Re: spamd not well after crash

2006-08-07 Thread John Andersen
On Sunday 06 August 2006 16:30, kalin mintchev wrote: hi all... last week we had a power outage and our mail sever went down with it. the spamd performance has been disappointing ever since. crap like Re: veaooVzlAGRA is passing through without a hitch. here is what spamd added to the

Re: 0451.com

2006-08-07 Thread Duncan Hill
On Monday 07 August 2006 00:02, wrote: | 2250 0733.com Here are my numbers from last week: 5006 0451.com 3845 53.com Not seeing anywhere near as high, but this is only on my personal server: 440733.com 340451.com 110668.com 4 023.com 2 08.com 2 020.com 1

sender in blacklist_from but message is delivered to recipient

2006-08-07 Thread Daniel Chojecki
Hello,my conf is:postfix-2.3.2spamd 3.1.4blacklist_from in sql.The problem is that spamd delivers message even when the senderis on blacklist_from - in logs i see - user_in_blacklist. Any idea ?best regradsDaniel

Re: 0451.com

2006-08-07 Thread Nigel Frankcom
On Mon, 7 Aug 2006 08:21:41 +0100, Duncan Hill [EMAIL PROTECTED] wrote: On Monday 07 August 2006 00:02, wrote: | 2250 0733.com Here are my numbers from last week: 5006 0451.com 3845 53.com Not seeing anywhere near as high, but this is only on my personal server: 440733.com

Re: sender in blacklist_from but message is delivered to recipient

2006-08-07 Thread jdow
From: Daniel Chojecki [EMAIL PROTECTED] Hello, my conf is: postfix-2.3.2 spamd 3.1.4 blacklist_from in sql. The problem is that spamd delivers message even when the sender is on blacklist_from - in logs i see - user_in_blacklist. Any idea ? All is normal. SpamAssassin NEVER fails to

Re: spamd not well after crash

2006-08-07 Thread kalin mintchev
Horked Bayes database? It would be easier to fire up CPAN and install the latest than to try and figure it out. You are back level 2 or 4 releases. ok. i'll be doing it. but we are using vpopmail with individual preferences for every user. does that mean that every single user has to start

RE: 0451.com

2006-08-07 Thread Sietse van Zanen
Caring about 'legitimate' e-mail coming from these domains would be like caring about the 'legitimate' claims of Bush saying he is a true christian... -Sietse From: Nigel Frankcom [mailto:[EMAIL PROTECTED] Sent: Mon 07-Aug-06 11:32 To:

Re: sender in blacklist_from but message is delivered to recipient

2006-08-07 Thread Daryl C. W. O'Shea
jdow wrote: All is normal. SpamAssassin NEVER fails to deliver email. It simply marks it as spam. It is the job of whatever called SpamAssassin to parse the return and filter as you wish. I'd say it ALWAYS fails to deliver email, since it doesn't do that. ;)

RE: 0451.com

2006-08-07 Thread Tony Finch
On Mon, 7 Aug 2006, Sietse van Zanen wrote: Caring about 'legitimate' e-mail coming from these domains would be like caring about the 'legitimate' claims of Bush saying he is a true christian... All-numeric domains are popular in China because they are easier for people to deal with than

Re: 0451.com

2006-08-07 Thread Ralf Hildebrandt
* Tony Finch [EMAIL PROTECTED]: All-numeric domains are popular in China because they are easier for people to deal with than alphabetic domains. For example, 263.com is China's second-largest ISP. You can't just assume that an all-numeric domain is necessarily abusive, any more so than Yahoo

Re: spamd not well after crash

2006-08-07 Thread Loren Wilton
It would be easier to fire up CPAN and install the latest than to try and figure it out. You are back level 2 or 4 releases. If you previously installed from a distro of some kind you should probably upgrade using the newer distro rather than CPAN directly; otherwise you can end up with

RE: 0451.com

2006-08-07 Thread Sietse van Zanen
OK than let's put this in another 'political' context: Caring about 'legitimate' e-mail coming from those domains would be like caring for the few 'legitimate' bombs dropped over Iraq, Afghanistan or Lebanon. It would indeed be better to have no bombs at all -Sietse

RE: 0451.com

2006-08-07 Thread Michael Scheidell
I have a US customer with a numeric domain. Not sure why they did that (boy, did it muck up Microsoft NT!) Funny thing, when the spammers starting dictionary attacks, they do it in alphabetic order, so numeric domains get hit with spam first also.

RE: 0451.com

2006-08-07 Thread Gary D. Margiotta
On Mon, 7 Aug 2006, Sietse van Zanen wrote: OK than let's put this in another 'political' context: Caring about 'legitimate' e-mail coming from those domains would be like caring for the few 'legitimate' bombs dropped over Iraq, Afghanistan or Lebanon. It would indeed be better to have no

Upgrade Woo's

2006-08-07 Thread Chuck Payne
Hi, I just did a major from 3.0.4 to 3.1.3. I am having some issue with the upgrade. When I start spamd I see the following error in my mail log. Aug 7 07:32:02 magi spamd[14114]: config: failed to parse line, skipping: W Aug 7 07:32:02 magi spamd[14114]: config: failed to parse line,

Re: 0451.com and blacklist domains

2006-08-07 Thread Ben Wylie
and not only them according to our daily sendmail logs: # egrep '@[0-9]+\.com' YESTERDAY | sed -e 's/^.*@//' -e 's/.*$//' | sort | uniq -c | sort -rn | head 2484 0733.com 2449 0451.com 100 072.com 66 1039.com 52 006.com 51 0668.com 40 004.com 37 163.com 18 126.com 15 mail.0451.com

Re: testing for empty text/plain

2006-08-07 Thread Eric A. Hall
On 8/7/2006 12:25 AM, Theo Van Dinter wrote: On Mon, Aug 07, 2006 at 12:07:58AM -0400, Eric A. Hall wrote: Anybody written a rule that tests for empty text/plain, preferably only when a non-empty text/html or some other media-type is provided? Sounds very similar to MPART_ALT_DIFF. That

Re: Upgrade Woo's

2006-08-07 Thread Loren Wilton
As Imentioned to someone (perhaps you) the error checking has improved and previously erroneous stuff is getting caught and flagged. Aug 7 07:32:02 magi spamd[14114]: config: failed to parse line, skipping: W You seem to have an uncommented W somewhere in a config file. Aug 7 07:32:02

Re: 0451.com

2006-08-07 Thread Hamish Marson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Duncan Hill wrote: On Monday 07 August 2006 00:02, wrote: | 2250 0733.com Here are my numbers from last week: 5006 0451.com 3845 53.com Not seeing anywhere near as high, but this is only on my personal server: 440733.com 34

Re: 0451.com

2006-08-07 Thread Obantec Support
- Original Message - From: Hamish Marson [EMAIL PROTECTED] To: Duncan Hill [EMAIL PROTECTED] Cc: users@spamassassin.apache.org Sent: Monday, August 07, 2006 3:11 PM Subject: Re: 0451.com -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Duncan Hill wrote: On Monday 07 August 2006

Re: 0451.com

2006-08-07 Thread Duncan Hill
On Monday 07 August 2006 15:20, Obantec Support wrote: What would 192.com or 118118.com do without these names? Deal with the fact that the RFCs don't support such names, and petition for a new RFC that accomodates their names? Other businesses have had no issues adapting to the requirements

URIBL and SURBL no lnger hitting

2006-08-07 Thread DAve
Good morning, I noticed this morning that I am no longer hitting any URIBL and SURBL. I did a test, host -tTXT test.uribl.com.multi.uribl.com and got the proper response. I also ran spamassassin -D testemail.txt which is a message with a URI known in the URIBL list and it provided the

Re: Upgrade Woo's

2006-08-07 Thread Theo Van Dinter
On Mon, Aug 07, 2006 at 08:00:59AM -0400, Chuck Payne wrote: Aug 7 07:32:02 magi spamd[14114]: config: failed to parse line, skipping: W Aug 7 07:32:02 magi spamd[14114]: config: failed to parse line, skipping: bayes_use_chi2_combining 1 W isn't a valid config line, and the chi2 business is

OCR

2006-08-07 Thread Filbert
Hi, I'm planning to test the OCR module in SA very soon. I was wondering if other (commercial) anti-spam products already have a OCR module built-in? Thx F.

Re: testing for empty text/plain

2006-08-07 Thread Theo Van Dinter
On Mon, Aug 07, 2006 at 09:11:14AM -0400, Eric A. Hall wrote: What's the most efficient way to grab the text/plain part? Check out the other code/plugins. Getting to a specific message part is pretty easy. -- Randomly Generated Tagline: Sarchasm: The gulf between the author of sarcastic wit,

Re: 0451.com

2006-08-07 Thread Tony Finch
On Mon, 7 Aug 2006, Hamish Marson wrote: The RFC's actually state that a domain MUST start with a letter, and be any letter or digit or hyphen after. So according to the RFC's purely numberic domains are illegal. No! Wrong! Totally wrong! If they were illegal they would never have been

Re: 0451.com

2006-08-07 Thread Logan Shaw
On Mon, 7 Aug 2006, Tony Finch wrote: On Mon, 7 Aug 2006, Hamish Marson wrote: The RFC's actually state that a domain MUST start with a letter, and be any letter or digit or hyphen after. So according to the RFC's purely numberic domains are illegal. No! Wrong! Totally wrong! If they were

Re: URIBL and SURBL no lnger hitting

2006-08-07 Thread DAve
DAve wrote: Good morning, I noticed this morning that I am no longer hitting any URIBL and SURBL. I did a test, host -tTXT test.uribl.com.multi.uribl.com and got the proper response. I also ran spamassassin -D testemail.txt which is a message with a URI known in the URIBL list and it

Re: URIBL and SURBL no lnger hitting

2006-08-07 Thread Richard
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 I noticed this morning that I am no longer hitting any URIBL and SURBL. I did a test, ... I should have included this in the debug output. [23441] dbg: dns: is Net::DNS::Resolver available? yes [23441] dbg: dns: Net::DNS version: 0.57

Spam with mail address in it

2006-08-07 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, today we received a non-recognized spam mail which contained only plaintext + an email address to write to. The email was [EMAIL PROTECTED] so I wanted to see if uribl maybe lists the domain. The command hostx -t TXT

Re: Spam with mail address in it

2006-08-07 Thread Theo Van Dinter
On Mon, Aug 07, 2006 at 05:37:37PM +0200, decoder wrote: Maybe uribl could be changed to also check mail addresses, too? FWIW, I thought there was an older one, but a quick search didn't turn it up, so here's the new one: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5014 -- Randomly

Re: Spam with mail address in it

2006-08-07 Thread Rob McEwen (PowerView Systems)
Maybe uribl could be changed to also check mail addresses, too? Chris, SURBL and URIBL are not intended to be used for checking against the domains of e-mail addresses, even when the e-mail is contained within the body of the message. In spite of that, I did used to do this... but I

Re: URIBL and SURBL no lnger hitting

2006-08-07 Thread DAve
DAve wrote: DAve wrote: Good morning, I noticed this morning that I am no longer hitting any URIBL and SURBL. I did a test, host -tTXT test.uribl.com.multi.uribl.com and got the proper response. I also ran spamassassin -D testemail.txt which is a message with a URI known in the URIBL

Re: Spam with mail address in it

2006-08-07 Thread Rob McEwen (PowerView Systems)
Perhaps sometime someone can take Joe's data and create a web site like URIBL were people can report e-mail addresses found in scam spam to create a more comprehensive list with faster turnaround? Oh... I forget... a previous round of discussions about this killed off this idea because there is

Re: URIBL and SURBL no lnger hitting

2006-08-07 Thread DAve
Richard wrote: -BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 I noticed this morning that I am no longer hitting any URIBL and SURBL. I did a test, ... I should have included this in the debug output. [23441] dbg: dns: is Net::DNS::Resolver available? yes [23441] dbg: dns: Net::DNS

bayes: database version is different than what we understand ???

2006-08-07 Thread Marc Perkel
I'm using MySQL and getting this error: bayes: database version is different than what we understand ??? What does this mean?

RE: A lot of this going around

2006-08-07 Thread David Baron
Aug  7 18:04:30 d_baron spamd[28549]: bayes: write failed to Bayes journal /home/david/.spamassassin/bayes_journal (0 of 3624)! Getting numerous messages of this form. Things seem to be working normally! (Note that sa-update failed this morning due to problems at the site.) Also these: Aug  7

Re: A lot of this going around

2006-08-07 Thread Theo Van Dinter
On Mon, Aug 07, 2006 at 09:28:12PM +0300, David Baron wrote: Aug  7 18:04:30 d_baron spamd[28549]: bayes: write failed to Bayes journal /home/david/.spamassassin/bayes_journal (0 of 3624)! Getting numerous messages of this form. Things seem to be working normally! Aug  7 18:03:38 d_baron

A lot of this going around

2006-08-07 Thread David Baron
Aug  7 18:04:30 d_baron spamd[28549]: bayes: write failed to Bayes journal /home/david/.spamassassin/bayes_journal (0 of 3624)! Getting numerous messages of this form. Things seem to be working normally! (Note that sa-update failed this morning due to problems at the site.)

sa-update gives Can't locate LWP/UserAgent.pm in @INC ?

2006-08-07 Thread Evan Platt
Hello all... Running SpamAssassin 3.1.3 on a OS/X box. Running sa-update gives Can't locate LWP/UserAgent.pm in @INC. Can't recall if I've ever tried sa-update before. Googling doesn't give much help, and a locate of UserAgent.pm finds nothing on my system. Thanks. Evan

Re: sa-update gives Can't locate LWP/UserAgent.pm in @INC ?

2006-08-07 Thread Theo Van Dinter
On Mon, Aug 07, 2006 at 11:52:50AM -0700, Evan Platt wrote: Running SpamAssassin 3.1.3 on a OS/X box. Running sa-update gives Can't locate LWP/UserAgent.pm in @INC. Can't recall if I've ever tried sa-update before. Googling doesn't give much help, and a locate of UserAgent.pm finds

Re: URIBL and SURBL no lnger hitting

2006-08-07 Thread DAve
DAve wrote: Richard wrote: -BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 I noticed this morning that I am no longer hitting any URIBL and SURBL. I did a test, ... I should have included this in the debug output. [23441] dbg: dns: is Net::DNS::Resolver available? yes [23441] dbg: dns:

Re: A lot of this going around

2006-08-07 Thread David Baron
On Monday 07 August 2006 21:34, Theo Van Dinter wrote: On Mon, Aug 07, 2006 at 09:28:12PM +0300, David Baron wrote: Aug  7 18:04:30 d_baron spamd[28549]: bayes: write failed to Bayes journal /home/david/.spamassassin/bayes_journal (0 of 3624)! Getting numerous messages of this form.

Re: 0451.com

2006-08-07 Thread John D. Hardin
On Mon, 7 Aug 2006, Hamish Marson wrote: The RFC's actually state that a domain MUST start with a letter, and be any letter or digit or hyphen after. So according to the RFC's purely numberic domains are illegal. Should this be worth a point or so in the base ruleset? -- John Hardin KA7OHZ

Re: 0451.com

2006-08-07 Thread John D. Hardin
On Mon, 7 Aug 2006, Tony Finch wrote: On Mon, 7 Aug 2006, Hamish Marson wrote: The RFC's actually state that a domain MUST start with a letter, and be any letter or digit or hyphen after. So according to the RFC's purely numberic domains are illegal. No! Wrong! Totally wrong! If they

RE: sa-update gives Can't locate LWP/UserAgent.pm in @INC ?

2006-08-07 Thread Chan, Wilson
-Original Message- From: Evan Platt [mailto:[EMAIL PROTECTED] Sent: Monday, August 07, 2006 8:53 AM To: users@spamassassin.apache.org Subject: sa-update gives Can't locate LWP/UserAgent.pm in @INC ? Had the same problem on Fedora Core 5. I had to install these additional packages.

ImageInfo path

2006-08-07 Thread carnold5
Hello all. Mostly a lurker here. I am trying to install the imageinfo plugin. So, i followed the instructions, place *.pm file in Plugins dir and *.cf file in Spamassassin dir. Do a spamassassin --lint and get [6870] warn: plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamA

Re: ImageInfo path

2006-08-07 Thread qqqq
| I am sure it has to do with the dir structure. We use oes-linux and the | dir structure on it is /etc/mail/spamassassin. So i am asking in what | file do i change the path from /mail/spamassassin to | /etc/mail/spamassassin. I have searched through the 2 files (*.pm and | *.cf and can not find

Re: URIBL and SURBL no lnger hitting

2006-08-07 Thread DAve
DAve wrote: DAve wrote: Richard wrote: -BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 I noticed this morning that I am no longer hitting any URIBL and SURBL. I did a test, ... I should have included this in the debug output. [23441] dbg: dns: is Net::DNS::Resolver available? yes

Having Bayes MySQL problems

2006-08-07 Thread Marc Perkel
Anyone know what would cause this? I ran sa-learn --force-expire Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/BayesStore/SQL.pm line 132. Use of uninitialized value in numeric ne (!=) at

Re: 0451.com

2006-08-07 Thread Hamish
On Monday 07 August 2006 16:09, Tony Finch wrote: On Mon, 7 Aug 2006, Hamish Marson wrote: The RFC's actually state that a domain MUST start with a letter, and be any letter or digit or hyphen after. So according to the RFC's purely numberic domains are illegal. No! Wrong! Totally wrong!

Improved OCR Plugin with approximate matching

2006-08-07 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello there, I have improved the original OcrPlugin (found at http://wiki.apache.org/spamassassin/OcrPlugin), so it contains fuzzy matching. Like that, mistakes made by the OCR recognition or intentional obfuscations in the text don't make the

Re: spamd not well after crash

2006-08-07 Thread John Andersen
On Monday 07 August 2006 03:32, Loren Wilton wrote: If you previously installed from a distro of some kind you should probably upgrade using the newer distro rather than CPAN directly; otherwise you can end up with mucked up installations since some distros move things around. The problem with

Re: Improved OCR Plugin with approximate matching

2006-08-07 Thread uNiXpSyChO
decoder wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello there, I have improved the original OcrPlugin (found at http://wiki.apache.org/spamassassin/OcrPlugin), so it contains fuzzy matching. Like that, mistakes made by the OCR recognition or intentional obfuscations in the text

Re: Improved OCR Plugin with approximate matching

2006-08-07 Thread uNiXpSyChO
seems to work... but i never see a score about 1.00. the docs say the default score is 4. did i miss something? above 1.00 i meant.

Re: Improved OCR Plugin with approximate matching

2006-08-07 Thread jdow
From: uNiXpSyChO [EMAIL PROTECTED] decoder wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello there, I have improved the original OcrPlugin (found at http://wiki.apache.org/spamassassin/OcrPlugin), so it contains fuzzy matching. Like that, mistakes made by the OCR recognition or

SA-Update required modules

2006-08-07 Thread Chris
I looked at the list of required modules and noticed after I've been running it for awhile that I didn't have these two installed: 9109] dbg: diag: module not installed: Net::Ident ('require' failed) 9109] dbg: diag: module not installed: IO::Socket::INET6 ('require' failed) I tried installing

Memory requirements

2006-08-07 Thread James Lay
Hey all! Anyone happen to know the memory requirements of SpamAssassin? I have 3.0.4 running on 128 Megs okwill upgrading to 3.1.4 plus the SARE rules tank it? Or am I safe? Thanks all! James

Latest Network Upgrade not spam.

2006-08-07 Thread Robert Nicholson
It seems the latest version of these isn't spam?Are there any rules to mark MS attachments as SPAM?        From:   [EMAIL PROTECTED] Subject: Latest Network Upgrade Date: August 5, 2006 9:55:10 PM CDT To:   [EMAIL PROTECTED] X-Spam-Dcc: : grub.camros.com 1113; Body=1 Fuz1=1 Fuz2=1

Re: Memory requirements

2006-08-07 Thread John D. Hardin
On Mon, 7 Aug 2006, James Lay wrote: Anyone happen to know the memory requirements of SpamAssassin? I have 3.0.4 running on 128 Megs okwill upgrading to 3.1.4 plus the SARE rules tank it? Or am I safe? Thanks all! I'm running 3.1.3 with a bunch of SARE and local rules on my hosted

Re: Memory requirements

2006-08-07 Thread jdow
From: James Lay [EMAIL PROTECTED] Hey all! Anyone happen to know the memory requirements of SpamAssassin? I have 3.0.4 running on 128 Megs okwill upgrading to 3.1.4 plus the SARE rules tank it? Or am I safe? Thanks all! Perhaps. Do not run anything else with a significant memory

Re: Latest Network Upgrade not spam.

2006-08-07 Thread jdow
From: Robert Nicholson [EMAIL PROTECTED] It seems the latest version of these isn't spam? Are there any rules to mark MS attachments as SPAM? From: [EMAIL PROTECTED] Subject: Latest Network Upgrade Date: August 5, 2006 9:55:10 PM CDT To: [EMAIL PROTECTED] X-Spam-Dcc: :

Re: SA-Update required modules

2006-08-07 Thread Nigel Frankcom
I had similar problems on CentOS 32 64; I ended up installing the Net::Ident with yum instead (off the dag repo), that worked ok... yum install perl-Net-Ident.noarch The INET6 can be installed the same way, though I don't think it's critical to have it in. HTH Nigel On Mon, 7 Aug 2006