RE: SPAMD dies

>Daryl C. W. O'Shea wrote: > > >Thomas Kinghorn [MTNNS -Rosebank] wrote: >> Good morning list. >> >> I am having issues with SPAMD just dying and no info being shown in >> the logs to help troubleshoot. >> >> The system is running Redhat 9, Latest versions of Exim & spamassassin. >> Spamassas

Re: SPAMD dies

Thomas Kinghorn [MTNNS -Rosebank] wrote: Good morning list. I am having issues with SPAMD just dying and no info being shown in the logs to help troubleshoot. The system is running Redhat 9, Latest versions of Exim & spamassassin. Spamassassin uses pyzor, razor & dcc. What "latest version

SPAMD dies

Title: SPAMD dies Good morning list. I am having issues with SPAMD just dying and no info being shown in the logs to help troubleshoot. This is what I have: Jul 15 01:01:04 jp-mx-1 spamd[16441]: identified spam (8.8/4.4) for xadmin:501 in 4.5 seconds, 5865 bytes.Jul 15 01:01:04 jp-mx-1

Re: MTA developer question

[ cc'd users list in my reply, hope you don't mind ] On Thu, Jul 14, 2005 at 09:12:25PM +1000, Jason Faulkner wrote: > As my users create their newsletters, etc, I would like my application > to automatically give them a spam assassin type of score that it uses to > parse their email before they s

Re: I am NOT a spammer

> 3) generate a huge database that can handle ip-by-ip listings. > > 3 isn't practical because the hardware requirements. SORBS has to be a real-time > query, and if every query has to search a database with 4 billion individual IP > entries in it, it's going to be slow. Matt, just to be pickey th

Re: Tag all emails with gif, jpg, tif, or tiff?

At 08:53 PM 7/14/2005, Dr Robert Young wrote: Is there a rule that would allow one to score an email with an embedded graphic to a negative spam value, no matter what else was in the body??? To a negative value? or positive value?? I assume you mean positive since you want to tag it... Somet

Re: Just in case....

At 10:05 PM 7/14/2005, Dr Robert Young wrote: Being new to SA , maybe this is a no-brainer, however I thought I would ask the 70_sc_top200.cf rulset is described as being updated every day? But the one I downloaded from rulesemporium.com had an internal "modified" date of 5/27/05 5:39:28 PM ES

NOTICE: 3.1.0 rescoring mass-checks -- REDO!

Sorry all -- we have to redo these, due to a stupid mistake (half of the scores were left at 0 from the 3.0.0 mass-check, instead of set to a nonzero value so the rules at least would be run). If you've already run these with pre2 or pre3, we need them redone *again*; unfortunately the previous o

Just in case....

Being new to SA , maybe this is a no-brainer, however I thought I would ask the 70_sc_top200.cf rulset is described as being updated every day? But the one I downloaded from rulesemporium.com had an internal "modified" date of 5/27/05 5:39:28 PM EST Am I comparing apples and oranges? ___

Re: Tag all emails with gif, jpg, tif, or tiff?

> Is there a rule that would allow one to score an email with an embedded > graphic to a negative spam value, no matter what else was in the > body??? I'm not 100% sure what you're asking here, but just looking for a graphic attachment isn't a good sign one way or the other: OVERALL% SPAM%

Re[2]: Proper way to override scores

Hello Herb, Thursday, July 14, 2005, 12:12:26 AM, you wrote: >> Never place new scores or rules into the >> /usr/share/spamassassin directory. They WILL get deleted or >> replaced when you update. HM> Really? I didn't know that (obviously) although I have updated HM> several (minor) versions

Re[4]: Rule Advice

Hello dennis, Thursday, July 14, 2005, 9:03:46 AM, you wrote: dsc> On Jul 14, 2005, at 5:52 AM, Robert Menschel wrote: >> header FROM_STARTS_WITH_NUMS     From:addr =~ /^\d{6,}\S+\@/i >> The email address used in the From header begins with 6 (or more) >> digits. it's not hitting on 360SkinCare.c

Tag all emails with gif, jpg, tif, or tiff?

Is there a rule that would allow one to score an email with an embedded graphic to a negative spam value, no matter what else was in the body??? Dr. Robert Young ALI Database Consultants 1151 Williams Dr Aiken SC 29803 USA WWW: http:/

Re: Another whitelist question

At 04:03 PM 7/14/2005, Dr Robert Young wrote: One more whitelist question if the whitelist database file is "deleted", then spamassassin will create a new one ( by itself) and start collecting information from the beginning, correct? AFIAK yes, although to avoid race conditions you migh

Re: I am NOT a spammer

From: "Don Levey" <[EMAIL PROTECTED]> > The entity that needs to *prove* that you've got a static IP is the *owner* > of that IP - the ISP. That is the entity that SORBS (or other reputable > blocking lists) will talk to about the problem. Unfortunately, they seem to > be uninterested in doing a

Re: milter-spamc timeout...looking into cause

On Thu, 14 Jul 2005, Dr Robert Young wrote: > I am trying to id the cause of a milter-spamc-> spamd timeout. There > are all the lines from the maillog. Is it possible to tell from the > following 'where' (ie which test or even type of test) it might have > timed out on? The spam passed on throu

Re: I am NOT a spammer

Aecioneto wrote on Thu, 14 Jul 2005 15:38:03 -0300: > 1. My ip is not dynamic Well, I concluded it from your first message: > I am using a personal and secondary address to workaround a dumb rule, > > assuming that all hosts under a dynamic IP is a source of spam. If it's not, well, then talk

Re: Long Scanning Delays

jdow wrote: From: "Technical Department" <[EMAIL PROTECTED]> We are running Qmail Scanner 1.25 + Spamassassin 3.04 + Clamd 1.86.1 on our dual 1.4Ghz P3 Linux mail server. We've been experiencing some problems with the server taking a long time to scan messages (In most cases they are taking be

Re: Net::DNS and Spamassassin

On Thu, 14 Jul 2005, Jose Hidalgo wrote: > OS: FreeBSD 4.9-RELEASE-p12 > > p5-Mail-SpamAssassin-3.0.4 > p5-Net-DNS-0.51 > razor-agents-2.72 > perl-5.8.7 > > When trying to report a message it fails with the following error: > > razor2 report failed: No such file or directory Died at > /usr/local/l

Re: How does one remove a whitelist entry?

On Thursday, July 14, 2005 at 6:57:00 PM, [EMAIL PROTECTED] confabulated: > Is there a way to remove an entry from a user's individual and/or a > system wide whitelist db? See: http://spamassassin.apache.org/full/3.0.x/dist/doc/spamassassin.html The -R or --remove-addr-from-whitelist option.

Re: Proper way to override scores

Debbie D wrote: I often want to alter the scores of already set filters in the SARE and other custom filter sets.. what/where is the proper places to do this without altering each individual set which will get over-written down the road thanks You want to add them to a .cf file in /etc

Another whitelist question

One more whitelist question if the whitelist database file is "deleted", then spamassassin will create a new one ( by itself) and start collecting information from the beginning, correct? Dr. Robert Young ALI Database Consultants

Re: How does one remove a whitelist entry?

Dr Robert Young wrote: Is there a way to remove an entry from a user's individual and/or a system wide whitelist db? Which whitelist system do you mean? The one that generates USER_IN_WHITELIST_* (static), or AWL (the auto-whitelist). For the AWL, which is a database, see man spamassassin. L

Re: I am NOT a spammer

Jamie Pratt wrote: Evan Platt wrote: At 12:36 PM 7/14/2005, you wrote: That's why I am aguing about such a great list setting up to use such a stupid blocking listing services. So, here is my point: take my ip 200.207.18.245. I want someone to *prove* that it is a dsl static IP. No way

milter-spamc timeout...looking into cause

I am trying to id the cause of a milter-spamc-> spamd timeout. There are all the lines from the maillog. Is it possible to tell from the following 'where' (ie which test or even type of test) it might have timed out on? The spam passed on through without ever being seem by spamd (no X-Spam he

RE: I am NOT a spammer

aecioneto wrote: >> I think a few people have already mentioned it, but your IP is >> listed > in SORBS: >> >> Remote host said: 550 Dynamic IP Addresses See: >> http://www.sorbs.net/lookup.shtml?200.207.18.245 >> >> Best bet is to get it removed. > > Great! > I will start making money this way: >

Re: I am NOT a spammer

Evan Platt wrote: At 12:36 PM 7/14/2005, you wrote: That's why I am aguing about such a great list setting up to use such a stupid blocking listing services. So, here is my point: take my ip 200.207.18.245. I want someone to *prove* that it is a dsl static IP. No way a bad SORBS entry is e

Re: I am NOT a spammer

aecioneto wrote: > I am not a Telefónica fan, but I also had noticed that worldwide dsl > addresses are being incorrectly related as dynamic - like SORBS does. Actually, SORBS does not do that in general. Most business DSL blocks that are correctly separated from dynamic blocks aren't listed by

Re: I am NOT a spammer

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 SORBS requires payment for delisting if you're listed as a spammer. Not a great idea in my opinion, but either way, it's entirely separate to the dynamic list. They run multiple separate lists. I've asked ASF infrastructure to see if we can get your

Re: I am NOT a spammer

At 12:36 PM 7/14/2005, you wrote: Great! I will start making money this way: 1. I start listing a whole bunch of IPs as dynamic. 2. When they complain about it, they have to pay me to clean them up. And as soon as people find out your blacklist is nothing more then extortion, you'll find no on

Re: I am NOT a spammer

> I think a few people have already mentioned it, but your IP is listed > in > SORBS: > > Remote host said: 550 Dynamic IP Addresses See: > http://www.sorbs.net/lookup.shtml?200.207.18.245 > > Best bet is to get it removed. Great! I will start making money this way: 1. I start listing a whole bun

Net::DNS and Spamassassin

OS: FreeBSD 4.9-RELEASE-p12 p5-Mail-SpamAssassin-3.0.4 p5-Net-DNS-0.51 razor-agents-2.72 perl-5.8.7 When trying to report a message it fails with the following error: razor2 report failed: No such file or directory Died at /usr/local/lib/perl5/site_perl/5.8.7/Mail/SpamAssassin/Reporter.pm li

Re: I am NOT a spammer

> Did Aecio confirm that Kai? > > AFAIK Aecio claims to be posting from a static IP. It's on DSL, but that > doesn't > make it dynamic (think business class DSL lines). Yes, perfect! > However, Since the Brazilian Telecom that owns the IP block mixes and matches > dynamic and static IP's at rand

How does one remove a whitelist entry?

Is there a way to remove an entry from a user's individual and/or a system wide whitelist db? Dr. Robert Young ALI Database Consultants 1151 Williams Dr Aiken SC 29803

Re: I am NOT a spammer

At 11:38 AM 7/14/2005, you wrote: Guys, people, audience... 1. My ip is not dynamic. It is a business ADSL fixed IP. 2. Smarthost, mail servers etc etc does not exist in Brasil ADSL carrier providers. 3. To use a smarthost elsewhere I have to pay for it and get rid of all my internal infra. Do

Re: I am NOT a spammer

Kai Schaetzl wrote: > Aecio F. Neto wrote on Thu, 14 Jul 2005 12:18:01 -0300: > > >>The problem is with this list that does relies its technics over *not >>reliable* listing services. > > > I understand, it wasn't clear to me you were really talking about this > very list. Sorry. Nevertheless

Re: I am NOT a spammer

> Aecio F. Neto wrote on Thu, 14 Jul 2005 12:18:01 -0300: > > > The problem is with this list that does relies its technics over *not > > reliable* listing services. > > I understand, it wasn't clear to me you were really talking about this > very list. Sorry. Nevertheless, as you confirmed

Re: I am NOT a spammer

Aecio F. Neto wrote on Thu, 14 Jul 2005 12:18:01 -0300: > The problem is with this list that does relies its technics over *not > reliable* listing services. I understand, it wasn't clear to me you were really talking about this very list. Sorry. Nevertheless, as you confirmed you are posting f

Re: I am NOT a spammer

List Mail User wrote: [snip] Absolutely incorrect! Your HELO/EHLO must match your rDNS or the rDNS needs to match an MX RR for your argument or a few other cases. AOL is quite strict, but you have misinterpreted either their stated policy and/or RFCs 2821 and 2822. In particular, yo

Re: Long Scanning Delays

>... >List Mail User <[EMAIL PROTECTED]> wrote on 07/14/2005 11:50:19 AM: > >>Remove evilnumbers.cf - check the archives for previous threads >> and postings by its author (i.e. it should be delete and not used) >according >> to Chris Santerra. >> >>Paul Shupak >>[EMAIL PROTECTED] > >

Re: I am NOT a spammer

At 10:49 AM 7/14/2005, you wrote: Actually incorrect, too. AOL, and many other large ISP's do indeed subscibe to a blacklist for ip addresses listed by other ISP's as "dynamic" addrsses. I am forced to relay through my isp's smarthost for outbound mails, even though my EHLO domain matches my

Re: I am NOT a spammer

>... >Kai Schaetzl escreveu: > >>Aecio F. Neto wrote on Thu, 14 Jul 2005 10:58:25 -0300: >> >> >> >>>Sorry bothering you all with such matter but I wasn't able to quickly >>>locate an admin address and I HOPE this message get attention from >>>someone able to workaround my issue. >>> >>> >>

Re: I am NOT a spammer

Inline. . . List Mail User wrote: ... jdow wrote: From: "Aecio F. Neto" <[EMAIL PROTECTED]> I have been trying to post to this list using my original subscriber email address. Unfortunately, It has been not possible up to now. I am using a per

Re: I am NOT a spammer

>... > >jdow wrote: >> From: "Aecio F. Neto" <[EMAIL PROTECTED]> >> >> >>>I have been trying to post to this list using my original subscriber >>>email address. >>>Unfortunately, It has been not possible up to now. >>> >>>I am using a personal and secondary address to workaround a dumb rule, >>>a

RE: Blacklisting

On Thu, 14 Jul 2005, Jean-Paul Natola wrote: > > > -Original Message- > From: Steven Dickenson [mailto:[EMAIL PROTECTED] > Sent: Wednesday, July 13, 2005 6:18 PM > To: Jean-Paul Natola > Cc: users@spamassassin.apache.org > Subject: Re: Blacklisting > > On Jul 13, 2005, at 11:55 AM, Jean-Pa

Re: I am NOT a spammer

> There is a large problem with Brazilian addresses and SORBS; I have > help a few people and tried to help even more - SORBS will gladly take your > "donation", then immediately relist you. The problem, however is with nearly > all the Brazilian telcos not properly segregating dynamic and stat

Re: I am NOT a spammer

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 BTW, the issue is with the ASF's mail servers -- sadly they're inundated with spam, and without using dynamic-IP blocking, they cannot keep up with the spam volume with the hardware they have. (apache.org addresses are on a *lot* of spam lists.) Aeci

Re: Re[2]: Rule Advice

> header FROM_STARTS_WITH_NUMS From:addr =~ /^\d{6,}\S+\@/i > The email address used in the From header begins with 6 (or more) > digits. it's not hitting on 360SkinCare.com, but on the user part of > the email address (doesn't even look at the domain name). > The From line didn't start with

Re: I am NOT a spammer

>... > >This is a multi-part message in MIME format. >--090502030107020101040103 >Content-Type: text/plain; charset=ISO-8859-1; format=flowed >Content-Transfer-Encoding: 7bit > >I have been trying to post to this list using my original subscriber >email address. >Unfortunately, It has

Re: Proper way to override scores

> Thanks.. I just wanted to also verify the format of the over rides.. The score override is exactly the same format as the original score line. The word "score", the identical rule name, and the new score or scores. > For instance.. if this is the rule I want to override: > > header SARE_ADLT

RE: Blacklisting

-Original Message- From: Steven Dickenson [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 13, 2005 6:18 PM To: Jean-Paul Natola Cc: users@spamassassin.apache.org Subject: Re: Blacklisting On Jul 13, 2005, at 11:55 AM, Jean-Paul Natola wrote: > I'm attempting to blacklist @freelotto.co

RE: Long Scanning Delays

> >... > > > >I don't see anything much wrong with the rule selections, > other than I think > >mr_wiggly and maybe nov2rules are pretty old, and at least > mr wiggly is in > >sare_specific (I believe it is) these days. I think perhaps also > >domaindigits has been depreciated; but I could be wron

Re: Long Scanning Delays

List Mail User <[EMAIL PROTECTED]> wrote on 07/14/2005 11:50:19 AM: >    Remove evilnumbers.cf - check the archives for previous threads > and postings by its author (i.e. it should be delete and not used) according > to Chris Santerra. > >    Paul Shupak >    [EMAIL PROTECTED] Bigevil is the b

Re: Long Scanning Delays

>... > >I don't see anything much wrong with the rule selections, other than I think >mr_wiggly and maybe nov2rules are pretty old, and at least mr wiggly is in >sare_specific (I believe it is) these days. I think perhaps also >domaindigits has been depreciated; but I could be wrong about that. >

Re: Rule Advice

>... > >Been using SA for quite a while and agree it's working great. > >Is FROM_STARTS_WITH_NUMS appropriately spammy if it's a legal way to >name a domain? > >Is this related to the "suspicious hostname" flags? Or is that >related to the use of webmail? If the former, then they're getting >

RE: I am NOT a spammer

At 11:16 AM 7/14/2005, Dave Duffner - PSCGi wrote: Kai Schaetzl decided to say on Thursday, July 14, 2005 11:06 AM: Since this List doesn't have a tagline at the bottom indicating where to find help, subscribe or unsub, much less a tag like [SAApache] in

Re: I am NOT a spammer

jdow wrote: > Note that received from at Apache shows it came from 192.168.0.252. > That is NEVER going to get through any properly configured mail setup. > It looks like a forgery attempt to make mail look like it came from an > internal address even when received from outside. That won't fly, in

Re: Proper way to override scores

From: "Bret Miller" <[EMAIL PROTECTED]> > > Thanks.. I just wanted to also verify the format of the over rides.. > > > > For instance.. if this is the rule I want to override: > > > > header SARE_ADLTSUB6 Subject =~ /(?!\bfuck)\bf.?u.?c.?k/i > > describe SARE_ADLTSUB6 Apparent spam seems to co

Re: I am NOT a spammer

From: "Matt Kettler" <[EMAIL PROTECTED]> > At 11:06 AM 7/14/2005, Kai Schaetzl wrote: > > > > Sorry bothering you all with such matter but I wasn't able to quickly > > > locate an admin address and I HOPE this message get attention from > > > someone able to workaround my issue. > > > >Talk to th

Re: I am NOT a spammer

From: "Kai Schaetzl" <[EMAIL PROTECTED]> > Aecio F. Neto wrote on Thu, 14 Jul 2005 10:58:25 -0300: > > > Sorry bothering you all with such matter but I wasn't able to quickly > > locate an admin address and I HOPE this message get attention from > > someone able to workaround my issue. > > Ta

Re: Re[2]: Rule Advice

On Jul 14, 2005, at 5:52 AM, Robert Menschel wrote:header FROM_STARTS_WITH_NUMS     From:addr =~ /^\d{6,}\S+\@/i The email address used in the From header begins with 6 (or more) digits. it's not hitting on 360SkinCare.com, but on the user part of the email address (doesn't even look at the domain

Re: Rule Advice

On Jul 14, 2005, at 8:55 AM, Duncan Hill wrote:On Thursday 14 July 2005 16:50, [EMAIL PROTECTED] typed: On Jul 14, 2005, at 4:14 AM, Loren Wilton wrote: Received: (qmail 31028 invoked from network); 9 Jul 2005 21:00:29 - Received: from localhost (127.0.0.1) by localhost with SMTP; 9 Jul 2005 21

Re: Rule Advice

On Thursday 14 July 2005 16:50, [EMAIL PROTECTED] typed: > On Jul 14, 2005, at 4:14 AM, Loren Wilton wrote: > Received: (qmail 31028 invoked from network); 9 Jul 2005 21:00:29 > - > Received: from localhost (127.0.0.1) by localhost with SMTP; 9 Jul > 2005 21:00:29 - > >

Re: Rule Advice

On Jul 14, 2005, at 4:14 AM, Loren Wilton wrote:Received: (qmail 31028 invoked from network); 9 Jul 2005 21:00:29 - Received: from localhost (127.0.0.1) by localhost with SMTP; 9 Jul 2005 21:00:29 - Are you really located in England?  So far as I know PacBell doesn't serve that area. I coul

RE: Proper way to override scores

> Thanks.. I just wanted to also verify the format of the over rides.. > > For instance.. if this is the rule I want to override: > > header SARE_ADLTSUB6 Subject =~ /(?!\bfuck)\bf.?u.?c.?k/i > describe SARE_ADLTSUB6 Apparent spam seems to contain porn subject > scoreSARE_ADLTSUB6 3.500 # ty

Re: I am NOT a spammer

At 11:06 AM 7/14/2005, Kai Schaetzl wrote: > Sorry bothering you all with such matter but I wasn't able to quickly > locate an admin address and I HOPE this message get attention from > someone able to workaround my issue. Talk to the site you have a problem sending to. Kai, this list *IS* t

Re: I am NOT a spammer

Keith Ivey wrote: JamesDR wrote: If you want to post to aol, your HELO MUST match your rdns (has been in my case and a few others.) Not true. I send messages to AOL all the time from a machine whose HELO does not match its rDNS. Perhaps you mean that the HELO must be a valid hostname tha

Re: Proper way to override scores

"Kai Schaetzl" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > Debbie D wrote on Thu, 14 Jul 2005 09:26:09 -0400: > >> I simply add to my custom or create a new custom lets say called: >> 10_custom_scores.cf > > the name is not important, it just needs to be in /etc/mail/spamassassi

Re: I am NOT a spammer

Kai Schaetzl escreveu: Aecio F. Neto wrote on Thu, 14 Jul 2005 10:58:25 -0300: Sorry bothering you all with such matter but I wasn't able to quickly locate an admin address and I HOPE this message get attention from someone able to workaround my issue. Talk to the site you have a pr

RE: I am NOT a spammer

Kai Schaetzl decided to say on Thursday, July 14, 2005 11:06 AM: > Aecio F. Neto wrote on Thu, 14 Jul 2005 10:58:25 -0300: > >> Sorry bothering you all with such matter but I wasn't able to quickly >> locate an admin address and I HOPE this message get attention from >

[Fwd: Re: I am NOT a spammer]

I was trying not to keep OT here, but since some are discussing it... Good anti-spam technics involves not only identifying properly spam, but also to properly identify non-spam (or ham, you name it). And this is the hard part, IMHO. So, I am seeing this list not dealing well with this matter,

Re: I am NOT a spammer

Aecio F. Neto wrote on Thu, 14 Jul 2005 10:58:25 -0300: > Sorry bothering you all with such matter but I wasn't able to quickly > locate an admin address and I HOPE this message get attention from > someone able to workaround my issue. Talk to the site you have a problem sending to. Kai -- K

Re: Proper way to override scores

Debbie D wrote on Thu, 14 Jul 2005 09:26:09 -0400: > I simply add to my custom or create a new custom lets say called: > 10_custom_scores.cf the name is not important, it just needs to be in /etc/mail/spamassassin if this is your local config dir. > > scoreSARE_ADLTSUB6 8.500 # type=o

Re: I am NOT a spammer

JamesDR wrote: If you want to post to aol, your HELO MUST match your rdns (has been in my case and a few others.) Not true. I send messages to AOL all the time from a machine whose HELO does not match its rDNS. Perhaps you mean that the HELO must be a valid hostname that points to your ser

Re: I am NOT a spammer

jdow wrote: From: "Aecio F. Neto" <[EMAIL PROTECTED]> I have been trying to post to this list using my original subscriber email address. Unfortunately, It has been not possible up to now. I am using a personal and secondary address to workaround a dumb rule, assuming that all hosts under a d

RE: cleaning whitelist?

Dr Robert Young wrote: > I was wondering since our whitelist database is currently > > 8Mb and when looking at it, a vast majority are only /1 scores... > > > > On Jul 14, 2005, at 7:31 AM, Kai Schaetzl wrote: > >> Dr Robert Young wrote on Wed, 13 Jul 2005 22:00:04 -0400: >> >>> How often shou

Re: I am NOT a spammer

From: "Aecio F. Neto" <[EMAIL PROTECTED]> > I have been trying to post to this list using my original subscriber > email address. > Unfortunately, It has been not possible up to now. > > I am using a personal and secondary address to workaround a dumb rule, > assuming that all hosts under a dynam

milter-spamc -b vs -B

A question on this milter being used with sendmail and spamd if the -B option is used to direct spam to a "collection point", it changes the original "received list" according to the docs. The -b option keeps the list intact. The current spamd has "autolearn enabled", but my first inclina

Re: Proper way to override scores

- Original Message - From: "Debbie D" <[EMAIL PROTECTED]> To: Sent: 2005 July, 14, Thursday 06:20 Subject: Re: Proper way to override scores > I didn't cross post that I am aware of.. I know it is poor form!! According > to my SENT box it went to: gmane.mail.spam.spamassassin.general o

Re: cleaning whitelist?

I was wondering since our whitelist database is currently > 8Mb and when looking at it, a vast majority are only /1 scores... On Jul 14, 2005, at 7:31 AM, Kai Schaetzl wrote: Dr Robert Young wrote on Wed, 13 Jul 2005 22:00:04 -0400: How often should one "clean" the whitelist ? Unless the

I am NOT a spammer

I have been trying to post to this list using my original subscriber email address. Unfortunately, It has been not possible up to now. I am using a personal and secondary address to workaround a dumb rule, assuming that all hosts under a dynamic IP is a source of spam. My office server IP is N

RE: cleaning whitelist?

> -Original Message- > From: Dr Robert Young [mailto:[EMAIL PROTECTED] > Sent: Wednesday, July 13, 2005 10:00 PM > To: users@spamassassin.apache.org > Subject: cleaning whitelist? > > > How often should one "clean" the whitelist ? I assume you mean the AWL, which some of us call the A

Re: Proper way to override scores

I didn't cross post that I am aware of.. I know it is poor form!! According to my SENT box it went to: gmane.mail.spam.spamassassin.general only "jdow" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > From: "Debbie D" <[EMAIL PROTECTED]> > >> I often want to alter the scores of al

Re: Proper way to override scores

Herb, Thanks.. I just wanted to also verify the format of the over rides.. For instance.. if this is the rule I want to override: header SARE_ADLTSUB6 Subject =~ /(?!\bfuck)\bf.?u.?c.?k/i describe SARE_ADLTSUB6 Apparent spam seems to contain porn subject scoreSARE_ADLTSUB6 3.500 # type=ob

Re: Long Scanning Delays

Hello Technical, Thursday, July 14, 2005, 3:15:19 AM, you wrote: TD> Hi TD> We are running Qmail Scanner 1.25 + Spamassassin 3.04 + Clamd 1.86.1 on TD> our dual 1.4Ghz P3 Linux mail server. We've been experiencing some TD> problems with the server taking a long time to scan messages (In most TD>

Re: Stock Spam

Hello r, Thursday, July 14, 2005, 12:37:07 AM, you wrote: rwac> Hi rwac> Does anyone have any idea to block the stock spam? I use rwac> J_CHICKEN_POX ?rules but some stock spam still get through rwac> inbox. It depends on why the stock spam is getting through. 7?_sare_bml_*25x.cf (two files, p

Re: cleaning whitelist?

Hello Dr, Wednesday, July 13, 2005, 7:00:04 PM, you wrote: DRY> How often should one "clean" the whitelist ? IMO: When the AWL rule misbehaves repeatedly and significantly (I assume you're talking about the AWL database/rule). And it's probably best, if AWL is working in general, but there's a

Re[2]: Rule Advice

Hello dennis, Thursday, July 14, 2005, 2:34:42 AM, you wrote: dsc> Been using SA for quite a while and agree it's working great. dsc> Is FROM_STARTS_WITH_NUMS appropriately spammy if it's a legal way to dsc> name a domain? Yes. > header FROM_STARTS_WITH_NUMS From:addr =~ /^\d{6,}\S+\@/i The

Testing new versions of SC and XS

The new SURBL data engine is ready enough to start testing. The external lists such as WS, JP, OB, AB, PH have essentially the same content as before, but the SC and XS lists are significantly updated. The new XS list is twice as large at about 1000 records and the inclusion is a lot more selecti

Re: Trying to understand whitelist_from_rcvd

Hello Dr. Young, Wednesday, July 13, 2005, 3:37:18 PM, you wrote: DRY> If this is set in local.cf DRY> whitelist_from_rcvd@gold.com gold.com DRY> trusted_networks gold.com ( via the IP address } DRY> and the incoming email header looks like (xxx added by me) DRY> Received: ... DRY> From

Re: Long Scanning Delays

From: "Loren Wilton" <[EMAIL PROTECTED]> > I'd look at the load average on the system and see if you are running out of > memory. I don't know qmail, so can't suggest how to cure it if it is the > case. However, that is about the most common reason for slow scanning. You > don't seem to say how

RE: Proper way to override scores

Joanne wrote: > No to both of them, Herb. > > Place them into the /etc/mail/spamassassin (or > /etc/spamassassin depending on where the local.cf file is.) > Make a new file and put them into that file. It's cleaner > than getting local.cf all cluttered. That seems a good variation on the oth

Re: Bayes Questions

Herb Martin wrote on Tue, 12 Jul 2005 12:35:55 -0500: > I checked magic, performed learn with each of ham/spam, > saw positive sign that 'M of N messages were learned' and > yet on viewing magic subsequently the numbers for both > nspam and nham had not changed. You probably learned with a dif

Re: cleaning whitelist?

Dr Robert Young wrote on Wed, 13 Jul 2005 22:00:04 -0400: > How often should one "clean" the whitelist ? Unless there is a problem: never. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com IE-Center: http://ie5.de & http://msie.winware.or

Re: Long Scanning Delays

I don't see anything much wrong with the rule selections, other than I think mr_wiggly and maybe nov2rules are pretty old, and at least mr wiggly is in sare_specific (I believe it is) these days. I think perhaps also domaindigits has been depreciated; but I could be wrong about that. You might al

Re: Rule Advice

> Is FROM_STARTS_WITH_NUMS appropriately spammy if it's a legal way to > name a domain? >From the rule name (without looking) I'd say it refers to the from address. From: [EMAIL PROTECTED] It may be that it refers to the hostname itself starting with numbers, but that seems a little unlikely. Wh

Re: Stock Spam

> Does anyone have any idea to block the stock spam? I use J_CHICKEN_POX ?rules but some stock spam still get through inbox. SARE has some rules that help. Not sure which file though. If you aren't on 3.0, there are also some better rules in the main release over 2.6x. Loren

RE: sa-learn user

Matt Kettler wrote: > At 09:29 PM 7/13/2005, Mun Fai wrote: > >> I'd appreciate it if anyone could spot the user. > > spamd is the user your mail gets scanned as. > > All the spamd children and the main spamd process are running as that > user. The main spamd process has it's command like cut of

Long Scanning Delays

Hi We are running Qmail Scanner 1.25 + Spamassassin 3.04 + Clamd 1.86.1 on our dual 1.4Ghz P3 Linux mail server. We've been experiencing some problems with the server taking a long time to scan messages (In most cases they are taking between 60 and 80 seconds). I have the following rulesets i

Re: Rule Advice

Been using SA for quite a while and agree it's working great. Is FROM_STARTS_WITH_NUMS appropriately spammy if it's a legal way to name a domain? Is this related to the "suspicious hostname" flags? Or is that related to the use of webmail? If the former, then they're getting dinged at lea

  1   2   >