Re: Question regarding meta rule handling

2005-08-02 Thread Theo Van Dinter
On Wed, Aug 03, 2005 at 08:18:16AM +0200, Sven Riedel wrote: > header __X Content-Type =~ /^(message|multipart)/i > rawbody __Y /\S/ > meta Z ( !X && !Y ) > > and yet the rule triggers for me. Doing a Of course. __X != X ... :) -- Randomly Generated Tagline: "The question is to what extent par

Question regarding meta rule handling

2005-08-02 Thread Sven Riedel
Hi, a while back someone kindly posted a rule here that matches on empty mails: header __X Content-Type =~ /^(message|multipart)/i rawbody __Y /\S/ meta Z ( !X && !Y ) Now I find that Z matches on all mails - investigation shows that Y matches on all non-whitespaces as it should, and X doesn't

RE: Load balancing spamd

2005-08-02 Thread Gary W. Smith
> > How do you (make and) balance the calls to the AV servers? How do you > (make > and) balance the calls to the spamd machines? I am very interested in > these > details! We just call them in order case on the connection line. On two of the 4 SMTP gateways we use node 1 as the primary and

Re: Bayes: not enough usable tokens found

2005-08-02 Thread Loren Wilton
Hum. I'm a little confused by that SA score stuff on the bottom of the message. If it refers to a message that should be spam you have two serious problems. If it referred to a message from this list you may have a serious problem and a less serious problem. pts rule name descript

Re: Bayes: not enough usable tokens found

2005-08-02 Thread Daryl C. W. O'Shea
Mike Cavanagh wrote: Hum. I can see some messages are being caught via the Bayes test, but I would think Bayes would find many more as I have close to 5000 SPAM in the Bayes system. I get at most 15 messages a day flagged as SPAM while I receive approx. 100 messages a day as non-SPAM but shoul

OT: RBL for dynamic "no reverse DNS" lookups

2005-08-02 Thread Rob McEwen
OT: RBL for dynamic "no reverse DNS" lookups I'm trying to find an RBL which will return a standard RBL return code (like "127.0.0.2") if/when the IP passed to the RBL doesn't have a reverse DNS entry. (1) I know that SA doesn't have a need for this as another function is already available in SA

Re: Bayes: not enough usable tokens found

2005-08-02 Thread Mike Cavanagh
Hum.  I can see some messages are being caught via the Bayes test, but I would think Bayes would find many more as I have close to 5000 SPAM in the Bayes system. I get at most 15 messages a day flagged as SPAM while I receive approx. 100 messages a day as non-SPAM but should be flagged as SPAM.

Re: Bayes: not enough usable tokens found

2005-08-02 Thread Loren Wilton
> What does this message mean?? > debug: cannot use bayes on this message; not enough usable tokens found > debug: bayes: not scoring message, returning undef Unless you are seeing this a whole lot, I don't think you are doing anything wrong. I think this just means that the particular ma

RE: Load balancing spamd

2005-08-02 Thread email builder
--- "Gary W. Smith" <[EMAIL PROTECTED]> wrote: > We have 4 front end servers running postfix. These servers call and AV > process on two additional AV servers behind the wall. Then these > servers "these" being the AV server calls spamd or it goes back to the MTA first? How do you (make and)

Bayes: not enough usable tokens found

2005-08-02 Thread Mike Cavanagh
What does this message mean?? debug: cannot use bayes on this message; not enough usable tokens found debug: bayes: not scoring message, returning undef I am using MimeDefang Ver. 2.52 and SpamAssassin Ver. 3.0.4 Below is: current status of bayes database (sa-learn --dump=magic) sa-m

Re: Load balancing spamd

2005-08-02 Thread email builder
--- Charles Sprickman <[EMAIL PROTECTED]> wrote: > On Tue, 2 Aug 2005, email builder wrote: > > > Technically, this should be feasible with just plain DNS load balancing, > but > > in our current medium/low budget scenario, we don't have the rackspace to > > have numerous boxes that are dedicat

RE: Load balancing spamd

2005-08-02 Thread Gary W. Smith
We have 4 front end servers running postfix. These servers call and AV process on two additional AV servers behind the wall. Then these servers call spamd on two additional servers behind the wall. Those two servers have a simple MySQL cluster (running Linux-HA and DRBD). In all we have 8 box

Re: Runaway processes

2005-08-02 Thread Frank M. Cook
Pretty much answered in my following mail. In general each child might us 30-60mb under NORMAL circumstances, so the amount of memory on your machine will determine the upper limit for number of children. so 8 would be max on a 512meg system (what I have). I still have free ram after firing

Re: Load balancing spamd

2005-08-02 Thread Charles Sprickman
On Tue, 2 Aug 2005, email builder wrote: Technically, this should be feasible with just plain DNS load balancing, but in our current medium/low budget scenario, we don't have the rackspace to have numerous boxes that are dedicated ONLY to SA/clam, thus our desire is to figure out a way to *WEIGH

Re: Load balancing spamd

2005-08-02 Thread email builder
--- Jason Frisvold <[EMAIL PROTECTED]> wrote: > On 8/1/05, email builder <[EMAIL PROTECTED]> wrote: > > Even if I had forgotten the -A, I think I would have been seeing > connection > > refused notices, but right now, it just seems to time out. I'm pretty > sure > > this is a LVS question more

Re: Increase Performance howto

2005-08-02 Thread jdow
From: "Dhanny Kosasih" <[EMAIL PROTECTED]> > I tested my qmail wtih more than 14000 spam (i used qmail-inject in my > script). If i use QSheff + ClamAV + SpamAssassin, my server process > 14000 emails in 1 hour, and if i only use qmail my server process 14000 > emails in 1/3 hours. How can i incre

Re: Forwarding mail address

2005-08-02 Thread jdow
From: "Alexandre Cruz" <[EMAIL PROTECTED]> > Hi all, > > I do understand that this can sound as a very newbie question, however i > have a doubt that i can't find an answer. We are using Spamassassin with > procmail/sendmail. It is working fine, however, spam mail is being > forwarded for a mail

Re: Runaway processes

2005-08-02 Thread Loren Wilton
> is it better to run five children with 20 connections each, or 20 children with five connections each? Pretty much answered in my following mail. In general each child might us 30-60mb under NORMAL circumstances, so the amount of memory on your machine will determine the upper limit for number

Re: Increase Performance howto

2005-08-02 Thread Loren Wilton
> I tested my qmail wtih more than 14000 spam (i used qmail-inject in my > script). If i use QSheff + ClamAV + SpamAssassin, my server process > 14000 emails in 1 hour, and if i only use qmail my server process 14000 > emails in 1/3 hours. How can i increase my server performance ? I don't > unders

Re: Runaway processes

2005-08-02 Thread Loren Wilton
> so you are running 30 per child and 6 children? 180 total. how many messages a day are you handling. I upped my children from 5 to 15 thinking that would help but it hasn't. I was thinking of taken connections down to 5 or 6 on 15 children. maybe I have it backwards? I don't have anything e

Re: Personal Bayes Score

2005-08-02 Thread Dhanny Kosasih
Matthew Yette wrote: Dankos, Put this into your /etc/mail/spamassassin/local.cf: user_scores_sql_custom_querySELECT preference, value FROM _TABLE_ WHERE username = _USERNAME_ OR username = '@GLOBAL' OR username = _DOMAIN_ ORDER BY username ASC That will make per-user preferences priority,

Re: Runaway processes

2005-08-02 Thread Frank M. Cook
  is it better to run five children with 20 connections each, or 20 children with five connections each? Frank M. CookAssociation Computer Services, Inc.http://www.acsplus.com  

Increase Performance howto

2005-08-02 Thread Dhanny Kosasih
I tested my qmail wtih more than 14000 spam (i used qmail-inject in my script). If i use QSheff + ClamAV + SpamAssassin, my server process 14000 emails in 1 hour, and if i only use qmail my server process 14000 emails in 1/3 hours. How can i increase my server performance ? I don't understand w

Re: Runaway processes

2005-08-02 Thread Loren Wilton
Most strange. Could you give us the listing frop top or the like? The normal case, as you are probably aware, is that the children get fat (use a lot of memory) and your system goes into thraashing. This sounds like you have some other problem. Are you using awl (it is on by default in 3.x) or

RE: Runaway processes

2005-08-02 Thread Pierre Thomson
Herb Martin wrote: >> When people ask why I haven't upgraded from 2.64 yet... I'm waiting >> until a week goes by without a new thread about runaway / way-slow / >> resource-eating SA 3.0.X processes! :-) >> > > I suspect your wait is over 3.10 (due any day now) + 1 week > should make you happy.

Re: userpref with mysql does not work

2005-08-02 Thread Michael Parker
Martin Tanzer wrote: > My setup: > Debian 3.1 (sarge) with the provided spamassassin package (3.0.3-2) > Postfix, spamassassin bound to postfix (no amavisd-new) > There are no users on the machine, all mails are forwarded to another > mailserver trough the transport file. > > Any ideas? It seems

Re: Forwarding mail address

2005-08-02 Thread Mike Jackson
I do understand that this can sound as a very newbie question, however i have a doubt that i can't find an answer. We are using Spamassassin with procmail/sendmail. It is working fine, however, spam mail is being forwarded for a mail account, which is no longer valid. I've been looking where this

Re: Forwarding mail address

2005-08-02 Thread Evan Platt
At 09:00 AM 8/2/2005, you wrote: Hi all, I do understand that this can sound as a very newbie question, however i have a doubt that i can't find an answer. We are using Spamassassin with procmail/sendmail. It is working fine, however, spam mail is being forwarded for a mail account, which is

Re: Forwarding mail address

2005-08-02 Thread Matt Kettler
Alexandre Cruz wrote: > Hi all, > > > > I do understand that this can sound as a very newbie question, however i > have a doubt that i can’t find an answer. We are using Spamassassin with > procmail/sendmail. It is working fine, however, spam mail is being > forwarded for a mail account, which

Forwarding mail address

2005-08-02 Thread Alexandre Cruz
Hi all,   I do understand that this can sound as a very newbie question, however i have a doubt that i can’t find an answer. We are using Spamassassin with procmail/sendmail. It is working fine, however, spam mail is being forwarded for a mail account, which is no longer valid. I’ve been

Re: runaway processes

2005-08-02 Thread Tom Gwilt
My setup is as follows: FreeBSD 4.10, SpamAssassin 3.0.4, Perl 5.8 Using Bayes and a pile 'o SARE rules. It scanned 34484 messages last night and the only time we see lags is when the bayes database is expiring. The startup script is as follows: /usr/local/bin/spamd --max-children=6 --max-c

RE: Runaway processes

2005-08-02 Thread Herb Martin
> > When people ask why I haven't upgraded from 2.64 yet... I'm waiting > > until a week goes by without a new thread about runaway / > way-slow / > > resource-eating SA 3.0.X processes! :-) > > I suspect your wait is over 3.10 (due any day now) + 1 week should make you happy. Improved thread

Re: Runaway processes

2005-08-02 Thread Mike Jackson
Sorry, no, that didn't come out right. There's only six children running at any time. Each will process 30 messages, then restart. The machine processed about 3200 messages yesterday, so each child restarted about once every 2.5-3 hours. Mike Jackson Tech Administrator, Datahost www.datahost.c

Re: Runaway processes

2005-08-02 Thread Frank M. Cook
so you are running 30 per child and 6 children?  180 total.  how many messages a day are you handling.  I upped my children from 5 to 15 thinking that would help but it hasn't.  I was thinking of taken connections down to 5 or 6 on 15 children.  maybe I have it backwards?  I don't have anyth

Re: Runaway processes

2005-08-02 Thread nick
Pierre Thomson wrote: I'm running SA 3.0.4 on OpenBSD with Perl 5.8.6 & Exim V4.52. I'm noticing that SA seems to have a big problem with child processes just "running away", never terminating and eating CPU. My mailservers can't cope, and I'm looking at having to switch off SA. (Not something

RE: Runaway processes

2005-08-02 Thread Pierre Thomson
> I'm running SA 3.0.4 on OpenBSD with Perl 5.8.6 & Exim V4.52. > > I'm noticing that SA seems to have a big problem with child > processes just "running away", never terminating and eating CPU. > > My mailservers can't cope, and I'm looking at having to switch > off SA. (Not something I really wan

Re: Runaway processes

2005-08-02 Thread Frank M. Cook
I've been fighting a problem which may turn out to be similar. my spamassassin just starts falling behind and runaway threads could be the cause. I'm going to try adjusting --max connections per child (check docs for exact syntax). the default is 200. maybe someone else will jump in with a

Re: Load balancing spamd

2005-08-02 Thread Jason Frisvold
On 8/1/05, email builder <[EMAIL PROTECTED]> wrote: > Even if I had forgotten the -A, I think I would have been seeing connection > refused notices, but right now, it just seems to time out. I'm pretty sure > this is a LVS question more than a spamc/d question, since I've no problems > with the la

Runaway processes

2005-08-02 Thread Gordon Ross
I'm running SA 3.0.4 on OpenBSD with Perl 5.8.6 & Exim V4.52. I'm noticing that SA seems to have a big problem with child processes just "running away", never terminating and eating CPU. My mailservers can't cope, and I'm looking at having to switch off SA. (Not something I really want to do..)

Re: Qmail + spamassassin + squirellmail

2005-08-02 Thread Tom Q. Citizen
Dhanny Kosasih wrote: Hi, Any body know, how to install qmail + spamassassin + squirellmail (can tell spam to spamassassin) ? And how to make spamassassin can autolearn for spam ? Regards, dankos. Here are two "toaster" documents I used: http://sylvestre.ledru.info/howto/howto_qmail_vpo

Re: unwanted breakthrough

2005-08-02 Thread Loren Wilton
> SARE_ADLTSUB2 Subject =~ /\b(?:blow|climax > |enlarg(e|ment)|fuck|inter+acial|lick|porn|penis|pervert|pussy|tits|tight|va gina|virgins?)\b/i > > Fix the rule, don't ditch the \b's for such a broad rule.. > > Besides, the whole rule is subject to all kinds of obfuscation tricks. P.e.n.i.s > still