Spamd logs

2007-05-10 Thread Nigel Frankcom
Hi All, I saw the mention earlier about spamd logs and thought I'd check mine. In 12 hours it has achieved the impressive, if very worrying size of 1.8 Gb. A check back over the last few days show similarly sized logs. My system lint's clean. and sa-compile ran fine after I removed the rules

Re: Spamd logs

2007-05-10 Thread Nigel Frankcom
On Thu, 10 May 2007 12:01:53 +0100, Nigel Frankcom [EMAIL PROTECTED] wrote: Hi All, I saw the mention earlier about spamd logs and thought I'd check mine. In 12 hours it has achieved the impressive, if very worrying size of 1.8 Gb. A check back over the last few days show similarly sized logs

Re: Spamd logs

2007-05-10 Thread Nigel Frankcom
On Thu, 10 May 2007 12:28:31 +0100, Nigel Frankcom [EMAIL PROTECTED] wrote: On Thu, 10 May 2007 12:01:53 +0100, Nigel Frankcom [EMAIL PROTECTED] wrote: Hi All, I saw the mention earlier about spamd logs and thought I'd check mine. In 12 hours it has achieved the impressive, if very worrying

Re: Spamd logs

2007-05-10 Thread Nigel Frankcom
On Thu, 10 May 2007 12:39:51 +0100, Nigel Frankcom [EMAIL PROTECTED] wrote: On Thu, 10 May 2007 12:28:31 +0100, Nigel Frankcom [EMAIL PROTECTED] wrote: On Thu, 10 May 2007 12:01:53 +0100, Nigel Frankcom [EMAIL PROTECTED] wrote: Hi All, I saw the mention earlier about spamd logs and thought I'd

SpamAssassin 3.2.0 and ImageInfo.pm

2007-05-03 Thread Nigel Frankcom
Hi All, Is anyone else that uses ImageInfo.pm getting the following errors after updating to 3.2.0? I've tried upgrading ImageInfo with no difference. I'm going to try upgrading the Perl modules now to see if any of those are out of date. [3168] warn: Subroutine new redefined at

Re: Mail Lost? How can this happen?

2007-04-27 Thread Nigel Frankcom
It won't be SA doing the deleting. SA does nothing with email except scan and add the headers (if so set). What happens to the mail before and after is entirely down to your mail prog. You can't bounce a message from SA, nor can you delete a message from SA; all you can do is scan it and add

Re: Need help finding an old rule making page.

2007-04-06 Thread Nigel Frankcom
On Fri, 6 Apr 2007 12:13:03 -0700, Josh Graham [EMAIL PROTECTED] wrote: Last year there was this page I had bookmarked that was basically a php form where you enter criteria and it would output Spamassassin rules for you. I lost all my bookmarks when a flash drive died, does anyone know of the

Re: KAUF-TIPP DER WOCHE spam getting through

2007-03-28 Thread Nigel Frankcom
On Wed, 28 Mar 2007 11:40:53 +0300, Panagiotis Christias [EMAIL PROTECTED] wrote: Hello, the last days we get a lot of spam like this: spam body begins here Words disputed interview galli provisions raise, eyebrows dead holders! KAUF-TIPP DER WOCHE LESEN SIE DIE NACHRICTEN

Anyone else seeing a large rise in spam?

2007-03-24 Thread Nigel Frankcom
Hi All, As per the title, I'm seeing a pretty big rise this last week. So far this week has seen the most spam I've ever had to deal with in over 10 years. RBLs and SA are catching more, as is greylisting. That said, yesterday saw double my 'usual' amount of spam. Though it's been creeping up

Re: Anyone else seeing a large rise in spam?

2007-03-24 Thread Nigel Frankcom
On Sat, 24 Mar 2007 05:48:49 -0700, Loren Wilton [EMAIL PROTECTED] wrote: Spam's been down for me for the last week or two. I suspect is it shifting patterns more than an actual change. Loren AKA - I'm getting all your spam now? :-D

Re: [OT] How to deal with SPF_FAIL ?

2007-03-21 Thread Nigel Frankcom
On Wed, 21 Mar 2007 13:12:27 -0700, Jo Rhett [EMAIL PROTECTED] wrote: On Mar 6, 2007, at 11:45 AM, Raul Dias wrote: I was thinking about adding spf checking support directly in the MTA. This would allow messages that fail spf to be instantly blocked. Bad idea, and not recommended even by the

Re: Custom Rule to catch this

2007-03-08 Thread Nigel Frankcom
On Thu, 08 Mar 2007 03:24:20 +, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Hi, I searched the list and found this rule to catch URL with single space (www.ledrx .com). Please help me in modifying this rule to catch URL with double space (www.superveils . com). body URL_WITH_SPACE

Regex Question

2007-03-03 Thread Nigel Frankcom
Hi All, I've recently invested in some books and software to help me figure out what I *thought* I already knew pretty well (regex). As was pointed out by a kind list member, there are various 'flavours' of regex. Can anyone tell me which particular flavour I'm best concentrating on for SA rules?

Rule Regex Question.

2007-02-26 Thread Nigel Frankcom
Hi All, Can anyone tell me if I need to escape the characters within the square braces in the following? body NF_REM_CHAR1 /remove [*%!+`£$%^()_-=#~]/i score NF_REM_CHAR1 4.0 describe NF_REM_CHAR1 remove chars for URL spams TIA Nigel

Re: Undefined subroutine Mail::SpamAssassin::Plugin::DBI::dbi

2007-02-24 Thread Nigel Frankcom
On Sat, 24 Feb 2007 22:45:51 +0100, Michael Monnerie [EMAIL PROTECTED] wrote: On Dienstag, 20. Februar 2007 06:45 Michael Parker wrote: Persistent DBI connections. I use it, it worked well until SA 3.1.7, I just updated via CPAN to 3.1.8, and now I get the same error message # sa-update

Re: Undefined subroutine Mail::SpamAssassin::Plugin::DBI::dbi

2007-02-24 Thread Nigel Frankcom
On Sat, 24 Feb 2007 23:33:26 +, Nigel Frankcom [EMAIL PROTECTED] wrote: On Sat, 24 Feb 2007 22:45:51 +0100, Michael Monnerie [EMAIL PROTECTED] wrote: On Dienstag, 20. Februar 2007 06:45 Michael Parker wrote: Persistent DBI connections. I use it, it worked well until SA 3.1.7, I just

Re: complete false hits for BASE64 and LW_STOCK_SPAM4

2007-02-22 Thread Nigel Frankcom
Could the next person passing the record player give it a jolt? It seems to be stuck on the same track... and I wasn't too keen on this track the 1st few times I heard it either ;-D

Re: Startting spamassassin

2007-02-10 Thread Nigel Frankcom
On Sat, 10 Feb 2007 16:44:16 +, Mário Gamito [EMAIL PROTECTED] wrote: Hi, I've just installed spamassassin. I'ts been a long time since i've installed the last mail server and i never used version 3. Ok, i've compiled it and copied spamd to /etc/init.d If i just run ./spamd start, it

Re: Startting spamassassin

2007-02-10 Thread Nigel Frankcom
Nigel Frankcom wrote: On Sat, 10 Feb 2007 16:44:16 +, Mário Gamito [EMAIL PROTECTED] wrote: Hi, I've just installed spamassassin. I'ts been a long time since i've installed the last mail server and i never used version 3. Ok, i've compiled it and copied spamd to /etc/init.d If i

Re: A New Approach: Find the Ham

2007-02-10 Thread Nigel Frankcom
On Sat, 10 Feb 2007 20:52:17 +0100, Giampaolo Tomassoni [EMAIL PROTECTED] wrote: From: Dan [mailto:[EMAIL PROTECTED] I've developed a new approach to scoring that I want to 1) share with everyone and 2) make into a working system thats as accurate as what I've already built, but easier

Re: A New Approach: Find the Ham

2007-02-10 Thread Nigel Frankcom
On Sat, 10 Feb 2007 15:14:56 -0500, Miles Fidelman [EMAIL PROTECTED] wrote: Dan wrote: I've developed a new approach to scoring that I want to 1) share with everyone and 2) make into a working system thats as accurate as what I've already built, but easier to use. First, the theory: NEW

Re: Nuisance stock spams

2007-02-08 Thread Nigel Frankcom
On Thu, 08 Feb 2007 14:46:31 +0530, Ramprasad [EMAIL PROTECTED] wrote: The stock spams are getting obfuscated to extreme lengths. This mail went clean thru spamassassin. All it got hit were my custom rules where I score mails containing companies mentioned in stock spam ( risky but no

Re: TVD_SILLY_URI_OBFU

2007-02-05 Thread Nigel Frankcom
On Mon, 5 Feb 2007 13:03:08 -0500 , Bowie Bailey [EMAIL PROTECTED] wrote: Nigel Frankcom wrote: On Sat, 03 Feb 2007 07:15:39 +, Nigel Frankcom [EMAIL PROTECTED] wrote: body Test_01 /remove \\*|\%|\!\/i score Test_01 4.0 describe Test_01 Test remove asterisk for URL spams

Re: TVD_SILLY_URI_OBFU

2007-02-03 Thread Nigel Frankcom
On Sat, 03 Feb 2007 07:15:39 +, Nigel Frankcom [EMAIL PROTECTED] wrote: On Sat, 03 Feb 2007 07:13:08 +, Nigel Frankcom [EMAIL PROTECTED] wrote: On Fri, 2 Feb 2007 21:40:32 -0500, Theo Van Dinter [EMAIL PROTECTED] wrote: On Fri, Feb 02, 2007 at 06:33:40PM -0800, Kenneth Porter wrote

Re: Bayes resolution gettin weaker

2007-02-03 Thread Nigel Frankcom
On Sat, 3 Feb 2007 08:12:36 -0500, Jack Gostl [EMAIL PROTECTED] wrote: I've been watching this for awhile, and there is now a pattern to what I'm seeing. I'm running a configuration with multiple users sharing a bayes files. This is an interim move to facilitate the spamassassin upgrades, and

Re: rules are not used anymore

2007-02-03 Thread Nigel Frankcom
On Sat, 03 Feb 2007 18:42:51 +0100, David Obando [EMAIL PROTECTED] wrote: Dear all, I'm using SA 3.1.7 on a Debian Etch system. My config is in /etc/spamassassin, the default rules that came with SA are in /usr/share/spamassassin/, and the rules I get via sa-update-channels are in

Re: rules are not used anymore

2007-02-03 Thread Nigel Frankcom
On Sat, 03 Feb 2007 19:13:19 +0100, David Obando [EMAIL PROTECTED] wrote: Nigel Frankcom schrieb am 03.02.2007 18:53: On Sat, 03 Feb 2007 18:42:51 +0100, David Obando [EMAIL PROTECTED] wrote: Dear all, I'm using SA 3.1.7 on a Debian Etch system. My config is in /etc/spamassassin

Re: rules are not used anymore

2007-02-03 Thread Nigel Frankcom
On Sat, 03 Feb 2007 19:27:44 +0100, David Obando [EMAIL PROTECTED] wrote: Nigel Frankcom schrieb am 03.02.2007 19:23: On Sat, 03 Feb 2007 19:13:19 +0100, David Obando [EMAIL PROTECTED] wrote: Nigel Frankcom schrieb am 03.02.2007 18:53: On Sat, 03 Feb 2007 18:42:51 +0100, David

Re: Bayes resolution gettin weaker

2007-02-03 Thread Nigel Frankcom
On Sat, 3 Feb 2007 23:33:29 -0500, Jack Gostl [EMAIL PROTECTED] wrote: I've been watching this for awhile, and there is now a pattern to what I'm seeing. I'm running a configuration with multiple users sharing a bayes files. This is an interim move to facilitate the spamassassin upgrades, and

Re: TVD_SILLY_URI_OBFU

2007-02-02 Thread Nigel Frankcom
On Fri, 2 Feb 2007 21:40:32 -0500, Theo Van Dinter [EMAIL PROTECTED] wrote: On Fri, Feb 02, 2007 at 06:33:40PM -0800, Kenneth Porter wrote: If I read this right, it looks for an illegal domain character in the domain component after the first dot. The new pattern puts a % after the second

Re: TVD_SILLY_URI_OBFU

2007-02-02 Thread Nigel Frankcom
On Sat, 03 Feb 2007 07:13:08 +, Nigel Frankcom [EMAIL PROTECTED] wrote: On Fri, 2 Feb 2007 21:40:32 -0500, Theo Van Dinter [EMAIL PROTECTED] wrote: On Fri, Feb 02, 2007 at 06:33:40PM -0800, Kenneth Porter wrote: If I read this right, it looks for an illegal domain character in the domain

Re: Made my first rule but is not checking anything? Do I need to enable that?

2007-02-01 Thread Nigel Frankcom
On Thu, 1 Feb 2007 11:59:30 -0800 (PST), z3r0 [EMAIL PROTECTED] wrote: I'm a common user, just have a hosting account and spamassassin 3.1.7 enabled. The only directory in all my ftp folder that contains something related to SA is in root .spamassassin, where lives just 4 files, one of these is

Re: Made my first rule but is not checking anything? Do I need to enable that?

2007-02-01 Thread Nigel Frankcom
On Thu, 1 Feb 2007 11:59:30 -0800 (PST), z3r0 [EMAIL PROTECTED] wrote: I'm a common user, just have a hosting account and spamassassin 3.1.7 enabled. The only directory in all my ftp folder that contains something related to SA is in root .spamassassin, where lives just 4 files, one of these is

Re: To create a cf file: notepad and youfile.cf enough?

2007-02-01 Thread Nigel Frankcom
On Thu, 1 Feb 2007 12:10:14 -0800 (PST), z3r0 [EMAIL PROTECTED] wrote: Is it enough to create a cf file using notepad and save the file like yourfile.cf (with quotes) I notice that files that I make that way have the wordpad icon, but the original cf files I have in my ftp, has no icon. So

Re: To create a cf file: notepad and youfile.cf enough?

2007-02-01 Thread Nigel Frankcom
On Thu, 1 Feb 2007 12:52:02 -0800 (PST), z3r0 [EMAIL PROTECTED] wrote: Nigel Frankcom wrote: On Thu, 1 Feb 2007 12:10:14 -0800 (PST), z3r0 [EMAIL PROTECTED] wrote: Is it enough to create a cf file using notepad and save the file like yourfile.cf (with quotes) I notice that files that I

Re: huge cpu usage

2007-02-01 Thread Nigel Frankcom
On Fri, 02 Feb 2007 03:19:53 +0530, deepak [EMAIL PROTECTED] wrote: Jan Doberstein wrote: deepak schrieb: Suddenly, i notice huge cpu usage by SA on 3 different servers. nothing was changed in custom rules or configuration recently. kindly suggest, what might have been casing this.

Re: Made my first rule but is not checking anything? Do I need to enable that?

2007-02-01 Thread Nigel Frankcom
On Thu, 01 Feb 2007 18:34:09 -0500, Daryl C. W. O'Shea [EMAIL PROTECTED] wrote: z3r0 wrote: rules that would kill system performance I suppoused rules were nice and good, no time-bombs. I'm not sure what you're saying there. So any chances for me or I must forget SA? That, of course, is up

Re: Spam with image and tons of nonsense words, works fantastic for spammers

2007-02-01 Thread Nigel Frankcom
On Thu, 1 Feb 2007 15:29:13 -0800 (PST), z3r0 [EMAIL PROTECTED] wrote: I'm seeing all my spam and those with images and lot of nonsense words only scores 1.5. Great for spammers awfull for all the rest of the world. Since I can't use custom rules because I'm a normal hosting user. I have to

Did that fix bar me as well?

2007-02-01 Thread Nigel Frankcom
Hi Theo, Did the fix we discussed drop me off the list as well? Kind regards Nigel

Re: Drug spam, some caught some not - none caught by drug rules

2007-01-28 Thread Nigel Frankcom
On Sun, 28 Jan 2007 14:51:21 -0500, Tim Boyer [EMAIL PROTECTED] wrote: One thing I've noticed is that Polyakov is starting to obfuscate the URL. What would normally be caught because it's in the Spamhaus SBL is getting missed because of this: Good day, Viazzgra $1, 80 Ciazzlis $3, 00

Re: Drug Spam

2007-01-27 Thread Nigel Frankcom
On Sat, 27 Jan 2007 11:49:03 +, --[ UxBoD ]-- [EMAIL PROTECTED] wrote: Sorry for asking as I am sure that it has already been covered. But if there a rule for the new spate of drug SPAM where the URL has Remove * to make the link working! in it ? Thanks, This was suggested to me

Re: Drug spam, some caught some not - none caught by drug rules

2007-01-26 Thread Nigel Frankcom
On Thu, 25 Jan 2007 20:16:42 -0500, Matt Kettler [EMAIL PROTECTED] wrote: Nigel Frankcom wrote: Debug results are available on: http://dev.blue-canoe.net/spam/spam01.txt http://dev.blue-canoe.net/spam/debug1.txt http://dev.blue-canoe.net/spam/spam02.txt http://dev.blue-canoe.net/spam

Re: Drug spam, some caught some not - none caught by drug rules

2007-01-26 Thread Nigel Frankcom
On Fri, 26 Jan 2007 09:16:09 -0500, Matt Kettler [EMAIL PROTECTED] wrote: Nigel Frankcom wrote: Files redone... a little more informative this time round :-D http://dev.blue-canoe.net/spam/spam01.txt http://dev.blue-canoe.net/spam/debug1.txt http://dev.blue-canoe.net/spam/spam02.txt

Re: Drug spam, some caught some not - none caught by drug rules

2007-01-26 Thread Nigel Frankcom
On Fri, 26 Jan 2007 13:54:03 +, Ben Wylie [EMAIL PROTECTED] wrote: I recommend the KAM rules list which can be found here: http://www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf This catches the drugs names in these emails. Cheers, Ben Nigel Frankcom wrote: On Thu, 25 Jan 2007 20

Re: Drug spam, some caught some not - none caught by drug rules

2007-01-25 Thread Nigel Frankcom
On Thu, 25 Jan 2007 10:28:21 -0500, Andy Figueroa [EMAIL PROTECTED] wrote: Thanks, Matt. That sounds like a good suggestion. Nigel, since you have the emails, if you could capture the debug output in a file and post like you did the messages, perhaps someone wise could evaluate what is going

Re: Drug spam, some caught some not - none caught by drug rules

2007-01-25 Thread Nigel Frankcom
On Thu, 25 Jan 2007 10:28:21 -0500, Andy Figueroa [EMAIL PROTECTED] wrote: Thanks, Matt. That sounds like a good suggestion. Nigel, since you have the emails, if you could capture the debug output in a file and post like you did the messages, perhaps someone wise could evaluate what is going

Re: Rulesdujour?

2007-01-25 Thread Nigel Frankcom
On Thu, 25 Jan 2007 12:20:09 -0500, Gene Heskett [EMAIL PROTECTED] wrote: On Thursday 25 January 2007 11:56, Theo Van Dinter wrote: On Thu, Jan 25, 2007 at 11:50:13AM -0500, Gene Heskett wrote: I got this email from Rules_Du_Jour this morning, what is the fix? Don't take this the wrong way, but

Drug spam, some caught some not - none caught by drug rules

2007-01-24 Thread Nigel Frankcom
Hi All, Does anyone have any idea why there are such scoring disparities between these two emails? I've been seeing a few of these creep through lately. http://dev.blue-canoe.net/spam/spam01.txt http://dev.blue-canoe.net/spam/spam02.txt http://dev.blue-canoe.net/spam/spam03.txt

Re: Drug spam, some caught some not - none caught by drug rules

2007-01-24 Thread Nigel Frankcom
On Thu, 25 Jan 2007 02:40:30 -0500, Matt Kettler [EMAIL PROTECTED] wrote: Nigel Frankcom wrote: Hi All, Does anyone have any idea why there are such scoring disparities between these two emails? I've been seeing a few of these creep through lately. http://dev.blue-canoe.net/spam/spam01.txt

Re: Expiring tokens in SA database

2007-01-17 Thread Nigel Frankcom
On Wed, 17 Jan 2007 11:25:02 +0100, Rocco Scappatura [EMAIL PROTECTED] wrote: Hello, I'm using SA with MySQL. I have to Amavisd-new server, each talking with a different MySQL server. I run every night regularly this command: sa-learn --sync --force-expire for datbase maintaining. I have

Re: Expiring tokens in SA database

2007-01-17 Thread Nigel Frankcom
On Wed, 17 Jan 2007 13:00:37 +0100, Rocco Scappatura [EMAIL PROTECTED] wrote: Do you compact the database afterwards? Nigel No. How I have to do? rocsca From the CL use something like this: mysql -u root --password=yourpassword -e USE spamassassin;OPTIMIZE TABLE awl, bayes_expire,

Re: URIBL

2007-01-17 Thread Nigel Frankcom
On Wed, 17 Jan 2007 14:46:36 +, Jon Bjorn Njalsson [EMAIL PROTECTED] wrote: I have Net::DNS module installed. [14934] dbg: dns: is Net::DNS::Resolver available? yes [14934] dbg: dns: Net::DNS version: 0.57 and [14934] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC

Re: Major bayes problems

2007-01-15 Thread Nigel Frankcom
On Mon, 15 Jan 2007 07:33:08 -0600, Drew Burchett [EMAIL PROTECTED] wrote: 1. 99% of the mail that I sa-learn comes back already learnt correctly, not learning twice. I've had mail that has NEVER been on my system and somehow scored a 0 in spamassassin, yet when I run it through sa-learn, I

Re: Major bayes problems

2007-01-15 Thread Nigel Frankcom
On Mon, 15 Jan 2007 08:27:15 -0600, Drew Burchett [EMAIL PROTECTED] wrote: -Original Message- From: Nigel Frankcom [mailto:[EMAIL PROTECTED] Sent: Monday, January 15, 2007 8:14 AM To: users@spamassassin.apache.org Subject: Re: Major bayes problems On Mon, 15 Jan 2007 07:33:08 -0600

Re: When a rule fails, SA give false positives on absent headers

2007-01-15 Thread Nigel Frankcom
On Mon, 15 Jan 2007 15:14:36 +, Ben Wylie [EMAIL PROTECTED] wrote: I have tried writing a rule to detect a specific To Header: header FULLNAMEINTOHEADER To =~ /\Full\sName\\s[EMAIL PROTECTED]/ When i tested this rule against an email with the string, the result i get is: * -2.0

Re: When a rule fails, SA give false positives on absent headers

2007-01-15 Thread Nigel Frankcom
On Mon, 15 Jan 2007 08:06:16 -0800, Evan Platt [EMAIL PROTECTED] wrote: At 07:44 AM 1/15/2007, you wrote: Thanks, I have now done this, and it is working fine. However i think it is still a bug for it to give these problems when a rule is miswritten in this way. You make a mistake in a rule,

Re: Techworld says spam shows sudden slide'?

2007-01-12 Thread Nigel Frankcom
On Fri, 12 Jan 2007 05:37:01 -0800, jdow [EMAIL PROTECTED] wrote: From: Giampaolo Tomassoni [EMAIL PROTECTED] From: Michael Scheidell [mailto:[EMAIL PROTECTED] Ok, who installed the swartasam blocker for techworld? All of a sudden, they say that worldwide spam levels have dropped. I don't

Re: White Listing

2007-01-03 Thread Nigel Frankcom
On Wed, 03 Jan 2007 11:50:27 -0500, Kyle Quillen [EMAIL PROTECTED] wrote: Hello all, I am looking for an easy way for my spamassassin to relearn messages marked as spam that users would like to get. Would it be safe and avoid bayesian poisoning if I were to setup an email box such as [EMAIL

Re: LDAP user configurations

2007-01-03 Thread Nigel Frankcom
On Wed, 03 Jan 2007 17:48:17 +, Ian Eiloart [EMAIL PROTECTED] wrote: Hi, I'm trying to get spamd to read user configurations from LDAP, and I see the errors below all the time. Does anyone know the cause? Or better, the solution? I'm using this dsn: user_scores_dsn

Re: Stand-alone SpamAssassin server specs

2007-01-03 Thread Nigel Frankcom
ex. 7012 Local: 623.434.8050 ex. 7012 FAX: 623.434.8453 From: Nigel Frankcom [EMAIL PROTECTED] Sent: Wednesday, January 03, 2007 10:19 AM To: [EMAIL PROTECTED] Subject: Re: Stand-alone SpamAssassin server specs On Wed, 3 Jan 2007 08:22:40 -0700, Jeff Hrdy

Re: sa-update problem...

2007-01-02 Thread Nigel Frankcom
On Tue, 2 Jan 2007 10:36:19 -0600, Mike French [EMAIL PROTECTED] wrote: After the recent sa-update I get this after a lint: [8042] warn: config: warning: score set for non-existent rule SUBJECT_IN_BLACKLIST snip When you ran sa-update did you add any extra instructions like install dir?

Re: sa-update problem...

2007-01-02 Thread Nigel Frankcom
On Tue, 2 Jan 2007 15:01:09 -0600, Mike French [EMAIL PROTECTED] wrote: Thanks for the heads-up I didn't think the Ident and INet6 was a big deal, but then again I'm still learning... I'm going to do some more reading on the sa-update stuff and get it fleshed out. In the mean time, I'm

Re: SA-UPDATE and recent branches/3.1 rules?

2007-01-01 Thread Nigel Frankcom
On Mon, 1 Jan 2007 01:23:59 -0500, Theo Van Dinter [EMAIL PROTECTED] wrote: On Sun, Dec 31, 2006 at 09:11:08PM -0600, Larry Rosenman wrote: Is there some process that needs to be automated to ship out the 3.1 branch rules changes via sa-update? At the moment, we push out the updates manually.

Re: SA-UPDATE and recent branches/3.1 rules? or Did I miss an SA version update?

2007-01-01 Thread Nigel Frankcom
On Mon, 01 Jan 2007 09:46:01 +, Nigel Frankcom [EMAIL PROTECTED] wrote: On Mon, 1 Jan 2007 01:23:59 -0500, Theo Van Dinter [EMAIL PROTECTED] wrote: On Sun, Dec 31, 2006 at 09:11:08PM -0600, Larry Rosenman wrote: Is there some process that needs to be automated to ship out the 3.1 branch

Re: SA-UPDATE and recent branches/3.1 rules? or Did I miss an SA version update?

2007-01-01 Thread Nigel Frankcom
On Mon, 1 Jan 2007 11:25:53 -0500, Shaun T. Erickson [EMAIL PROTECTED] wrote: Regardless of the reason, is my SA now broken, and in any case, how do I recover from this? No, your SA won't be broken. IIRC SA won't apply anything if there's a failure. At least my SA is still running fine here

Re: sa-update errors with 3.1.7

2007-01-01 Thread Nigel Frankcom
On Tue, 2 Jan 2007 02:16:56 -0500, Theo Van Dinter [EMAIL PROTECTED] wrote: On Mon, Jan 01, 2007 at 07:11:03PM +, Justin Mason wrote: Looks like Theo pushed through updates for the wrong version in the 3.1.x channel ;) Give it an hour or so and it should be fixed. Um. No, I didn't. In

Re: SA not catching apostrophes in sender's addressess?

2006-12-29 Thread Nigel Frankcom
On Thu, 28 Dec 2006 15:40:49 -0800, John Rudd [EMAIL PROTECTED] wrote: Chris wrote: On Thursday 28 December 2006 12:22 pm, Benny Pedersen wrote: if clamav knows its a virus, why then test it as spam in spamassassin ? Why not? I'm using the clamav plug-in as part of the spamassassin install.

Re: Problem with Update

2006-12-29 Thread Nigel Frankcom
On Thu, 28 Dec 2006 12:48:16 +0100, sasa [EMAIL PROTECTED] wrote: Hi, I have updated SA from spamassassin-3.0.4 to spamassassin-3.1.7 with YUM method and all it's ok, but when I run sa-update I have this error: [EMAIL PROTECTED] ~]# sa-update Can't locate IO/Zlib.pm in @INC (@INC contains:

Re: sa-learn explained

2006-12-29 Thread Nigel Frankcom
On Fri, 29 Dec 2006 09:51:05 -0500, Andy Figueroa [EMAIL PROTECTED] wrote: I still fee like a tyro with SpamAssassin, but my installation is catching better than 99% with perhaps 0.1% false positives (thanks in large part to things I've learned from this list), and I think I can tell you a

Re: How to stop this kind of spam?

2006-12-24 Thread Nigel Frankcom
On Sun, 24 Dec 2006 02:44:38 -0800 (PST), andysutton123 [EMAIL PROTECTED] wrote: Anyone As Matt asked, can you supply the X headers for those mails? and give some idea of what system you're using and what rule sets you have in place; also exactly which version of SA 3.0.0, 3.1.0, 3.1.2

Re: Deleting SA headers on ham

2006-12-23 Thread Nigel Frankcom
On Sat, 23 Dec 2006 11:39:44 -0700, [EMAIL PROTECTED] (Bob Proulx) wrote: David Baron wrote: Occasionally, I get false positives. I run the sa_learn to mark as ham. The spamassassin spam headings remain. Is there a script or optiont that I might use to remove them (restore message to

Re: [OT] Re: ORDB.org is shutting down

2006-12-21 Thread Nigel Frankcom
On Thu, 21 Dec 2006 11:16:43 +0100, Emmanuel Lesouef [EMAIL PROTECTED] wrote: Thanks Ian, I didn't know rbl-plus.mail-abuse.ja.net. I therefore added rbl-plus.mail-abuse.org as I'm outside of Janet. This gives me for my postfix based installlation : reject_rbl_client sbl-xbl.spamhaus.org,

Re: URIBL_*_SURBL

2006-12-20 Thread Nigel Frankcom
On Wed, 20 Dec 2006 13:44:09 -, Dhaval Patel [EMAIL PROTECTED] wrote: Hello all, I have been using spamassassin for quite some time and just recently I have seen some false positives. Looking at the content analysis I see that it is the URIBL*SURBL rules that is throwing it over the edge.

Re: roaming users sending mail internally and dynamic IPs issue

2006-12-18 Thread Nigel Frankcom
On Mon, 18 Dec 2006 16:13:32 -0500, Thomas Bolioli [EMAIL PROTECTED] wrote: Dan Horne wrote: Set up SMTP AUTH and require your users to log in to send email. If I understand correctly Spamassassin automatically trusts

Re: X-Spam-Flag is allwais YES

2006-12-16 Thread Nigel Frankcom
On Sun, 17 Dec 2006 08:06:03 +0100, Christian Eichert [EMAIL PROTECTED] wrote: I have a question Shouldn't X-Spam-Flag: be YES only if the spam score is more than a given level. In my configuration it is allwais YES is this normal ? I think you may have something broken or misconfigured.

Re: X-Spam-Flag is allwais YES

2006-12-16 Thread Nigel Frankcom
On Sun, 17 Dec 2006 08:30:12 +0100, Christian Eichert [EMAIL PROTECTED] wrote: Nigel Frankcom wrote: [...] So to answer your question; no, it's not normal. thanks nigel I thought this, but can someone tell where I shoult look for to fix it? I'd start by checking your local.cf and look

Re: X-Spam-Flag is allwais YES

2006-12-16 Thread Nigel Frankcom
On Sun, 17 Dec 2006 07:42:11 +, Nigel Frankcom [EMAIL PROTECTED] wrote: On Sun, 17 Dec 2006 08:30:12 +0100, Christian Eichert [EMAIL PROTECTED] wrote: Nigel Frankcom wrote: [...] So to answer your question; no, it's not normal. thanks nigel I thought this, but can someone tell where I

Re: Specification of sa-learn --backup format

2006-12-15 Thread Nigel Frankcom
On Fri, 15 Dec 2006 17:26:50 -0500, Theo Van Dinter [EMAIL PROTECTED] wrote: On Fri, Dec 15, 2006 at 11:12:21PM +0100, Georg Sauthoff wrote: t 1 0 1162501869 some_10digit_hex ^ a) ^ b) a) I guess some time format? Yes, UNIX standard

Re: SURBL Returning FP's on URIs

2006-12-06 Thread Nigel Frankcom
On Wed, 6 Dec 2006 00:40:38 -0800, Jeff Chan [EMAIL PROTECTED] wrote: On Tuesday, December 5, 2006, 11:59:17 PM, Nigel Frankcom wrote: Hi All, I was just going through the overnight spam and cam across a load of very definite FP's. SURBL seems to be firing on legitimate domains. A check

Re: SURBL Returning FP's on URIs

2006-12-06 Thread Nigel Frankcom
On Wed, 06 Dec 2006 08:52:09 +, Nigel Frankcom [EMAIL PROTECTED] wrote: On Wed, 6 Dec 2006 00:40:38 -0800, Jeff Chan [EMAIL PROTECTED] wrote: On Tuesday, December 5, 2006, 11:59:17 PM, Nigel Frankcom wrote: Hi All, I was just going through the overnight spam and cam across a load of very

Re: SURBL confusion

2006-12-06 Thread Nigel Frankcom
Hi Jeff, Below are the headers from 3 emails in chronological order. The 1st has no headers, a couple of minutes later the 2nd has them, then after that the 3rd (and all subsequent ones) don't. I have no clue what's going on. I've check all my local DNS and they appear to be working fine. Can

Re: spamassasin rules

2006-12-06 Thread Nigel Frankcom
On Wed, 6 Dec 2006 12:29:05 +, kailash vyas [EMAIL PROTECTED] wrote: Hi, I want to check whether emails that have been sent using my domain.com have originated from my server. Is there a check in spamassasin or exim for that. I am using exim mail server with spamassasin. thanks, kailash

Re: SURBL Returning FP's on URIs

2006-12-06 Thread Nigel Frankcom
On Wed, 6 Dec 2006 08:34:43 -0500, Coffey, Neal [EMAIL PROTECTED] wrote: Nigel Frankcom wrote: I get the following off the SA box (I don't use OpenDNS or any proxying, the rest of my lan uses the same dns that the SA box uses and all is resolving normally) [...] ;; AUTHORITY SECTION

Re: 5 digit probe spam?

2006-12-05 Thread Nigel Frankcom
On Tue, 05 Dec 2006 09:32:39 +0100, Yet Another Ninja [EMAIL PROTECTED] wrote: On 12/5/2006 7:27 AM, Marc Perkel wrote: Is anyone else getting these? Messages with a random subject and the message is a 5 digit number. What is it? aren't those digits the password for a password protected

Re: 5 digit probe spam?

2006-12-05 Thread Nigel Frankcom
On Tue, 05 Dec 2006 11:16:15 +0100, Yet Another Ninja [EMAIL PROTECTED] wrote: On 12/5/2006 11:02 AM, Nigel Frankcom wrote: On Tue, 05 Dec 2006 09:32:39 +0100, Yet Another Ninja [EMAIL PROTECTED] wrote: On 12/5/2006 7:27 AM, Marc Perkel wrote: Is anyone else getting these? Messages

Re: 5 digit probe spam?

2006-12-05 Thread Nigel Frankcom
On Tue, 05 Dec 2006 09:51:06 -0800, Marc Perkel [EMAIL PROTECTED] wrote: Yet Another Ninja wrote: Just found a few ... sent directly from DULs. (there went my theory...) :-( I have a theory that spammers are either doing some sort of probe or sending out nonspam so that ther headers

SURBL Returning FP's on URIs

2006-12-05 Thread Nigel Frankcom
Hi All, I was just going through the overnight spam and cam across a load of very definite FP's. SURBL seems to be firing on legitimate domains. A check on http://www.rulesemporium.com/cgi-bin/uribl.cgi showed none of the domains listed in the headers or bodies of the emails concerned are in any

Re: Over Zealous Checks for Nigerian 419 Scams

2006-12-04 Thread Nigel Frankcom
On Mon, 04 Dec 2006 16:12:01 -0500 (EST), Rick Mallett [EMAIL PROTECTED] wrote: What's the proper way to submit material for the ham corpus? I've got the entire newsletter that resulted in the Nigerian Scam FP I reported but I wasn't sure if it was appropriate to include it in the posting. Its

Re: spam

2006-12-04 Thread Nigel Frankcom
On Mon, 4 Dec 2006 16:11:28 -0800 (PST), san [EMAIL PROTECTED] wrote: Hi, Am recieving a spam mails which is just having number on the body just like 1265 or 2196... any thoughts how to stop this kind of spam.. thanks san Ditto How in the hell does one write a rule for this sh*?

Re: spam

2006-12-04 Thread Nigel Frankcom
On Mon, 4 Dec 2006 17:34:00 -0700, Darron Froese [EMAIL PROTECTED] wrote: I just got 12.4 on that kind of spam: BAYES_99=3.5, DATE_IN_FUTURE_96_XX=2.403, DK_POLICY_SIGNSOME=0.001, DSPAM_SPAM=4, RCVD_IN_BL_SPAMCOP_NET=1.558, SAGREY=1 On 4-Dec-06, at 5:24 PM, Nigel Frankcom wrote: On Mon, 4 Dec

Re: spam

2006-12-04 Thread Nigel Frankcom
On Mon, 04 Dec 2006 16:35:33 -0800, Evan Platt [EMAIL PROTECTED] wrote: At 04:24 PM 12/4/2006, you wrote: On Mon, 4 Dec 2006 16:11:28 -0800 (PST), san [EMAIL PROTECTED] wrote: Hi, Am recieving a spam mails which is just having number on the body just like 1265 or 2196... any thoughts

Re: Best Choice for Bayes filtering on SpamAssassin

2006-12-02 Thread Nigel Frankcom
On Sat, 02 Dec 2006 18:31:47 +0100, Noc Phibee [EMAIL PROTECTED] wrote: Thanks to your answer Yes 6 server in load balancing with for all 70 concurrency incoming only for spam detect and 3 server for virus scan Michael Scheidell a écrit : -Original Message- From: Noc Phibee

Re: Best Choice for Bayes filtering on SpamAssassin

2006-12-02 Thread Nigel Frankcom
On Sat, 2 Dec 2006 14:27:57 -0500, Michael Scheidell [EMAIL PROTECTED] wrote: -Original Message- From: Nigel Frankcom [mailto:[EMAIL PROTECTED] Sent: Saturday, December 02, 2006 2:24 PM To: SpamAssassin Subject: Re: Best Choice for Bayes filtering on SpamAssassin My MTA has

OT Question

2006-12-02 Thread Nigel Frankcom
Hey all, Did a botnet fall over or am I just lucky? spam has dropped dramatically here ~80% down. Not that I'm complaining - just curious is anyone else is seeing the same. KR Nigel

Re: Best Choice for Bayes filtering on SpamAssassin

2006-12-02 Thread Nigel Frankcom
On Sat, 2 Dec 2006 16:20:53 -0500, Michael Scheidell [EMAIL PROTECTED] wrote: -Original Message- From: Craig Morrison [mailto:[EMAIL PROTECTED] Sent: Saturday, December 02, 2006 3:08 PM To: Michael Scheidell Cc: Nigel Frankcom; SpamAssassin Subject: Re: Best Choice for Bayes

Re: My Credit rateing does TOO matter

2006-12-01 Thread Nigel Frankcom
On Fri, 01 Dec 2006 09:15:35 -0500, Joe Zitnik [EMAIL PROTECTED] wrote: On 12/1/2006 at 7:01 AM, Justin Mason [EMAIL PROTECTED] wrote: Guys -- vague hints as to the contents of the mail really don't help. It's spam -- we're all getting thousands of spams a day, most of us (ok, I for one

Re: optional score in local.cf is not working

2006-11-29 Thread Nigel Frankcom
On Wed, 29 Nov 2006 10:10:58 +0200, Leon Kolchinsky [EMAIL PROTECTED] wrote: Hi, I thought I was wrong and amavis restart didn't really helped there, but there is an update for this problem I had with configuration in local.cf not catching. It seems that only when I do /etc/init.d/amavis

Re: rbl insight and wisdom please

2006-11-27 Thread Nigel Frankcom
On Mon, 27 Nov 2006 12:42:40 -0800, R Lists06 [EMAIL PROTECTED] wrote: Hopefully this hasn't been rehashed to death on this list yet has there ever been a general consensus as to which rbl's and similar lists are best to use if you are going to engineer your mail systems with such? Anyone care

Re: rbl insight and wisdom please

2006-11-27 Thread Nigel Frankcom
On Mon, 27 Nov 2006 13:06:58 -0800, Quinn Comendant [EMAIL PROTECTED] wrote: I'm using the following with qmail's rblsmtpd: -r zen.spamhaus.org -r bl.spamcop.net -r relays.ordb.org -r cbl.abuseat.org I do find it very hard to determine if a list is malfunctioning and honest emails are blocked

Re: Percentage of email that is spam after filtering?

2006-11-25 Thread Nigel Frankcom
On Fri, 24 Nov 2006 23:51:23 -0600, Bookworm [EMAIL PROTECTED] wrote: Marc Perkel wrote: Kelly Jones wrote: I know that most (90%+) email sent now is spam, but what are the numbers for people who use spam filtering? I realize it varies by user, sensitivity to false positives, tools used,

<    1   2   3   4   >