Re: low scoring spam

2017-07-14 Thread Antony Stone
On Friday 14 July 2017 at 15:29:38, Charles Amstutz wrote: > Hello, > > I keep having spam come through that hits on almost zero rules, (or very > few) . I get this is definitely possibly, but it's annoying as its > obviously spam. I guess my question is, if what we have in place isn't >

low scoring spam

2017-07-14 Thread Charles Amstutz
Hello, I keep having spam come through that hits on almost zero rules, (or very few) . I get this is definitely possibly, but it's annoying as its obviously spam. I guess my question is, if what we have in place isn't hitting on much, then aside from learning it to Bayes, what do we do? Even

discard high scoring spam?

2014-01-06 Thread Mark Chaney
I sure I hope I didnt fail to bad on searching for this answer, but when simply using spamassasin with postfix as an incoming smtp relay server and not using anything like amavis or mailscanner, is there still a way to discard high scoring spam (lets say 25), yet still marking emails

Re: discard high scoring spam?

2014-01-06 Thread Robert Schetterer
Am 06.01.2014 16:02, schrieb Mark Chaney: I sure I hope I didnt fail to bad on searching for this answer, but when simply using spamassasin with postfix as an incoming smtp relay server and not using anything like amavis or mailscanner, is there still a way to discard high scoring spam (lets

Re: discard high scoring spam?

2014-01-06 Thread Matus UHLAR - fantomas
On 06.01.14 09:02, Mark Chaney wrote: I sure I hope I didnt fail to bad on searching for this answer, but when simply using spamassasin with postfix as an incoming smtp relay server and not using anything like amavis or mailscanner, is there still a way to discard high scoring spam (lets say

Re: discard high scoring spam?

2014-01-06 Thread Kevin A. McGrail
, is there still a way to discard high scoring spam (lets say 25), yet still marking emails with scores of 5 or more as spam? I know how this would work with amavis or mailscanner, but not sure how to do it standalone with postfix/SA. I am hoping to avoid having to create filters at the destination servers

Re: discard high scoring spam?

2014-01-06 Thread Mark Chaney
high scoring spam (lets say 25), yet still marking emails with scores of 5 or more as spam? I know how this would work with amavis or mailscanner, but not sure how to do it standalone with postfix/SA. I am hoping to avoid having to create filters at the destination servers and having them deleted

Re: discard high scoring spam?

2014-01-06 Thread Axb
anything like amavis or mailscanner, is there still a way to discard high scoring spam (lets say 25), yet still marking emails with scores of 5 or more as spam? I know how this would work with amavis or mailscanner, but not sure how to do it standalone with postfix/SA. I am hoping to avoid having

Re: discard high scoring spam?

2014-01-06 Thread Robert Schetterer
anything like amavis or mailscanner, is there still a way to discard high scoring spam (lets say 25), yet still marking emails with scores of 5 or more as spam? I know how this would work with amavis or mailscanner, but not sure how to do it standalone with postfix/SA. I am hoping to avoid

Re: discard high scoring spam?

2014-01-06 Thread Robert Schetterer
Chaney: I sure I hope I didnt fail to bad on searching for this answer, but when simply using spamassasin with postfix as an incoming smtp relay server and not using anything like amavis or mailscanner, is there still a way to discard high scoring spam (lets say 25), yet still marking emails

Re: discard high scoring spam?

2014-01-06 Thread Robert Schetterer
on searching for this answer, but when simply using spamassasin with postfix as an incoming smtp relay server and not using anything like amavis or mailscanner, is there still a way to discard high scoring spam (lets say 25), yet still marking emails with scores of 5 or more as spam? I know how

Re: discard high scoring spam?

2014-01-06 Thread Mark Chaney
on searching for this answer, but when simply using spamassasin with postfix as an incoming smtp relay server and not using anything like amavis or mailscanner, is there still a way to discard high scoring spam (lets say 25), yet still marking emails with scores of 5 or more as spam? I know how

Re: discard high scoring spam?

2014-01-06 Thread Duane Hill
, is there still a way to discard high scoring spam (lets say 25), yet still marking emails with scores of 5 or more as spam? I know how this would work with amavis or mailscanner, but not sure how to do it standalone with postfix/SA. I am hoping to avoid having to create filters at the destination servers

Re: discard high scoring spam?

2014-01-06 Thread Miles Fidelman
Mark Chaney wrote: I sure I hope I didnt fail to bad on searching for this answer, but when simply using spamassasin with postfix as an incoming smtp relay server and not using anything like amavis or mailscanner, is there still a way to discard high scoring spam (lets say 25), yet still

Re: discard high scoring spam?

2014-01-06 Thread Robert Schetterer
high scoring spam (lets say 25), yet still marking emails with scores of 5 or more as spam? I know how this would work with amavis or mailscanner, but not sure how to do it standalone with postfix/SA. I am hoping to avoid having to create filters at the destination servers and having them deleted

Re: discard high scoring spam?

2014-01-06 Thread Adam Moffett
SpamAssassin can not drop a mail - it will always produce its output and not producing it is treated as an error. If you call SpamAssassin directly from within Postfix, you can use a header check to discard the message on a high score. Yeah, I'm surprised how many people answered no to this

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-23 Thread Matus UHLAR - fantomas
On 04/22/2013 09:29 AM, Andrzej A. Filip wrote: Are you ready/willing to report spam you receive to spamcop.net, razor, pyzor, ...? On 22.04.13 15:01, Thomas Cameron wrote: That's an interesting question... Each user has their own spam folders, so I guess I should create a cron job per user

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-22 Thread Thomas Cameron
On 04/08/2013 03:52 AM, Andrzej A. Filip wrote: On 04/08/2013 05:12 AM, Thomas Cameron wrote: [...] I want to delete any spam that scores over 10, though. I believe that I should insert a new rule between the first and second, and I want to use the X-Spam-Level header. But since it uses

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-22 Thread Matus UHLAR - fantomas
On 22.04.13 08:27, Thomas Cameron wrote: Currently I'm using procmail recipes for individual users, but I'm leaning heavily towards going back to spamass-milter, and rejecting everything that scores 10 or more. with thing like spamass-milter I found REFUSING mail (not devnulling!) sa safe. I

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-22 Thread Andrzej A. Filip
On 04/22/2013 03:27 PM, Thomas Cameron wrote: On 04/08/2013 03:52 AM, Andrzej A. Filip wrote: On 04/08/2013 05:12 AM, Thomas Cameron wrote: [...] I want to delete any spam that scores over 10, though. I believe that I should insert a new rule between the first and second, and I want to use

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-22 Thread Benny Pedersen
Andrzej A. Filip skrev den 2013-04-22 16:29: Are you ready/willing to report spam you receive to spamcop.net, razor, pyzor, ...? or dnswl, return-path ? :) -- senders that put my email into body content will deliver it to my own trashcan, so if you like to get reply, dont do it

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-22 Thread Thomas Cameron
On 04/22/2013 09:03 AM, Matus UHLAR - fantomas wrote: On 22.04.13 08:27, Thomas Cameron wrote: Currently I'm using procmail recipes for individual users, but I'm leaning heavily towards going back to spamass-milter, and rejecting everything that scores 10 or more. with thing like

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-22 Thread Thomas Cameron
On 04/22/2013 09:29 AM, Andrzej A. Filip wrote: False positives in super-spam (10 SA score) should be very rare. Exactly my point. Are you ready/willing to report spam you receive to spamcop.net, razor, pyzor, ...? That's an interesting question... Each user has their own spam folders, so

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-22 Thread jdow
On 2013/04/22 06:27, Thomas Cameron wrote: On 04/08/2013 03:52 AM, Andrzej A. Filip wrote: On 04/08/2013 05:12 AM, Thomas Cameron wrote: [...] I want to delete any spam that scores over 10, though. I believe that I should insert a new rule between the first and second, and I want to use the

Re: Much better procmail alternative (was Re: Verifying .procmailrc settings to delete high scoring spam messages)

2013-04-09 Thread Martin Gregorie
On Mon, 2013-04-08 at 19:41 -0400, David F. Skoll wrote: On Mon, 8 Apr 2013 16:02:27 -0600 Bob Proulx b...@proulx.com wrote: Karsten Bräckelmann wrote: Unfortunately, no. While procmail implements some flavor of extended Regular Expressions, there are still quite some differences

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-09 Thread Ian Turner
On Monday, April 08, 2013 05:06:57 PM Walter Hurry wrote: I agree that dev-nulling is generally a bad idea, but there may be exceptions. For example, I dump everything from hinet.net straight onto the floor. FWIW, I get ham from hinet.net. IMHO, it is not appropriate to drop mail no matter

Re: Verifying .procmailrc settings to delete high scoring spam messages

2013-04-09 Thread Lucio Chiappetti
On Sun, 7 Apr 2013, Bob Proulx wrote: Thomas Cameron wrote: I believe that would match ... and redirect the e-mail to /dev/null. Am I right? I would'nt comment on the exact procmail syntax. I have lots of procmail rules but wrote them long ago and my memory is getting rusty. I would

Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-08 Thread Andrzej A. Filip
On 04/08/2013 05:12 AM, Thomas Cameron wrote: [...] I want to delete any spam that scores over 10, though. I believe that I should insert a new rule between the first and second, and I want to use the X-Spam-Level header. But since it uses asterisks, which are interpreted as regex wildcards,

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-08 Thread Walter Hurry
On Mon, 08 Apr 2013 10:52:11 +0200, Andrzej A. Filip wrote: I would suggest redirecting such messages to another folder/maildir. The folder should auto-purge old messages (e.g. older than 30 days). Shit does happen. I remember at least one case in which mailing list (ham) thread about spammer

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-08 Thread Bowie Bailey
hinet.net straight onto the floor. By default, I just tag and deliver everything. For some of the company accounts that have spam problems and for the customers who have asked for it, I will drop high-scoring spam. -- Bowie

Re: Verifying .procmailrc settings to delete high scoring spam messages

2013-04-08 Thread Karsten Bräckelmann
On Sun, 2013-04-07 at 21:44 -0600, Bob Proulx wrote: [ Bunch of good advise snipped. ] :0 * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\* devnull/ Since procmail uses Extended Regular Expressions there is one more optimization I would make. I wouldn't list out every star. It gets hard to

Re: Verifying .procmailrc settings to delete high scoring spam messages

2013-04-08 Thread Bob Proulx
Karsten Bräckelmann wrote: Bob Proulx wrote: * ^X-Spam-Level: \*{10} Unfortunately, no. While procmail implements some flavor of extended Regular Expressions, there are still quite some differences to other regex engines, like egrep's or PCRE. Most notably, the repetition operator {n}

Much better procmail alternative (was Re: Verifying .procmailrc settings to delete high scoring spam messages)

2013-04-08 Thread David F. Skoll
On Mon, 8 Apr 2013 16:02:27 -0600 Bob Proulx b...@proulx.com wrote: Karsten Bräckelmann wrote: Unfortunately, no. While procmail implements some flavor of extended Regular Expressions, there are still quite some differences to other regex engines, I got sufficiently fed up with procmail

Verifying .procmailrc settings to delete high scoring spam messages

2013-04-07 Thread Thomas Cameron
All - I have a pretty simple .procmailrc setup for my home mail server. Right now it looks like: :0fw: spamassassin.lock * 256000 | spamc :0: * ^X-Spam-Flag:.*YES spam That dumps everything that is flagged as spam into my spam folder. I want to delete any spam that scores over 10, though.

Re: Verifying .procmailrc settings to delete high scoring spam messages

2013-04-07 Thread Bob Proulx
Thomas Cameron wrote: :0: * ^X-Spam-Level:.*\*\*\*\*\*\*\*\*\*\* /dev/null I believe that would match 10 asterisks or more, and redirect the e-mail to /dev/null. Am I right? Mostly all okay. However I don't like the .* in the front of it. That isn't likely to cause trouble but it is

Re: Verifying .procmailrc settings to delete high scoring spam messages

2013-04-07 Thread Thomas Cameron
On 04/07/2013 10:44 PM, Bob Proulx wrote: Thomas Cameron wrote: :0: * ^X-Spam-Level:.*\*\*\*\*\*\*\*\*\*\* /dev/null I believe that would match 10 asterisks or more, and redirect the e-mail to /dev/null. Am I right? Mostly all okay. However I don't like the .* in the front of it. That

High scoring spam...

2011-01-31 Thread Giles Coochey
Makes you wonder how many servers actually accept these messages these days!!! Jan 31 13:46:56 gate sendmail[28364]: p0VCkkxF028364[1]: Milter add: header: X-Spam-Status: Yes, score=70.8 required=5.0

Re: High scoring spam...

2011-01-31 Thread John Adams
Am 31.01.2011 14:33, schrieb Giles Coochey: Makes you wonder how many servers actually accept these messages these days!!! all spam traps?

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Matus UHLAR - fantomas
On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? IT's the kind of content that should be captured by clamav imho. clamav does have some kind og javascript decopding engine. -- Matus UHLAR - fantomas, uh...@fantomas.sk ;

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Per Jessen
Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? IT's the kind of content that should be captured by clamav imho. It's plain spam - personally I don't want clamav to deal with spam. clamav does have some

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Christian Brel
On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? IT's the kind of content that should be captured by clamav imho. clamav does have some kind og javascript decopding

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Per Jessen
Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? IT's the kind of content that should be captured by clamav imho. clamav does have some kind og

Re: [SPAM:9.6] Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Christian Brel
On Tue, 12 Jan 2010 12:15:41 +0100 Per Jessen p...@computer.org wrote: Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? IT's the kind of

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread John Hardin
On Tue, 12 Jan 2010, Per Jessen wrote: Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? I'm just interested in the kind of java-script(?) munging that

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Christian Brel
On Tue, 12 Jan 2010 10:56:09 -0800 (PST) John Hardin jhar...@impsec.org wrote: On Tue, 12 Jan 2010, Per Jessen wrote: Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Per Jessen
John Hardin wrote: On Tue, 12 Jan 2010, Per Jessen wrote: Christian Brel wrote: On Tue, 2010-01-12 at 10:44 +0100, Matus UHLAR - fantomas wrote: On 12.01.10 06:48, Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? I'm just interested in the kind of

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Jason Bertoch
I'm just interested in the kind of java-script(?) munging that has gone on there and what it is in 'English' for want of a better phrase. Nothing was munged, it's just random text. If so, what's the point to it? By no means a JS coder, and haven't dug deeper to find out, but couldn't it be

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Benny Pedersen
On Tue 12 Jan 2010 07:48:23 AM CET, Christian Brel wrote http://pastebin.com/m66a5a2ae X-Virus-Status: Infected (Sanesecurity.Junk.25057.UNOFFICIAL) -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Francis Russell
Jason Bertoch wrote: By no means a JS coder, and haven't dug deeper to find out, but couldn't it be pre-compiled JS and not just random text? Doubtful. I don't believe JavaScript has a bytecode or any other (except in some JavaScript engines internal representation) compiled format. Francis

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread John Hardin
On Tue, 12 Jan 2010, Jason Bertoch wrote: I'm just interested in the kind of java-script(?) munging that has gone on there and what it is in 'English' for want of a better phrase. Nothing was munged, it's just random text. If so, what's the point to it? By no means a JS

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Christian Brel
On Wed, 13 Jan 2010 00:41:00 +0100 Benny Pedersen m...@junc.org wrote: On Tue 12 Jan 2010 07:48:23 AM CET, Christian Brel wrote http://pastebin.com/m66a5a2ae X-Virus-Status: Infected (Sanesecurity.Junk.25057.UNOFFICIAL) Err, yes - I had already *highlighted* that, it was posted because

Re: Interesting Low Scoring SPAM with odd script

2010-01-11 Thread Per Jessen
Christian Brel wrote: http://pastebin.com/m66a5a2ae Anyone seen script like that? Yeah, I saw a couple of those last week. /Per Jessen, Zürich

Re: Dealing with low scoring spam - tighter MTA integration

2009-03-05 Thread Kenneth Porter
--On Thursday, March 05, 2009 7:43 AM +0100 Andrzej Adam Filip a...@onet.eu wrote: What I would like to see is a option to make spam assassin to produce weighted scores based on subset of all tests capable to work on subset of the final data available *before* message headersbody are

Re: Dealing with low scoring spam - tighter MTA integration

2009-03-05 Thread Andrzej Adam Filip
Kenneth Porter sh...@sewingwitch.com wrote: --On Thursday, March 05, 2009 7:43 AM +0100 Andrzej Adam Filip a...@onet.eu wrote: What I would like to see is a option to make spam assassin to produce weighted scores based on subset of all tests capable to work on subset of the final data

Re: Dealing with low scoring spam - tighter MTA integration

2009-03-05 Thread James Wilkinson
Andrzej Adam Filip wrote: At RCPT TO: stage there are available: * connecting client IP address (last mail hop) so big part of DNSBL and DNSWL tests *CAN* be used * envelope sender for SPF based tests * envelope sender and envelope recipient for auto white/black listing (producing some

Re: Dealing with low scoring spam - tighter MTA integration

2009-03-05 Thread Andrzej Adam Filip
James Wilkinson sa-u...@aprilcottage.co.uk wrote: Andrzej Adam Filip wrote: At RCPT TO: stage there are available: * connecting client IP address (last mail hop) so big part of DNSBL and DNSWL tests *CAN* be used * envelope sender for SPF based tests * envelope sender and envelope

Re: Dealing with low scoring spam - tighter MTA integration

2009-03-05 Thread Kenneth Porter
--On Thursday, March 05, 2009 10:31 PM +0100 Andrzej Adam Filip a...@onet.eu wrote: I try hard to preach that SA methodology of creating spam score based on weighted tests *CAN* be applied at this point too. I would like too apply such test in milter (MIMEDefang) that uses SA anyway in my

Dealing with low scoring spam - tighter MTA integration [was: 2 + 2 != 4 - Spamassassin needs a new paradigm]

2009-03-04 Thread Andrzej Adam Filip
throwing this out there for people to chew on and think about. Oh, and another problem with this: About 98-99% of my spam in-stream scores as high, that any such proposal results in a useless increase of the score. The problem lies with the LOW scoring spam. Alas, these do not tend

Re: Dealing with low scoring spam - tighter MTA integration [was: 2 + 2 != 4 - Spamassassin needs a new paradigm]

2009-03-04 Thread Karsten Bräckelmann
On Wed, 2009-03-04 at 16:02 +0100, Andrzej Adam Filip wrote: Karsten Bräckelmann guent...@rudersport.de wrote: About 98-99% of my spam in-stream scores as high, that any such proposal results in a useless increase of the score. The problem lies with the LOW scoring spam. Alas, these do

Re: Dealing with low scoring spam - tighter MTA integration

2009-03-04 Thread Andrzej Adam Filip
. The problem lies with the LOW scoring spam. Alas, these do not tend to trigger on a solid subset or meta as you proposed. In particular, RBL hits are quite rare, even more so for multiple hits. The few rules hit by low scorers are quite diverse, which complicates this. May be spamassassin should

Re: Dealing with low scoring spam - tighter MTA integration

2009-03-04 Thread John Hardin
On Wed, 4 Mar 2009, Andrzej Adam Filip wrote: This would be an entirely different application, not SA, wouldn't it? It can be developed using the same spam score logic, based subset of all tests requiring only the subset of final data available during classic run. So in other words

Re: Dealing with low scoring spam - tighter MTA integration

2009-03-04 Thread Andrzej Adam Filip
John Hardin jhar...@impsec.org wrote: On Wed, 4 Mar 2009, Andrzej Adam Filip wrote: This would be an entirely different application, not SA, wouldn't it? It can be developed using the same spam score logic, based subset of all tests requiring only the subset of final data available during

Re: Dealing with low scoring spam - tighter MTA integration [was: 2 + 2 != 4 - Spamassassin needs a new paradigm]

2009-03-04 Thread SM
At 07:02 04-03-2009, Andrzej Adam Filip wrote: May be spamassassin should create set of tests intended for use before replying RCPT TO: in SMTP session? [ test based on: sending IP address, envelope sender, envelope recipient, and name in helo/ehlo ] SpamAssassin processes the message and

Re: Dealing with low scoring spam - tighter MTA integration [was: 2 + 2 != 4 - Spamassassin needs a new paradigm]

2009-03-04 Thread Kenneth Porter
--On Wednesday, March 04, 2009 4:02 PM +0100 Andrzej Adam Filip a...@onet.eu wrote: May be spamassassin should create set of tests intended for use before replying RCPT TO: in SMTP session? Check out http://mimedefang.org/ MIMEDefang includes SA integration.

Re: Dealing with low scoring spam - tighter MTA integration

2009-03-04 Thread Andrzej Adam Filip
Kenneth Porter sh...@sewingwitch.com wrote: --On Wednesday, March 04, 2009 4:02 PM +0100 Andrzej Adam Filip a...@onet.eu wrote: May be spamassassin should create set of tests intended for use before replying RCPT TO: in SMTP session? Check out http://mimedefang.org/ MIMEDefang includes

Re: OT Alert: Forward low scoring SPAM to sa-learn.

2007-07-18 Thread Matus UHLAR - fantomas
On 17.07.07 10:40, Anthony Kamau wrote: I'm faced with a dilemma on how to use sa-learn with mail forwarded from a user's inbox on Exchange to the sendmail server. Since we just recently started using sendmail as a front end server, our bayes system is still in its infancy and spam is getting

RE: OT Alert: Forward low scoring SPAM to sa-learn.

2007-07-17 Thread Anthony Kamau
-Original Message- From: Michael Scheidell [mailto:[EMAIL PROTECTED] Sent: Tuesday, 17 July 2007 2:51 PM To: Anthony Kamau; users@spamassassin.apache.org Subject: RE: OT Alert: Forward low scoring SPAM to sa-learn. Only hope it to create shared, public folders for them to move

RE: OT Alert: Forward low scoring SPAM to sa-learn.

2007-07-17 Thread Anthony Kamau
-Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Tuesday, 17 July 2007 11:35 AM To: Anthony Kamau Cc: users@spamassassin.apache.org Subject: Re: OT Alert: Forward low scoring SPAM to sa-learn. That said, if you're just doing a forward as attachment type

OT Alert: Forward low scoring SPAM to sa-learn.

2007-07-16 Thread Anthony Kamau
Hello all. I'm faced with a dilemma on how to use sa-learn with mail forwarded from a user's inbox on Exchange to the sendmail server. Since we just recently started using sendmail as a front end server, our bayes system is still in its infancy and spam is getting through to user inboxes with

Re: OT Alert: Forward low scoring SPAM to sa-learn.

2007-07-16 Thread Matt Kettler
Anthony Kamau wrote: Hello all. I'm faced with a dilemma on how to use sa-learn with mail forwarded from a user's inbox on Exchange to the sendmail server. Since we just recently started using sendmail as a front end server, our bayes system is still in its infancy and spam is getting

RE: OT Alert: Forward low scoring SPAM to sa-learn.

2007-07-16 Thread Michael Scheidell
-Original Message- From: Anthony Kamau [mailto:[EMAIL PROTECTED] Sent: Monday, July 16, 2007 8:40 PM To: users@spamassassin.apache.org Subject: OT Alert: Forward low scoring SPAM to sa-learn. Hello all. The next step is what has me stunned - is there a standard marker

scoring spam

2006-10-20 Thread Steve Ingraham
I am trying to understand scoring for spam messages in the rules. I hope you guys can help me understand this better. I have an email header below that is from a spam email. I think I follow that the score for the various rules is in the X-Spam-Report section of the header. I am running

Re: scoring spam

2006-10-20 Thread Peter H. Lemieux
Steve Ingraham wrote: I am trying to figure out how I can get scores to this type of spam bumped up so they do not get delivered to my user mailboxes. Can anyone give me some suggestions on what I should do to stop this type of spam from being delivered? [...] X-Spam-Flag: YES X-Spam-Status:

RE: scoring spam

2006-10-20 Thread Steve Ingraham
Peter Lemieux wrote: You don't need to bump up the score; this one received an 8.3 which exceeds your 5.0 ceiling. This result is that it's tagged as spam. SA itself doesn't do anything other than tag likely spams. It's up to you to decide what to do with these messages. [...] I was

Re: scoring spam

2006-10-20 Thread Peter H. Lemieux
Steve Ingraham wrote: I was trying to see if there was anything I could change in the rules in spamassassin to raise the spam score up enough to reach the spam_hits=10 limit set up in my qmail controls so that qmail will not deliver the message. Once the spam score reaches 10 delivery is

RE: scoring spam

2006-10-20 Thread Steve Ingraham
Peter Lemioux wrote: You can modify the scoring of any rule by adding a file to /etc/mail/spamassassin that changes the score for specific rules. I named mine ZZscores.cf so it will be read after the other files in this directory. For instance, score HTML_MESSAGE_BODY1.0

RE: scoring spam

2006-10-20 Thread Bowie Bailey
R Lists06 wrote: I am sorry if I am asking this question and it is answered in the archives. I will try to go back and read those past posts but is there a site where I can download the SARE stock rules and the plugins? I am aware of Rules Du Jour but whenever I have attempted to

Re: scoring spam

2006-10-20 Thread Peter H. Lemieux
Steve Ingraham wrote: Could you explain how I can train Bayes? What specifically do I need to do to accomplish this? http://spamassassin.apache.org/full/3.0.x/dist/doc/sa-learn.html

RE: scoring spam

2006-10-20 Thread R Lists06
If you are having problems with memory after downloading the rules, you just need to be careful that you use the right ones. Read the descriptions of the rules carefully and only use the ones that you think would be useful. Any time you add more rules, the spamd children will take up more

Re: Server Wide Tagging of Very High Scoring Spam

2005-10-22 Thread Loren Wilton
local.cf (global spam settings) === required_hits 100 rewrite_subject 1 subject_tag [DEFINITE_SPAM] user_prefs === required_hits 5 rewrite_subject 0 The idea here is that all user's handle their own spam settings but the global

Re: Server Wide Tagging of Very High Scoring Spam

2005-10-21 Thread Daniel W
Daniel W wrote: I'm looking to be able to do a system such as follows: local.cf (global spam settings) === required_hits 100 rewrite_subject 1 subject_tag [DEFINITE_SPAM] body ANG_KILL_RULE_FALSE_VIRUS_SCANNER /\+\+\+ Attachment: No Virus found/ describe

RE: Server Wide Tagging of Very High Scoring Spam

2005-10-21 Thread Bowie Bailey
From: Daniel W [mailto:[EMAIL PROTECTED] Daniel W wrote: I'm looking to be able to do a system such as follows: local.cf (global spam settings) === required_hits 100 rewrite_subject 1 subject_tag [DEFINITE_SPAM] body

Re: Server Wide Tagging of Very High Scoring Spam

2005-10-21 Thread jdow
From: Daniel W [EMAIL PROTECTED] Daniel W wrote: I'm looking to be able to do a system such as follows: local.cf (global spam settings) === required_hits 100 rewrite_subject 1 subject_tag [DEFINITE_SPAM] body ANG_KILL_RULE_FALSE_VIRUS_SCANNER /\+\+\+ Attachment:

Server Wide Tagging of Very High Scoring Spam

2005-10-17 Thread Daniel W
I'm looking to be able to do a system such as follows: local.cf (global spam settings) === required_hits 100 rewrite_subject 1 subject_tag [DEFINITE_SPAM] body ANG_KILL_RULE_FALSE_VIRUS_SCANNER /\+\+\+ Attachment: No Virus found/ describe

RE: Low scoring spam

2005-02-25 Thread Robert Bartlett
To: [EMAIL PROTECTED] Cc: users@spamassassin.apache.org Subject: RE: Low scoring spam At 11:59 AM 2/24/2005, [EMAIL PROTECTED] wrote: spamd is aliases to spamassassin. Ok... May I ask why? (I excluded the rest of the headers for privacy reasons, but its just the top part of a regular email

RE: Low scoring spam

2005-02-25 Thread Robert Bartlett
, February 24, 2005 10:38 AM To: [EMAIL PROTECTED] Cc: users@spamassassin.apache.org Subject: RE: Low scoring spam At 11:59 AM 2/24/2005, [EMAIL PROTECTED] wrote: spamd is aliases to spamassassin. Ok... May I ask why?

RE: Low scoring spam

2005-02-25 Thread Ken Goods
Hmm.. I wonder if it is even using the bayes db at all. I keep seeing it find it but I dont see it actually being used. If that is the case how do I make sure Bayes will be used for each message? Thanks Robert From your logs. debug: bayes: Not available for scanning, only 48 ham(s) in

RE: Low scoring spam

2005-02-25 Thread Robert Bartlett
Message- From: Ken Goods [mailto:[EMAIL PROTECTED] Sent: Thursday, February 24, 2005 5:43 PM To: users@spamassassin.apache.org Subject: RE: Low scoring spam Hmm.. I wonder if it is even using the bayes db at all. I keep seeing it find it but I dont see it actually being used. If that is the case

RE: Low scoring spam

2005-02-25 Thread Robert Bartlett
@spamassassin.apache.org Subject: RE: Low scoring spam Hmm.. I wonder if it is even using the bayes db at all. I keep seeing it find it but I dont see it actually being used. If that is the case how do I make sure Bayes will be used for each message? Thanks Robert From your logs. debug: bayes

RE: Low scoring spam

2005-02-25 Thread Robert Bartlett
PM To: users@spamassassin.apache.org Subject: RE: Low scoring spam Hmm.. I wonder if it is even using the bayes db at all. I keep seeing it find it but I dont see it actually being used. If that is the case how do I make sure Bayes will be used for each message? Thanks Robert From your logs

Re: Low scoring spam

2005-02-25 Thread Loren Wilton
Without seeing the actual spam it is hard to say how high it could score. However, getting enough ham into Bayes such that it will run will up the score considerably. Loren

Re: Low scoring spam

2005-02-25 Thread Loren Wilton
Hmm.. I wonder if it is even using the bayes db at all. I keep seeing it It isn't. find it but I dont see it actually being used. If that is the case how do I make sure Bayes will be used for each message? debug: bayes: Not available for scanning, only 48 ham(s) in Bayes DB 200 Make sure

Re: Low scoring spam

2005-02-25 Thread Stuart Johnston
Robert Bartlett wrote: Ok Im sorry I mis understood. I ran it the way you suggested and it did come with headers this time. I attached the results. I still feel like something else is wrong. Install Razor.

Re: Low scoring spam

2005-02-25 Thread robert
Now that I got bayes working my next question is should I reactivate autowhitelist and autolearn? Thanks Robert

RE: Low scoring spam

2005-02-24 Thread Robert Bartlett
] Sent: Wednesday, February 23, 2005 8:44 AM To: [EMAIL PROTECTED]; users@spamassassin.apache.org Subject: RE: Low scoring spam At 10:31 AM 2/23/2005, Robert Bartlett wrote: Do you suggest until resolved disable this? If to disable it what exactly do I need to disable? Upon closer inspection are you

Re: Low scoring spam

2005-02-24 Thread Robert Menschel
Hello Robert, Not directly related to your problem, I don't think, but from your debug listing I see you're using the following rules files: debug: config: read file ... debug: config: read file /etc/mail/spamassassin/70_sare_random.cf ... debug: config: read file

RE: Low scoring spam

2005-02-24 Thread Matt Kettler
At 08:06 PM 2/23/2005, Robert Bartlett wrote: Well all I did was run spamd -D /path/to/message Is that a typo of spamc, or did you really try to feed a message to spamd?

RE: Low scoring spam

2005-02-24 Thread Matt Kettler
At 08:06 PM 2/23/2005, Robert Bartlett wrote: Well all I did was run spamd -D /path/to/message Wait.. even if it is a typo, it still won't work. You need to redirect things when calling spamc.. You can't pass it a filename. And spamc doesn't take a -D parameter, only spamd does... but spamd does

RE: Low scoring spam

2005-02-24 Thread robert
spamd is aliases to spamassassin. I forgot to insert the part in my email but that is what I did. Robert At 08:06 PM 2/23/2005, Robert Bartlett wrote: Well all I did was run spamd -D /path/to/message Wait.. even if it is a typo, it still won't work. You need to redirect things when

RE: Low scoring spam

2005-02-24 Thread Matt Kettler
At 11:59 AM 2/24/2005, [EMAIL PROTECTED] wrote: spamd is aliases to spamassassin. Ok... May I ask why?

  1   2   >