Jack Gostl wrote: > > ----- Original Message ----- From: "Steven Stern" > <[EMAIL PROTECTED]> > To: "Spamass" <users@spamassassin.apache.org> > Sent: Wednesday, July 12, 2006 4:31 PM > Subject: Re: Image only spam > > >> Jack Gostl wrote: >>> Thanks for the response. >>> >>> Take it slow with me, spamassassin has been running so well for so >>> long that I haven't had to fiddle with it in ages and I don't >>> remember the details. Do I add these rules to my user_prefs? Or to my >>> /etc/mail/local.cf files? >>> >>> ----- Original Message ----- From: "Steven Stern" >>> <[EMAIL PROTECTED]> >>> To: "Spamass" <users@spamassassin.apache.org> >>> Sent: Wednesday, July 12, 2006 9:13 AM >>> Subject: Re: Image only spam >>> >>> >>>> Jack Gostl wrote: >>>>> I'm running SpamAssassin version 3.0.3 running on Perl version 5.8.2 >>>>> under AIX 5.3. Starting a few months ago, I have been absolutely >>>>> inundated with "image only spam". I've gone from catching 99% of the >>>>> spam with almost no false positives to less than 85%. I asked about >>>>> this >>>>> awhile ago, and tried to upgrade to SpamAssassin version 3.1.1 running >>>>> on Perl version 5.8.0, and didn't see much improvement, so I left the >>>>> prod machine alone. >>>>> >>>>> I'm sure I'm not the only one with this problem. Has anyone had any >>>>> success with it? >>>>> >>>>> Thanks... >>>>> >>>>> Jack >>>>> >>>> >>>> Are you using the SARE_STOCK rules from RulesDuJour at >>>> rulesemporium.com? We catch more than 99% of the image only stuff with >>>> the standard RBLs and 70_sare_stock.cf. >>>> >>>> In case you ask, these are the SARE rules we're using: >>>> >>>> TRUSTED_RULESETS="SARE_GENLSUBJ0 SARE_OBFU SARE_REDIRECT_POST300 >>>> SARE_ADULT SARE_HEADER0 SARE_CODING SARE_SPECIFIC SARE_SPOOF SARE_FRAUD >>>> SARE_WHITELIST_SPF SARE_WHITELIST_RCVD SARE_URI0 SARE_OEM SARE_STOCKS"; >>>> >>>> -- >>>> >>>> Steve >>>> >> Hop over to the Rules Emporium (http://rulesemporium.com) and read >> about RulesDuJour. Install that and set up cron job to look for >> updates once a day. That's about it. It's about 30 minutes of think >> work up front to understand the documentation and install it. After >> that, set it and forget it. >> >> http://www.exit0.us/index.php?pagename=RulesDuJour >> >> I think you'll be happy with the trusted ruleset line above. > > wanted to tell you how this all turned out. > > I installed the new rules, incorrectly as Dimitri observed, and then > restarted spamassassin. (spamd actually). The spam capture rate has > zoomed from 85% into the high 90s. Looking back I see that we replaced > our processor about a year ago, and have been exceptionally stable since > then. We haven't IPLed in almost a year, which also means that > spamassassin probably hasn't been started in almost as long. > > Obviously the new rules weren't the reason for the improvement, since > they were installed wrong. So it must have been the restart. This makes > me wonder, was it a "corruption", or is there a cumulative effect. I > wonder if anyone has any thoughts on that. > >
I have a cron job scheduled for every Sunday sa-update && spamassassin --lint && /etc/init.d/spamassassin restart This will pick up updates to the basic SA rules if they update them. -- Steve
