Re: Worthwhile to scan outgoing?

at an early stage. - several checks in exim. - spamassassin which only get into the action after the email has passed the first filters. Regards Johann -- Johann Spies Telefoon: 021-808 4599 Informasietegnologie, Universiteit van Stellenbosch "What? know ye not that your bod

Re: Whitelist on List-ID

On Thu, Jan 21, 2010 at 09:08:05PM -0700, LuKreme wrote: > You shouldn't be sending ANY mailinglists through SpamAssassin. Why not? A lot of mailing lists are used by spammers. Regards Johann -- Johann Spies Telefoon: 021-808 4599 Informasietegnologie, Universiteit van Stel

Re: Googlegroups related spam

_GOOGLEGROUPS_15 Contains a suspicious googlegroups URI. > scoreNN_GOOGLEGROUPS_15 2 > > > /Per Jessen, Zürich Thanks. To me it is special to get help from Zürich. I have a daughter and son staying there. Regards Johann (Stellenbosh, South Africa) -- Johann Spies T

Re: Googlegroups related spam

sword 'tydelik'. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Peace I leave with you, my peace I give unto you; not as the world giveth, give I unto you. Let not your heart be troub

Googlegroups related spam

. But you can't do that on 20 emails per day and I am not sure how to handle such a process from exim. I am sure I am not the only one having to deal with this kind of spam. How do you counter it? Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Univers

Re: spam bypass spamassassin

:21 - > X-Spam-Status: Yes, score=5.1 required=5.0 > X-Spam-Level: + It did not bypass Spamassassin. Spamassassin did it's job by classifying the message as spam. The rest is up to your mta. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie,

Re: imeout-problem - additional information

100k to spamassassin, had a clear effect on the timeouts. Since that change in the configuration - about 18 hours ago, there was not one timeout. It seems that the newer version of Spamassassin handles large messages less efficiently than the older version. Regards Johann -- Johann Spies

Re: imeout-problem - additional information

o separate each message's debug info from the combined > debug log). What parts of the scanning process are taking the most > amount of time? I will do that. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch &quo

Re: imeout-problem - additional information

Hello Daryl, Thanks for your reply. On Fri, Mar 07, 2008 at 02:23:13PM -0500, Daryl C. W. O'Shea wrote: > On 05/03/2008 5:44 AM, Johann Spies wrote: > > On Thu, Feb 28, 2008 at 02:44:02PM +0200, Johann Spies wrote: > >> On a new mailserver with 8Gb ram and 2xdual-co

Re: prefork: child states: BBBBBBB

encing the same from time to time and nobody has tried to answer my questions about it. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Go ye therefore, and teach all nations, baptizing them in the name of the Fa

Re: timeout-problem - additional information

On Thu, Feb 28, 2008 at 02:44:02PM +0200, Johann Spies wrote: > On a new mailserver with 8Gb ram and 2xdual-core CPU's we get regular > messages in the log: > > Feb 28 12:52:43 mail2 spamd[32558]: prefork: child states: BIBBB > Feb 28 12:52:44 mail2 spamd[459]: rules: fail

timeout-problem

r-home-dir" Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "These things have I written unto you that believe on the name of the Son of God; that ye may know that ye have eternal life, and that ye may believe

Re: Greeting card

a greeting ecard from a Colleague! > Since we started using Clamav most (almost all) of those spam are refused. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Have not I commanded thee? Be strong and of a good

Re: PDFInfo plugin with SA 3.1.7

eed to > modify some bits of the first few lines (down to the rsync binary location): The script I have downloaded also do some testing. I think the reason why those files were not unzipped was that the script was looking for the unzipped files before finishing it's task. It is working now a

Re: PDFInfo plugin with SA 3.1.7

2 15:05 MSRBL-Images.hdb -rw-r--r-- 1 clamav clamav 228436 2007-07-12 15:05 MSRBL-SPAM.ndb -rw-r--r-- 1 clamav clamav 180868 2007-07-12 10:26 phish.ndb.gz -rw-r--r-- 1 clamav clamav 115449 2007-07-12 10:26 scam.ndb.gz Regards Johann -- Johann Spies Telefoon: 021-808 4

Re: Is Bayes Dead? Have the spammers won?

- so I disabled it on the one server I was trying it out. The result is more image spam. Maybe it is time to rebuild the bayesian database with "clean" spam excluding image spam and a lot of ham messages. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie,

Re: HAM and SPAM mailboxes

e diretory from where it can be processed. At the moment the directories are hardcoded but I can adapt it for more generic situations there is a need for. If someone is interested, let me know and I will try and make it available. Regards Johann -- Johann Spies Telefoon: 021-8

Re: Problem synchronizing database of two spamassassins

amd are running? Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Jesus said unto her, I am the resurrection, and the life; he that believeth in me, though he were dead, yet shall he live." John 11:25

mcafee-spamassassin-rules

there version of spamassassin to do so? Would that be advisable? Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "If a man abide not in me, he is cast forth as a branch, and is withered; and men gather them

FuzzyOcrPlugin with 3.0.3?

Can I use this plugin with Spamassassin 3.0.3? Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch

Re: Running on Debian stable

il.info like this: Aug 23 13:17:48 mail2 spamd[23582]: child processing timeout at /usr/sbin/spamd line 1086, and this coincided with entries in /var/log/exim4/paniclog: spam acl condition: cannot parse spamd output Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnolo

Re: Exim: spam acl condition: cannot parse spamd output (more information)

On Wed, Aug 23, 2006 at 02:28:38PM +0200, Johann Spies wrote: > I have just upgraded my Spamassassin on Debian Stable to 3.1.3 > (backports) from 3.0.3 and I get this message in Exim's paniclog: > > spam acl condition: cannot parse spamd output At the same time the /var/l

Exim: spam acl condition: cannot parse spamd output

condition = ${if <{$message_size}{100k}{1}{0}} condition = ${if >{$spam_score_int}{80}{1}{0}} log_message = SPAM: Message viewed as spam. (scored $spam_score) Any idea what is causing this? Regards Johann -- Johann Spies Telefoon: 021-808 4036

Re: Bug in sa-learn (Debian :3.0.3-2sarge1)

ds Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Look not every man on his own things, but every man also on the things of others."Philippians 2:4

Bug in sa-learn (Debian :3.0.3-2sarge1)

) { + dbg ("html: failed to enable UTF-8 mode (perl ver $] h:p ver $HTML::Parser::VERSION)"); +} + } + $self; } How do I solve this? Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Be not de

Re: BAYES_99 makes lots of false-positive

he phrase that SA has learned? some key phrases, words > in the spam mails? If so, can I see some chinese phrases? Do you use chinese emails to "feed" the spamfilter both ham and spam regularly? That would probably be the best way to improve the accuracy of the Bayesian filter. Regard

Re: Which Operating Systems Do You Use and Why?

operating system. And by the way, we use Debian here. Regards. Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "But seek ye first the kingdom of God, and his righteousness; and all these things shall be added unto you." Matthew 6:33

Re: SA scores

a score, >without writing SA header inside it spamc -R < mail.txt Regars Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Trust in the Lord with all your heart and lean not on your own understanding; in all

Re: SORBS unreasonable: Accusation retracted

onable: Apparently the owner(s) of the spesific mailing list populated the list with names harvested from the internet. Apologies to SORBS. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "All we like sheep have gone as

SORBS unreasonable

bers of this list handle situations like that? Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "All we like sheep have gone astray; we have turned every one to his own way; and the LORD hath laid on him the iniquity of us all." Isaiah 53:6

Re: SpamdForkScaling error

erl/5.8.7/Mail/SpamAssassin/SpamdForkScaling.pm line > > 554. > > Nov 21 17:33:20 mail last message repeated 7 times Who is the owner of "spamd" ? Does that owner have all the necessary permissions to write in the directory where spamd wants to work? Regards Johann -- Johan

Re: SpamCop listing internal hotmail servers?

y relay email, was poorly setup as an open relay and this server had indeed been used by spammers to send out some 2+ emails per day for a day or three. So I am grateful to Spamcop helping us to identify a problem that could cause us serious problems if it went on undetected. Regards Johann --

The owner of the spamd-process

=spamd SNAME=spamassassin DESC="SpamAssassin Mail Filter Daemon" PIDFILE="/var/run/$NAME.pid" PNAME="spamd" Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "My son, do not despise the LORD's disci

Re: memory-usage going BOOM

md-child when it grows bigger than 200 bytes in memory: ps flax | grep [s]pamd | \ awk '{if($7 > 200) print "kill " $3}' | /bin/sh It seems to work. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosc

Re: Whitelising IP's?

On Tue, Feb 22, 2005 at 07:30:26AM -0600, Larry Rosenman wrote: > Johann Spies wrote: > > On Fri, Feb 18, 2005 at 11:02:15AM -0500, Chris Santerre wrote: > >> > >> Absolutely! But without knowing how you are blocking, I can't say > >> anymore. > >

Re: Whitelising IP's?

On Fri, Feb 18, 2005 at 11:02:15AM -0500, Chris Santerre wrote: > > Absolutely! But without knowing how you are blocking, I can't say anymore. I am using exim4 with exiscan and refuse to accept mail identified as spam. Regards Johann -- Johann Spies Telefoon: 0

Whitelising IP's?

elisting? Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "All we like sheep have gone astray; we have turned every one to his own way; and the LORD hath laid on him the iniquity of us all." Isaiah 53:6

Thanks - Re: Less spam blocked with 3.02 - AWL-related?

5.996.65 mail3 6.285.385.776.80 This is more like the pattern I was seeing with 2.63/2.64. My next step would be to write something that would analyse my logs to see exactly what the rules are doing - and to try razor. Regards Johann -- Johann Spies Telefoon: 021-80

Re: Less spam blocked with 3.02 - AWL-related?

Thanks! I am learning every day. Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "For by him were all things created, that are in heaven, and that are in earth, visible and invisible, whether they be throne

Re: Less spam blocked with 3.02 - AWL-related?

or). They will hit on a lot of spam. For > me at least, Razor the second best test after Bayes. > Thanks. I have not used Razor in the past because I was cautious to stretch my resources too far. I will probably try it out now. Thank you for taking the trouble to help me. Regards Johann -

Re: Less spam blocked with 3.02 - AWL-related?

n NS record query on anything but a domain name.. ie: there > is no ns record for xanadu.evi-inc.com or 208.39.141.94, but there is an NS > record for evi-inc.com. The reason being xanadu is a host, not a domain. You have convinced me. I clearly did not understand the documentation correc

Re: Less spam blocked with 3.02 - AWL-related?

score so far=-3.408 debug: running header regexp tests; score so far=-3.408 debug: running body-text per-line regexp tests; score so far=-3.408 debug: running uri tests; score so far=-3.408 debug: running raw-body-text per-line regexp tests; score so far=-3.408 debug: running full-text regexp tests; score

Re: Less spam blocked with 3.02 - AWL-related?

ing any configuration. Thanks for your commentary. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Make a joyful noise unto the LORD, all ye lands. Serve the LORD with gladness; come before his presence with

Less spam blocked with 3.02 - AWL-related?

nd are trained with the same spam/ham on a nearly daily basis. I am suspecting AWL to be the culprit but I am not sure how to determine it other than switching it of for a period. Any commentary? Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universite

Re: Bayes questions

plays no part in the auto-learn decision. Yes you can feed it to sa-learn - should if it is spam. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Come now, and let us reason together, saith the LORD; though y

Re: 3.02 on Debian Woody?

On Thu, Jan 20, 2005 at 03:12:44AM -0700, Bob Proulx wrote: > Johann Spies wrote: > > Mail-Followup-To: Johann Spies <[EMAIL PROTECTED]>, > > users@spamassassin.apache.org, > > [EMAIL PROTECTED] > > Please pick only one of these two aliases to t

Re: 3.02 on Debian Woody?

On Wed, Jan 19, 2005 at 10:48:18PM -0900, John Andersen wrote: > On Wednesday 19 January 2005 10:44 pm, Johann Spies wrote: > > I could only get the network tests to work after installing  Net::DNS > > using CPAN.  I would prefer however to do it the Debian way. > > CPAN is

Re: 3.02 on Debian Woody?

On Wed, Jan 19, 2005 at 10:48:18PM -0900, John Andersen wrote: > On Wednesday 19 January 2005 10:44 pm, Johann Spies wrote: > > I could only get the network tests to work after installing  Net::DNS > > using CPAN.  I would prefer however to do it the Debian way. > > CPAN is

Re: 3.02 on Debian Woody?

tests does not seem to be working... I will now try the dh-make-perl option suggested by others. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Neither is there salvation in any other; for there is none other n

3.02 on Debian Woody?

using CPAN. I would prefer however to do it the Debian way. Is there a way to get this working using Debian packages? And which packages should be installed then? Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Ne

Re: Training byessian filter in a gatway situation.

llect the "nuwespam" and "ham" folders on a daily basis and feed them to sa-learn. >From time to time I select ham message from emails I receive to save to the "ham" folder because the feedback I get from users are normally more spam than ham. Regards Johann -- Joh

Re: Catching Windows executables as attachments

ime = com:vbs:bat:pif:scr:exe Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "Draw near to God and he will draw near to you. Cleanse your hands, you sinners; and purify your hearts, you double minded."