Re: dcc SA problem

2008-03-13 Thread Anatoly Pugachev
Thanks, that helped. Any chance to make dcc plugin to work from local.cf or user preference file? since as user, i can't change system installed files. On Wed, Mar 12, 2008 at 03:19:51PM +0100, Benny Pedersen wrote: On Mon, March 10, 2008 14:11, Anatoly Pugachev wrote:

Re: sa-learn question

2008-03-13 Thread Matt Kettler
Hungry Snail wrote: Site-wide is what i'm trying to setup, I guess i need to do some more googling :) assuming you're using db_file not SQL: First create a path where you want your bayes DB to live, make that directory world RWX. (ie: chmod 0777) in your /etc/mail/spamassassin/local.cf:

Re: sa-learn question

2008-03-13 Thread Matt Kettler
Matt Kettler wrote: Hungry Snail wrote: Site-wide is what i'm trying to setup, I guess i need to do some more googling :) Also, I've updated the wiki article on sitewide bayes. It is now at least technically correct. http://wiki.apache.org/spamassassin/SiteWideBayesSetup previously it

RE: Pyzor and cloudmark

2008-03-13 Thread Rob Sterenborg
Matus UHLAR - fantomas wrote: On 12.03.08 16:30, R.Smits wrote: Forget it I have just discovered DCC . Looks a lot better :-) they are very different things. I advise using both (or, all three) Since I witnesed slow responses and timeouts from Pyzor (yes, also with the alternative

RE: Pyzor and cloudmark

2008-03-13 Thread Raymond Dijkxhoorn
Hi! I have just discovered DCC . Looks a lot better :-) they are very different things. I advise using both (or, all three) Since I witnesed slow responses and timeouts from Pyzor (yes, also with the alternative server) I'd only recommend Razor2 and DCC. Has anyone got experience with

autowhitelisting of recipient itself

2008-03-13 Thread romanovsky
OS: Debian Sarge SpamAssassin: 3.0.3-2 Problem description: [EMAIL PROTECTED] sends a ham message to himself (i.e. From:==To:[EMAIL PROTECTED]). Autowhiltelisting mechanism adds [EMAIL PROTECTED] to the whiltelist. A spammer sends spam to [EMAIL PROTECTED] from forged address [EMAIL PROTECTED]

Re: autowhitelisting of recipient itself

2008-03-13 Thread John Hardin
On Thu, 13 Mar 2008, romanovsky wrote: The question is: how to disable autowhiltelisting in case of From:==To:? Consider not calling SA at all if from == to. How is SA hooked in? If it's via procmail, that's a fairly simple rule. -- John Hardin KA7OHZ

Re: autowhitelisting of recipient itself

2008-03-13 Thread Matt Kettler
romanovsky wrote: OS: Debian Sarge SpamAssassin: 3.0.3-2 Problem description: [EMAIL PROTECTED] sends a ham message to himself (i.e. From:==To:[EMAIL PROTECTED]). Autowhiltelisting mechanism adds [EMAIL PROTECTED] to the whiltelist. A spammer sends spam to [EMAIL PROTECTED] from forged address

Re: sa-learn question

2008-03-13 Thread Hungry Snail
Matt Kettler-3 wrote: previously it had several bits of bad advice: Don't /etc/mail/spamassassin to store your bayes DB Don't specify -C on the sa-learn command-line. You REALLY don't want to use that option on any SA tool unless you know exactly what you're doing. (This option is

Re: autowhitelisting of recipient itself

2008-03-13 Thread Matus UHLAR - fantomas
On Thu, 13 Mar 2008, romanovsky wrote: The question is: how to disable autowhiltelisting in case of From:==To:? On 13.03.08 05:48, John Hardin wrote: Consider not calling SA at all if from == to. How is SA hooked in? If it's via procmail, that's a fairly simple rule. what would not help

Re: autowhitelisting of recipient itself

2008-03-13 Thread Matus UHLAR - fantomas
romanovsky wrote: OS: Debian Sarge SpamAssassin: 3.0.3-2 Problem description: [EMAIL PROTECTED] sends a ham message to himself (i.e. From:==To:[EMAIL PROTECTED]). Autowhiltelisting mechanism adds [EMAIL PROTECTED] to the whiltelist. A spammer sends spam to [EMAIL PROTECTED] from forged

Slow processing with 3.2.4

2008-03-13 Thread Spam Admin
I have two mail servers running Spamassassin. One is running 3.1.9 and the other 3.2.4, both with the same set of local rules, plus the standard rules that come with each version. The 'load' on the processors for 3.2.4 is about *4 times more *than the 'load' on 3.1.9. Do others have the

Re: dcc SA problem

2008-03-13 Thread Anatoly Pugachev
made SA bugzilla ticket : https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5849 it explains why that don't work from local.cf file. thanks for the help anyway! On Thu, Mar 13, 2008 at 03:23:47PM +0100, Benny Pedersen wrote: On Thu, March 13, 2008 08:40, Anatoly Pugachev wrote:

Re: autowhitelisting of recipient itself

2008-03-13 Thread Benny Pedersen
On Thu, March 13, 2008 13:16, romanovsky wrote: SpamAssassin: 3.0.3-2 old Problem description: [EMAIL PROTECTED] sends a ham message to himself (i.e. From:==To:[EMAIL PROTECTED]). Autowhiltelisting mechanism adds [EMAIL PROTECTED] to the whiltelist. why is whitelistning of your own mail

Re: dcc SA problem

2008-03-13 Thread Benny Pedersen
On Thu, March 13, 2008 08:40, Anatoly Pugachev wrote: Thanks, that helped. super Any chance to make dcc plugin to work from local.cf or user preference file? explain problem more in detail, any plugins works from local.cf and user_prefs only execption is it can not load from this *.cf

Re: autowhitelisting of recipient itself

2008-03-13 Thread Benny Pedersen
On Thu, March 13, 2008 14:18, Matt Kettler wrote: USER_IN_WHITELIST means the message matched a whitelist_from, whitelist_from_rcvd, or whitelist_from_spf statement in your configfiles. spf no Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Pyzor and cloudmark

2008-03-13 Thread Benny Pedersen
On Wed, March 12, 2008 16:19, R.Smits wrote: Has anyone got experience with the spamassasin plugin from cloudmark ? i am unsure if that is not just razor ? Is anyone using pyzor ? both server and client here yes We are looking at these add-ons for spamasssassin. Pyzor looks old... (last

Re: Pyzor and cloudmark

2008-03-13 Thread Benny Pedersen
On Wed, March 12, 2008 16:30, R.Smits wrote: I have just discovered DCC . Looks a lot better :-) sure do, we are all here to help later even if it looks good later olso Sorry i've asked. Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Pyzor and cloudmark

2008-03-13 Thread Matus UHLAR - fantomas
On Wed, March 12, 2008 16:19, R.Smits wrote: Has anyone got experience with the spamassasin plugin from cloudmark ? On 13.03.08 15:44, Benny Pedersen wrote: i am unsure if that is not just razor ? afaik it supports special features of commercial RAZOR version Is anyone using pyzor ?

Re: Slow processing with 3.2.4

2008-03-13 Thread Ralf Hildebrandt
* Spam Admin [EMAIL PROTECTED]: I have two mail servers running Spamassassin. One is running 3.1.9 and the other 3.2.4, both with the same set of local rules, plus the standard rules that come with each version. The 'load' on the processors for 3.2.4 is about *4 times more *than the

Re: autowhitelisting of recipient itself

2008-03-13 Thread romanovsky
SA is called from amavisd-new. I suppose that the problem should be solved on the level it was created, i.e. on SA level. I already have few patches of amavisd-new. Sure I can write another one. Before do that dirty hack I'd like to search for a good solution. Thanks for trying to help, John.

Re: autowhitelisting of recipient itself

2008-03-13 Thread romanovsky
Matt, You're absolutely right! Thanks for you notice. I found whitelist_from for some domains in the config. Odds are, there's a well meaning, but woefully mistaken whitelist_from [EMAIL PROTECTED] in the config somewhere.. -- View this message in context:

Re: autowhitelisting of recipient itself

2008-03-13 Thread John Hardin
On Thu, 13 Mar 2008, Matus UHLAR - fantomas wrote: On Thu, 13 Mar 2008, romanovsky wrote: The question is: how to disable autowhiltelisting in case of From:==To:? On 13.03.08 05:48, John Hardin wrote: Consider not calling SA at all if from == to. How is SA hooked in? If it's via procmail,

Whitelisting PayPal Notification of payment Messages

2008-03-13 Thread Michael B Allen
Hi, I really have my HTML rules cranked up and it's killing my PayPal payment notifications. I can't whitelist by From because PayPal sends the notifications from the person sending the money and not an address in the paypal.com domain. How can I whitelist these messages? Is there some way to

Re: Pyzor and cloudmark

2008-03-13 Thread Ben Poliakoff
* Matus UHLAR - fantomas [EMAIL PROTECTED] [20080313 07:59]: Is anyone using pyzor ? both server and client here yes looking at it now, I got no PYZOR catches last day :( FWIW, at our site PYZOR_CHECK fires on about 65% of all of our spam. We had a total of 7523 hits for PYZOR_CHECK

Re: Whitelisting PayPal Notification of payment Messages

2008-03-13 Thread Rob McEwen
Michael B Allen wrote: I really have my HTML rules cranked up and it's killing my PayPal payment notifications. I can't whitelist by From because PayPal sends the notifications from the person sending the money and not an address in the paypal.com domain. How can I whitelist these messages? Is

Re: Nice girl like to chat spam

2008-03-13 Thread Kris Deugau
Savoy, Jim wrote: I think you need to change: body NICE_GIRL_01 /Hello! I am (?:bored|tired) (?:today|this(?:afternoon|evening)|tonight)\./ to: body NICE_GIRL_01 /Hello! I am (?:bored|tired) (?:today|this (?:afternoon|evening)|tonight)\./ (ie add a space after the word this). It probably

RE: Whitelisting PayPal Notification of payment Messages

2008-03-13 Thread James E. Pratt
-Original Message- From: Rob McEwen [mailto:[EMAIL PROTECTED] Sent: Thursday, March 13, 2008 12:40 PM To: users@spamassassin.apache.org Subject: Re: Whitelisting PayPal Notification of payment Messages Michael B Allen wrote: I really have my HTML rules cranked up and it's

Re: Slow processing with 3.2.4

2008-03-13 Thread Kris Deugau
Spam Admin wrote: I have two mail servers running Spamassassin. One is running 3.1.9 and the other 3.2.4, both with the same set of local rules, plus the standard rules that come with each version. The 'load' on the processors for 3.2.4 is about *4 times more *than the 'load' on 3.1.9.

Re: Whitelisting PayPal Notification of payment Messages

2008-03-13 Thread Rob McEwen
James E. Pratt wrote: Well, if they truly aren't coming from paypal servers at all, the above is really of no use... Can you find a static text string in them that is unique to the emails for which you could write a body rule for? Regards, jamie James, That would be too easy to forge,

RE: Whitelisting PayPal Notification of payment Messages

2008-03-13 Thread James E. Pratt
-Original Message- From: Rob McEwen [mailto:[EMAIL PROTECTED] Sent: Thursday, March 13, 2008 1:27 PM To: users@spamassassin.apache.org Subject: Re: Whitelisting PayPal Notification of payment Messages James E. Pratt wrote: Well, if they truly aren't coming from paypal servers at

Re: Whitelisting PayPal Notification of payment Messages

2008-03-13 Thread Loren Wilton
Rob, the OP stated the emails were *not* coming from any paypal servers. Am I missing something here? I believe he said the Fron address didn't show paypal, NOT that it wasn't coming from a paypal/ebay server. I believe the way these work, is they come from any one of a number of internal

Re: Whitelisting PayPal Notification of payment Messages

2008-03-13 Thread Daryl C. W. O'Shea
On 13/03/2008 12:18 PM, Michael B Allen wrote: Hi, I really have my HTML rules cranked up and it's killing my PayPal payment notifications. I can't whitelist by From because PayPal sends the notifications from the person sending the money and not an address in the paypal.com domain. The

Re: Slow processing with 3.2.4

2008-03-13 Thread Spam Admin
Yes, the hardware is identical. The MX records are both '10', and the volume of mail is slightly LESS on the 3.2.4 machine over the 3.1.9 it's taking more time to process less mail on the newer machine. We have 2.5 Gig memory on each machine. Our graphs show that we are using about 1.5 Gig of

sa-update doesn't do languages file?

2008-03-13 Thread Chris Hoogendyk
OK, I didn't get any responses to the question I posted late yesterday (hint, hint), but I'll give it a try with another question. I've just gotten sa-update running. I'm grabbing the base set, sare, and sought. My mail log is showing the following: Mar 13 15:46:11 eclogite

Re: sa-update doesn't do languages file?

2008-03-13 Thread Arthur Dent
On Thu, Mar 13, 2008 at 04:19:55PM -0400, Chris Hoogendyk wrote: OK, I didn't get any responses to the question I posted late yesterday (hint, hint), but I'll give it a try with another question. [snip] (Oh, and [yeah, I know, I said it already] it would be really cool if someone could

Re: sa-update doesn't do languages file?

2008-03-13 Thread Daryl C. W. O'Shea
On 13/03/2008 5:15 PM, Arthur Dent wrote: On Thu, Mar 13, 2008 at 04:19:55PM -0400, Chris Hoogendyk wrote: OK, I didn't get any responses to the question I posted late yesterday (hint, hint), but I'll give it a try with another question. [snip] (Oh, and [yeah, I know, I said it already] it

Plugin eval failed

2008-03-13 Thread Jean-Paul Natola
Hi all, I upgraded to sa 3.2.4 And I've been restarting spamd every 15 minutes just to keep mail coming in, This is what is constantly coming up in the maillog plugin: eval failed: child processing timeout at /usr/local/bin/spamd line 1259. Any help would be appreciated Running Freebsd

Re: Plugin eval failed

2008-03-13 Thread Daryl C. W. O'Shea
On 13/03/2008 7:08 PM, Jean-Paul Natola wrote: Hi all, I upgraded to sa 3.2.4 And I've been restarting spamd every 15 minutes just to keep mail coming in, This is what is constantly coming up in the maillog plugin: eval failed: child processing timeout at /usr/local/bin/spamd line

Re: sa-update doesn't do languages file?

2008-03-13 Thread Theo Van Dinter
On Thu, Mar 13, 2008 at 04:19:55PM -0400, Chris Hoogendyk wrote: Mar 13 15:46:11 eclogite mimedefang-multiplexor[7518]: [ID 980602 mail.info] Slave 3 stderr: config: path /var/lib/spamassassin/3.002004/languages is inaccessible: Permission denied What is that file, and what is using it?

RE: Plugin eval failed

2008-03-13 Thread Jean-Paul Natola
What other info should I post? -Original Message- From: Daryl C. W. O'Shea [mailto:[EMAIL PROTECTED] Sent: Thursday, March 13, 2008 7:16 PM To: Jean-Paul Natola Cc: SpamAssassin Subject: Re: Plugin eval failed On 13/03/2008 7:08 PM, Jean-Paul Natola wrote: Hi all, I upgraded to sa

Re: Plugin eval failed

2008-03-13 Thread Daryl C. W. O'Shea
On 13/03/2008 8:02 PM, Jean-Paul Natola wrote: What other info should I post? The output of vmstat while this is happening. A definition of constantly. Every message, some % of messages? For some common size of messages? Whether it happens when scanning mail for a subset of users or for all

RE: Plugin eval failed

2008-03-13 Thread Jean-Paul Natola
1.We have a sitewide config 2.Startup parameters are command_args=-d --min-children=2 --max-children=10 --min-spare=2 --max-spare=3 --max-conn-per-child=100 -r ${pidfile} 3.I do not scan messages over 250 k 4.We process roughly 5k messages daily 5. the hardware is ehh kinda crappy, but we

Re: sa-update doesn't do languages file?

2008-03-13 Thread Chris Hoogendyk
Theo Van Dinter wrote: On Thu, Mar 13, 2008 at 04:19:55PM -0400, Chris Hoogendyk wrote: Mar 13 15:46:11 eclogite mimedefang-multiplexor[7518]: [ID 980602 mail.info] Slave 3 stderr: config: path /var/lib/spamassassin/3.002004/languages is inaccessible: Permission denied What is

Spam getting through: server reached --max-children

2008-03-13 Thread dalchri000
I've got a boat load of these in my maillog: Mar 9 04:39:12 database spamd[3881]: prefork: server reached --max-children setting, consider raising it It occurs whenever we get a burst of spam and all the child threads are busy. I'm using a sendmail, spamass-milter, SpamAssassin configuration.