strange issue with cron.daily

2010-11-16 Thread Francesco Acchiappati
Hello everyone, i'm experiencing a strange issue everytime the crondaily runs the spamassassin script for updating. the error returned to me by cron daily is the following: run-parts: /etc/cron.daily/spamassassin exited with return code 25 I've tried to search on this list archive and also

sender in black list

2010-11-16 Thread Sasa
Hi, I would put an mail address in my black list and then I have modified local.cf: blacklist from t...@hotmail.it ..but in log file I have still: Nov 15 18:30:38 mail amavis[6974]: (06974-10) Checking: [82.51.y.x] t...@hotmail.it - tt...@domain.it Nov 15 18:30:40 mail amavis[6974]:

Re: sender in black list

2010-11-16 Thread Matus UHLAR - fantomas
On 16.11.10 11:01, Sasa wrote: Hi, I would put an mail address in my black list and then I have modified local.cf: blacklist from t...@hotmail.it ..but in log file I have still: Nov 15 18:30:38 mail amavis[6974]: (06974-10) Checking: [82.51.y.x] t...@hotmail.it - tt...@domain.it Nov

sa-update changelog

2010-11-16 Thread Alvaro Marin
Hi, Is there anyway to see the changes made by sa-udpate when I execute it? I want to see which rules and scores are modified since the last update. Thanks! Regards, -- Alvaro Marín Illera Hostalia Internet www.hostalia.com

Re: sa-update changelog

2010-11-16 Thread Yet Another Ninja
On 2010-11-16 11:41, Alvaro Marin wrote: Hi, Is there anyway to see the changes made by sa-udpate when I execute it? I want to see which rules and scores are modified since the last update. Thanks! Regards, sa-update -D

Re: strange issue with cron.daily

2010-11-16 Thread RW
On Tue, 16 Nov 2010 09:08:20 +0100 Francesco Acchiappati francesco.acchiapp...@secoges.com wrote: Hello everyone, i'm experiencing a strange issue everytime the crondaily runs the spamassassin script for updating. the error returned to me by cron daily is the following: run-parts:

URIBL_RHS_DOB slowness (was Re: How to find out which rules have changed in the last time?)

2010-11-16 Thread David F. Skoll
On Mon, 15 Nov 2010 13:43:57 -0500 Kris Deugau kdeu...@vianet.ca wrote: I noticed recently that the average ~0.8s scan time on our filter cluster had jumped to just over 3s. We noticed a huge jump in scan times on several of our customers' systems. Try disabling the Day-old Bread rules. We

Re: strange issue with cron.daily

2010-11-16 Thread Benny Pedersen
On tir 16 nov 2010 09:08:20 CET, Francesco Acchiappati wrote the error returned to me by cron daily is the following: run-parts: /etc/cron.daily/spamassassin exited with return code 25 try doing what writed in that cron from shell and add -D to args sa-update -D what are being in shell here

Re: sender in black list

2010-11-16 Thread Benny Pedersen
On tir 16 nov 2010 11:01:39 CET, Sasa wrote Hi, I would put an mail address in my black list and then I have modified local.cf: blacklist from t...@hotmail.it blacklist_from not blacklist from perldoc Mail::SpamAssassin::Conf -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: strange issue with cron.daily

2010-11-16 Thread Benny Pedersen
On tir 16 nov 2010 12:48:48 CET, RW wrote I don't think that cron.daily/spamassassin is part of SA - it's probably specific to your OS or distribution. Perhaps you could post it. or delete it to get rid of the problem :) -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: strange issue with cron.daily

2010-11-16 Thread Francesco Acchiappati
Il 16/11/2010 12:48, RW ha scritto: On Tue, 16 Nov 2010 09:08:20 +0100 Francesco Acchiappatifrancesco.acchiapp...@secoges.com wrote: Hello everyone, i'm experiencing a strange issue everytime the crondaily runs the spamassassin script for updating. the error returned to me by cron daily

Re: sa-update changelog

2010-11-16 Thread Bowie Bailey
On 11/16/2010 6:05 AM, Yet Another Ninja wrote: On 2010-11-16 11:41, Alvaro Marin wrote: Hi, Is there anyway to see the changes made by sa-udpate when I execute it? I want to see which rules and scores are modified since the last update. Thanks! Regards, sa-update -D sa-update -v will

Re: SPF technical problems (was Re: email address forgery)

2010-11-16 Thread Marc Perkel
On 11/15/2010 10:25 AM, David F. Skoll wrote: On Mon, 15 Nov 2010 08:07:43 -1000 Alexandre Chapellonalexandre.chapel...@mana.pf wrote: I use it just the same for the domains I have complete controm over. Unfortunately, be aware that this setup maybe forbid your legitimate emails to be

Re: strange issue with cron.daily

2010-11-16 Thread Karsten Bräckelmann
On Tue, 2010-11-16 at 14:54 +0100, Benny Pedersen wrote: /var/lib/spamassassin/compiled ]; then this dir does imho not exists, its /var/lib/spamassassin/version/compiled Nope, the path is correct. See man sa-compile for yourself. --updatedir=path Directory to place updates (default:

some custom rules query

2010-11-16 Thread Mike Bro
Hello, Just wanted to create (or use if they already exist) some rules: 1. Email body contains more than 10 newliners without any text between them 2. Email body contains less than 4 characters 3. Email body contains only a line of text and a line with some URL Any help appreciated. Regards,

Re: strange issue with cron.daily

2010-11-16 Thread John Hardin
On Tue, 16 Nov 2010, Francesco Acchiappati wrote: Il 16/11/2010 15:11, John Hardin ha scritto: I'd suggest the most likely problem is sa-compile is failing for some reason. Try running it interactively. You could run this: bash -x /etc/cron.daily/spamassassin 21 | tee /tmp/log.txt As

Re: SPF technical problems (was Re: email address forgery)

2010-11-16 Thread John Hardin
On Tue, 16 Nov 2010, Marc Perkel wrote: Spammer can and do use SPF so it's not a good white list either. That was never its intent. If SPF is correct and the domain is in my white list then I'll pass it as white. _that_ is its intent. -- John Hardin KA7OHZ

Re: strange issue with cron.daily

2010-11-16 Thread Francesco Acchiappati
Il 16/11/2010 17:27, John Hardin ha scritto: On Tue, 16 Nov 2010, Francesco Acchiappati wrote: Il 16/11/2010 15:11, John Hardin ha scritto: I'd suggest the most likely problem is sa-compile is failing for some reason. Try running it interactively. You could run this: bash -x

Differing results from same email

2010-11-16 Thread justin9988
Hi guys This is the first time I have used this software so sorry if it's a stupid question but SpamAssassin is giving us differing results on the same email when they are run on different websites. Classic ASP Site VERSION: SpamAssassin 3.2.3 (2007-08-08) SCORE: 5.2 Spam Tests:

Re: Differing results from same email

2010-11-16 Thread Karsten Bräckelmann
On Tue, 2010-11-16 at 08:51 -0800, an anonymous Nabble user wrote: This is the first time I have used this software so sorry if it's a stupid question but SpamAssassin is giving us differing results on the same email when they are run on different websites. Some of this is quite confusing.

Re: some custom rules query

2010-11-16 Thread Martin Gregorie
On Tue, 2010-11-16 at 16:02 +, Mike Bro wrote: Hello, I've seen all but (2) in ham, so be careful with these rules - you probably want to score them at 0.01 and use them in meta-rules. Just wanted to create (or use if they already exist) some rules: 1. Email body contains more than 10

Re: strange issue with cron.daily

2010-11-16 Thread Bob Proulx
Francesco Acchiappati wrote: John Hardin ha scritto: You also might want to run sa-compile manually and see what happens. /bin/sh: cc: command not found make: *** [body_0.o] Error 127 command failed: exit 2 heh... i think this may be the reason.. sa-compile returns this error.. now i

Re: How to find out which rules have changed in the last time?

2010-11-16 Thread Kris Deugau
John Hardin wrote: On Mon, 15 Nov 2010, Kris Deugau wrote: I noticed recently that the average ~0.8s scan time on our filter cluster had jumped to just over 3s. If you can duplicate this behavior on a manual scan of a test message, there are debug flags and a timing plugin that will help

Re: Blocking Senders with young domains

2010-11-16 Thread Michael Scheidell
On 11/16/10 4:31 PM, Liam R. MacInnes wrote: Hi All I've been looking around and racking my brains to find a rule to key on a pattern we've noticed. A lot of the recent spam that's making it through seems to be sent from domains registered in the previous 48 hours with valid SPF records. I'm

Re: Blocking Senders with young domains

2010-11-16 Thread Rob McEwen
On 11/16/2010 4:34 PM, Michael Scheidell wrote: there was/is a 'DOB' blacklist (day old bread). but I think the dns servers may be overloaded. some people are complaining about timeouts. I think this was revived at the following web site (probably by a different person?):

Re: Blocking Senders with young domains

2010-11-16 Thread Darxus
http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists#Familiar_Domains These *might* work. I mangled together a couple types of tests: header __RCVD_IN_FAMILIAReval:check_rbl_envfrom('familiar', 'hostkarma.junkemailfilter.com.') describe __RCVD_IN_FAMILIAR Received from

Re: SPF technical problems (was Re: email address forgery)

2010-11-16 Thread Alexandre Chapellon
Le mardi 16 novembre 2010 à 07:48 -0800, Marc Perkel a écrit : On 11/15/2010 10:25 AM, David F. Skoll wrote: On Mon, 15 Nov 2010 08:07:43 -1000 Alexandre Chapellonalexandre.chapel...@mana.pf wrote: I use it just the same for the domains I have complete controm over. Unfortunately,

Re: some custom rules query

2010-11-16 Thread John Hardin
On Tue, 16 Nov 2010, Martin Gregorie wrote: On Tue, 2010-11-16 at 16:02 +, Mike Bro wrote: 2. Email body contains less than 4 characters I've never seen mail with so short a body - where's the spam payload? Likely the Subject line. -- John Hardin KA7OHZ

Re: Blocking Senders with young domains

2010-11-16 Thread John Hardin
On Tue, 16 Nov 2010, dar...@chaosreigns.com wrote: I'd be curious to hear how that goes. And what would happen if they were run through the weekly network mass checks. I don't think you'd ever see good results in the mass checks. The masscheck corpora retain spam for an extended period

Re: Blocking Senders with young domains

2010-11-16 Thread Darxus
On 11/16, John Hardin wrote: I don't think you'd ever see good results in the mass checks. The masscheck corpora retain spam for an extended period (several months) and DoB-style rules would only hit for a few days after the spam run initially sent the message. Are you telling me the mass

Re: some custom rules query

2010-11-16 Thread Martin Gregorie
On Tue, 2010-11-16 at 14:20 -0800, John Hardin wrote: On Tue, 16 Nov 2010, Martin Gregorie wrote: On Tue, 2010-11-16 at 16:02 +, Mike Bro wrote: 2. Email body contains less than 4 characters I've never seen mail with so short a body - where's the spam payload? Likely the

Re: Blocking Senders with young domains

2010-11-16 Thread Darxus
On 11/16, John Hardin wrote: How so? If masscheck only considered the rules that hit when the message was first received (or more properly, was first added to the corpora), how would you ever test new rules against the existing corpora? They don't just use emails since the last mass check?

Re: Blocking Senders with young domains

2010-11-16 Thread Henrik K
On Tue, Nov 16, 2010 at 04:27:55PM -0800, John Hardin wrote: On Tue, 16 Nov 2010, dar...@chaosreigns.com wrote: On 11/16, John Hardin wrote: I don't think you'd ever see good results in the mass checks. The masscheck corpora retain spam for an extended period (several months) and DoB-style

Re: Blocking Senders with young domains

2010-11-16 Thread Henrik K
On Tue, Nov 16, 2010 at 04:44:41PM -0500, dar...@chaosreigns.com wrote: http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists#Familiar_Domains These *might* work. I mangled together a couple types of tests: header __RCVD_IN_FAMILIAReval:check_rbl_envfrom('familiar',

Re: SPF technical problems (was Re: email address forgery)

2010-11-16 Thread Benny Pedersen
On tir 16 nov 2010 16:48:28 CET, Marc Perkel wrote Other than that - it just plain doesn't work. spammers can do what thay like, but add sender domain to spf whitelist here is not there bussiness do you belive its spammers rule the world ? example of a invalid spf

Re: strange issue with cron.daily

2010-11-16 Thread Benny Pedersen
On tir 16 nov 2010 17:00:50 CET, Karsten Bräckelmann wrote Nope, the path is correct. See man sa-compile for yourself. --updatedir=path Directory to place updates (default: /var/lib/spamassassin/compiled/perlversion/version) yep i lost it here, compiled is in that dir even on gentoo,

Re: strange issue with cron.daily

2010-11-16 Thread Benny Pedersen
On tir 16 nov 2010 17:51:21 CET, Francesco Acchiappati wrote heh... i think this may be the reason.. sa-compile returns this error.. now i have to figure out how a dependency like cc is missing on my system... mmm this will be a loong night.. thank you very much to everyone who helped

Re: strange issue with cron.daily

2010-11-16 Thread Bob Proulx
Benny Pedersen wrote: gcc is not default installed in debian bug it as a missing dependice for spamassassin It is only a Recommends: relationship because it isn't required. It is only required if you use the compiled rules. And that is optional. So gcc isn't required but only optional. Bob