Re: Spamassassin Debug

2005-12-23 Thread Loren Wilton
> For the local.cf settings, my local.cf file seems pretty inocuous: Depends on precisely what you mean by 'inocuous'. At least four of those settings are invalid. Loren > > # > # rewrite_subject 0 > # report_safe 1 > # trusted_networks 212.17.35. > > # Bayesian Auto Learn > auto_learn

Re: Spamassassin Debug

2005-12-23 Thread Miles Muri
Here's what --lint shows (the same errors you pointed out, thanks) saskatoon:/etc/mail/spamassassin root# spamassassin --lint config: SpamAssassin failed to parse line, skipping: auto_learn 1 config: SpamAssassin failed to parse line, skipping: safe_reporting 0 config: SpamAssassin failed to pars

Re: Spamassassin Debug

2005-12-23 Thread Miles Muri
Thanks, First, I don't know that the DNS server is the problem. I have caching DNS on the mailserver itself and it seems to work OK. I'm wondering if Net::DNS isn't working properly? It wasn't installed by default, so I used CPAN to get the latest version. How does a person go about testi

Re: Spamassassin debug - cont.

2005-12-23 Thread Loren Wilton
> What does this line in the debug mean? I assume it is related to the > lack of network tests... > > debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x19250d8) > inhibited further callbacks It is essentially meaningless and is a normal operating sign. I believe it has been removed or ch

Re: Spamassassin Debug

2005-12-23 Thread Matt Kettler
At 11:00 PM 12/23/2005, Miles Muri wrote: I'm trying to work through a problem where network tests don't seem to be working. Here's what I get from the debug on the command line: BTW: SA 3.0.1 invoked through amavisd on Mac OS X Server 10.4.3 saskatoon:~ mmuri$ sa-learn --dump magic ERROR:

Spamassassin debug - cont.

2005-12-23 Thread Miles Muri
Sorry about that... pressed send before I had finished writing the message. regarding the debug output from the previous message, I have a few questions: 1) is the // in the default rules dir normal? Where do I fix this? 2) network tests don't seem to be working, I tried this test mentio

Re: Spamassassin Debug

2005-12-23 Thread Richard Ozer
I had a similar issue last week. I had inadvertantly set the DNS to an internal DNS server with forwarders to the outside, rather than to a real outside DNS server. Once I changed to a bona-fide outside DNS provider, all my network tests worked properly. You also need to fix those invalid se

Spamassassin Debug

2005-12-23 Thread Miles Muri
I'm trying to work through a problem where network tests don't seem to be working. Here's what I get from the debug on the command line: BTW: SA 3.0.1 invoked through amavisd on Mac OS X Server 10.4.3 saskatoon:~ mmuri$ sa-learn --dump magic ERROR: Bayes dump returned an error, please re-run

RE: Bayes Scores Skipped/Not Applied: HAPPY RESOLUTION

2005-12-23 Thread John Urness
Hi Matt, I resolved the issue. Thanks for pointing me in a different direction- the rubber has not been meeting the road for about a week on this issue! After upgrading using CPAN I am getting BAYES scores (among others from the /usr/share/spamassassin dir). So apparently it was an installation is

RE: Bayes Scores Skipped/Not Applied

2005-12-23 Thread John Urness
Here is some debugging info from MailScanner. Starting MailScanner... In Debugging mode, not forking... debug: SpamAssassin version 3.0.1 debug: Score set 0 chosen. debug: running in taint mode? no debug: config: SpamAssassin failed to parse line, skipping: use_razor1 0 debug: SpamAssassin versio

RE: Bayes Scores Skipped/Not Applied

2005-12-23 Thread John Urness
Hi Matt, I stopped running spamd. The ALL_TRUSTED was letting a lot of junk get through and I saw a post that recommended 0 for the score to prevent false negatives. I have restored it to its original and added trusted networks (with a couple of subnets) as you suggest. I am still not seeing any

RE: Bayes Scores Skipped/Not Applied

2005-12-23 Thread John Urness
Loren, You are seriously paying attention. I did the debugs yesterday and completely rebuilt the bayes db today using a whitelist and a blacklist mailspool so it is now a lot smaller since it lost a couple of years of autolearning when I started over... So it is actually from a site bayes database

Re: Bayes Scores Skipped/Not Applied

2005-12-23 Thread Loren Wilton
This seems strange: > Here is sa-learn --dump magic: > This shows that I have more than enough spam and ham > 0.000 0 3 0 non-token data: bayes db version > 0.000 0 3754 0 non-token data: nspam > 0.000 0220 0 non-

Re: SARE_URI_EQUALS false positives

2005-12-23 Thread Loren Wilton
> Does anyone have any suggestions, apart from simply reducing the score > for SARE_URI_EQUALS? Is this a spamassassin bug, or is there no way to > guarantee that only real uris are parsed as such? Several. 1.Change your report generator to remove the extraneous dot between updated and by. O

Re: Bayes Scores Skipped/Not Applied

2005-12-23 Thread Matt Kettler
John Urness wrote: > > /etc/mail/spamassassin/local.cf > score ALL_TRUSTED 0 0 0 0 That is very concerning. Why'd you do that? 99.9% of the time the proper fix is to declare a trusted_networks. Disabling this rule merely covers up one symptom of a very pervasive problem (errant trust). > >

Re: SARE_URI_EQUALS false positives

2005-12-23 Thread Robert Menschel
Hello Chris, Friday, December 23, 2005, 3:04:29 AM, you wrote: CL> I'm getting false positives for SARE_URI_EQUALS, which scores 5 and is CL> therefore skewing the scoring of some mail quite badly. ... CL> Does anyone have any suggestions, apart from simply reducing the CL> score for SARE_URI_EQ

Bayes Scores Skipped/Not Applied

2005-12-23 Thread John Urness
Hi, I recently upgraded from spamassassin 3.0 to 3.1 and right away the amount of false negatives increased. I thought at first that it was because of the loss of dcc and razor (which surely is a factor), but on further investigation it appears that it is more related to the Bayes system. I have l

Re: sender-valid SMTP callbacks (Re: Does "tuxorama.com" sound fa miliar to anyone?)

2005-12-23 Thread Matt Yackley
François Conil said: snip > > it's kinda easy with postfix : > http://www-personal.umich.edu/~malth/gaptuning/postfix/ > > I strongly advise to run it manually instead of via cron, since if the > exchange server sh*t itself, the exchange_recipients list will contains > nothing and all mails will b

Re: Using Dig for RBL lookups.

2005-12-23 Thread Matt Kettler
CORRECTION OF MY PREVIOUS STATEMENTS: SBL doesn't appear to use a bitmask format as I suggested earlier. 127.0.0.6 would appear to be a valid answer for XBL only. It looks like they might use format 2 below, and SA's query implementation reflects this. Their choice of listing numbers suggests 1),

Re: I'm afraid I might have to report this list as a spam source

2005-12-23 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Martin Hepworth wrote: > > >> -Original Message- >> From: Craig McLean [mailto:[EMAIL PROTECTED] >> Sent: 23 December 2005 16:03 >> To: users@spamassassin.apache.org >> Subject: Re: I'm afraid I might have to report this list as a spam source

RE: I'm afraid I might have to report this list as a spam source

2005-12-23 Thread Martin Hepworth
> -Original Message- > From: Craig McLean [mailto:[EMAIL PROTECTED] > Sent: 23 December 2005 16:03 > To: users@spamassassin.apache.org > Subject: Re: I'm afraid I might have to report this list as a spam source > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Kai Schaetzl wrote:

Re: I'm afraid I might have to report this list as a spam source

2005-12-23 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kai Schaetzl wrote: > You are all speculating. No one knows why or if the original poster can't > unsubscribe. I'll agree with that, to a point. > And, frankly, it was the first posting of this kind I've ever > seen. It's not a problem at all. >

Re: SARE_URI_EQUALS false positives

2005-12-23 Thread List Mail User
updated.by - check http://www.tld.by/cgi-bin/registry.cgi You'll see that update.by is a registered domain! Therefore "updated.by" is indeed a URI. QED Paul Shupak [EMAIL PROTECTED]

Re: SARE_URI_EQUALS false positives

2005-12-23 Thread Chris Lear
* jdow wrote (23/12/05 12:06): > From: "Chris Lear" <[EMAIL PROTECTED]> >>* jdow wrote (23/12/05 11:26): >>> From: "Chris Lear" <[EMAIL PROTECTED]> >>> I'm getting false positives for SARE_URI_EQUALS, which scores 5 and is therefore skewing the scoring of some mail quite badly. The

Re: SARE_URI_EQUALS false positives

2005-12-23 Thread jdow
From: "Chris Lear" <[EMAIL PROTECTED]> * jdow wrote (23/12/05 11:26): From: "Chris Lear" <[EMAIL PROTECTED]> I'm getting false positives for SARE_URI_EQUALS, which scores 5 and is therefore skewing the scoring of some mail quite badly. The weird thing is that the uris that spamassassin is comp

Re: SARE_URI_EQUALS false positives

2005-12-23 Thread Chris Lear
* jdow wrote (23/12/05 11:26): > From: "Chris Lear" <[EMAIL PROTECTED]> > >> I'm getting false positives for SARE_URI_EQUALS, which scores 5 and is >> therefore skewing the scoring of some mail quite badly. >> The weird thing is that the uris that spamassassin is complaining about >> aren't uris a

Re: Question re perl & security fixes

2005-12-23 Thread Gene Heskett
On Friday 23 December 2005 06:29, jdow wrote: >From: "Gene Heskett" <[EMAIL PROTECTED]> > >> Greetings all; >> >> Because FC2 seems to have fallen off the Fedora-Legacy radar, I >> dl'd the perl5.8.5 stuff for FC3, figuring if there was a >> dependency clash, rpm would fuss. >> >> It didn't, but I'

Re: Question re perl & security fixes

2005-12-23 Thread jdow
From: "Gene Heskett" <[EMAIL PROTECTED]> Greetings all; Because FC2 seems to have fallen off the Fedora-Legacy radar, I dl'd the perl5.8.5 stuff for FC3, figuring if there was a dependency clash, rpm would fuss. It didn't, but I'm noting that when SA is searching for missing pkgs, the log

Re: SARE_URI_EQUALS false positives

2005-12-23 Thread jdow
From: "Chris Lear" <[EMAIL PROTECTED]> I'm getting false positives for SARE_URI_EQUALS, which scores 5 and is therefore skewing the scoring of some mail quite badly. The weird thing is that the uris that spamassassin is complaining about aren't uris at all. The mail in question is auto-created r

Question re perl & security fixes

2005-12-23 Thread Gene Heskett
Greetings all; Because FC2 seems to have fallen off the Fedora-Legacy radar, I dl'd the perl5.8.5 stuff for FC3, figuring if there was a dependency clash, rpm would fuss. It didn't, but I'm noting that when SA is searching for missing pkgs, the log does not indicate that it is searching in the

SARE_URI_EQUALS false positives

2005-12-23 Thread Chris Lear
I'm getting false positives for SARE_URI_EQUALS, which scores 5 and is therefore skewing the scoring of some mail quite badly. The weird thing is that the uris that spamassassin is complaining about aren't uris at all. The mail in question is auto-created reports of cvs diffs, so it's slightly unus

Re: I'm afraid I might have to report this list as a spam source

2005-12-23 Thread Kai Schaetzl
You are all speculating. No one knows why or if the original poster can't unsubscribe. And, frankly, it was the first posting of this kind I've ever seen. It's not a problem at all. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

Re: Newbie looking for info...

2005-12-23 Thread Kai Schaetzl
Aaron Boyles wrote on Thu, 22 Dec 2005 09:34:09 -0500: > Unfortunately, this would result in a third "step" in the SMTP process. > Currently, the SMTP filter I run allows us to use our choice of virus > scanner to check for viruses, monitor real-time traffic, and even "chat > back" to a would-b

Re: Is it possible to increase the Bayesian Score ?

2005-12-23 Thread jdow
Yes. Do it with due consideration. (I raised Bayes_99 to 5.0, for example. At this location that is as sure an indication of spam as I have present on the system. A score lower than Bayes_90, as out of the box, seemed stupid. Bayes_99 fires on 0.08% of ham and 84.7% of spam. Whitelist rules handle