Re: Is Spamassassin failing math?

2006-04-04 Thread Thomas Hochstein
Jason Marshall schrieb: I'm sure I'm not the first one to suggest this, but why NOT always display the numbers in their entirety? I can't think of any reason why a user would say please give me less accuracy and a lot more confusion in return for fewer digits to parse. But I can - and I

Re: Broken FORGED_MUA_OUTLOOK checks

2006-04-04 Thread Michael Monnerie
On Freitag, 31. März 2006 14:40 Sander Holthaus wrote: (almost) full message at http://zmi.at/x/ham01.txt mfg zmi Are you sure that is a valid OE-email? Doesn't appear to me as such, hence I'd say the tests fired correctly. Hi, I got feedback today that they use Mass Mailer to send their

Re: Moving bayes from bdb to MySQL

2006-04-04 Thread Michael Monnerie
On Montag, 3. April 2006 14:34 Lars Ringh wrote: Now, since in each case the source data can come from two different servers scanning the same kind of mails, should I try to merge the bayes-data from servers home1 and home2 into the the same myqsl-db and then merge the data from corp1 and

RE: Randomly Not Scanning Messages

2006-04-04 Thread Michael Shuler
That was it. Thank you! Michael Shuler, C.E.O. OmniLEC And BitWise Communications, Inc. 682 High Point Lane East Peoria, IL 61611 OmniNumber: (309) 670-0575 Fax: (309) 213-3500 E-Mail: [EMAIL PROTECTED] Customer Service: (877) New-Omni -Original

auto-whitelist

2006-04-04 Thread Andrea Bencini
Is it possible to manage auto-withelist? I am testing auto-whitelist and with my check_whitelist I have -2.8(-2.8/1) -- [EMAIL PROTECTED]|ip=none -2.7(-2.7/4) -- [EMAIL PROTECTED]|ip=none -1.7(-1.7/3) -- [EMAIL PROTECTED]|ip=none -2.3

Re: running SA on multiple machines

2006-04-04 Thread Dave Stern
On Mon, 3 Apr 2006, Matt Kettler wrote: Dave Stern wrote: I'm trying to get SA working by remote connections and don't see it consistantly working. Users kick off SA in their .procmailrc on our mail server which can't handle a more recent version of SA so we only have v2.64 installed locally.

Re: running SA on multiple machines

2006-04-04 Thread Daryl C. W. O'Shea
Dave Stern wrote: As to the format spamc -d 1.2.3.4,10 2.3.4.5,10 That was from a google search. I believe that allows you to specify timeouts per host rather than a more universal -t. I'm not aware of that being valid. In any case, anything beyond a single host would either not fail to

Re: running SA on multiple machines

2006-04-04 Thread Matt Kettler
Dave Stern wrote: On Mon, 3 Apr 2006, Matt Kettler wrote: (who on earth still uses SRV records for anything?) Actually, I'm told it's used a lot for windoze services (active dir?) Ok, who that actually uses a real DNS server. :)

Re: Stopping recent stock pumping spam

2006-04-04 Thread Mike Robinson
Tristan Miller wrote: Greetings. I'm using SpamAssassin 3.0.4 with local Bayesian filtering, Vipul's Razor, and several daily-updated SARE rulesets [1]. Nonetheless, there's one particular kind of spam lately that always seems to slip through; it consists of a bunch of random words plus a

sa-learn Lotus Notes

2006-04-04 Thread Andy Jezierski
There have been numerous threads on how to have end users drop misclassified mail to spam/ham folders in Exchange, but I don't recall seeing any mention of a way of doing this with Notes. Is anyone doing this with Notes that would care to share the secret? Thanks Andy

Re: Stopping recent stock pumping spam

2006-04-04 Thread Doc Schneider
Tristan Miller wrote: Greetings. I'm using SpamAssassin 3.0.4 with local Bayesian filtering, Vipul's Razor, and several daily-updated SARE rulesets [1]. Nonetheless, there's one particular kind of spam lately that always seems to slip through; it consists of a bunch of random words plus a

Re: Stopping recent stock pumping spam

2006-04-04 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 [ forgot to copy list - d'oh ] Tristan Miller wrote: [snip image-only stock pd spam comments] Does anyone have a filterset or other recommended settings that will block this kind of spam? Regards, Tristan I ran a couple of those messages

Re: Stopping recent stock pumping spam

2006-04-04 Thread Matt Kettler
Tristan Miller wrote: Greetings. I'm using SpamAssassin 3.0.4 with local Bayesian filtering, Vipul's Razor, and several daily-updated SARE rulesets [1]. Nonetheless, there's one particular kind of spam lately that always seems to slip through; it consists of a bunch of random words plus a

Re: Stopping recent stock pumping spam

2006-04-04 Thread Tristan Miller
Greetings. In article [EMAIL PROTECTED], Doc Schneider wrote: [1] SARE rulesets: SARE_REDIRECT_POST300 SARE_EVILNUMBERS0 SARE_EVILNUMBERS1 SARE_EVILNUMBERS2 SARE_BAYES_POISON_NXM SARE_HTML SARE_HEADER SARE_SPECIFIC SARE_ADULT SARE_BML SARE_FRAUD SARE_SPOOF SARE_RANDOM SARE_SPAMCOP_TOP200

false positive on FORGED_MUA_OUTLOOK (v.3.1)

2006-04-04 Thread Tony Finch
The following headers come from a legitimate message - I have obscured the sender's name, but that's all. The SlipStream SP Server seems to have appended the client username and IP address to the message-ID, causing the FP. See also:

Re: Stopping recent stock pumping spam

2006-04-04 Thread Doc Schneider
Tristan Miller wrote: Greetings. In article [EMAIL PROTECTED], Doc Schneider wrote: [1] SARE rulesets: SARE_REDIRECT_POST300 SARE_EVILNUMBERS0 SARE_EVILNUMBERS1 SARE_EVILNUMBERS2 SARE_BAYES_POISON_NXM SARE_HTML SARE_HEADER SARE_SPECIFIC SARE_ADULT SARE_BML SARE_FRAUD SARE_SPOOF SARE_RANDOM

Re: Stopping recent stock pumping spam

2006-04-04 Thread Tristan Miller
Greetings. In article [EMAIL PROTECTED], Matt Kettler wrote: Nonetheless, there's one particular kind of spam lately that always seems to slip through; it consists of a bunch of random words plus a graphic attachment. The graphic is usually a page of text advertising something -- almost

RE: Re: Stopping recent stock pumping spam

2006-04-04 Thread Matthew.van.Eerde
Tristan Miller wrote: debug: is DNS available? 0 What is the output of $ cat /etc/resolv.conf ? -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer

Re: Stopping recent stock pumping spam

2006-04-04 Thread Daryl C. W. O'Shea
[EMAIL PROTECTED] wrote: Tristan Miller wrote: debug: is DNS available? 0 What is the output of $ cat /etc/resolv.conf ? It's likely that spamd is being called with -L. If on a RedHat/Fedora system, it'll be set in /etc/sysconfig/spamassassin.

Re: Stopping recent stock pumping spam

2006-04-04 Thread Tristan Miller
Greetings. In article [EMAIL PROTECTED], Tristan Miller wrote: The first message in that example SHOULD have triggered RCVD_IN_NJABL_DUL and RCVD_IN_SORBS_DUL. As per this header: Received: from M696P000.adsl.highway.telekom.at (M696P000.adsl.highway.telekom.at [62.47.246.224]) by

Re: Is Spamassassin failing math?

2006-04-04 Thread Philip Prindeville
Matt Kettler wrote: The real answer would be to always display 3-decimal place scores, but that's rather of ugly and creates a cluttered report. However, you'd always be 100% accurate. You'd still have rounding issues, just of a different sort. This is floating point, right? -Philip

Re: Is Spamassassin failing math?

2006-04-04 Thread Matt Kettler
Philip Prindeville wrote: Matt Kettler wrote: The real answer would be to always display 3-decimal place scores, but that's rather of ugly and creates a cluttered report. However, you'd always be 100% accurate. You'd still have rounding issues, just of a different sort.

Filtering based on the recipients

2006-04-04 Thread Philip Prindeville
I was looking on the FAQ and the Wiki, but couldn't find this... How do I filter based on the recipient mailbox address? For instance, I'm running Linux, so if I get email sent to [EMAIL PROTECTED] or [EMAIL PROTECTED] then I know they're bogus... And can probably block it, even if some of the