Re: sa-update

2010-03-31 Thread Jari Fredriksson
On 31.3.2010 14:02, Andrea Bencini wrote: I installed with yum lhe following pakages: postfix, amavisd-new and spamassassin. I have *.cf in /usr/share/spamassassin/ directory and now I would like update them. Is it possible? with sa-update? If yes which is the complete command to use to

Re: Bayes is causing MySQL performance issues

2010-03-30 Thread Jari Fredriksson
On 30.3.2010 12:04, Martin Svensson wrote: Thanks for your response. The problem is unfortunately still not solved. Yesterday I dropped the database and re-created it from bayes_mysql.sql file that is bundled with the SpamAssassin package (and added a lastupdate field). Just a double

Re: SA rules don't seem to be getting hit

2010-03-26 Thread Jari Fredriksson
On 27.3.2010 0:44, Brody wrote: Hi, I've got a linux box running sa 3.2.5 normally sa is invoked via amavis, however for this test I'm running it via spamassassin -D msg It seems that sa isn't hitting any of the more useful rules i.e. ones that should cause it to increase the score.

Re: Bayes improvement

2010-03-25 Thread Jari Fredriksson
On 25.3.2010 10:14, Giampaolo Tomassoni wrote: Having this in the bayes db: 335424 nspam 144915 nham 129892 ntokens and a fairly good hit rate by Bayes in detecting both spam and ham, how would you improve Bayes scores? In example, would you increase every bayes

Re: Bayes improvement

2010-03-25 Thread Jari Fredriksson
On 25.3.2010 20:30, Giampaolo Tomassoni wrote: I have increased BAYES_00 and BAYES_99. It seems that those are pretty good and cause no FP's, but BAYES_05 may sometimes be spam. I have BAYES_99 as a killer, it has 5 points, sending the mail to a 'probable spam' alone. Ah, that is even

Re: Botnet plugin still relevant?

2010-03-22 Thread Jari Fredriksson
On 22.3.2010 16:51, micah anderson wrote: On Wed, 17 Mar 2010 14:45:53 -0700, John Rudd jr...@ucsc.edu wrote: Some people need to put in some alternate values for DNS timeouts, but if you've got a local caching name server, you typically don't need that. There aren't any actual bugs in it

Re: My First Spam Mail Today

2010-03-11 Thread Jari Fredriksson
On 11.3.2010 15:18, Carlos Mennens wrote: On Wed, Mar 10, 2010 at 6:04 PM, Martin Gregorie mar...@gregorie.org wrote: Post the entire message to pastebin or a similar site and send the URL here together with your explanation of what happened so we have something to work with. I am sorry I

Re: My First Spam Mail Today

2010-03-11 Thread Jari Fredriksson
On 11.3.2010 16:41, Carlos Mennens wrote: On Thu, Mar 11, 2010 at 9:28 AM, Jari Fredriksson ja...@iki.fi wrote: You still posted not enough data. There is only the headers the link. Here is the entire message: http://pastebin.com/MtXWXdvc That is hard. Only one URL in the body. X-Spam

Re: problem with the Bayesian filter

2010-03-09 Thread Jari Fredriksson
On 9.3.2010 20:24, Curtis MacDuff wrote: My Bayesian filter keeps getting screwed up and causing mail flow to stop. The problem seems to be expiring tokens out of the database. My expiry setting is set to 200,000. I've tried many different settings for this but they all seem to behave about

Re: rules

2010-03-08 Thread Jari Fredriksson
On 8.3.2010 21:33, Renata Dias wrote: Some messages receive score 0.00/0.00 and other receive the correct score like the example below. ... I'm updated SpamAssassin to p5-Mail-SpamAssassin-3.3.0_3 and rules are /var/db/spamassassin/3.003000/ . Can someone help me? You showed a

Re: Spamassassin with Bayes/MySQL

2010-03-05 Thread Jari Fredriksson
On 5.3.2010 17:23, Stephane MAGAND wrote: Hi ok i have put bayes_sql_override_username and now that's work thanks ;=) Another small question, after bayes, can i put AWL in MySQL ? Yes you can, it's all in the doku or wiki. Anyway: --- local.cf -- # Enable awl

Re: error closing STDOUT

2010-03-04 Thread Jari Fredriksson
On 4.3.2010 17:07, Blake101 wrote: Sorry if there is already a tread about this. When trying to send a test message, I get the following error. error closing STDOUT: Broken pipe at /usr/bin/spamassassin line 409. any ideas why I get this Sending a message is an alien concept to

Re: Spam Score

2010-03-04 Thread Jari Fredriksson
On 5.3.2010 0:04, Walter Breno wrote: Hi, i have some problems with false positives so i need that the e-mails with spamassassin score 2 or 3 has being marked as spam but delivered to the user, what is the parameter that can help me with this problem? SpamAssassin does not do anything in order

Re: UPS Delivery problem

2010-03-03 Thread Jari Fredriksson
On 3.3.2010 15:22, twofers wrote: I have 52 of these sitting in my inbox this morning when I came in to work. this is just the beginning. I get literally hundreds of these a day and Spamassassin does not even check them. Thats hundreds of these every day for weeks and weeks and weeks on

Re: UPS Delivery problem

2010-03-03 Thread Jari Fredriksson
On 3.3.2010 15:34, Jari Fredriksson wrote: On 3.3.2010 15:22, twofers wrote: I have 52 of these sitting in my inbox this morning when I came in to work. this is just the beginning. I get literally hundreds of these a day and Spamassassin does not even check them. Thats hundreds

Rationale behind FREEMAIL_ENVFROM_END_DIGIT?

2010-02-20 Thread Jari Fredriksson
I just found this rule in SA 1.6 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (alv.john2[at]gmail.com) What's the rationale? Many FreeMail users end up having a digited username, as the wanted username is reserved. How is it a sign of

Re: Rationale behind FREEMAIL_ENVFROM_END_DIGIT?

2010-02-20 Thread Jari Fredriksson
On 20.2.2010 17:29, LuKreme wrote: On 20-Feb-2010, at 08:21, Jari Fredriksson wrote: I just found this rule in SA 1.6 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (alv.john2[at]gmail.com) What's the rationale? The rational

Re: is bayes learning?

2010-02-19 Thread Jari Fredriksson
On 19.2.2010 12:42, tonjg wrote: Jari Fredriksson wrote: That is not the recipe I meant. That calls SA yes, but does not reject. I can't provide a recipe for procmail as I personally use maildrop, but the recipe that is needed is one filing the spam to a spam folder (or /dev/null

Re: is bayes learning?

2010-02-18 Thread Jari Fredriksson
On 18.2.2010 18:16, tonjg wrote: Matus UHLAR - fantomas wrote: you seem to be running mimedefang which takes care about the e-mail. I have no idea how does mimedefang interact with spamassassin, but I think you should ask your question in mimedefang mailing list, or at least search the

Re: is bayes learning?

2010-02-18 Thread Jari Fredriksson
On 19.2.2010 1:48, Chris wrote: On Thu, 2010-02-18 at 09:59 -0800, tonjg wrote: Jari Fredriksson wrote: How does MimeDefang reject anything if it does not scan it? Your log header sample looked like it was scanned by MimeDefang. Propably MD calls SpamAssassin in it's scan process just like

Re: is bayes learning?

2010-02-18 Thread Jari Fredriksson
On 19.2.2010 1:48, Chris wrote: On Thu, 2010-02-18 at 09:59 -0800, tonjg wrote: Jari Fredriksson wrote: How does MimeDefang reject anything if it does not scan it? Your log header sample looked like it was scanned by MimeDefang. Propably MD calls SpamAssassin in it's scan process just like

Re: How should this tricky spam be filtered?

2010-01-30 Thread Jari Fredriksson
On 30.1.2010 19:14, Ralph Bornefeld-Ettmann wrote: in the Raw Message tab you can get the plain message (http://spamalyser.com/v/5cbffujq/raw) It's not raw message, it has a line number on each row. -- http://www.iki.fi/jarif/ You may be recognized soon. Hide. signature.asc

Debian maintainers online? 3.3.0 availability Q

2010-01-27 Thread Jari Fredriksson
Will the new 3.3 be announced for Lenny (possibly via backports) or do I need to use CPAN? Thanks for info. -- http://www.iki.fi/jarif/ That secret you've been guarding, isn't. signature.asc Description: OpenPGP digital signature

AWL structure for 3.3.0?

2010-01-27 Thread Jari Fredriksson
I'm trying to install it via CPAN or debian deb, so I do not have the sql-readme available. The AWL format changed, can someone post the MySQL desc output please? -- http://www.iki.fi/jarif/ That secret you've been guarding, isn't. signature.asc Description: OpenPGP digital signature

Re: AWL structure for 3.3.0?

2010-01-27 Thread Jari Fredriksson
On 27.1.2010 10:43, Henrik K wrote: On Wed, Jan 27, 2010 at 10:38:38AM +0200, Jari Fredriksson wrote: I'm trying to install it via CPAN or debian deb, so I do not have the sql-readme available. The AWL format changed, can someone post the MySQL desc output please? http://svn.apache.org

Re: SpamAssassin, One Baye for a lot of SpamAssassin server

2010-01-22 Thread Jari Fredriksson
On 22.1.2010 10:53, Mariusz Kruk wrote: On Fri, 2010-01-22 at 19:47 +1100, Jean-Yves Avenard wrote: In a previous post, i have request a information, can i use one central bayes database for a lot of SpamAssassin Server. I have received a answer: Yes But what is the process ? I use a

Re: Spam getting through while SA restarts

2010-01-15 Thread Jari Fredriksson
On 15.1.2010 10:21, geoff.spamassass...@alphaworks.co.uk wrote: I occasionally get a spam leaking through without having been processed by SA despite passing the part of my procmail filtering where SA is called. These spams are always at the time of scheduled SA restarts so I assume they slip

Re: hostkarma false positive

2010-01-11 Thread Jari Fredriksson
On 11.1.2010 10:35, Michael Monnerie wrote: Another FP on hostkarma: bsmtp5.bon.at[195.3.86.187] Please investigate and fix. And put them on YELLOW, they are an ISP here in Austria. Please check bsmtp[1-9] also. Hello. Your PGP key has expired, my software says. Just FYI. --

Re: spamassassin or spamd with amavisd-new?

2010-01-05 Thread Jari Fredriksson
On 5.1.2010 13:09, Angel L. Mateo wrote: Hello, Because FH_DATE_PAST_20XX bug, I have found that when I run spamassassin through amavisd-new (in a postfix server) I need to restart spamassassin and amavisd-new after any change in spamassassin. Debugging this, I found that amavisd-new doesn't

Re: OT: Museum piece...

2009-12-17 Thread Jari Fredriksson
On 16.12.2009 18:15, Benny Pedersen wrote: On ons 16 dec 2009 16:49:52 CET, Charles Gregory wrote On Tue, 15 Dec 2009, Chris Hoogendyk wrote: Marc Perkel wrote: http://www.vintage-computer.com/asr33.shtml There was actually a time when I had one of those in my house. For your amusement:

Re: OT: Museum piece...

2009-12-17 Thread Jari Fredriksson
On 17.12.2009 23:10, Jari Fredriksson wrote: On 16.12.2009 18:15, Benny Pedersen wrote: On ons 16 dec 2009 16:49:52 CET, Charles Gregory wrote On Tue, 15 Dec 2009, Chris Hoogendyk wrote: Marc Perkel wrote: http://www.vintage-computer.com/asr33.shtml There was actually a time when I

Re: Smart Smoker spam sailing past SA scores

2009-12-05 Thread Jari Fredriksson
On 5.12.2009 16:03, LuKreme wrote: On Dec 4, 2009, at 13:42, Jari Fredriksson ja...@iki.fi wrote: Content analysis details: (14.9 points, 5.0 required) 14 of your points come from the IP being listed. It was not listed initially, and score 0.9 on your tests based on that. Really

Re: Smart Smoker spam sailing past SA scores

2009-12-04 Thread Jari Fredriksson
On 4.12.2009 18:00, Thomas Harold wrote: SA had a lot of trouble identifying this as spam. The IP (174.139.37.196) is not yet listed in a lot of the DNSBLs. So it only scored around a 1.0 on the spam meter. http://pastebin.com/m1d0a75b7 It uses a block of foreign language spam at the

Re: HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread Jari Fredriksson
31.10.2009 23:26, Adam Katz kirjoitti: Brilliant minds think alike ;-) I have very similar rules in my khop-general channel: header KHOP_BIG_TO_CC ToCc =~ /(?:[^,\...@]{1,6...@[^,]{4,30},){10,19}/ describe KHOP_BIG_TO_CC Sent to 10+ recipients instaed of Bcc or a list score

Re: How to reject spam where sender = receiver

2009-10-28 Thread Jari Fredriksson
28.10.2009 16:42, Adam Katz kirjoitti: I scored that 0.1 ... rejecting based on sender==recipient would effectively be scoring it far higher, and would most certainly reject legitimate mail (lots of people send announcements via Bcc or Cc while addressing the message back to themselves).

Re: Spam with my company domain

2009-10-28 Thread Jari Fredriksson
28.10.2009 22:07, Jeremy Davila kirjoitti: Hi all, I'm getting Spam which is addressed to another person in my company , but it getting sent to me . So in my inbox the To Field is Kristin , but in Jeremy's inbox. Hello. That is possible, the email is sent to whoever is in the RCPT-TO

Re: Error from sa-update script

2009-10-27 Thread Jari Fredriksson
27.10.2009 23:14, fugtruck kirjoitti: I have an SMTP gateway setup with Postfix+SpamAssassin on a CentOS 5.3 server that is functioning. Lately, I've noticed an increase in the amount of SPAM getting through the gateway. That's when I discovered an error that is showing up daily in the

Re: Spamassassin not tagging some emails

2009-10-23 Thread Jari Fredriksson
23.10.2009 4:52, MySQL Student kirjoitti: Hi, On the message that should have been scanned: The emails that has not been tagged at all: [...] From: Angus - 3idea angus.d...@3idea.com To: supp...@3idea.com Are you forwarding this spam from your internal account to this other

Re: OT: Thunderbird filter

2009-10-23 Thread Jari Fredriksson
23.10.2009 18:26, Adam Katz kirjoitti: Dan Schaefer wrote: The emails being sent to postfix-users-dig...@cloud9.net are messing with my head. I setup a filter to put emails sent to users@spamassassin.apache.org into a SA folder. Whenever an email gets sent to

Re: Spamassassin not tagging some emails

2009-10-23 Thread Jari Fredriksson
23.10.2009 20:04, MySQL Student kirjoitti: Hi, SpamAssassin DOES NOT bypass scanning, if the internal or trusted networks contain the server in it. Hmm.. thanks for correcting me. How would you, then, go about preventing SA from scanning the localhost or a specific domain without

Elena wants an iron cast oven

2009-10-22 Thread Jari Fredriksson
If you have any old portable oven and in case you don't use it anymore, we will be very grateful to you if you can donate it to us and organize transport of this oven to our address (200km from Moscow). This ovens are different, usually they made from cast iron. Dozens of these for months

Re: Elena wants an iron cast oven

2009-10-22 Thread Jari Fredriksson
22.10.2009 22:26, John Hardin kirjoitti: On Thu, 22 Oct 2009, Jari Fredriksson wrote: What's the business model of this scam? I can't believe they really want millions of iron cast ovens from all around the world. Maybe I should answer and ask directly ;D Was the from address something

Re: Elena wants an iron cast oven

2009-10-22 Thread Jari Fredriksson
22.10.2009 23:24, Michael Scheidell kirjoitti: Jari Fredriksson wrote: If you have any old portable oven and in case you don't use it anymore, we will be very grateful to you if you can donate it to us and organize transport of this oven to our address (200km from Moscow). This ovens

Re: Elena wants an iron cast oven

2009-10-22 Thread Jari Fredriksson
22.10.2009 23:39, Benny Pedersen kirjoitti: On tor 22 okt 2009 21:37:28 CEST, Jari Fredriksson wrote The message does not have any attachments, it is a plain text from a poor woman in Russia. how do you know ?, was there picture in the mail ?, if so how can you be sure its hir picture

Re: Mail not scanned

2009-10-21 Thread Jari Fredriksson
21.10.2009 18:40, Lars Ebeling kirjoitti: Why aren't mail from United Parcel Service scanned? The last 24 hours have i got about 20 of them and none scanned. Those are not scanned in *my* system just because they are scanned by amavisd-new before they will be scanned by SA. As they

Re: Pulling my hair out

2009-10-20 Thread Jari Fredriksson
20.10.2009 16:25, jp kirjoitti: As an admin with two years of CS education... I think Spamassassin is one of the easiest programs to get, install, etc.. The documentation on it's tests is great. There's no voodoo like many anti-spam products. Stopping spam is not simple, and there are no

Re: Pulling my hair out

2009-10-20 Thread Jari Fredriksson
20.10.2009 17:27, RW kirjoitti: On Tue, 20 Oct 2009 16:38:14 +0300 Jari Fredriksson ja...@iki.fi wrote: I have tried to compile spamd for cygwin, but could not make it. I would have used it as one spamd instance in my LAN in addition to the working Linux ones, spamd is perl, it's

Re: Problems with high spam

2009-10-20 Thread Jari Fredriksson
20.10.2009 17:44, McDonald, Dan kirjoitti: whitelist_from *...@enerquimica.com whitelist_from should generally be avoided. find out if these senders have published an spf record, or use DKIM signing, then use whitelist_from_spf or whitelist_from_dkim instead of whitelist_from IMO

Re: Pulling my hair out

2009-10-20 Thread Jari Fredriksson
20.10.2009 18:43, RW kirjoitti: On Tue, 20 Oct 2009 18:12:21 +0300 Jari Fredriksson ja...@iki.fi wrote: 20.10.2009 17:27, RW kirjoitti: On Tue, 20 Oct 2009 16:38:14 +0300 Jari Fredriksson ja...@iki.fi wrote: I have tried to compile spamd for cygwin, but could not make it. I would

Re: KHOP_NO_FULL_NAME

2009-10-17 Thread Jari Fredriksson
18.10.2009 2:22, Adam Katz kirjoitti: Jari Fredriksson quoted himself (both on the 17th): I have not yet analysed what whitehats cause this, but this rule seems suspipicious to me at moment. Now I have. Legitimate bulk mailers. From: NYTimes.comnytdir...@nytimes.com From

Re: [SA] sneaky pharma spam shooting past standard rules

2009-10-16 Thread Jari Fredriksson
15.10.2009 22:43, Adam Katz kirjoitti: A score of 6 is FREAKISHLY high, even for something with a very low FP rate. I'd score that around 1.2 if I trusted it. I like it, so I'm throwing it in khop-general as MC_TAB_IN_FROM scoring at 0.6 for now: # @Mike Cappella on sa-users, 20090806

KHOP_NO_FULL_NAME

2009-10-16 Thread Jari Fredriksson
I have not yet analysed what whitehats cause this, but this rule seems suspipicious to me at moment. At the bright side: HOSTKARMA is a pleasant thing to have, now that my config is fixed with the community aid. Email: 1280 Autolearn: 765 AvgScore: 13.53 AvgScanTime: 11.23 sec Spam: 632

Re: KHOP_NO_FULL_NAME

2009-10-16 Thread Jari Fredriksson
17.10.2009 3:12, Jari Fredriksson kirjoitti: I have not yet analysed what whitehats cause this, but this rule seems suspipicious to me at moment. Now I have. Legitimate bulk mailers. From: NYTimes.com nytdir...@nytimes.com From: Iltalehti.fi iltalehti-288-d690018e-1000350

Re: Hostkarma whitelist needs something.. (No more; SOLVED)

2009-10-15 Thread Jari Fredriksson
15.10.2009 8:48, Jari Fredriksson kirjoitti: iki.fi is a famous Finnish email forwarding service and as such should be added as internal_networks, if you are using it. Things like this are hard to know unless you really understand TruthPaths.. All right. I removed internal_networks which

Date in report safe page

2009-10-15 Thread Jari Fredriksson
It seems that SpamAssassin attaches the Date header from the original (attached) email when it creates the announcement email. Would it be better to create a new current Date for the new email? The idea here is to fix forged Date, as it often is. I sort my mail with Date, and hate when the

Re: sneaky pharma spam shooting past standard rules

2009-10-15 Thread Jari Fredriksson
15.10.2009 18:38, Jason Haar kirjoitti: I just received what appeared to be a standard certain north american country pharma spam that went straight by rules I have that normally catch it. Within Thunderbird (and any other HTML-capable MUA) it's blatantly shouting its wares. Clever usage of

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 19:17, R-Elists kirjoitti: All I can say is that if these numbers were real or typical I would be out of business. perkel, i might be wrong, yet it doesnt appear to me that Jari have enough mail volume to have a reasonable statistical base... - rh You are not wrong,

Re: DCCPROC and / or DCCIFD

2009-10-14 Thread Jari Fredriksson
14.10.2009 19:52, Rick Knight kirjoitti: Eduardo Casarero wrote: 2009/10/14 Rick Knight rick_kni...@rlknight.com mailto:rick_kni...@rlknight.com With the help of people here, I have gotten DCCIFD working. Now I have another question. Should I use DCCIFD with DCCPROC or instead of DCCPROC?

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 20:33, Rick Knight kirjoitti: Jari, How did you produce the great looking statistics? Thanks, Rick It's a perl script called sa-stats.pl I tried not google it for you, but could not find the original. Many scripts with the same name though.. I put that to my server as

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 20:50, Jari Fredriksson kirjoitti: which works for me (Debian), the script not runs without arguments. *now* runs. (s/not/now/g) -- http://www.iki.fi/jarif/ Q: How many WASPs does it take to change a light bulb? A: One. pgpEguqewsBA6.pgp Description: PGP signature

Re: dns query timed out while sa-update

2009-10-14 Thread Jari Fredriksson
14.10.2009 20:51, Karsten Bräckelmann kirjoitti: On Wed, 2009-10-14 at 13:44 -0400, Terry Carmen wrote: Karsten Bräckelmann wrote: However, the single point of failure is your router -- assuming you actually are using its DNS. It's entirely possible his ISP is intercepting his DNS

Re: dns query timed out while sa-update

2009-10-14 Thread Jari Fredriksson
14.10.2009 20:57, Jari Fredriksson kirjoitti: If I'm not mistaken, it is always good to run a local nameserver when using SpamAssassin anyway, and not use any router for that. This is how I have it, I have a local bind, and OpenDNS as forwarders. And a special zone like

Re: dns query timed out while sa-update

2009-10-14 Thread Jari Fredriksson
14.10.2009 21:48, Benny Pedersen kirjoitti: On Wed 14 Oct 2009 07:57:35 PM CEST, Jari Fredriksson wrote This is how I have it, I have a local bind, and OpenDNS as forwarders. dont put all eggs in one basket :) (remove opendns forwards in bind) after i learned bind more i found that its

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 21:49, Mike Cardwell kirjoitti: Jari Fredriksson wrote: Jari, How did you produce the great looking statistics? Thanks, Rick It's a perl script called sa-stats.pl I tried not google it for you, but could not find the original. Many scripts with the same name though.. I put

Re: symlink for spamassassin directory

2009-10-14 Thread Jari Fredriksson
14.10.2009 22:45, Bowie Bailey kirjoitti: I have several virtual users and I want them to all use the same Bayes DB (and user_prefs, etc). The are all using the same UID/GID. Is it safe to make all of the $HOME/spamassassin directories symlinks to a common directory? I can't think of a

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 23:55, Rick Knight kirjoitti: Jari Fredriksson wrote: 14.10.2009 21:49, Mike Cardwell kirjoitti: Jari Fredriksson wrote: Jari, How did you produce the great looking statistics? Thanks, Rick It's a perl script called sa-stats.pl I tried not google it for you, but could

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 23:55, Rick Knight kirjoitti: Jari, Thanks again for putting the script up. I found the original site and downloaded the 3.1 version. In the instructions it says If your top 5 does not contain URIBL_BLACK, see http://www.uribl.com/usage.shtml;. On my system URIBL_BLACK is number

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 0:21, Rick Knight kirjoitti: Here's the url for the newer version http://www.rulesemporium.com/programs/sa-stats-1.0.txt;. It's not newer, it's exactly the same version, without or later additions. Please to not reply to my INBOX, I get confused. My Thunderbird sees your

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 0:42, Rick Knight kirjoitti: Jari Fredriksson wrote: 15.10.2009 0:21, Rick Knight kirjoitti: Here's the url for the newer version http://www.rulesemporium.com/programs/sa-stats-1.0.txt;. It's not newer, it's exactly the same version, without or later additions. Please

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 6:41, Adam Katz kirjoitti: Karsten Bräckelmann wrote: 3.0 RCVD_IN_BRBL_RELAY RBL: received via a relay rated as poor by Barracuda [187.10.243.78 listed in bb.barracudacentral.org] Hmm, a different IP. ... Any chance your internal and

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 4:33, Karsten Bräckelmann kirjoitti: On Thu, 2009-10-15 at 02:44 +0300, Jari Fredriksson wrote: -1.0 RCVD_IN_HOSTKARMA_WRBL: HostKarma: relay in white list (first pass) [212.16.98.53 listed in hostkarma.junkemailfilter.com] $ host 212.16.98.53

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 3:37, Marc Perkel kirjoitti: TOP HAM RULES FIRED -- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM -- 1 RCVD_IN_JMF_W 1115 6.88 0.06 74.98 This

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 8:29, Henrik K kirjoitti: On Thu, Oct 15, 2009 at 03:33:54AM +0200, Karsten Bräckelmann wrote: On Thu, 2009-10-15 at 02:44 +0300, Jari Fredriksson wrote: -1.0 RCVD_IN_HOSTKARMA_WRBL: HostKarma: relay in white list (first pass) [212.16.98.53 listed

Hostkarma whitelist needs something..

2009-10-12 Thread Jari Fredriksson
Email: 911 Autolearn: 603 AvgScore: 13.10 AvgScanTime: 12.16 sec Spam: 462 Autolearn: 414 AvgScore: 33.17 AvgScanTime: 10.80 sec Ham:449 Autolearn: 189 AvgScore: -7.55 AvgScanTime: 13.55 sec Time Spent Running SA: 3.08 hours Time Spent Processing

Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
This looks worrying. I have it at 2.2 pts, and not caused any false positives, but still, odd. Or is it? I know it is a SPAM indicator but a bulk indicator. But it is triggered for example by some mailing list posts which are genuine and not bulk. Is someone trying to poison DCC? sa-stats:

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
Auto correct: That should be 'I know it is *not* a spam indicator but a bulk indicator.' Correct ;) You have to whitelist the mailing list in the dcc whiteclnt file. Ok, have to learn something new here. I have whiteclnt now in my vi as a starting point. Thanks all for your

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
Auto correct: That should be 'I know it is *not* a spam indicator but a bulk indicator.' Correct ;) You have to whitelist the mailing list in the dcc whiteclnt file. Ok, have to learn something new here. I have whiteclnt now in my vi as a starting point. Thanks all for your

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
Is someone trying to poison DCC? Yes, you are(:-) If you haven't whitelisted the mailing list then you are reporting the email from the mailing list to DCC, which will increase the DCC count. Me? But I do report to DCC/Razor2/SpamCop only spam. I do not report ALL my email.

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
From: Jari Fredriksson ja...@iki.fi Date: Fri, 9 Oct 2009 19:25:15 +0300 Is someone trying to poison DCC? Yes, you are(:-) If you haven't whitelisted the mailing list then you are reporting the email from the mailing list to DCC, which will increase

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
DCC identifies mail that has been sent often. That's what the rule checks for, if other recipients have seen it, too. You voluntarily installed DCC, knowing SA will use it. This was on your discretion, and it's your duty to evaluate if it actually is, what you want. [1] Once, mind

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
Thank you all guys, on list and especially off list.. You know who you are. Thanks. I Put this to the list because I have certain difficulties to write a letter to each of you separately. Thanks.

Re: Subject Rewrite Based on Score

2009-10-08 Thread Jari Fredriksson
Spamassassin Version 3.2.5 I am curious if it is possible to rewrite the subject based on the value of the score. A example of this would be if a score of 4.0 was given the subject would state [Potential Spam], but if it was 5.0-10.0 then it is [SPAM] if it was greater then 10.0 it would

Re: Low score? Recommendations?

2009-10-05 Thread Jari Fredriksson
Keep getting similar obvious (to me) spam - tuning recommendations? My threshold is torqued down to 3.5 X-Spam-Level: * X-Spam-Status: No, score=1.1 required=3.5 tests=BAYES_50,RAZOR2_CHECK, SPF_HELO_PASS,US_DOLLARS_3 autolearn=no version=3.2.4 Please don't send spam to the list.

Re: OT bad news

2009-10-05 Thread Jari Fredriksson
We have been running Spamassassin for maybe eight years now. But, my coworkers do not like OpenSource. So they have finally complained enough that my boss is going to replace our reliable FreeBSD/Spamassassin boxes. They are planning on purchasing something that runs ON Exchange. What a

Daily statistics into email

2009-10-02 Thread Jari Fredriksson
Some just mentioned sa-stats.pl statistics, and I then wrote a script for me to post daily stats for me into email. This is not nuclear science, but I still share it. It is HTML formatted because I use Outlook Express to read mail, but it is easy to fix The file is named so that it runs

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
On Fri, 2009-10-02 at 20:45 +0300, Jari Fredriksson wrote: Sendmail command is available with sendmail and postfix emailers, dunno about others. You don't need to use sendmail: if the cron job writes anything to stdout (or stderr) this is automatically mailed to root. If you'd rather

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
http://ruleqa.spamassassin.org/ If you are capable of processing your mail nightly in cron, why don't you join the nightly mass check? You can help to test the rules and make the sa-update channel better. We especially need non-English ham in the nightly masscheck.

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
http://ruleqa.spamassassin.org/ If you are capable of processing your mail nightly in cron, why don't you join the nightly mass check? You can help to test the rules and make the sa-update channel better. We especially need non-English ham in the nightly masscheck.

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
On Fri, 2009-10-02 at 21:33 +0300, Jari Fredriksson wrote: On Fri, 2009-10-02 at 20:45 +0300, Jari Fredriksson wrote: Sendmail command is available with sendmail and postfix emailers, dunno about others. You don't need to use sendmail: if the cron job writes anything to stdout

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
On Fri, 2009-10-02 at 23:28 +0300, Jari Fredriksson wrote: There is a blank line between Content-Type and Hello, but the Content-Type line WILL get to the body, and the html gets injected after it as raw html code, not as html (because the actual content type will be text not html). Cron

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
On Sat, 2009-10-03 at 00:03 +0300, Jari Fredriksson wrote: This is something that I have no knowledge. It was a surprise to me too! Could you see the source format of the mail? I can't think anything except it being in HTML format, as there is no AFAIK no other formats for rich text

Re: Understanding the hostKarma Lists

2009-09-29 Thread Jari Fredriksson
It seems that people have already been using the rules copied from your site. It will be confusing to them if we change the official name. Some will accidentally have your lists twice. RCVD_HOSTKARMA_BL Black RCVD_HOSTKARMA_WL White RCVD_HOSTKARMA_YL Yellow RCVD_HOSTKARMA_BR Brown

Re: Understanding the hostKarma Lists

2009-09-29 Thread Jari Fredriksson
On tir 29 sep 2009 23:30:15 CEST, Warren Togami wrote Could you please decide between the existing JMF rule names or the above proposed HOSTKARMA names? It seems opinions are split here. let it be the long names that loose ? ironical you wanted to be shurt names but created a longer

Re: Report in header of SPAM emails

2009-09-25 Thread Jari Fredriksson
Hello if I restarted the spamd You need more words when communicating ;) Does this mean the report still does not show up, even if you restarted SA after the setting? Well. SpamAssassin does not have a Quarantine. Something in your system has, and that is what is calling the

Re: Do I need to do anything to maintain MySQL?

2009-09-24 Thread Jari Fredriksson
I ran this command: ALTER TABLE bayes_seen ADD lastupdate timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP; It chugged for ~1.5N rows and the result is that all of the lastupdate fields have a value of 0's. All new lastupdate columns get set to the current time

Re: Report in header of SPAM emails

2009-09-24 Thread Jari Fredriksson
dears Srs, I have added the option report_safe 1, but the mail deposited in the quarantine folder not have any attached and SA report Do not use the amavis, if not the simscan Did you restart Spamd after the change?

Re: Two more SA/MySQL questions.

2009-09-24 Thread Jari Fredriksson
24.9.2009 21:55, Kris Deugau wrote: Steven W. Orr wrote: The questions is this: I thought that InnoDB was going to consume *more* resources because the purpose of it was to support transactions. Am I wrong? If I convert to a higher rev of MySQL and get InnoDB will I get *better*

Re: Two more SA/MySQL questions.

2009-09-24 Thread Jari Fredriksson
24.9.2009 23:57, LuKreme kirjoitti: On 24-Sep-2009, at 13:46, Jorn Argelo wrote: Using InnoDB is absolutely vital and you cannot use MyISAM at all from my experience. My bayes_token table is 12 million rows and increasing every day, and performance is still just fine. Is there a

Re: Do I need to do anything to maintain MySQL?

2009-09-23 Thread Jari Fredriksson
On 23.09.09 00:04, Steven W. Orr wrote: Every so often, I see some large MySQL accesses taking place from SA. Is there any regular maintenance needed or should I just leave it alone? It depends on what you use mysql for. IF you store bayes and AWL databases there, you need bayes

Re: After moving mailserver to another box three rules dont work

2009-09-23 Thread Jari Fredriksson
Hi out there, Sep 22 15:17:17 web14 amavis[21065]: SA info: config: failed to parse line, skipping, in /etc/mail/spamassassin/teltarifregeln.cf: rawbodyfull X_SMALLFONTLONGTEXT /FONT\\s+(FACE=[^]*\\s)?size=?1?(br|p|\\/p|[^]|\\r|\\n){160}/is but all this rules worked fine on the old

<    1   2   3   4   5   6   7   >