Re: Help with own RBL

2018-07-23 Thread Patrick Ben Koetter
p@rick -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

Re: DNS again

2016-06-03 Thread Patrick Ben Koetter
s. p@rick -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

Re: Problem with Bayes

2015-09-09 Thread Ben Whyall
spam corpus. Which the override statement is sorting. Ben Matus UHLAR - fantomas <mailto:uh...@fantomas.sk> 09 September 2015 15:55via Postbox <https://www.postbox-inc.com/?utm_source=email&utm_medium=sumlink&utm_campaign=reach> Ben Whyall <mailto:b...@whyall-systems.c

Re: Problem with Bayes

2015-09-09 Thread Ben Whyall
Hi I didnt have that option but I did have bayes_sql_username set I have added the sql_override as well. I have restarted and will see what happens. I am using the ubuntu exim-daemon heavy and it calls spamd directly. Ben Axb <mailto:axb.li...@gmail.com> 09 September 2015 15:10via P

Problem with Bayes

2015-09-09 Thread Ben Whyall
atime delta 0.000 0 783449 0 non-token data: last expire reduction count Could anyone suggest how I might find out what is going awry ? Ben -- Sent from Postbox <https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campaign=reach> -

Re: [Announce] SA-Plugins: RedisAWL, RuleTimingRedis

2015-07-16 Thread Patrick Ben Koetter
t; -- > > I'm currently not using it on a system where the overhead is > relevant for me, but > i tried to reduce the number of redis command executed. > I hope this will reduce the overhead significant. that's great news. Thanks! > Feedback and test results welcom

Re: [Announce] SA-Plugins: RedisAWL, RuleTimingRedis

2015-07-15 Thread Patrick Ben Koetter
https://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

Re: Macs/Yosemite can no longer send abuse reports

2015-06-29 Thread Ben
I can't speak about the specifics of this particular change, but anything that makes it harder to trivially forward a message, Whilst I obviously can't argue with you in the context of making it easy to report spam, there are a couple of things to point out. First, Jo said "have removed all

Re: Macs/Yosemite can no longer send abuse reports

2015-06-29 Thread Ben
On 27/06/2015 23:00, Jo Rhett wrote: All versions of Yosemite have removed all functionality for sending abuse reports to helpdesks. Jo, You're making a few mountains out of molehills here ! They have not "removed all functionality", they have removed ONE function. There is nothing stopping

Re: .science the new leper of TLD's?

2015-06-19 Thread Patrick Ben Koetter
nchen Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

Re: SA running different tests when run manually ?

2015-06-10 Thread Ben
amavisd uses the spamassassin libraries internally, it does not use the spamassassin command, nor spamd. If you update parts of the config, you'll need to reload/restart amavisd. Aah... I must have missed that bit of the fabulous manual... ;-(

SA running different tests when run manually ?

2015-06-10 Thread Ben
I have a curious conundrum. A piece of spam received shows the following in the header when processed via amavis and spamd : DATE_IN_PAST_03_06, HTML_MESSAGE, RCVD_IN_BL_SPAMCOP_NET, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, RDNS_DYNAMIC, SHORTENED_URL_SRC But when the exact piece of Spam is fed d

Re: Dealing with spammers making creative use of Google links ?

2015-06-10 Thread Ben
On 10/06/2015 12:32, Kevin A. McGrail wrote: I'm hitting over spam threshold on the message and have a simple redir for Google match in KAM.cf. 1.0 KAM_GOOGLE_STRING URI: Use of Google redir appearing in spam July 2006 0.0 HTML_MESSAGE BODY: HTML

Re: Must-Have Plugins?

2015-06-10 Thread Ben
- Enable RBLs and DBLs. zen.spamhaus.org is the best way to block the majority of junk before it reaches SA. Just make sure you are below their free threshold limit. One important way to do this is "One important way to do this" in terms of the Spamhaus threshold limit is to not be

Dealing with spammers making creative use of Google links ?

2015-06-10 Thread Ben
"http://www.google.com/url?q="; in order to obfuscate their URLs, as a DBL check countermeasure I suspect. Ideas most welcome ! Ben

Re: definition update frequency?

2015-06-04 Thread Ben
And while I do monitor users@ for issues, a lack of updates does not present a user issue. It is my opinion that if an admin is concerned about rules updates, they should be monitoring dev@ and/or ruleqa@. Plus, let's have a look at the definitions of aforementioned lists : Dev Unless you a

Re: definition update frequency?

2015-06-04 Thread Ben
On 04/06/2015 16:06, Kevin A. McGrail wrote: a lack of updates does not present a user issue. It is my opinion that if an admin is concerned about rules updates, they should be monitoring dev@ and/or ruleqa@. Lack of updates seems to be to be important enough to merit a little post to users@

Re: fwd.facebook.com envelope sender spam

2015-06-03 Thread Ben
talking about a "mitm problem" is nonsense, these mails are just sent to your facebook emial address and forwarded to the email account in your profile settings Sounds a lot like a MTIM problem to me ! Sender -> FB SMTP -> -> Receipient ;-)

Re: IT Recycling emails being missed

2015-06-01 Thread Ben
This is dicey ESP bulk which SA will hardly ever detect. To help tag this you'll need to : - feed/use Bayes - implement Razor/Pyzor/DCC (if not already done) - write rules - header rules to score on certain X Headers, URI rules, etc. or track their IP ranges and reject at MTA level (would be m

IT Recycling emails being missed

2015-06-01 Thread Ben
I've seen a few examples of IT Recycling emails being missed in the Spamassassin net recently. Spamassasin has been scoring them very low. I've kept back a couple of the most recent specimens, I am running Spamassassin 3.4.0 on Ubuntu 14 LTS. Ubuntu is fully up to date, and sa-update is run

Re: Which milter do you prefer?

2015-03-13 Thread Patrick Ben Koetter
etection, amavis takes you there as well. p@rick -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

Is there an official port of SpamAssassin to Windows ?

2014-12-19 Thread Ben Stover
Is there an official port of SpamAssassin to Windows ?

How to setup threshold in SpamAssassin.sfd for Thunderbird?

2014-07-13 Thread Ben Stover
in a file SpamAssassin.sfd but I have no clue on how to define it there. I would appreciate if someone could give me a guide on how to accomplish this? Thank you Ben Yes, I have to disabled TBs built-in adaptive junk mail control. So junk mail handling relys only on SpamAssassin.

Re: sa-update NOT updating.

2014-06-16 Thread Ben
At the ASF, there is an infrastructure team that manages those type of issues. They work hard and do a lot of good but unfortunately, there was a disconnect back in 2009 and a backup request was not implemented correctly. An untested backup is not a backup. Some people only ever seem to lea

Spam score range and distribution statistics?

2014-06-09 Thread Ben Stover
gaussian distribution graphic visualisation? Ben

Re: bit.ly and Spamhaus DBL

2014-03-05 Thread Ben
On 05/03/2014 05:47, Benny Pedersen wrote: On 2014-03-04 18:52, Ben wrote: Just for my reference, is there a way to affect the score rather than skip completely ? score FOO (1) (1) (1) (1) add one point to FOO rule it also works with negative scores that will subtract scores post sample

Re: bit.ly and Spamhaus DBL

2014-03-04 Thread Ben
uridnsbl_skip_domain bit.ly Thanks, will try that. or you liked the other way, score when bit.ly is in urls ? Just for my reference, is there a way to affect the score rather than skip completely ?

bit.ly and Spamhaus DBL

2014-03-04 Thread Ben
Hi, I'm filtering strongly on Spamhaus DBLwhich is working great. Except for bit.ly which Spamhaus take exception to. How can I reduce the weighting specifically for the bit.ly domain ? Thanks ! Ben

Re: Bayes scoring priority

2013-06-24 Thread Ben Johnson
ble.com/BAYES-99-and-ham-td38832.html The short answer is that you can, and probably should, increase the BAYES_99 score value to 4 or 4.5. Setting it to 5 puts you at risk (albeit very slight) for false-positives. -Ben

Re: New rule for HTML spam, using comments?

2013-06-18 Thread Ben Johnson
On 6/18/2013 1:18 PM, Amir 'CG' Caspi wrote: > At 8:58 AM -0400 06/18/2013, Ben Johnson wrote: >> a.) You are copying/pasting the body of the email, but not the headers. > > No, I am copying the headers... however, I am using Eudora (ancient, I > know) as a mail c

Re: New rule for HTML spam, using comments?

2013-06-18 Thread Ben Johnson
ade the same mistake. I use Thunderbird, and to view the actual message source there, one presses Ctrl+U. *That's* the text you would want to copy and paste. b.) You are running Bayes as two different users when you perform your tests. It's possible that SpamAssassin has its own user for executing Bayes-related tasks, but you're using your own system account, for example, which would explain the observed behavior. (By default, each user has his own Bayes DB; it is possible to "hard-code" the Bayes user, which is exactly what I had to do, for more reason than one.) I sincerely doubt that this is a problem with your mailbox format. Have a look at the thread I cited and see if anything jumps-out at you. -Ben

Re: Massive spamruns

2013-06-12 Thread Ben Johnson
enerally because the IPs are only used for a short while, but long > enough to get 25 spams in from the address. I was hoping to find > commonalities between the messages that could be used to generate some > other rules. > > Thanks, > Alex > Isn't this the function that Bayes is intended to serve, rather precisely? -Ben

Re: Large # of Spam getting through all of a sudden.

2013-06-10 Thread Ben Johnson
on, it's well-prescribed for a reason: sort-out your Bayes situation (will probably require wiping and starting over with a hand-sorted corpus that is *retained*) and implement greylisting (provided you can live with its caveats). The DNSBLs can be used to supplement the above. Good luck, Brian! --Ben

Re: Large # of Spam getting through all of a sudden.

2013-06-10 Thread Ben Johnson
y? I use SA via AMaViS, and the header changes look slightly different from yours, but I see no evidence that Bayes scoring is being used in the above header (if, in fact, that is a sample header with all SA markup appended). --Ben

Re: .pw / Palau URL domains in spam

2013-05-25 Thread Ben Johnson
lem went away completely, sorry Palau. > > Steve > Steve, just wanted to thank you for providing an elegant solution to this problem. It seems far more preferable to block this nonsense right at the MTA level (for now). Your instructions worked for me and I now see the following in my mail log for any .pw sender: postfix/smtpd[10660]: NOQUEUE: reject: RCPT from unknown[173.213.124.203]: 554 5.7.1 : Sender address rejected: Access denied Much appreciated! -Ben

Re: dns*.registrar-servers.com as a rogue registrar?

2013-05-07 Thread Ben Johnson
for the "Domains -- Legal and Abuse" department. From the sounds of it, you'd be doing us all a big favor! -Ben On 5/7/2013 3:26 PM, Chris Santerre wrote: > The owner is NameCheap, Inc. > > A quick google will bring up historical problems with NameCheap and its > owner

Re: SQL error: Duplicate entry

2013-04-25 Thread Ben Johnson
s I mention above. Only a developer or disciple of the SA source code can say for sure. I wish I had time to look myself. Out of curiosity, how did this SQL error come to your attention in the first place? -Ben

Re: SQL error: Duplicate entry

2013-04-24 Thread Ben Johnson
. Of course, the messages that you're seeing tell us nothing about which DB table is causing the problem. Maybe one of the developers will see this and recall making such a change. Alternatively, you could dig into your tables and attempt to identify where those values actually live. Once we have the offending table, further troubleshooting will be possible. -Ben

Re: Seminar Spam

2013-04-24 Thread Ben Johnson
s? For example, is it possible to do a > 'whois' and process the output in some way? > > Thanks > > Judy. > Have you been feeding Bayes samples of these messages? I would think Bayes to be far more effective against this type of spamming (given the dynamic nature of the domains and IP addresses) than writing custom rules. -Ben

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-22 Thread Ben Johnson
On 4/20/2013 3:20 PM, Benny Pedersen wrote: > Ben Johnson skrev den 2013-04-20 05:02: > >> Yes, I believe that me and the system always execute SA commands as the >> "amavis" user. When I was using the SQL setup, I had the following in >> local.cf: >> >

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-20 Thread Ben Johnson
like I'm out of the woods here! Thanks for all the expert help, guys. -Ben

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-19 Thread Ben Johnson
bayes_path /var/lib/amavis/.spamassassin/bayes in local.cf, and using the SQL setup, I added bayes_sql_override_username amavis Sorry for the confusion! -Ben On 4/19/2013 11:02 PM, Ben Johnson wrote: > > > On 4/19/2013 1:54 PM, Benny Pedersen wrote: >> Ben Johnson skrev den 2

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-19 Thread Ben Johnson
On 4/19/2013 1:54 PM, Benny Pedersen wrote: > Ben Johnson skrev den 2013-04-19 18:02: > >> Still stumped here... > > for amavisd-new, put spamassassin sql setup into user_prefs file for the > user amavisd-new runs as might be working better then have insecure sql &g

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-19 Thread Ben Johnson
On 4/19/2013 12:12 PM, Axb wrote: > On 04/19/2013 06:02 PM, Ben Johnson wrote: > >> Still stumped here... > > do a bayes sa-learn --backup > > switch to file based in SDBM format (which is fast) > > do a > > sa-learn --restore > > feed it a fe

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-19 Thread Ben Johnson
ary flag" directive an the -t switch. I was actually using the -t switch to produce the output that I pasted two messages back. So, it seems that the "X-Spam-Tok-Stat" output is added only when the token count is high enough to be useful. Still stumped here... -Ben

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-19 Thread Ben Johnson
On 4/18/2013 12:18 PM, Ben Johnson wrote: > > My concern now is that I am on 3.3.1, with little control over upgrades. > I have read all three bug reports in their entirety and Bug 6624 seems > to be a very legitimate concern. To quote Mark in the bug description: > >>

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-18 Thread Ben Johnson
On 4/18/2013 12:26 PM, Axb wrote: > On 04/18/2013 06:18 PM, Ben Johnson wrote: >> I have done some searching-around on the string "cannot use bayes on >> this message; not enough usable tokens found" and have not found >> anything authoritative regarding w

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-18 Thread Ben Johnson
On 4/17/2013 10:15 PM, John Hardin wrote: > On Wed, 17 Apr 2013, Ben Johnson wrote: > >> The first post on that page was the key. In particular, adding the >> following to each MySQL "CREATE TABLE" statement: >> >> ENGINE=InnoDB DEFAULT CHARSET=utf8

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-17 Thread Ben Johnson
On 4/17/2013 5:39 PM, Tom Hendrikx wrote: > On 17-04-13 21:40, Ben Johnson wrote: >> Ideally, using the above directives will tell us whether we're >> experiencing timeouts, or these spam messages are simply not in the >> Pyzor or Razor2 databases. >> >> O

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-17 Thread Ben Johnson
On 4/17/2013 6:47 PM, Ben Johnson wrote: > > > On 4/17/2013 5:05 PM, Kris Deugau wrote: >> Ben Johnson wrote: >>> Is there anything else that would cause Bayes tests not be performed? I >>> ask because other types of tests are disabled automatically und

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-17 Thread Ben Johnson
On 4/17/2013 5:05 PM, Kris Deugau wrote: > Ben Johnson wrote: >> Is there anything else that would cause Bayes tests not be performed? I >> ask because other types of tests are disabled automatically under >> certain circumstances (e.g., network tests), and I'm won

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-17 Thread Ben Johnson
Daniel, thanks for the quick reply. I'll reply inline, below. On 4/16/2013 5:01 PM, Daniel McDonald wrote: > > > > On 4/16/13 2:59 PM, "Ben Johnson" wrote: > >> Are there any normal circumstances under which Bayes tests are not run? > Yes, if USE_BAY

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-04-16 Thread Ben Johnson
at Bayes is setup correctly (database was wiped and now training is done manually and is supervised), and that network tests are being performed when messages are scanned. Thanks for sticking with me through all of this, guys! -Ben On 1/18/2013 11:51 AM, Ben Johnson wrote: > So, I've bee

Re: Interpreting an Authentication-Results: header ?

2013-03-29 Thread Patrick Ben Koetter
++ ++ ++ At least that's my understanding at the moment. p@rick -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Joerg Heidrich

Re: Interpreting an Authentication-Results: header ?

2013-03-28 Thread Patrick Ben Koetter
ttp://tools.ietf.org/html/rfc5451#section-1.2> has been established. The documentation should mention that. p@rick -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben

Re: DKIM scoring with spamassassin

2013-02-17 Thread Patrick Ben Koetter
ses SpamAssassin to get the spam score. You might want to investigate in the project if you want to use DKIM (as one of many methods) to filter spam. p@rick -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Joerg Heidrich

Re: mass check tips and tricks - need advice

2013-02-12 Thread Patrick Ben Koetter
t give a definite advice. > > I am going to be running on SSD drives. should I use mbox? Test it and let us know. Switching between mailbox formats is done within less than a minute in Dovecot. p@rick -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München

Re: Telling BAYES not to learn?

2013-02-07 Thread Ben Johnson
On 2/7/2013 11:13 AM, Marc Perkel wrote: > > On 2/7/2013 6:58 AM, RW wrote: >> On Tue, 05 Feb 2013 07:20:24 -0800 >> Marc Perkel wrote: >> >>> is there a way I can put something in a rule that would cause bayes >>> not to learn - such as a rule that detects bayes poisoning? >> Why do you think t

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-02-06 Thread Ben Johnson
ge from the submission inbox's Ham folder to the permanent Ham corpus folder? Or should I *move* the message? I'm trying to discern whether or not there's value in retaining end-user submissions *as they were classified upon submission*. In case 2.), should I simply delete the message from the submission folder? Or is there some reason to retain the message (i.e., move it into an "Erroneous" folder within the submission mailbox)? I did read http://wiki.apache.org/spamassassin/HandClassifiedCorpora , but it doesn't address these issues, specifically. Thanks again! -Ben

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-02-06 Thread Ben Johnson
On 2/1/2013 12:00 PM, John Hardin wrote: > On Fri, 1 Feb 2013, Ben Johnson wrote: > >> John, thanks for pointing-out the problems associated with re-sending >> the messages via sendmail. >> >> I threw a line out to the Dovecot users group and learned how to

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-02-01 Thread Ben Johnson
On 1/31/2013 5:50 PM, RW wrote: > On Thu, 31 Jan 2013 12:12:15 -0800 (PST) > John Hardin wrote: > >> On Thu, 31 Jan 2013, Ben Johnson wrote: >> > >>> So, I finally got around to tackling this change. >>> >>> With a couple of simple modifica

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-31 Thread Ben Johnson
ce and scalability aside). >> >> I don't find that procedure to be confusing, but people are different, I >> suppose. > > Hm. One thing I would watch out for in that environment is people who > have intentionally subscribed to some sort of mailing list deciding they > don't want to receive it any longer and just junking the messages rather > than unsubscribing. The steps I've taken above will allow me to review submissions and educate users who engage in this practice. Thanks again for elucidating this scenario. I hope that this approach to user-based SpamAssassin training is useful to others. Best regards, -Ben

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-18 Thread Ben Johnson
and after this one do have evidence of BAYES_* tests, so, it's not as though something is completely broken. Are there any normal circumstances under which Bayes tests are not run? Do I need to turn debugging back on and wait until this happens again? Thanks for all the help, everyone! -Ben

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-16 Thread Ben Johnson
On 1/16/2013 2:22 PM, Bowie Bailey wrote: > On 1/16/2013 1:18 PM, Ben Johnson wrote: >> >> On 1/16/2013 11:00 AM, John Hardin wrote: >>> On Wed, 16 Jan 2013, Ben Johnson wrote: >>> >>>> Is it possible that the training I've been doing over

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-16 Thread Ben Johnson
On 1/16/2013 11:00 AM, John Hardin wrote: > On Wed, 16 Jan 2013, Ben Johnson wrote: > >> On 1/15/2013 5:22 PM, John Hardin wrote: >>> On Tue, 15 Jan 2013, Ben Johnson wrote: >>>> >>>> Wow! Adding several more reject_rbl_client entries to the >&

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-16 Thread Ben Johnson
On 1/16/2013 2:02 AM, Tom Hendrikx wrote: > On 1/15/13 5:26 PM, Ben Johnson wrote: > >> >> In postfix's main.cf: >> > >> >> Hmm, very interesting. No, I have no greylisting in place as yet, and >> no, my userbase doesn't demand imme

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-16 Thread Ben Johnson
On 1/15/2013 5:22 PM, John Hardin wrote: > On Tue, 15 Jan 2013, Ben Johnson wrote: > >> >> >> On 1/15/2013 1:55 PM, John Hardin wrote: >>> On Tue, 15 Jan 2013, Ben Johnson wrote: >>> >>>> On 1/14/2013 8:16 PM, John Hardin wrote: >>>

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-15 Thread Ben Johnson
On 1/15/2013 4:39 PM, Bowie Bailey wrote: > On 1/15/2013 4:27 PM, Ben Johnson wrote: >> On 1/15/2013 4:05 PM, Bowie Bailey wrote: >>> On 1/15/2013 3:47 PM, Ben Johnson wrote: >>>> One final question on this subject (sorry...). >>>> >>>>

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-15 Thread Ben Johnson
On 1/15/2013 4:05 PM, Bowie Bailey wrote: > On 1/15/2013 3:47 PM, Ben Johnson wrote: >> One final question on this subject (sorry...). >> >> Is there value in training Bayes on messages that SA classified as spam >> *due to other test scores*? In other words, if a

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-15 Thread Ben Johnson
that message be kept and fed to sa-learn so that Bayes can soak-up all the tokens from a message that is almost certainly spam (based on the other tests)? Am I making any sense? Thanks again! -Ben

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-15 Thread Ben Johnson
On 1/15/2013 1:55 PM, John Hardin wrote: > On Tue, 15 Jan 2013, Ben Johnson wrote: > >> On 1/14/2013 8:16 PM, John Hardin wrote: >>> On Mon, 14 Jan 2013, Ben Johnson wrote: >>> >>> Question: do you have any SMTP-time hard-reject DNSBL tests in pla

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-15 Thread Ben Johnson
On 1/14/2013 8:16 PM, John Hardin wrote: > On Mon, 14 Jan 2013, Ben Johnson wrote: > >> I understand that snowshoe spam may not hit any net tests. I guess my >> confusion is around what, exactly, classifies spam as "snowshoe". > > http://www.spamhaus.org/f

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-15 Thread Ben Johnson
On 1/14/2013 7:48 PM, Noel wrote: > On 1/14/2013 2:59 PM, Ben Johnson wrote: > >> I understand that snowshoe spam may not hit any net tests. I guess my >> confusion is around what, exactly, classifies spam as "snowshoe". > > Snowshoe spam - spreading a spam r

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-14 Thread Ben Johnson
On 1/14/2013 2:49 PM, RW wrote: > On Mon, 14 Jan 2013 13:24:55 -0500 > Ben Johnson wrote: > > >> A clear pattern has emerged: the X-Spam-Status headers for very >> obviously spammy messages never contain evidence that network tests >> contributed to their SA score

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-14 Thread Ben Johnson
On 1/11/2013 4:27 PM, Ben Johnson wrote: > I enabled Amavis's SA debugging mode on the server in question and was > able to extract the debug output for two messages that seem like they > should definitely be classified as spam. > > Message #1: http://pastebin.com/xLMikNJH &

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-11 Thread Ben Johnson
On 1/10/2013 3:13 PM, Tom Hendrikx wrote: > On 10-01-13 19:55, Ben Johnson wrote: >> >> >> On 1/10/2013 1:06 PM, RW wrote: >>> On Thu, 10 Jan 2013 12:48:07 -0500 >>> Ben Johnson wrote: >>>> pon further consideration, this behavior makes p

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-11 Thread Ben Johnson
On 1/10/2013 4:12 PM, John Hardin wrote: > On Thu, 10 Jan 2013, Ben Johnson wrote: > >> So, at this point, I'm struggling to understand how the following >> happened. >> >> Over the course of 15 minutes, I received the same exact message four >> time

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-10 Thread Ben Johnson
On 1/10/2013 1:06 PM, RW wrote: > On Thu, 10 Jan 2013 12:48:07 -0500 > Ben Johnson wrote: >> pon further consideration, this behavior makes perfect sense if the >> mailbox user has moved the message from Inbox to Junk between scans; >> Dovecot's Antispam filter i

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-10 Thread Ben Johnson
On 1/10/2013 12:18 PM, Ben Johnson wrote: > > > On 1/10/2013 11:49 AM, RW wrote: >> On Thu, 10 Jan 2013 11:43:44 -0500 >> Ben Johnson wrote: >> >> >>> This observation begs the question: why are network tests being >>> performed for some mes

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-10 Thread Ben Johnson
On 1/10/2013 11:49 AM, RW wrote: > On Thu, 10 Jan 2013 11:43:44 -0500 > Ben Johnson wrote: > > >> This observation begs the question: why are network tests being >> performed for some messages but not others? To my knowledge, no >> white/gray/black listing has

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-10 Thread Ben Johnson
On 1/9/2013 9:13 PM, John Hardin wrote: > On Wed, 9 Jan 2013, Ben Johnson wrote: > >> On 1/9/2013 7:36 PM, wolfgang wrote: >>> >>>> RCVD_IN_BRBL_LASTEXT,RCVD_IN_CSS,RCVD_IN_PSBL,RCVD_IN_XBL,URIBL_DBL_S >>>> PAM, URIBL_JP_SURBL autolearn=disabled

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-09 Thread Ben Johnson
On 1/9/2013 7:36 PM, wolfgang wrote: > On 2013-01-10 01:03, Ben Johnson wrote: > >> I see; I saved the email message out of Thunderbird (with View -> >> Headers -> All), as a plain text file. Apparently, that process >> butchers the original message. > > In

Re: Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-09 Thread Ben Johnson
On 1/9/2013 5:36 PM, RW wrote: > On Wed, 09 Jan 2013 17:14:05 -0500 > Ben Johnson wrote: > >> About five months ago, I experienced a problem that I *thought* I had >> resolved, but I am observing similar behavior after retraining the >> Bayes database. While the sym

Calling spamassassin directly yields very different results than calling spamassassin via amavis-new

2013-01-09 Thread Ben Johnson
1382400 0 non-token data: last expire atime delta 0.000 0 3191 0 non-token data: last expire reduction count Ultimately, it seems that I should be trying to figure out how, exactly, Amavis is calling SpamAssassin in the course of normal operation. Thanks for any help here, folks! -Ben

pastebot: wiki update?

2012-10-29 Thread Patrick Ben Koetter
e link target seems to be up for sale. p@rick -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Joerg Heidrich

Re: Try to run sa-learn

2012-10-04 Thread Ben Johnson
On 10/4/2012 2:06 PM, troxlinux wrote: > Hi list , I try to run sa-learn on centos 6.3 but no work > > sa-learn --spam --showdots /dir/dir/domain.com.ni/spam/.spam/cur/ > > Learned tokens from 0 message(s) (1 message(s) examined) > ERROR: the Bayes learn function returned an error, please re-r

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-22 Thread Ben Johnson
On 8/22/2012 10:26 AM, Axb wrote: > On 08/22/2012 04:10 PM, Ben Johnson wrote: >> >> I did end-up overriding the bayes_path, which provided a workaround for >> the permissions issues. Cheers to the suggestion. > > This is not a workaround, it's common practi

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-22 Thread Ben Johnson
On 8/22/2012 9:43 AM, John Hardin wrote: > On Wed, 22 Aug 2012, Bowie Bailey wrote: > >> On 8/21/2012 5:51 PM, Ben Johnson wrote: >>> >>> What good is the --username switch, then? Thanks for the follow-up, John! > See other responses. > >>>

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-22 Thread Ben Johnson
On 8/22/2012 9:05 AM, Bowie Bailey wrote: > On 8/21/2012 5:51 PM, Ben Johnson wrote: >> >> On 8/21/2012 5:19 PM, John Hardin wrote: >>> On Tue, 21 Aug 2012, Ben Johnson wrote: >>> >>>> Aug 21 13:08:33.729 [23714] dbg: bayes: tie-ing to DB file R/O

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-21 Thread Ben Johnson
On 8/21/2012 5:19 PM, John Hardin wrote: > On Tue, 21 Aug 2012, Ben Johnson wrote: > >> Aug 21 13:08:33.729 [23714] dbg: bayes: tie-ing to DB file R/O >> /var/lib/amavis/.spamassassin/bayes_toks >> >> ---8<-- >> # sa-learn --username=amavis --du

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-21 Thread Ben Johnson
On 8/20/2012 2:47 PM, Ben Johnson wrote: > I was able to resolve the issue by adding the --username switch to the > 'sa-learn' executable: > > # sa-learn --username=amavis --spam > /var/vmail/example.com/trainer/Maildir/.INBOX.Spam/cur > > Thanks for all of t

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-20 Thread Ben Johnson
On 8/20/2012 2:02 PM, Ben Johnson wrote: > > > On 8/20/2012 12:56 PM, Bowie Bailey wrote: >> On 8/20/2012 12:46 PM, Axb wrote: >>> On 08/20/2012 06:42 PM, Ben Johnson wrote: >>>> >>>> On 8/17/2012 11:28 AM, John Hardin wrote: >>>>&g

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-20 Thread Ben Johnson
On 8/20/2012 12:56 PM, Bowie Bailey wrote: > On 8/20/2012 12:46 PM, Axb wrote: >> On 08/20/2012 06:42 PM, Ben Johnson wrote: >>> >>> On 8/17/2012 11:28 AM, John Hardin wrote: >>>> On Fri, 17 Aug 2012, Ben Johnson wrote: >>>> >>>>>

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-20 Thread Ben Johnson
On 8/17/2012 11:28 AM, John Hardin wrote: > On Fri, 17 Aug 2012, Ben Johnson wrote: > >> On 8/16/2012 2:00 PM, Ben Johnson wrote: >> Basically, I need to do something about the spam inundation, as soon as >> possible. >> >> Is there any reason that I s

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-17 Thread Ben Johnson
On 8/16/2012 2:00 PM, Ben Johnson wrote: > In any event, at this point, I'm confused as to which user account I > should be using when executing "sa-learn --spam", for example. > > As a bit of background, I'm using ISPConfig 3, which implements virtual >

Re: Academic interested in interviewing you for research paper.

2012-08-17 Thread Patrick Ben Koetter
* Michael Scheidell : > On 8/17/12 12:11 AM, jonathonb wrote: > >As such a detailed knowledge of its history > >or inner working is not necessary as I am only interested in YOUR views and > >contributors will remain anonymous. > > No, we do all of this for fame and fortune. > We WANT to see our na

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-16 Thread Ben Johnson
On 8/16/2012 12:32 PM, John Hardin wrote: > On Thu, 16 Aug 2012, Ben Johnson wrote: > >> On 8/16/2012 11:38 AM, John Hardin wrote: >>> On Thu, 16 Aug 2012, Ben Johnson wrote: >>> >>>> So, after disabling auto-learn (for now) and executing "sa-

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-16 Thread Ben Johnson
On 8/16/2012 11:38 AM, John Hardin wrote: > On Thu, 16 Aug 2012, Ben Johnson wrote: > >> So, after disabling auto-learn (for now) and executing "sa-learn >> --clear", and restarting Amavis, I'm still seeing this: >> >> No, score=0.593

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-16 Thread Ben Johnson
On 8/16/2012 10:14 AM, Ben Johnson wrote: > > > On 8/15/2012 4:05 PM, John Hardin wrote: >> On Wed, 15 Aug 2012, Ben Johnson wrote: >> >>> On 8/15/2012 2:24 PM, John Hardin wrote: >>>> On Wed, 15 Aug 2012, Ben Johnson wrote: >>>> >&

Re: Very spammy messages yield BAYES_00 (-1.9)

2012-08-16 Thread Ben Johnson
On 8/15/2012 4:05 PM, John Hardin wrote: > On Wed, 15 Aug 2012, Ben Johnson wrote: > >> On 8/15/2012 2:24 PM, John Hardin wrote: >>> On Wed, 15 Aug 2012, Ben Johnson wrote: >>> >>>> Some 99% of the spam that I receive, which is grossly spammy (we'

  1   2   3   4   >