Re: SA suddenly giving lots of FP's?

2006-01-03 Thread mouss
Gene Heskett a écrit : - From [EMAIL PROTECTED] Sat Dec 31 23:16:57 2005 Return-Path: [EMAIL PROTECTED] Received: from localhost (localhost.localdomain [127.0.0.1]) by coyote.coyote.den (8.12.11/8.12.10) with ESMTP id k014Gv7g021793 for [EMAIL PROTECTED]; Sat,

Re: SA suddenly giving lots of FP's?

2006-01-03 Thread mouss
Gene Heskett a écrit : Well, I've now defined it to be 2.8 in local.cf, and thats working better but I feel I may have to reduce it another few tenths. One of the problems I think I've detected is that fetchmail isn't doing a 100% verbatum suck from vz, but seems to be deleting some of the

Re: SA suddenly giving lots of FP's?

2006-01-03 Thread Gene Heskett
On Tuesday 03 January 2006 17:30, mouss wrote: Gene Heskett a écrit : - From [EMAIL PROTECTED] Sat Dec 31 23:16:57 2005 Return-Path: [EMAIL PROTECTED] Received: from localhost (localhost.localdomain [127.0.0.1]) by coyote.coyote.den (8.12.11/8.12.10) with ESMTP id

Re: SA suddenly giving lots of FP's?

2006-01-02 Thread Gene Heskett
On Sunday 01 January 2006 22:51, jdow wrote: [...] Anyway, the rule thats applying the 3.8 score is HELO_DYNAMIC_IPADDR2. ATM, I have a grep -R HELO_DYNAMIC_IPADDR2 * running from / because that rule isn't present in any of the .spamassassin(/rulesdujour) or /etc/mail/spamassassin

Re: SA suddenly giving lots of FP's?

2006-01-02 Thread Craig White
On Mon, 2006-01-02 at 22:19 -0500, Gene Heskett wrote: On Sunday 01 January 2006 22:51, jdow wrote: [...] Anyway, the rule thats applying the 3.8 score is HELO_DYNAMIC_IPADDR2. ATM, I have a grep -R HELO_DYNAMIC_IPADDR2 * running from / because that rule isn't present in any of the

Re: SA suddenly giving lots of FP's?

2006-01-02 Thread Gene Heskett
On Monday 02 January 2006 22:34, Craig White wrote: On Mon, 2006-01-02 at 22:19 -0500, Gene Heskett wrote: On Sunday 01 January 2006 22:51, jdow wrote: [...] Anyway, the rule thats applying the 3.8 score is HELO_DYNAMIC_IPADDR2. ATM, I have a grep -R HELO_DYNAMIC_IPADDR2 * running from

Re: SA suddenly giving lots of FP's?

2006-01-02 Thread jdow
From: Gene Heskett [EMAIL PROTECTED] On Monday 02 January 2006 00:50, Chris Purves wrote: On Sunday 01 January 2006 12:24, Gene Heskett wrote: On Saturday 31 December 2005 20:21, Chris Purves wrote: On Sun, January 1, 2006 3:28 am, Gene Heskett said: On Saturday 31 December 2005 13:38, Rick

Re: SA suddenly giving lots of FP's?

2006-01-02 Thread Craig White
On Mon, 2006-01-02 at 22:57 -0500, Gene Heskett wrote: to my knowledge, fetchmail doesn't remove any headers at all. Procmail may be doing it or your MTA, depending upon how you are handling it. Humm, AFAIK, fetchmail gets it from vz, writing it to /var/spool/mail/gene

Re: SA suddenly giving lots of FP's?

2006-01-02 Thread jdow
From: Gene Heskett [EMAIL PROTECTED] On Monday 02 January 2006 22:34, Craig White wrote: On Mon, 2006-01-02 at 22:19 -0500, Gene Heskett wrote: On Sunday 01 January 2006 22:51, jdow wrote: [...] Anyway, the rule thats applying the 3.8 score is HELO_DYNAMIC_IPADDR2. ATM, I have a grep -R

Re: SA suddenly giving lots of FP's?

2006-01-02 Thread Chris Purves
Gene Heskett wrote: In that event, how do I go about telling fetchmail that the mailfile it generates in /var/spool/mail/gene is to be a verbatum copy of what was sucked in the vz's server. My fetchmailrc is comparatively clean, with no options that I know about set that would encourage the

Re: SA suddenly giving lots of FP's?

2006-01-02 Thread Craig White
On Mon, 2006-01-02 at 20:16 -0800, jdow wrote: From: Gene Heskett [EMAIL PROTECTED] Fetchmail is verbatim in the sense needed. Does fetchmail go through the tool that fires off SpamAssassin or is this done up in KMail as it reads? If so KMail may have sanitized off headers in much the same

Re: SA suddenly giving lots of FP's?

2006-01-02 Thread Gene Heskett
On Monday 02 January 2006 23:16, jdow wrote: From: Gene Heskett [EMAIL PROTECTED] On Monday 02 January 2006 00:50, Chris Purves wrote: On Sunday 01 January 2006 12:24, Gene Heskett wrote: On Saturday 31 December 2005 20:21, Chris Purves wrote: On Sun, January 1, 2006 3:28 am, Gene Heskett

Re: SA suddenly giving lots of FP's?

2006-01-02 Thread Gene Heskett
On Monday 02 January 2006 23:22, jdow wrote: From: Gene Heskett [EMAIL PROTECTED] On Monday 02 January 2006 22:34, Craig White wrote: On Mon, 2006-01-02 at 22:19 -0500, Gene Heskett wrote: On Sunday 01 January 2006 22:51, jdow wrote: [...] Anyway, the rule thats applying the 3.8 score is

Re: SA suddenly giving lots of FP's?

2006-01-01 Thread Gene Heskett
On Sunday 01 January 2006 00:56, jdow wrote: From: Gene Heskett [EMAIL PROTECTED] On Saturday 31 December 2005 12:42, Gene Heskett wrote: Greetings; This morning I'm going thru my JunqueMail folder and find that about a dozen msgs to the OpenOffice list, 5 or 6 to the fedeora list, and one to

Re: SA suddenly giving lots of FP's?

2006-01-01 Thread Stanislaw Halik
Gene Heskett [EMAIL PROTECTED] wrote: ATM, I have a grep -R HELO_DYNAMIC_IPADDR2 * running from / because that rule isn't present in any of the .spamassassin(/rulesdujour) or /etc/mail/spamassassin directories. it's in $PREFIX/share/spamassassin. regards, -- Stanisław Halik,

Re: SA suddenly giving lots of FP's?

2006-01-01 Thread Gene Heskett
On Sunday 01 January 2006 13:35, Stanislaw Halik wrote: Gene Heskett [EMAIL PROTECTED] wrote: ATM, I have a grep -R HELO_DYNAMIC_IPADDR2 * running from / because that rule isn't present in any of the .spamassassin(/rulesdujour) or /etc/mail/spamassassin directories. it's in

Re: SA suddenly giving lots of FP's?

2006-01-01 Thread Stanislaw Halik
Gene Heskett [EMAIL PROTECTED] wrote: Now I'm beginning to wonder, just where are _the definitive_ rulesets for SA? They seem to be scattered around rather liberally, almost like a friggin viri... ones in $PREFIX/share/spamassassin are the default 'safe' rulesets from SA distribution. these

Re: SA suddenly giving lots of FP's?

2006-01-01 Thread mouss
Gene Heskett a écrit : pts rule name description -- -- 3.8 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2) 1.8 FORGED_YAHOO_RCVD 'From'

Re: SA suddenly giving lots of FP's?

2006-01-01 Thread jdow
From: Gene Heskett [EMAIL PROTECTED] On Sunday 01 January 2006 00:56, jdow wrote: From: Gene Heskett [EMAIL PROTECTED] On Saturday 31 December 2005 12:42, Gene Heskett wrote: Greetings; This morning I'm going thru my JunqueMail folder and find that about a dozen msgs to the OpenOffice

Re: SA suddenly giving lots of FP's?

2006-01-01 Thread jdow
From: Gene Heskett [EMAIL PROTECTED] On Sunday 01 January 2006 13:35, Stanislaw Halik wrote: Gene Heskett [EMAIL PROTECTED] wrote: ATM, I have a grep -R HELO_DYNAMIC_IPADDR2 * running from / because that rule isn't present in any of the .spamassassin(/rulesdujour) or /etc/mail/spamassassin

Re: SA suddenly giving lots of FP's?

2006-01-01 Thread Chris Purves
On Sunday 01 January 2006 12:24, Gene Heskett wrote: On Saturday 31 December 2005 20:21, Chris Purves wrote: On Sun, January 1, 2006 3:28 am, Gene Heskett said: On Saturday 31 December 2005 13:38, Rick Macdougall wrote: Gene Heskett wrote: On Saturday 31 December 2005 12:42, Gene Heskett

SA suddenly giving lots of FP's?

2005-12-31 Thread Gene Heskett
Greetings; This morning I'm going thru my JunqueMail folder and find that about a dozen msgs to the OpenOffice list, 5 or 6 to the fedeora list, and one to the gimp-print-devel list were flaged and sorted as *SPAN*. With one exception, all were in english. Using rulesdujour here, and

Re: SA suddenly giving lots of FP's?

2005-12-31 Thread Rick Macdougall
Gene Heskett wrote: On Saturday 31 December 2005 12:42, Gene Heskett wrote: Greetings; This morning I'm going thru my JunqueMail folder and find that about a dozen msgs to the OpenOffice list, 5 or 6 to the fedeora list, and one to the gimp-print-devel list were flaged and sorted as

Re: SA suddenly giving lots of FP's?

2005-12-31 Thread Gene Heskett
On Saturday 31 December 2005 13:38, Rick Macdougall wrote: Gene Heskett wrote: On Saturday 31 December 2005 12:42, Gene Heskett wrote: Greetings; This morning I'm going thru my JunqueMail folder and find that about a dozen msgs to the OpenOffice list, 5 or 6 to the fedeora list, and one to

Re: SA suddenly giving lots of FP's?

2005-12-31 Thread Chris Purves
On Sun, January 1, 2006 3:28 am, Gene Heskett said: On Saturday 31 December 2005 13:38, Rick Macdougall wrote: Gene Heskett wrote: On Saturday 31 December 2005 12:42, Gene Heskett wrote: This morning I'm going thru my JunqueMail folder and find that about a dozen msgs to the OpenOffice list,

Re: SA suddenly giving lots of FP's?

2005-12-31 Thread Gene Heskett
On Saturday 31 December 2005 20:21, Chris Purves wrote: On Sun, January 1, 2006 3:28 am, Gene Heskett said: On Saturday 31 December 2005 13:38, Rick Macdougall wrote: Gene Heskett wrote: On Saturday 31 December 2005 12:42, Gene Heskett wrote: This morning I'm going thru my JunqueMail folder and

Re: SA suddenly giving lots of FP's?

2005-12-31 Thread jdow
From: Gene Heskett [EMAIL PROTECTED] On Saturday 31 December 2005 12:42, Gene Heskett wrote: Greetings; This morning I'm going thru my JunqueMail folder and find that about a dozen msgs to the OpenOffice list, 5 or 6 to the fedeora list, and one to the gimp-print-devel list were flaged and