Re: fired rules count ..rule

2012-02-23 Thread Martin Gregorie
On Thu, 2012-02-23 at 08:49 +0100, Amedeo Rinaldo wrote: Is there a way/rule to count the fired ruled number ? I've google a lot with no results (surely my fault ..wrong keywords) ..thanks for any help If you just want to see what rules fire within a period of time and/or count them, scan

no score when doctype is declared

2012-02-23 Thread zafer akyel
Hi, Anyone having the same problem ? When I declare doctype as below, spam score result is always 0 but if I removed it scores as expected. !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.01 Transitional//tr http://www.w3.org/TR/html4/loose.dtd; Thank you.

Re: no score when doctype is declared

2012-02-23 Thread Kevin A. McGrail
On 2/23/2012 8:45 AM, zafer akyel wrote: Hi, Anyone having the same problem ? When I declare doctype as below, spam score result is always 0 but if I removed it scores as expected. !DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.01 Transitional//tr http://www.w3.org/TR/html4/loose.dtd; Thank you.

Re: no score when doctype is declared

2012-02-23 Thread zafer akyel
Hi, This is the whole HTML we are testing. http://pastebin.com/cjPYe9Gz Thank you. 2012/2/23 Kevin A. McGrail kmcgr...@pccc.com: On 2/23/2012 8:45 AM, zafer akyel wrote: Hi, Anyone having the same problem ? When I declare doctype as below, spam score result is always 0 but if I removed

Re: no score when doctype is declared

2012-02-23 Thread Kevin A. McGrail
On 2/23/2012 10:43 AM, zafer akyel wrote: This is the whole HTML we are testing. http://pastebin.com/cjPYe9Gz Thank you. How are you calling SpamAssassin exactly?

Re: no score when doctype is declared

2012-02-23 Thread zafer akyel
Hi, I am using java to execute the spamassassin executeCommand = spamassassin -L -t; String[] command = {CMD, /C, executeCommand}; ProcessBuilder probuilder = new ProcessBuilder(command); probuilder.directory(new File(c:\\Mail-SpamAssassin-3.0.4)); Process process =

Re: no score when doctype is declared

2012-02-23 Thread Bowie Bailey
On 2/23/2012 10:43 AM, zafer akyel wrote: Hi, This is the whole HTML we are testing. http://pastebin.com/cjPYe9Gz Thank you. SA is designed to work on email messages. That looks like a webpage, not an email. If you send that to SA as-is, you will not get good results. You would want to

Re: no score when doctype is declared

2012-02-23 Thread zafer akyel
Thank you for your answer but it is an HTML email. That is the content of HTML I am appending message.append(From: + this._from + \n); message.append(To: + this._to + \n); message.append(Date: + formatter.format(d) + \n); message.append(Subject: + this._subject + \n);

Re: no score when doctype is declared

2012-02-23 Thread Bowie Bailey
On 2/23/2012 11:22 AM, zafer akyel wrote: Thank you for your answer but it is an HTML email. That is the content of HTML I am appending message.append(From: + this._from + \n); message.append(To: + this._to + \n); message.append(Date: + formatter.format(d) + \n);

Re: no score when doctype is declared

2012-02-23 Thread zafer akyel
Thank you very much for your answers. I will try and notify you. Thank you. 2012/2/23 Bowie Bailey bowie_bai...@buc.com: On 2/23/2012 11:22 AM, zafer akyel wrote: Thank you for your answer but it is an HTML email. That is the content of HTML I am appending       message.append(From: +

Re: no score when doctype is declared

2012-02-23 Thread Kevin A. McGrail
On 2/23/2012 10:58 AM, zafer akyel wrote: Hi, I am using java to execute the spamassassin executeCommand = spamassassin -L -t; String[] command = {CMD, /C, executeCommand}; ProcessBuilder probuilder = new ProcessBuilder(command); probuilder.directory(new

Re: no score when doctype is declared

2012-02-23 Thread Martin Gregorie
On Thu, 2012-02-23 at 18:22 +0200, zafer akyel wrote: Thank you for your answer but it is an HTML email. That is the content of HTML I am appending message.append(From: + this._from + \n); message.append(To: + this._to + \n); message.append(Date: + formatter.format(d) +

Re: no score when doctype is declared

2012-02-23 Thread Joseph Brennan
Martin Gregorie mar...@gregorie.org wrote: A correctly formatted message will have both the text/html part preceded by either a plaintext body or a 'text/plain' part: the latter is preferable. No plain text part is required. There could be only one part, html, but it needs the right MIME

spam skating through

2012-02-23 Thread Jonathan Nichols
Two examples from the past half hour alone: http://pastebin.com/SraBrj7r http://pastebin.com/PRspRuLS I'm getting flooded with spam these days. Bayes is on, I'm using the built-in RBLs, hostkarma, mailspike, BRBL, botnet freemail plugin, pyzor, razor.. and things are still sailing right

Re: spam skating through

2012-02-23 Thread Kevin A. McGrail
How is the email getting into your server? The only received header is localhost... Received: from localhost (localhost [127.0.0.1]) by heap.pbp.net (Postfix) with ESMTP id 27604E44DB for remo...@pbp.net; Thu, 23 Feb 2012 10:45:25 -0600 (CST) testing

Re: spam skating through

2012-02-23 Thread Jonathan Nichols
Amavis is stamping it. The rest of the header info is below in the pastebin sample. And just my luck.. *now* it's showing up in Razor and URIBL. Argh! It's as if spammers are using me as a crash test dummy this year. :/ On Feb 23, 2012, at 12:13 PM, Kevin A. McGrail wrote: How is the email

Re: spam skating through

2012-02-23 Thread Kevin A. McGrail
On 2/23/2012 12:19 PM, Jonathan Nichols wrote: Amavis is stamping it. The rest of the header info is below in the pastebin sample. Roger, I see that now. Missed the split. And just my luck.. *now* it's showing up in Razor and URIBL. Argh! It's as if spammers are using me as a crash test dummy

Re: spam skating through

2012-02-23 Thread RW
On Thu, 23 Feb 2012 12:10:13 -0500 Jonathan Nichols wrote: Two examples from the past half hour alone: http://pastebin.com/SraBrj7r http://pastebin.com/PRspRuLS I'm getting flooded with spam these days. Bayes is on, ... and things are still sailing right through with low scores. Then

Re: no score when doctype is declared

2012-02-23 Thread Walter Hurry
On Thu, 23 Feb 2012 12:02:58 -0500, Joseph Brennan wrote: Including a plain part is desirable in many cases but not all. It is required if you want *me* to read it.

With fetchmail, SA can inappropriately test

2012-02-23 Thread Mark Porthouse
Hello, I've just experienced a *very unusual scenario* where SA is checking the reputation of the dynamic public IP address of the sending desktop client's authorised SMTP connection to their SMTP server. Usually SA would check the reputation of the IP address of SMTP relay, not the

Re: no score when doctype is declared

2012-02-23 Thread Martin Gregorie
On Thu, 2012-02-23 at 17:26 +, Walter Hurry wrote: On Thu, 23 Feb 2012 12:02:58 -0500, Joseph Brennan wrote: Including a plain part is desirable in many cases but not all. It is required if you want *me* to read it. +1

Re: spam skating through

2012-02-23 Thread Benny Pedersen
Den 2012-02-23 18:10, Jonathan Nichols skrev: http://pastebin.com/SraBrj7r http://pastebin.com/PRspRuLS Content analysis details: (6.7 points, 5.0 required) pts rule name description -- -- 1.7

Re: fired rules count ..rule

2012-02-23 Thread Amedeo Rinaldo
Il 23/02/2012 13:49, Martin Gregorie ha scritto: On Thu, 2012-02-23 at 08:49 +0100, Amedeo Rinaldo wrote: Is there a way/rule to count the fired ruled number ? ..[cut].. If you just want to see what rules fire within a period of time and/or count them, scan the mail log (/etc/log/maillog*)

Re: spam skating through

2012-02-23 Thread Jonathan Nichols
1.3 SAGREY Adds score to spam from first-time senders Now this is something that I have never seen before and am going to look into this evening

Re: spam skating through

2012-02-23 Thread Benny Pedersen
Den 2012-02-23 18:50, Jonathan Nichols skrev: Now this is something that I have never seen before and am going to look into this evening setup awl to mask on /32 and keep awl factor at 0.5 then follow the plugin guide

Re: With fetchmail, SA can inappropriately test

2012-02-23 Thread RW
On Thu, 23 Feb 2012 17:32:27 + Mark Porthouse wrote: Hello, I've just experienced a *very unusual scenario* where SA is checking the reputation of the dynamic public IP address of the sending desktop client's authorised SMTP connection to their SMTP server. I'm currently not

Re: no score when doctype is declared

2012-02-23 Thread John Hardin
On Thu, 23 Feb 2012, Martin Gregorie wrote: On Thu, 2012-02-23 at 17:26 +, Walter Hurry wrote: On Thu, 23 Feb 2012 12:02:58 -0500, Joseph Brennan wrote: Including a plain part is desirable in many cases but not all. It is required if you want *me* to read it. +1 +1 -- John

Re: fired rules count ..rule

2012-02-23 Thread Martin Gregorie
On Thu, 2012-02-23 at 18:47 +0100, Amedeo Rinaldo wrote: Il 23/02/2012 13:49, Martin Gregorie ha scritto: On Thu, 2012-02-23 at 08:49 +0100, Amedeo Rinaldo wrote: Is there a way/rule to count the fired ruled number ? ..[cut].. If you just want to see what rules fire within a period of

Sorry for the misunderstanding [WAS: HOW to setup an URIBL?]

2012-02-23 Thread Michelle Konzack
Hi guys, I was not aware, that I can run bind9 and rbldnsd at the same time on the same machine, exactly, I was thinking they will conflict with each other... ;-) Thanks, Greetings and nice Day/Evening Michelle Konzack -- # Debian GNU/Linux Consultant

Re: fired rules count ..rule

2012-02-23 Thread Alex
Hi, Is there a way/rule to count the fired ruled number ? I've google a lot with no results (surely my fault ..wrong keywords) ..thanks for any help If you just want to see what rules fire within a period of time and/or count them, scan the mail log (/etc/log/maillog*) on my system. A good

Re: spam skating through

2012-02-23 Thread Alex
Hi, 1.3 SAGREY                 Adds score to spam from first-time senders Now this is something that I have never seen before and am going to look into this evening I've also started to investigate SAGREY, and it sounds like a pretty cool solution (despite it not having been updated in

Re: Sorry for the misunderstanding [WAS: HOW to setup an URIBL?]

2012-02-23 Thread David B Funk
On Thu, 23 Feb 2012, Michelle Konzack wrote: Hi guys, I was not aware, that I can run bind9 and rbldnsd at the same time on the same machine, exactly, I was thinking they will conflict with each other... ;-) Thanks, Greetings and nice Day/Evening Michelle Konzack As long as they

Re: spam skating through

2012-02-23 Thread Kris Deugau
Alex wrote: Hi, 1.3 SAGREY Adds score to spam from first-time senders Now this is something that I have never seen before and am going to look into this evening I've also started to investigate SAGREY, and it sounds like a pretty cool solution (despite it not having

Re: spam skating through

2012-02-23 Thread David B Funk
On Thu, 23 Feb 2012, Alex wrote: Hi, 1.3 SAGREY                 Adds score to spam from first-time senders Now this is something that I have never seen before and am going to look into this evening I've also started to investigate SAGREY, and it sounds like a pretty cool solution

Re: With fetchmail, SA can inappropriately test

2012-02-23 Thread RW
On Thu, 23 Feb 2012 21:25:40 + Mark Porthouse wrote: On 23/02/2012 18:36, RW wrote: We went though this on the bug tracker. SA is failing to differentiate between an mx handover and submission. The main way that it does this via internal and trusted network settings. If you have

Re: spam skating through

2012-02-23 Thread RW
On Thu, 23 Feb 2012 15:35:38 -0500 Jonathan Nichols wrote: This sagrey plugin sounds great, I'm giving it a try now. Thanks for the info. I'd be wary about that. Personally, the FPs I've had in the past have overwhelmingly first contact.

Re: fired rules count ..rule

2012-02-23 Thread Martin Gregorie
On Thu, 2012-02-23 at 17:44 -0500, Alex wrote: How have you extended the logwatch scripts beyond the ones available here: http://logreporters.sourceforge.net/ I don't use amavis, so the only one of those that's useful to me would be the Postfix one. Up until the appearance of Fedora 15 the

Re: ANNOUNCE: ZMI_GERMAN available via a new channel

2012-02-23 Thread Michael Monnerie
Am Mittwoch, 15. Februar 2012, 14:25:46 schrieb Michael Monnerie: Starting now, the ZMI_GERMAN ruleset is available via a new channel: # sa-update --channel sa.zmi.at --nogpg Latest info: - Key is now also available from https://sa.zmi.at/sa-update-german/GPG.KEY to be more conform to what