME_HTML_ONLY, MSGID_FROM_MTA_ID

Re: my girlfriend is getting ticked :)

2005-03-30 Thread Matthew Lenz
On Wed, 2005-03-30 at 14:28 -0800, Morris Jones wrote: Mike Jackson wrote: In my experience, it's more efficient to let the MTA handle the RBL checks instead of Spamassassin. I can't remember what MTA the OP was using, but it's trivial to set them up in Sendmail. On my employer's