Re: Difference in score returned and sum of all points

2010-10-12 Thread RW
On Mon, 11 Oct 2010 23:37:50 -0700 (PDT) Gnanam wrote: > My question is, though SA reports 2.8 points at the top, on > summing-up each points from the Content analysis details, it is only > 2.7 points. Why SA is reporting/showing an increase by 0.1 point > from its Content analysis details poin

Re: Difference in score returned and sum of all points

2010-10-12 Thread Martin Gregorie
On Mon, 2010-10-11 at 23:37 -0700, Gnanam wrote: > My question is, though SA reports 2.8 points at the top, on summing-up each > points from the Content analysis details, it is only 2.7 points. Why SA is > reporting/showing an increase by 0.1 point from its Content analysis details > points sum? >

Re: Difference in score returned and sum of all points

2010-10-12 Thread Gnanam
Martin Gregorie-2 wrote: > > The report truncates scores to one decimal point. Your report shows > several low scoring rules as 0.0 when they're almost certainly in the > range 0.01 to 0.09. Scores of +/-0.01 are commonly used for rules that > are used as meta components but shouldn't otherwise

Re: Difference in score returned and sum of all points

2010-10-12 Thread Martin Gregorie
On Tue, 2010-10-12 at 04:22 -0700, Gnanam wrote: > Is it possible to get/see 2 decimal places of the rules, particularly for > low scoring rules? > Not as far as I know - apart from looking at the rule definitions, of course. Martin

Re: Difference in score returned and sum of all points

2010-10-12 Thread Gnanam
Martin Gregorie-2 wrote: > > Not as far as I know - apart from looking at the rule definitions, of > course. > Thanks. Where do I locate all the rule definitions? -- View this message in context: http://old.nabble.com/Difference-in-score-returned-and-sum-of-all-points-tp29940593p29942445.ht

Re: Difference in score returned and sum of all points

2010-10-12 Thread Martin Gregorie
On Tue, 2010-10-12 at 04:55 -0700, Gnanam wrote: > > Martin Gregorie-2 wrote: > > > > Not as far as I know - apart from looking at the rule definitions, of > > course. > > > > Thanks. Where do I locate all the rule definitions? > /var/lib/spamassassin/3.003001/updates_spamassassin_org Martin

Re: Difference in score returned and sum of all points

2010-10-12 Thread Jared Hall
There is a Wiki page on rounding issues within SpamAssassin: http://wiki.apache.org/spamassassin/RoundingIssues - Three decimal rules, one decimal composite, not to mention dynamic scoring by third party plugins. E-gads. This bug may be pertinent in your case also: https://issues.apache.org/

Re: Difference in score returned and sum of all points

2010-10-12 Thread Gnanam
Jared Hall-2 wrote: > > There is a Wiki page on rounding issues within SpamAssassin: > > http://wiki.apache.org/spamassassin/RoundingIssues > Thanks for sharing that useful link. -- View this message in context: http://old.nabble.com/Difference-in-score-returned-and-sum-of-all-points-tp2994

Re: Difference in score returned and sum of all points

2010-10-12 Thread Gnanam
Martin Gregorie-2 wrote: > > /var/lib/spamassassin/3.003001/updates_spamassassin_org > 1) I can see that file names are named based on some pattern. It's been prefixed with 10_*.cf, 20_*.cf, 25_*.cf, etc. Any idea on how it's been named? 2) I can see scores defined in "50_scores.cf". For e

Re: Difference in score returned and sum of all points

2010-10-12 Thread Bowie Bailey
On 10/12/2010 9:53 AM, Gnanam wrote: > > Martin Gregorie-2 wrote: >> /var/lib/spamassassin/3.003001/updates_spamassassin_org >> > 1) I can see that file names are named based on some pattern. It's been > prefixed with 10_*.cf, 20_*.cf, 25_*.cf, etc. Any idea on how it's been > named? > > 2) I ca

Constant .info domain spam

2010-10-12 Thread Julian Yap
NOTE: I changed the domains below to 'dot info' as the mailing list rejected my initial submission. I'm pretty sure it's not just me but there is some constant spamming from dot info domains. Perhaps for the past 2 months or so. Often they send hundreds per day and consistently from the same IP

Re: Babes in blue spam

2010-10-12 Thread Karsten Bräckelmann
On Tue, 2010-10-12 at 15:09 -0500, mdunlap wrote: > I've had problems sa-learning some particular emails that have some ASCII > escape characters, I've been getting this email that passes right through > the filter Subject: (¯`·._..babes_in_blue^(TM).._.·´¯) sa-learn won't > recognize it as an actu

Re: Constant .info domain spam

2010-10-12 Thread Karsten Bräckelmann
On Tue, 2010-10-12 at 10:32 -1000, Julian Yap wrote: > NOTE: I changed the domains below to 'dot info' as the mailing list > rejected my initial submission. > > I'm pretty sure it's not just me but there is some constant spamming > from dot info domains. Perhaps for the past 2 months or so. > >

RE: Constant .info domain spam

2010-10-12 Thread Peter Lowish
How are RCVD_IN_* rules implemented Karsten? I have similar spam being sent from such addresses as bidwars.uy...@trgide.soldiersupplywell.net and I don’t see that rule in the matching rules Running mailwatch for mailscanner with spamassassin Thanks peter -Original Message- From: Karsten

Re: Constant .info domain spam

2010-10-12 Thread Karsten Bräckelmann
On Wed, 2010-10-13 at 11:16 +1300, Peter Lowish wrote: > How are RCVD_IN_* rules implemented Karsten? They are generally DNS BL checks, some of which do (and are safe for) deep header parsing. Most of them are checked against the handing-over relay's IP only, though. They are enabled (by default)

RE: Constant .info domain spam

2010-10-12 Thread Peter Lowish
I confirm that on revisiting, RCVD_IN_* rules are implemented - thanks for your help Peter -Original Message- From: Karsten Bräckelmann [mailto:guent...@rudersport.de] Sent: Wednesday, 13 October 2010 11:41 a.m. To: users@spamassassin.apache.org Subject: Re: Constant .info domain spam

Re: Constant .info domain spam

2010-10-12 Thread Julian Yap
2010/10/12 Karsten Bräckelmann : > On Tue, 2010-10-12 at 10:32 -1000, Julian Yap wrote: >> NOTE: I changed the domains below to 'dot info' as the mailing list >> rejected my initial submission. >> >> I'm pretty sure it's not just me but there is some constant spamming >> from  dot info domains.  Pe

RE: Constant .info domain spam

2010-10-12 Thread Karsten Bräckelmann
On Wed, 2010-10-13 at 12:28 +1300, Peter Lowish wrote: > I confirm that on revisiting, RCVD_IN_* rules are implemented - thanks for > your help *sigh* > -Original Message- > From: Karsten Bräckelmann [mailto:guent...@rudersport.de] > Sent: Wednesday, 13 October 2010 11:41 a.m. > To: use

Re: Constant .info domain spam

2010-10-12 Thread Karsten Bräckelmann
On Tue, 2010-10-12 at 14:03 -1000, Julian Yap wrote: > 2010/10/12 Karsten Bräckelmann : > > On Tue, 2010-10-12 at 10:32 -1000, Julian Yap wrote: Doh! Upon re-reading, I just realized that you are the OP of this thread, not Peter. So, please, Julian, think of most (if not all) my questions being d

Re: Constant .info domain spam

2010-10-12 Thread Julian Yap
2010/10/12 Karsten Bräckelmann : > On Tue, 2010-10-12 at 14:03 -1000, Julian Yap wrote: >> 2010/10/12 Karsten Bräckelmann : >> > On Tue, 2010-10-12 at 10:32 -1000, Julian Yap wrote: >> > > Are people using automated IP blacklists or something like that? >> > >> > Yes. SA even uses them by default.

Re: Constant .info domain spam

2010-10-12 Thread Karsten Bräckelmann
On Tue, 2010-10-12 at 14:22 -1000, Julian Yap wrote: > 2010/10/12 Karsten Bräckelmann : > > On Tue, 2010-10-12 at 14:03 -1000, Julian Yap wrote: > >> Many of the don't trigger the RCVD_IN_* rules. Does anyone implement > >> their own private DNS black list? > > > > Many of what? > > Many of the

Re: Constant .info domain spam

2010-10-12 Thread Rob McEwen
On 10/12/2010 8:14 PM, Karsten Bräckelmann wrote: > [Added after re-reading: Same request. Which ones do hit, optionaly > which ones don't?] For the IPs mentioned: 217.23.6.209 204.45.150.196 64.32.6.4 173.234.224.131 184.107.29.11 72.55.165.139 67.159.50.131 174.37.134.225 ...here is a tally o

Re: Difference in score returned and sum of all points

2010-10-12 Thread Gnanam
Bowie Bailey wrote: > > http://spamassassin.apache.org/full/3.3.x/doc/Mail_SpamAssassin_Conf.html > > Look for the "SCORING OPTIONS" section near the top. > Thanks for your comments. Any idea/answer for the 1st question? I can see that file names are named by SA based on some pattern. It's

Re: Difference in score returned and sum of all points

2010-10-12 Thread Matus UHLAR - fantomas
> Bowie Bailey wrote: > > > > http://spamassassin.apache.org/full/3.3.x/doc/Mail_SpamAssassin_Conf.html > > > > Look for the "SCORING OPTIONS" section near the top. On 12.10.10 22:26, Gnanam wrote: > Thanks for your comments. > > Any idea/answer for the 1st question? I can see that file names

Re: Difference in score returned and sum of all points

2010-10-12 Thread Gnanam
Matus UHLAR - fantomas wrote: > > what's being named? > > All *.cf files under that directory contain rule definitions. > How are their names chosen is not important. What is the point of your > question? > Matus, this particular point was just out of my curiosity, nothing more than that. I