Re: OT - Hotmail/Outlook.com marking most of our email as Junk

2022-02-22 Thread Chris
Agreed, it seems to be deliberate to get people moved over to the big providers, they are clearly discouraging independent email servers as they clearly scored differently. I have even been doing tests on various spare unused ip's and the amount that get blocked by microsoft (but no other provider

Re: message size, mark if too large?

2020-12-27 Thread Chris
> > > > > > Is there a simple way? SpamAssassin version 3.4.2 > > > > > > > > > > > > > > > Here's a procmail recipe I use to mark large files :0 fh w * > 10 * ^Subject:\/.* | formail -I "Subject: {* -BIG- *} $MATCH" You can change the file size in the 2nd line to meet your needs. -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 08:07:17 up 14 days, 23:10, 1 user, load average: 3.29, 2.60, 1.69 Description:Ubuntu 20.04.1 LTS, kernel 5.4.0-58-generic

channel 'kam.sa-channels.mcgrail.com': GPG validation failed, channel failed

2020-12-12 Thread Chris
ing with code 4 This is Ubuntu 20.04.1 LTS Spamassassin spamassassin -V SpamAssassin version 3.4.4 running on Perl version 5.30.0 -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 20:00:37 up 11:04, 1 user, load average: 1.50, 1.16, 1.02 Description:Ubuntu 20.04.1 LTS, kernel 5.4.0-58-generic

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-07 Thread Chris
t; That is indeed v1.0.1 > > > > > It's old, 20190704 Riccardo, after updating the issue has been resolved. Thank you Chris -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 19:43:53 up 1 day, 3:38, 1 user, load average: 1.10, 0.74, 0.71 Description:Ubuntu 20.04.1 LTS, kernel 5.4.0-48-generic

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-07 Thread Chris
t; That is indeed v1.0.1 > > > > > It's old, 20190704 I picked up 20200825 last night, just waiting for my new key. -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 09:37:02 up 17:31, 1 user, load average: 0.53, 0.39, 0.47 Description:Ubuntu 20.04.1 LTS, kernel 5.4.0-48-generic

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-07 Thread Chris
is at least v1.0.2, i.e. has the rdns chop [1] in the > module. > > > Here's the message complete with body - > > https://pastebin.com/CW7Vj7Yh > > This written to my syslog - https://pastebin.com/M12PS1fK > > [1] > https://github.com/spamhaus/spamassassin-d

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris
On Tue, 2020-10-06 at 20:52 -0700, John Hardin wrote: > On Wed, 7 Oct 2020, Riccardo Alfieri wrote: > > > Hi Chris, > > > > > > > > > > > spamd[435769]: dns: new_dns_packet > > > > > > > (domain=o279.send.iheartdogs.co

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris
On Wed, 2020-10-07 at 03:40 +, Riccardo Alfieri wrote: > Hi Chris, > > > > > > > > spamd[435769]: dns: new_dns_packet > > > > > > (domain=o279.send.iheartdogs.com..x > > > > > > x/db > > > >

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris Pollock
On Tue, 2020-10-06 at 19:49 -0700, John Hardin wrote: > On Tue, 6 Oct 2020, Chris wrote: > > > On Tue, 2020-10-06 at 18:54 -0700, John Hardin wrote: > > > On Tue, 6 Oct 2020, Chris wrote: > > > > > > > The complete error looks like this: > >

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris
On Tue, 2020-10-06 at 19:49 -0700, John Hardin wrote: > On Tue, 6 Oct 2020, Chris wrote: > > > On Tue, 2020-10-06 at 18:54 -0700, John Hardin wrote: > > > On Tue, 6 Oct 2020, Chris wrote: > > > > > > > The complete error looks like this: > >

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris
On Tue, 2020-10-06 at 18:54 -0700, John Hardin wrote: > On Tue, 6 Oct 2020, Chris wrote: > > > The complete error looks like this: > > > > spamd[435769]: dns: new_dns_packet > > (domain=o279.send.iheartdogs.com..xx/dbl.dq > > .spa >

spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris
eally doesn't hurt anything however I'm just curious as to what might be causing it. It appears to have been going on all year so far but as I said not with every incoming message just from certain domains it seems. Any ideas? -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 20:12:39 up 4:0

Re: DNS issues or something else?

2020-10-05 Thread Chris
On Mon, 2020-10-05 at 16:14 +0100, RW wrote: > On Mon, 05 Oct 2020 09:17:09 -0500 > Chris wrote: > > > Since my update to Ubuntu 20.04 last Wed I've been seeing this in > > every message that's run through spamassassin. > > > > https://pastebin.co

DNS issues or something else?

2020-10-05 Thread Chris
on where I should begin my research on this would be appreciated. Thanks Chris -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 09:05:49 up 17:43, 1 user, load average: 1.64, 1.39, 1.28 Description:Ubuntu 20.04.1 LTS, kernel 5.4.0-48-generic

Re: DKIM invalid

2020-02-05 Thread Chris Conn
age a few plugins of my own for installation on other systems and hence you mangle the spamassassin package itself? oh my lord.. [root@mail-gw:~]$ rpm -qa | grep spamassassin | sort spamassassin-3.4.4-1.fc31.x86_64 spamassassin-bogofilter-1.0-8.fc31.20200204.rh.noarch spamassassin-clamav-

Re: DKIM invalid

2020-02-05 Thread Chris Conn
smart people would have opened koji, enter spamasssin,, select the F31 package from https://koji.fedoraproject.org/koji/packageinfo?packageID=554 and downloaded https://kojipkgs.fedoraproject.org//packages/spamassassin/3.4.4/1.fc31/x86_64/spamassassin-3.4.4-1.fc31.x86_64.rpm or just used "dnf

Re: DKIM invalid

2020-02-05 Thread Chris Conn
On 2/4/2020 5:12 PM, Chris Conn wrote: On 2/4/2020 5:09 PM, Damian wrote: https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7785 maybe? Hello, You were correct; using 3.4.3  on fedora with milter-spamc, pretty much every email would match DKIM_INVALID when handled by the MTA and

Re: DKIM invalid

2020-02-04 Thread Chris Conn
On 2/4/2020 5:09 PM, Damian wrote: https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7785 maybe? Hello, HM, very possible.  I am using milter-spamc but the behaviour might be similar.  I will look to build 3.4.4 and see if I get better DKIM returns.  Thanks for this. Chris I am

DKIM invalid

2020-02-04 Thread Chris Conn
MTA-level scan by the milter would score it invalid and a commandline test of the  .eml would return a different value on the same spamassassin daemon? Thanks in advance, Chris

Re: ANNOUNCE: Apache SpamAssassin 3.4.4 available

2020-01-30 Thread Chris
Instead of rolling out 3.4.3 they backported the fixes to 3.4.2. I'm getting ready to file another bug report requesting upgrade to 3.4.4 listing the CVE's affected and see what happens. > > Then they would presumably backport the SHA-256 checksum handling, > as > it is a security issue... > > -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 17:12:12 up 2 days, 8:39, 1 user, load average: 1.41, 0.72, 0.54 Description:Ubuntu 18.04.3 LTS, kernel 5.3.0-28-generic

Re: Use of uninitialized value $r in scalar chomp at /usr/local/share/perl/5.26.1/File/Scan/ClamAV.pm line 224

2020-01-10 Thread Chris
On Fri, 2020-01-10 at 00:56 -0500, Bill Cole wrote: > On 9 Jan 2020, at 17:32, Chris wrote: > > > Since upgrading my Ubuntu 18.04.3 to ClamAV version 0.102.1 > > yesterday > > I've been seeing this in my syslog: > > > > spamd[2455]: Use of uninitialized v

Re: rpm of centos

2020-01-10 Thread Chris Conn
luded and I am a fan of the Rule2XSBody plugin. Maybe thats old fashioned, I don't know; but Centos/RHEL being so strict on their versioning, Centos8 is stuck with 3.4.2 forever so I am happily running 3.4.3 on it. Best of luck in your build, hope this helps, Chris

Use of uninitialized value $r in scalar chomp at /usr/local/share/perl/5.26.1/File/Scan/ClamAV.pm line 224

2020-01-09 Thread Chris
/) at /usr/local/share/perl/5.26.1/File/Scan/ClamAV.pm line 227 Line 224 - chomp(my $r = $conn->getline); Line 227 - if($r =~ /stream:\ (.+)\ FOUND/ix){ Is this an issue with ClamAV.pm or with ClamAV itself? Chris -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 16:27:34 up 38 days, 7:10, 1 us

Ubuntu bug report for SA 3.4.3

2019-12-19 Thread Chris
I've submitted a bug report to Ubuntu to get SA upgraded by the newest version: https://bugs.launchpad.net/ubuntu/+source/spamassassin/+bug/1856248 -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 19:49:22 up 17 days, 10:32, 1 user, load average: 1.20, 0.91, 0.60 Description:Ubuntu 18.04.

Re: Spamassassin reporting

2019-12-05 Thread Chris
On Thu, 2019-12-05 at 14:47 -0500, Dave Goodrich wrote: > That looks very familiar, and exactly what I am looking for. I can > make that script work with our log files, thank you. > > DAve > You're welcome. -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 17:28:20 up 3 days

Re: Custom rule help

2019-12-05 Thread Chris Mulcahy
On Wed, 4 Dec 2019 12:40:27 -0800 Chris Mulcahy wrote: > Hi. > > I’m relatively new to complex custom rules. I have plenty of simple > and some multi-condition rules but need something custom. > > My approach to using my domain name is bad but I started it in the > 90s so… I

Re: Spamassassin reporting

2019-12-04 Thread Chris Pollock
not turning up > anything for me. > > Thanks, > > DAve > Forgot to add what the output looks like -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 19:11:09 up 2 days, 9:54, 1 user, load average: 0.66, 0.42, 0.39 Description:Ubuntu 18.04.3 LTS, kernel 5.0.0-

Re: Spamassassin reporting

2019-12-04 Thread Chris Pollock
not turning up > anything for me. > > Thanks, > > DAve > Here's what I use for my home system -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 18:06:20 up 2 days, 8:49, 1 user, load average: 0.90, 0.81, 0.84 Description:Ubuntu 18.04.3 LTS, kernel 5.0.0

Re: Custom rule help

2019-12-04 Thread Chris Mulcahy
From: Martin Gregorie Reply: mar...@gregorie.org Date: December 4, 2019 at 4:12:22 PM To: users@spamassassin.apache.org Subject: Re: Custom rule help On Wed, 2019-12-04 at 12:40 -0800, Chris Mulcahy wrote: > I want a rule that scores if “sitename” is not in the From: line. If > the

Custom rule help

2019-12-04 Thread Chris Mulcahy
Hi. I’m relatively new to complex custom rules. I have plenty of simple and some multi-condition rules but need something custom. My approach to using my domain name is bad but I started it in the 90s so… I have some sites where I gave them my email address as “ sitename@mydomain.com” so I

Re: Spamhaus Technology contributions to SpamAssassin

2019-07-03 Thread Chris Conn
0_dnsbl_tests.conf mecanisms? Cheers and thanks, Chris

Re: SA-Update cronjob output rejected by ISP for containing spam

2019-06-22 Thread Chris Pollock
On Sat, 2019-06-22 at 16:10 -0700, John Hardin wrote: > On Sat, 22 Jun 2019, Chris Pollock wrote: > > > On Sat, 2019-06-22 at 10:29 -0700, John Hardin wrote: > > > On Sat, 22 Jun 2019, Chris Pollock wrote: > > > > > > > I'm not sure how to exactly

Re: SA-Update cronjob output rejected by ISP for containing spam

2019-06-22 Thread Chris Pollock
On Sat, 2019-06-22 at 16:10 -0700, John Hardin wrote: > On Sat, 22 Jun 2019, Chris Pollock wrote: > > > On Sat, 2019-06-22 at 10:29 -0700, John Hardin wrote: > > > On Sat, 22 Jun 2019, Chris Pollock wrote: > > > > > > > I'm not sure how to exactly

Re: SA-Update cronjob output rejected by ISP for containing spam

2019-06-22 Thread Chris Pollock
On Sat, 2019-06-22 at 10:29 -0700, John Hardin wrote: > On Sat, 22 Jun 2019, Chris Pollock wrote: > > > I'm not sure how to exactly word the problem so the subject is the > > best > > I can do for now. Whenever a crojob is run a message is sent out > > via >

SA-Update cronjob output rejected by ISP for containing spam

2019-06-22 Thread Chris Pollock
that the message was rejected for containing spam. Any ideas what was in the latest rule updates to cause this? -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 11:56:52 up 1 day, 18:07, 1 user, load average: 1.21, 0.70, 0.65 Description:Ubuntu 18.04.2 LTS, kern

Re: Ransom spam body is .jpg

2019-05-24 Thread Chris Pollock
On Fri, 2019-05-24 at 18:29 -0700, John Hardin wrote: > On Fri, 24 May 2019, Chris Pollock wrote: > > > This is the 2nd of these ransom spams I've received where the body > > of > > the message is a .jpg. Below is the body and also a link to the > >

Ransom spam body is .jpg

2019-05-24 Thread Chris Pollock
ody=1 Fuz1=1 Fuz2=many DCC Brand is x.dcc-servers PYZOR Results are Reported 0 times. I don't know if a rule exists for something like this or not. -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 20:04:36 up 9 days, 12:23, 1 user, load average: 1.15, 1.15, 1.12 D

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-13 Thread Chris Pollock
On Thu, 2018-12-13 at 17:08 -0500, Bill Cole wrote: > On 13 Dec 2018, at 16:24, Chris Pollock wrote: > > > On Thu, 2018-12-13 at 15:14 -0600, Chris Pollock wrote: > > > On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > > > > On 11 Dec 2018, at 16:37, Chris Pol

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-13 Thread Chris Pollock
On Thu, 2018-12-13 at 15:14 -0600, Chris Pollock wrote: > On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > > On 11 Dec 2018, at 16:37, Chris Pollock wrote: > > > > > On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > > > > [...] > > > > Any

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-13 Thread Chris Pollock
On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > On 11 Dec 2018, at 16:37, Chris Pollock wrote: > > > On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > > [...] > > > Anyway, as of today I've capped those 2 subrules at levels which > > > leave a

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread Chris Pollock
On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > On 11 Dec 2018, at 16:37, Chris Pollock wrote: > > > On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > > [...] > > > Anyway, as of today I've capped those 2 subrules at levels which > > > leave a

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread Chris Pollock
On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > On 9 Dec 2018, at 18:23, Chris Pollock wrote: > > > On Sun, 2018-12-09 at 13:06 -0500, Bill Cole wrote: > > > On 9 Dec 2018, at 12:04, Chris Pollock wrote: > > > > > > > This is probably very trivial

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread Chris Pollock
On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > On 9 Dec 2018, at 18:23, Chris Pollock wrote: > > > On Sun, 2018-12-09 at 13:06 -0500, Bill Cole wrote: > > > On 9 Dec 2018, at 12:04, Chris Pollock wrote: > > > > > > > This is probably very trivial

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-09 Thread Chris Pollock
On Sun, 2018-12-09 at 13:06 -0500, Bill Cole wrote: > On 9 Dec 2018, at 12:04, Chris Pollock wrote: > > > This is probably very trivial and doesn't affect anything except > > maybe > > the size of the headers but I have to ask. When looking at the > > header

Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-09 Thread Chris Pollock
it's listed? Couldn't each subtest be listed just once instead of multiple times? -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 10:58:20 up 1 day, 15:22, 1 user, load average: 0.67, 0.49, 0.31 Description:Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic signature.

Re: Cannot install SpamAssassin on Ubuntu 18.04.1 (gpg not found?)

2018-10-26 Thread Chris Pollock
as > > installed > > and sa-compile was installed later. > > I am using SA on Ubuntu 18.04 without any such problems. Looking at > the package changelogs for SA 3.4.1-8 under Debian/Ubuntu they are > identical except that, for Ubuntu 18.04, SA was rebuilt > against openss

Current update channels

2018-09-19 Thread Chris Pollock
I noticed in a post that Kevin McGrail made that the 'sought' rules are no longer published. So, my update-channels file that SA-Update reads should have only one entry: updates.spamassassin.org Is that correct -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 14:

Re: [ANNOUNCE] Apache SpamAssassin 3.4.2 available

2018-09-16 Thread Chris
ackages > On Sun, Sep 16, 2018, 20:45 Chris wrote: > > On Sun, 2018-09-16 at 11:03 -0400, Kevin A. McGrail wrote: > > > > > Good Morning, > > > > > > > > > > On behalf of the Apache SpamAssassin Project Management > > Committee, I

Re: [ANNOUNCE] Apache SpamAssassin 3.4.2 available

2018-09-16 Thread Chris
urity announcement > will > follow within the next 24 hours. > > Apache SpamAssassin can be downloaded from > https://spamassassin.apache.org/downloads.cgi and via cpan > (Mail::SpamAssassin). > I assume that once the Ubuntu folks get the security announcement they'll build

Re: KAM.cf update script

2018-08-18 Thread Chris
r/bin/mail -s KAM_changes jpff > /bin/systemctl -l reload spamassassin.service > > exit 0 > > Sems to work OK; noting special > Thanks, looks good, I'll give it a try. > > On Sat, 18 Aug 2018, Chris wrote: > > > Does anyone have a script that I can run as

KAM.cf update script

2018-08-18 Thread Chris
Does anyone have a script that I can run as a cron job to update the KAM.cf file? Thanks Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 12:27:45 up 14:39, 1 user, load average: 8.88, 3.45, 1.40 Description:Ubuntu 18.04.1 LTS, kernel 4.15.0-32-generic

Re: Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-18 Thread Chris
On Sat, 2018-08-18 at 00:07 -0400, Bill Cole wrote: > On 17 Aug 2018, at 18:49 (-0400), Chris wrote: > > > Not in one of my rules: > > OK, but also not part of the standard ruleset: 3rd-party rules. Kevin > is a highly respected and active leader in the SpamAssassin proje

Re: Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-17 Thread Chris
On Fri, 2018-08-17 at 23:00 +0100, RW wrote: > On Fri, 17 Aug 2018 16:25:14 -0500 > Chris wrote: > > > Early on when SA-Compile was run I did manage to capture this: > > > > Running sa-compile (may take a long time) > > Unescaped left brace in regex is deprecat

Re: Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-17 Thread Chris
On Fri, 2018-08-17 at 14:46 -0700, John Hardin wrote: > On Fri, 17 Aug 2018, Chris wrote: > > > Early on > > when SA-Compile was run I did manage to capture this: > > > > Running sa-compile (may take a long time) > > Unescaped left brace in regex is depre

Re: Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-17 Thread Chris
On Fri, 2018-08-17 at 17:54 +0100, Dominic Raferd wrote: > > > On Fri, 17 Aug 2018 at 17:34, Chris wrote: > > I noticed last night while updating to 18.04.1 that there were > > warnings > > about SA Compile. I tried to copy to the clipboard however that >

Re: Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-17 Thread Chris
On Fri, 2018-08-17 at 17:54 +0100, Dominic Raferd wrote: > > > On Fri, 17 Aug 2018 at 17:34, Chris wrote: > > I noticed last night while updating to 18.04.1 that there were > > warnings > > about SA Compile. I tried to copy to the clipboard however that >

Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-17 Thread Chris
ttp://us.archive.ubuntu.com/ubuntu bionic/main i386 Packages 100 /var/lib/dpkg/status -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 11:18:49 up 13:48, 1 user, load average: 1.43, 1.26, 1.07 Description:Ubuntu 18.04.1 LTS, kernel 4.15.0-32-generic signature.asc Description: This is a digitally signed message part

Re: plugin: eval failed: __alarm__ignore__(xxx) how to troubleshoot

2018-04-20 Thread Chris Conn
l I can get 3.4.x deployed. Thanks again, Chris

Re: plugin: eval failed: __alarm__ignore__(xxx) how to troubleshoot

2018-04-20 Thread Chris Conn
==> got hit: "your business" Apr 20 14:14:06.444 [27778] dbg: rules: ran body rule __HIGHBITS ==> got hit: "â?¢ â?? " Apr 20 14:14:06.590 [27778] dbg: rules: running uri tests; score so far=4. however, with Rule2XSBody enabled, on SA 3.3.1 on Centos6, it loops forever. With or witout Rule2XSBody on Centos7 SA 3.4.0-2 bundled SA rpm, it works correctly. I am disabling Rule2XSBody for now while I rebuild Centos7 boxes. Chris

Re: plugin: eval failed: __alarm__ignore__(xxx) how to troubleshoot

2018-04-20 Thread Chris Conn
On 4/18/2018 10:32 AM, Benny Pedersen wrote: Chris Conn skrev den 2018-04-18 16:00: this is a relatively old install, SA 3.3.1 on Centos6 (stock RPMs) maybe solved in centos7 ? i do not use precompiled problems Hello, I believe I found the issue.  On my Centos6 boxes with SA 3.3.1 (the

Re: plugin: eval failed: __alarm__ignore__(xxx) how to troubleshoot

2018-04-18 Thread Chris Conn
eventually croaks with that msg. Thanks folks, Chris

plugin: eval failed: __alarm__ignore__(xxx) how to troubleshoot

2018-04-18 Thread Chris Conn
function in Timeout.pm this is a relatively old install, SA 3.3.1 on Centos6 (stock RPMs) Any tips on how to troubleshoot the essence or root of this issue? Thanks in advance, Chris

Re: smtp.centurylink.net 206.152.134.66

2018-02-11 Thread Chris
ell me to go into chat (which was useless also) or call. You might try them though.  Sorry I couldn't be of more help. Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 15:31:38 up 9 days, 23:04, 1 user, load average: 0.94, 0.83, 0.74 Description:Ubuntu 16

Re: SA-Update exits with code 4

2018-01-31 Thread Chris
On Wed, 2018-01-31 at 13:09 -0600, David Jones wrote: > On 01/30/2018 09:37 PM, Chris wrote: > > > > > > > > > > > rules: failed to run FORGED_GMAIL_RCVD test, skipping: > > >   (Can't locate object method > > > "check_for_forg

Re: SA-Update exits with code 4

2018-01-30 Thread Chris
On Tue, 2018-01-30 at 21:15 -0600, David Jones wrote: > On 01/30/2018 08:04 PM, Chris wrote: > > > > Yesterday there were no issues with my once a day update. Today it > > exited with a code 4. Here is the output: > > > > https://pastebin.com/aXvk0QQu > >

SA-Update exits with code 4

2018-01-30 Thread Chris
Yesterday there were no issues with my once a day update. Today it exited with a code 4. Here is the output: https://pastebin.com/aXvk0QQu Any ideas on what seems to be the problem? Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 20:02:58 up 2:46, 1 user, load

Re: ClamAV.pm question

2018-01-30 Thread Chris
orked after I changed the tmp dir to /var/tmp instead of /var/lib/clamav/tmp > On 30/01/2018 17:50, Chris wrote: > > > > I'm seeing this - https://pastebin.com/86s7cVBj and I'm not sure if > > it's an SA issue or a ClamAV issue. > > > >

ClamAV.pm question

2018-01-30 Thread Chris
I'm seeing this - https://pastebin.com/86s7cVBj and I'm not sure if it's an SA issue or a ClamAV issue.  apt-cache policy clamav clamav:   Installed: 0.99.3-0ubuntu1~chris+1   Candidate: 0.99.3-0ubuntu1~chris+1 apt-cache policy spamassassin spamassassin:   Installed: 3.4.1-3   Can

Re: From name containing a spoofed email address

2018-01-26 Thread Chris
On Fri, 2018-01-26 at 16:26 -0600, sha...@shanew.net wrote: > Just a hunch, but did you make sure to add the "$self->register..." > line inside the "sub new {" block with all the others in > HeaderEval.pm? > Yep, sure did, thanks for that. All is well now. &g

Re: From name containing a spoofed email address

2018-01-26 Thread Chris
ly spam > } >   } > } > > R.G. > Just for the heck of it I added the above to my SpamAssassin setup at home. However my syslog shows: rules: failed to run __F_DM1 test, skipping: (Can't locate object method "from_domains_mismatch" via package "Mail: [..

Re: skipping nameserver '0.ns.spamhaus.org' because it is a CNAME

2018-01-14 Thread Chris
gt; in > logs; I am quite confident that nothing was really seriously broken, > but I understand that it may have annoyed some people. > Thanks for the explanation Alex, I wasn't annoyed, just baffled. As you said, everything is back to normal. Chris -- Chris KeyID 0xE372A7DA98E6

skipping nameserver '0.ns.spamhaus.org' because it is a CNAME

2018-01-14 Thread Chris
I started seeing this yesterday evening - https://pastebin.com/Q01t63uf  AFAICT it's happening on every message that is processed by SA. This is: spamassassin -V SpamAssassin version 3.4.1   running on Perl version 5.22.1 Any ideas? Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.

Re: error: unable to refresh mirrors file for channel updates.spamassassin.org

2017-11-30 Thread Chris
On Thu, 2017-11-30 at 13:17 -0600, David Jones wrote: > On 11/30/2017 01:09 PM, Chris wrote: > > > > Over the past few days I've been seeing the above. The complete > > output > > is: > > > > /etc/cron.daily/spamassassin: > >

error: unable to refresh mirrors file for channel updates.spamassassin.org

2017-11-30 Thread Chris
this? Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 13:05:38 up 8 days, 2:06, 1 user, load average: 0.45, 0.72, 0.80 Description:Ubuntu 16.04.3 LTS, kernel 4.10.0-40-generic signature.asc Description: This is a digitally signed message part

Re: SA-Update not updating DB

2017-11-16 Thread Chris
On Thu, 2017-11-16 at 09:06 -0600, David Jones wrote: > On 11/16/2017 08:57 AM, Chris wrote: > > > > On Thu, 2017-11-16 at 07:22 -0600, David Jones wrote: > > > > > > Great news!  Last night's run finally produced a full > > > 72_scores.cf. >

Re: SA-Update not updating DB

2017-11-16 Thread Chris
this ruleset to my platforms and will monitor  > scoring/blocking over the next couple of days. > Hmm, the file doesn't seem to be able to be found unless of course I did something incorrectly: chris@localhost:~/Downloads$ wget http://sa-update.ena.com/${REV}.tar.g z --2017-11-16 08:5

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-21 Thread Chris
On Thu, 2017-09-21 at 11:58 +0100, Martin Gregorie wrote: > On Wed, 2017-09-20 at 19:39 -0500, Chris wrote: > > > > It was installed by default when upgrading from 14.04LTS to > > 16.04LTS > > > Then it may be best to just leave it there. > > > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
On Wed, 2017-09-20 at 15:22 -0700, Ian Zimmerman wrote: > On 2017-09-20 17:02, Chris wrote: > > > > > So, IIUC it would be a good idea to remove the resolv.conf symlink > > in > > /run/resolvconf ? > Definitely _not_ a good idea while the resolvconf package is &

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
On Wed, 2017-09-20 at 19:05 +0100, Martin Gregorie wrote: > On Wed, 2017-09-20 at 08:48 -0500, Chris wrote: > > > > On Wed, 2017-09-20 at 11:15 +0100, Martin Gregorie wrote: > > > > > > On Tue, 2017-09-19 at 19:32 -0500, Chris wrote: > > > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
. > So, IIUC it would be a good idea to remove the resolv.conf symlink in /run/resolvconf ? > Finally (and getting really OT), it helps to keep relevant /etc files > under version control, so you know when the system helpfully shifts > the > ground under you. > -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 16:42:52 up 19:55, 1 user, load average: 0.65, 0.59, 0.83 Description:Ubuntu 16.04.3 LTS, kernel 4.10.0-35-generic signature.asc Description: This is a digitally signed message part

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
 0.43.05 2 mterry - nethack  3.4.2-2 2 ogra   - pubip0.6 28thibran- snappy-debug 0.31.4-snapd2.26.9  70canonical  - snapweb      0.26-11-dev 307   canonical  - speed-test   1.8.0

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
On Tue, 2017-09-19 at 23:04 -0400, Bill Cole wrote: > On 19 Sep 2017, at 22:36, Chris wrote: > > > > > On Wed, 2017-09-20 at 04:31 +0200, Reindl Harald wrote: > > > > > > > > > Am 20.09.2017 um 02:32 schrieb Chris: > > > > > &

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
On Wed, 2017-09-20 at 11:15 +0100, Martin Gregorie wrote: > On Tue, 2017-09-19 at 19:32 -0500, Chris wrote: > > > > Hi Martin, here's what I see: > > > > sudo systemctl status dnsmasq > > [sudo] password for chris:  > > ● dnsmasq.service >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Wed, 2017-09-20 at 04:31 +0200, Reindl Harald wrote: > > Am 20.09.2017 um 02:32 schrieb Chris: > > > > I then installed dnsmasq (apparently it wasn't installed) > frankly clean up your mess - you recently posted dnsmasq as well as  > named listening on differen

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 19:32 -0500, Chris wrote: > On Wed, 2017-09-20 at 00:40 +0100, Martin Gregorie wrote: > > > > On Tue, 2017-09-19 at 16:44 -0500, Chris wrote: > > > > > > > > > > > > Thanks Martin, here's what I get, it appears to

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Wed, 2017-09-20 at 00:40 +0100, Martin Gregorie wrote: > On Tue, 2017-09-19 at 16:44 -0500, Chris wrote: > > > > > > Thanks Martin, here's what I get, it appears to not be running. > > > > sudo systemctl stop dnsmasq > > [sudo] password for chri

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 15:40 -0500, Chris wrote: > On Tue, 2017-09-19 at 08:41 -0500, David Jones wrote: > > > > On 09/19/2017 08:25 AM, Chris wrote: > > > > > > > > > On Tue, 2017-09-19 at 08:16 -0500, Chris wrote: > > > > > > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 14:47 -0700, John Hardin wrote: > On Tue, 19 Sep 2017, Chris wrote: > > > I'm getting different outputs each time I run dig +trace > > 65.43.116.208.iadb.isipp.com > > > > 65.43.116.208.iadb.isipp.com. 3600 IN A   127.0.1.255 > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 22:07 +0100, Martin Gregorie wrote: > On Tue, 2017-09-19 at 15:40 -0500, Chris wrote: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > &g

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 08:41 -0500, David Jones wrote: > On 09/19/2017 08:25 AM, Chris wrote: > > > > On Tue, 2017-09-19 at 08:16 -0500, Chris wrote: > > > > > > On Tue, 2017-09-19 at 07:45 -0500, David Jones wrote: > > > > > > > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 08:16 -0500, Chris wrote: > On Tue, 2017-09-19 at 07:45 -0500, David Jones wrote: > > > > On 09/18/2017 06:03 PM, Chris wrote: > [snip] > > > > > > > > > > > localhost dnsmasq[2323]: started, version 2.75 cachesize 150

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 07:45 -0500, David Jones wrote: > On 09/18/2017 06:03 PM, Chris wrote: [snip] > > > > localhost dnsmasq[2323]: started, version 2.75 cachesize 150 > > localhost dnsmasq[2323]: compile time options: IPv6 GNU-getopt DBus > > i18n IDN DHCP DHCPv6

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-18 Thread Chris
On Mon, 2017-09-18 at 12:32 -0500, David Jones wrote: > On 09/18/2017 11:52 AM, Chris wrote: > > > > On Mon, 2017-09-18 at 11:40 -0500, David Jones wrote: > > > > > > On 09/18/2017 11:14 AM, Chris wrote: > > > > > > > > &

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-18 Thread Chris
On Mon, 2017-09-18 at 11:40 -0500, David Jones wrote: > On 09/18/2017 11:14 AM, Chris wrote: > > > > On Mon, 2017-09-18 at 11:11 -0400, Bill Cole wrote: > > > > > > On 18 Sep 2017, at 10:57, Chris wrote: > > > > > > [...] > > > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-18 Thread Chris
On Mon, 2017-09-18 at 11:11 -0400, Bill Cole wrote: > On 18 Sep 2017, at 10:57, Chris wrote: > > [...] > > > > > > > > I am receiving many hits on *_IADB_* rules just fine recently for > > > emails  > > > from constantcontact.com and others.

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-18 Thread Chris
On Mon, 2017-09-18 at 09:28 -0500, David Jones wrote: > On 09/18/2017 09:12 AM, Kevin A. McGrail wrote: > > > > On 9/16/2017 4:36 PM, Chris wrote: > > > > > > I'm also seeing issues with ISIPP which is in 20_dnsbl_tests.cf. > > > I've > >

Re: bb.barracudacentral.org

2017-09-16 Thread Chris
On Sat, 2017-09-16 at 16:32 +0200, Reindl Harald wrote: > > Am 16.09.2017 um 16:27 schrieb Chris: > > > > named[1284]: REFUSED unexpected RCODE resolving > > '165.170.166.108.iadb.isipp.com/A/IN': 168.150.251.35#53 > > named[1284]: host unreachable resolvi

Re: bb.barracudacentral.org

2017-09-16 Thread Chris
On Sat, 2017-09-16 at 09:45 -0400, Kevin A. McGrail wrote: > Chris & all, > I have opened a bug about this:  > https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7471 > > I believe scoring it 0 for now will disable the rule but that's just  > hiding the issue. > &

Re: bb.barracudacentral.org

2017-09-15 Thread Chris
rules that use that plugin. It looks to me that I'll just ignore it since as I said at first it's not causing any other issues it's just something that had been nagging at me since I keep seeing it and wondering why. -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (El

Re: bb.barracudacentral.org

2017-09-15 Thread Chris
On Fri, 2017-09-15 at 18:20 -0400, Kevin A. McGrail wrote: > On 9/15/2017 5:50 PM, Chris wrote: > > > > It's not a 'show stopper' it's just annoying to keep seeing this > > and > > wondering what the cause is. > You have configured your installati

  1   2   3   4   5   6   7   8   9   10   >