From: Evan Platt [EMAIL PROTECTED]
At 10:05 PM 11/1/2005, you wrote:
Hi,
I have installed SA 3.0.4 with Sendmail, Cyrus IMAP, Procmail,
spamass-milter clamav-milter on Redhat FC3. The current problem
that I'm experiencing is when an email arrives it get scanned with
SA, get scored and
From: Evan Platt [EMAIL PROTECTED]
At 10:37 PM 11/1/2005, you wrote:
Evan,
Thanks. I have tried it but I still have the same results...
Not sure then. Does running spamassassin with -d --lint give any
errors? (Or possibly a clue as to what the issue is)?
All together now on three: 1, 2,
All
Anyone any idea what rule has the following in it that would cause the RDJ
lint to fail..
Lint output: [90183] warn: config: invalid regexp for rule KEZAAM:
/SecuryTeam Order: missing or invalid delimiters [90183]
Running SA 3.1.0 ???
Of course the hard way to download the updated rules my
Folks, we've been using SpamAssassin as part of MailScanner for just
over a year with no problems at all.
However, output (plain ASCII text files of a few k in size) from out
student admin system, which is mailed to users of the system, is now
being flagged as spam. Below are the relevant
In an older episode (Wednesday, 2. November 2005 12:11), Simon Hogg wrote:
Folks, we've been using SpamAssassin as part of MailScanner for just
over a year with no problems at all.
We have the threshold set at 6 for spam, but this scores 100.00 on IE_VULN.
Can it be that the content of
Hi Simon,
On Wed, 2005-11-02 at 11:11 +, Simon Hogg wrote:
Folks, we've been using SpamAssassin as part of MailScanner for just
over a year with no problems at all.
However, output (plain ASCII text files of a few k in size) from out
student admin system, which is mailed to users of
Evan,
Yes I can run spamassassin -d no problem and the --lint option gives no
error with my config file.
Thanks,
Dawid van Wyngaard
-Original Message-
From: Evan Platt [mailto:[EMAIL PROTECTED]
Sent: 02 November 2005 08:49 AM
To: spamassassin-users@incubator.apache.org
Subject: RE:
Jdow,
After the changes I actually restarted my server if that helpsI
fortunately have the luxury of restarting the box at anytime
currently
Thanks,
Dawid van Wyngaard
-Original Message-
From: jdow [mailto:[EMAIL PROTECTED]
Sent: 02 November 2005 10:39 AM
To:
Mike Loiterman wrote:
Mysql 4.1.15
DBD 3.0002
DBI 1.48
I can't get the --lint output into a filebut it doesn't say much else
besides what I've listed above.
Ahh yes, but it puts it in context which your other cut-and-paste does
not, for instance I believe that the error is harmless.
Michael Parker mailto:[EMAIL PROTECTED] wrote:
Mike Loiterman wrote:
Mysql 4.1.15
DBD 3.0002
DBI 1.48
I can't get the --lint output into a filebut it doesn't say much
else besides what I've listed above.
Ahh yes, but it puts it in context which your other cut-and-paste does
I'm trying to find a way to count the number of spam/ham that I recieve
each day. I was trying to parse my procmail log, but that doesn't list
spam/ham that get a false positive or false negitive; as such, I was
wondering if I could use the nspam/nham count from sa-learn --dump
magic, or if
2005/11/2, Burton Windle [EMAIL PROTECTED]:
I'm trying to find a way to count the number of spam/ham that I recieve
each day. I was trying to parse my procmail log, but that doesn't list
Iam not shure if it´s works without MailScanner but what about Vispan
Hi, I've configured this:
bayes_learn_to_journal 1
bayes_auto_expire 0
bayes_journal_max_size 0
I assumed that this would cause any bayes-learning
to land in the bayes_journal file, only to be incorporated in
the main bayes files whenever I ran sa-learn --sync. Thus
keeping bayes_toks,
Hi, I often see that bayes is not run on all the SA input.
About 2 in 5 spam just has Bayes not run in the _BAYES_
headerlines, and no Bayes_XX score.
What could cause bayes to skip? Too high a load? Too many locks on
the bayes-files?
I can't find anything in the logfiles.
Hi, SA 3.1.0 has some new lines in the log, like this:
info: prefork: child states: BBBIBBIBB
Does anybody know what they mean?
On Montag, 31. Oktober 2005 03:15 Linda Walsh wrote:
Still am not sure what size system (or user) db's should trigger
usage of SQL. Any reason why user DB's would hurt performance
over a system DB using Berkeley format? Supposing I have no system
DB and am only using user DB's? What if it
On Sonntag, 30. Oktober 2005 20:20 Daniel Watts wrote:
I'm not The God Of Regex, but maybe that helps:
body SOFTWARE_SPAM_BODY2 /(\$\d{1,3}\.\d{0,2}){10,}/s
#matches $xx.xx at least 10 times
If you have $133, your rule doesn't fit, as you forgot the .. Try
body SOFTWARE_SPAM_BODY2
Lint output: [90183] warn: config: invalid regexp for rule KEZAAM:
/SecuryTeam Order: missing or invalid delimiters [90183]
That was probably something from a posting recently here on the list, so I
would assume that you cut-n-pasted from the list into a personal file, and
may have had a line
On Mittwoch, 2. November 2005 15:25 Mike Loiterman wrote:
8:24:50 [EMAIL PROTECTED]: /home/mike]# spamassassin -D --lint
debug.txt 21
Ambiguous output redirect.
Arhm - is that a Unix box? I can't imagine where that error comes from.
Try
spamassassin -D --lint 21|cat debug.txt
or
On Wednesday 02 November 2005 12:02, Rick Cooper wrote:
-Original Message-
From: Michael Monnerie [mailto:[EMAIL PROTECTED]
Sent: Wednesday, November 02, 2005 12:07 PM
To: users@spamassassin.apache.org
Subject: Re: Bayes mysql db error
On Mittwoch, 2. November 2005 15:25 Mike
From: eBay [EMAIL PROTECTED]
Many MUAs will display simply ebay. If you've not had your first morning
cuppa stuff you might be tempted to click on it if it escapes other spam
rules as this list of cell phones for sale did. So I decided to nail the
sucker to the wall if it's ever tried on me
jdow wrote:
Since you're feeling pedantic...
===8--- This set of rules nails it cold.
header JD_SIMPLE_EBAY_SPOOFaFrom =~ /(\|\.|\b)ebay(\|\.|\b)/i
An exactly equivalent expression is:
From =~ /\bebay\b/i
This also has the added advantage of not populating $1 and $2.
--
Hello,Recently I have notice that some legitimate emails that are
coming to me =are marked as spam even though they still score below 5.0(spam
score).Here is the part of the header of such an email:X-Filtered-With:
renattach 1.2.2X-RenAttach-Info: mode=3Dbadlist action=""
Michael wrote:
Hello,
Recently I have notice that some legitimate emails that are coming to me =
are marked as spam even though they still score below 5.0(spam score).
Here is the part of the header of such an email:
X-Filtered-With: renattach 1.2.2
X-RenAttach-Info: mode=3Dbadlist
Michael Parker mailto:[EMAIL PROTECTED] wrote:
Mike Loiterman wrote:
Mysql 4.1.15
DBD 3.0002
DBI 1.48
I can't get the --lint output into a filebut it doesn't say much
else besides what I've listed above.
Ahh yes, but it puts it in context which your other cut-and-paste does
From: Michael Monnerie [EMAIL PROTECTED]
On Mittwoch, 2. November 2005 15:25 Mike Loiterman wrote:
8:24:50 [EMAIL PROTECTED]: /home/mike]# spamassassin -D --lint
debug.txt 21
Ambiguous output redirect.
Arhm - is that a Unix box? I can't imagine where that error comes from.
Try
From: [EMAIL PROTECTED]
jdow wrote:
Since you're feeling pedantic...
===8--- This set of rules nails it cold.
header JD_SIMPLE_EBAY_SPOOFaFrom =~ /(\|\.|\b)ebay(\|\.|\b)/i
An exactly equivalent expression is:
From =~ /\bebay\b/i
This also has the added advantage of not populating $1
On Wed, 2 Nov 2005, jdow wrote:
|# On Mittwoch, 2. November 2005 15:25 Mike Loiterman wrote:
|# 8:24:50 [EMAIL PROTECTED]: /home/mike]# spamassassin -D --lint
|# debug.txt 21
|# Ambiguous output redirect.
|#
|# Arhm - is that a Unix box? I can't imagine where that error comes from. Try
|#
On Wed, Nov 02, 2005 at 01:23:54PM -0600, Mike Loiterman wrote:
spamassassin -D --lint debug.txt 21
[22511] dbg: bayes: database connection established
[22511] dbg: bayes: found bayes db version 3
[22511] dbg: bayes: unable to initialize database for root user, aborting!
[22511] dbg:
[EMAIL PROTECTED] wrote:
jdow wrote:
Since you're feeling pedantic...
===8--- This set of rules nails it cold.
header JD_SIMPLE_EBAY_SPOOFaFrom =~ /(\|\.|\b)ebay(\|\.|\b)/i
An exactly equivalent expression is:
From =~ /\bebay\b/i
This also has the added advantage of
You don't seem to show a Subject heading there. There is nothing in what you
show to indicate that the message was marked as spam.
Loren
-Original Message-
From: Michael [EMAIL PROTECTED]
Sent: Nov 2, 2005 11:12 AM
To: users@spamassassin.apache.org
Subject: Why this is marked
Uwe írta:
2005/11/2, Burton Windle [EMAIL PROTECTED]:
I'm trying to find a way to count the number of spam/ham that I recieve
each day. I was trying to parse my procmail log, but that doesn't list
Iam not shure if it´s works without MailScanner but what about Vispan
Chris wrote:
[EMAIL PROTECTED] wrote:
jdow wrote:
Since you're feeling pedantic...
===8--- This set of rules nails it cold.
header JD_SIMPLE_EBAY_SPOOFaFrom =~ /(\|\.|\b)ebay(\|\.|\b)/i
An exactly equivalent expression is:
From =~ /\bebay\b/i
This also has the added
From: Chris [EMAIL PROTECTED]
[EMAIL PROTECTED] wrote:
jdow wrote:
Since you're feeling pedantic...
===8--- This set of rules nails it cold.
header JD_SIMPLE_EBAY_SPOOFaFrom =~ /(\|\.|\b)ebay(\|\.|\b)/i
An exactly equivalent expression is:
From =~ /\bebay\b/i
This also has the
jdow wrote:
jdow wrote:
===8--- This set of rules nails it cold.
header JD_SIMPLE_EBAY_SPOOFaFrom =~ /(\|\.|\b)ebay(\|\.|\b)/i
Actually I wanted to catch or . or blankness. And my head keeps
trying to make \b be blankness. If \b is boundary which includes
and . in the definition of
jdow wrote:
Actually I wanted to catch or . or blankness. And my head keeps
trying to make \b be blankness. If \b is boundary which includes
and . in the definition of boundary that's fine.
Yeah, \b matches a word Boundary. For blankness you probably want \s
which matches whiteSpace
From: [EMAIL PROTECTED]
jdow wrote:
jdow wrote:
===8--- This set of rules nails it cold.
header JD_SIMPLE_EBAY_SPOOFaFrom =~ /(\|\.|\b)ebay(\|\.|\b)/i
Actually I wanted to catch or . or blankness. And my head keeps
trying to make \b be blankness. If \b is boundary which includes
and .
[EMAIL PROTECTED] wrote:
Chris wrote:
Matthew,
@ebay.com matches that doesn't it?
Yup, it sure does, but that's OK. The intent was to detect email messages
where:
1) From matches /\bebay\b/i
2) From DOES NOT MATCH /[EMAIL PROTECTED]/i
The fact that @ebay. matches /bebay\b/ is
From: Kelson [EMAIL PROTECTED]
jdow wrote:
Actually I wanted to catch or . or blankness. And my head keeps
trying to make \b be blankness. If \b is boundary which includes
and . in the definition of boundary that's fine.
Yeah, \b matches a word Boundary. For blankness you probably want \s
jdow wrote:
my head keeps thinking blank for \b rather than boundary.
FWIW, I keep thinking bell :)
--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer
jdow wrote:
And a detail here - Does a From test include all characters
after the : or after the : ? That would change things, too.
After the :
From: Joe User [EMAIL PROTECTED]
^
The tested value starts at the first and ends at the final
--
From: Chris [EMAIL PROTECTED]
[EMAIL PROTECTED] wrote:
Chris wrote:
Matthew,
@ebay.com matches that doesn't it?
Yup, it sure does, but that's OK. The intent was to detect email messages
where:
1) From matches /\bebay\b/i
2) From DOES NOT MATCH /[EMAIL PROTECTED]/i
The fact
From: [EMAIL PROTECTED]
jdow wrote:
my head keeps thinking blank for \b rather than boundary.
FWIW, I keep thinking bell :)
Aw shucks, now you've screwed me up worse. Somehow I was
skipping over beep and bell in the search pattern. ARGH!
I'm ruined!
{O,o}
Chris wrote:
Understood, but I don't see the point in being lax with that match.
Perhaps I ebay too much using the address [EMAIL PROTECTED] ;)
Good point. Now that I think about it, just a few weeks ago I won an
auction from someone who used an address similar to
[EMAIL PROTECTED] That
Kelson wrote:
I forget, do numbers trigger word boundaries?
No. Wordish things include: letters, numbers, and the underscore.
--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer
Kelson wrote:
Chris wrote:
Understood, but I don't see the point in being lax with that match.
Perhaps I ebay too much using the address [EMAIL PROTECTED] ;)
Good point. Now that I think about it, just a few weeks ago I won an
auction from someone who used an address similar to
[EMAIL
From: Kelson [EMAIL PROTECTED]
Chris wrote:
Understood, but I don't see the point in being lax with that match.
Perhaps I ebay too much using the address [EMAIL PROTECTED] ;)
Good point. Now that I think about it, just a few weeks ago I won an
auction from someone who used an address
jdow said:
snip
Yup, it sure does, but that's OK. The intent was to detect email messages
where:
1) From matches /\bebay\b/i
2) From DOES NOT MATCH /[EMAIL PROTECTED]/i
The fact that @ebay. matches /bebay\b/ is irrelevant.
Let's see if I can amplify the intent.
The particular spam had a
From: Kelson [EMAIL PROTECTED]
Kelson wrote:
Chris wrote:
Understood, but I don't see the point in being lax with that match.
Perhaps I ebay too much using the address [EMAIL PROTECTED] ;)
Good point. Now that I think about it, just a few weeks ago I won an
auction from someone who used
Hello Martin,
Wednesday, November 2, 2005, 12:57:22 AM, you wrote:
MH Anyone any idea what rule has the following in it that would cause the RDJ
MH lint to fail..
MH Lint output: [90183] warn: config: invalid regexp for rule KEZAAM:
MH /SecuryTeam Order: missing or invalid delimiters [90183]
Evan / jdow,
Thanks for the help. After a bit more digging on the net I found the
solution. The is a spamass-milter config file
(/etc/sysconfig/spamass-milter) that I had to edit and take the -m
option out.
After this it's been working without any problems
Thanks,
Dawid van Wyngaard
Glad you got it fixed. Now if only a body replacement for this organic
support hardware I have was that easy.
{^_-}
- Original Message -
From: Dawid Wyngaard [EMAIL PROTECTED]
Evan / jdow,
Thanks for the help. After a bit more digging on the net I found the
solution. The is a
52 matches
Mail list logo
