Re: what does amavis logging Passed CEAN with Hits: -, mean?

2008-09-17 Thread Mark Martinec
Len Conrad wrote: example: Sep 16 01:18:22 mx1 amavis[11483]: (11483-01-31) Passed CLEAN, [12.xx.40.141] [12.xx.40.141] [EMAIL PROTECTED] - [EMAIL PROTECTED], Message-ID: [EMAIL PROTECTED], mail_id: 2M64mzvIA3wf, Hits: -, queued_as: 2CC9D1AF49B, 407 ms is - the same as 0.0, or

Re: DKIM sigs started failing.

2008-09-04 Thread Mark Martinec
Larry Nedry, Out of the last 249,000 emails, DKIM_VERIFIED has only hit 18 times. DKIM_SIGNED on the other hand has hit about 58,000 times. This is highly unusual, my stats show that overall 80% of messages with a DKIM or DK signature bear a valid signature, and 20% fail validation. (checking

Re: custom rule with pattern test of 0 (zero) not processed

2008-08-26 Thread Mark Martinec
On Tuesday 26 August 2008 10:09:37 mouss wrote: dms dms wrote: Hello all, I searched high and low but could not find anywhere that says the following rule patten is invalid or not allowed in SpamAssassin 3.2.5 on CentOS 5.1 However it works with non-zero numbers... Thoughts? and TIA

Re: check: no loaded plugin implements 'check_main': cannot scan!

2008-08-22 Thread Mark Martinec
Thiago, Running spamassassin - lint -D the .pre files are read: # spamassassin --lint -D ... [1002] dbg: config: using /etc/mail/spamassassin for site rules pre files [1002] dbg: config: read file /etc/mail/spamassassin/init.pre [1002] dbg: config: read file

Re: SA getting stuck on a message

2008-08-05 Thread Mark Martinec
Munroe, SA getting stuck on a message I have only seen this happen on Cron messages generated by our apt-cacher. I am running a Debian Lenny machine with: SpamAssassin version 3.2.5, Perl version 5.10.0, amavid-new 2.6.0 Aug 1 13:02:19.507 /usr/sbin/amavisd-new[4388]: (04388-01) SA dbg:

Re: WrongMX from amavisd-new?

2008-07-28 Thread Mark Martinec
Dan, I installed WrongMX.pm today, on my secondary MX, but it does not appear to be firing. A spamassassin -D --lint does show the module to be loaded, and the module shows up in my amavisd-new logs: Jul 23 13:33:56 foo amavis[17285]: (17285-01) extra modules loaded:

Re: [sa-list] Re: Blogger URLs

2008-04-21 Thread Mark Martinec
On Monday 21 April 2008 06:27:57 Dan Mahoney, System Admin wrote: The possibility of catering the reporting protocols to different sites (i.e. the major free sites have their own reporting systems that might be better used). It's beyond the scope of this thread, but are there any docs on how

Re: Low Scores on Bounce Backs

2008-04-14 Thread Mark Martinec
On Friday 11 April 2008 15:05:59 Justin Mason wrote: Mark Martinec writes: It would also block some messages which you may or may not want to block, such as: - some automatic notifications such as calendar/meeting reminders, notifications from ticketing/PR systems (OTRS), status

Re: Low Scores on Bounce Backs

2008-04-11 Thread Mark Martinec
On Friday 11 April 2008 11:13:09 Jason Haar wrote: So are you saying as I know what all our relays are (ie whitelist_bounce_relays), I should pump that score up to 20, and effectively blacklist (we block at scores 10) any bounces (which should just happen to be 100% forged spam) sent from

Re: Low Scores on Bounce Backs

2008-04-11 Thread Mark Martinec
Joseph Brennan wrote: Jeff Koch [EMAIL PROTECTED] wrote: One of the problems is that the actual spam email is sometimes not attached. But interestly enough we are usually sent the email header of the original email. From that we (the humans) can easily spot that the IP address of the

Re: Botnet.pm causing SA timeouts

2008-04-10 Thread Mark Martinec
Jan-Peter, I just noticed BotNet (0.8) causing SA timeouts Then it just hangs for quite some time and finally runs into the timeout. Any idea? A known problem, it uses a default timeout of Net::DNS, which is very long for certain unresolvable DNS queries. Try the following patch: ---

Re: Something about message/partial

2008-04-04 Thread Mark Martinec
On Friday 04 April 2008 21:45:11 SM wrote: MS Outlook and a few other MUAs support it. There's an option to split a message into several parts. [...] It's a useful feature if you want to get around message size limits to send attachments. It can also be handy when there's poor connectivity.

Re: Dramatic increase in bounce messages to forged addresses

2008-04-03 Thread Mark Martinec
Yes, we have also seen it on many of our clients domains. Same here. Does anyone have operational experience with a scheme of labeling envelope sender addresses to recognize legitimate bounces to own mail, such as the BATV scheme (Bounce Address Tag Validation): http://mipassoc.org/batv/

Re: Where can I find out about domain keys?

2008-02-28 Thread Mark Martinec
On Thursday 28 February 2008 23:26:49 Martin Gregorie wrote: What is this domainkeys of which they speak? http://www.rfc-editor.org/rfc/rfc4870.txt http://www.rfc-editor.org/rfc/rfc4871.txt http://www.dkim.org/info/dkim-faq.html http://www.dkim.org/ Mark

Re: Script to generate whitelist based on outgoing email

2008-02-03 Thread Mark Martinec
On Sunday 03 February 2008 16:14:37 OliverScott wrote: Not sure if this will be of any use to anyone else, of if it can be made to work with anything other than Exim, but here is the first draft of a script to generate a whitelist based on outgoing email! I have had it running on a server (for

Re: p0f not catching Windows XP

2008-01-27 Thread Mark Martinec
header L_P0F_WXP X-Amavis-OS-Fingerprint =~ /^Windows XP(?![^(]*\b2000 SP)/ score L_P0F_WXP 2.3 header L_P0F_W X-Amavis-OS-Fingerprint =~ /^Windows(?! XP)/ score L_P0F_W 1.0 [...] Matt Kettler wrote: Well, that much should be obvious. Both rules are explicitly designed to

Re: spamassassin 3.2.4, DKIM and DomainKeys

2008-01-11 Thread Mark Martinec
Pascal, it seems that since my upgrade to spamassassin 3.2.4, the DKIM an DomainKeys verifiers are no more used. All I see in the debug test are the following line : # spamassassin -D testmail.txt | grep -i dkim [4163] dbg: plugin: loading Mail::SpamAssassin::Plugin::DKIM from @INC

Re: Googlepages Livefilestore spams

2008-01-09 Thread Mark Martinec
I think you mean http:\/\/[^\/]+\. in those REs. Use delimiters than slash to avoid leaning toothpicks syndrome: uri xxx m{^http://[^/]+ ... }i Mark

Re: Googlepages Livefilestore spams

2008-01-09 Thread Mark Martinec
Ben, m{^https?://(?:\w+\.)*google\.(com|co\.uk|tw)/\{2,\}search} Btw, there is no need to quote braces within the regexp, as long as they are balanced (as they usually are). m{^https ... /{2,}search} Mark

Re: Per-User required_score

2008-01-07 Thread Mark Martinec
David, I want to give users control of the required_score variable. I am using Postfix // SpamAssassin // amavis. ... spamassassin unix - n n - - pipe user=nobody argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient} If your

Re: AWL: dont understand it

2007-12-12 Thread Mark Martinec
On Thursday 13 December 2007 02:07:00 Bob Proulx wrote: The problem is that it is based upon the from address. That is an unreliable piece of data. Spammers forge from addresses all of the time. Even valid senders will sometimes fabricate from addresses. If the input to the equation can't

Re: Certain Spam prevents Spamassassin from scanning it

2007-12-09 Thread Mark Martinec
Turns out that upgrading my perl version actually downgraded my libnet version. :\ They seem to include libnet with perl now, but as an older version. I still have libnet installed (1.21), but perl uses the old one from the basepackage.. What shall I do? Is it ok to simply delete

Re: Certain Spam prevents Spamassassin from scanning it

2007-12-08 Thread Mark Martinec
Tillman, Net::SMTP::recipient: unknown option(s) ORCPT - ignored at (eval 65) line 251 Oh, and does anyone know where the last line comes from? Appeared after the last perl upgrade... Older versions of Net::SMTP (libnet) did not support ORCPT option and issue a warning. Not a serious

Re: Certain Spam prevents Spamassassin from scanning it

2007-12-08 Thread Mark Martinec
Tillman, Use of uninitialized value in pattern match (m//) at /usr/lib/perl5/5.8.8/utf8_heavy.pl line 211. /usr/lib/perl5/5.8.8/utf8_heavy.pl line 347. plugin: eval failed: panic: swash_fetch at /etc/mail/spamassassin/KAM.cf, rule __KAM_STOCKTIP50, line 1. Appeared after the last perl

Re: Duplicate header question

2007-12-04 Thread Mark Martinec
On Tuesday 04 December 2007 17:05:04 Johnson, S wrote: 554 5.6.0 Reject, is=26786-18 - Bad_Header: Duplicate header field: Message-ID This nondelivery report was generated by the program amavisd-new at host mail.maildomain.com. Our internal reference code for your message is

Re: recover quarantined messages web interface

2007-11-22 Thread Mark Martinec
Morvan Daniel, I try webmin clamav module. I'm using amavisd-new with spamassassin perl module. Quarantined messages are in plain text format below /var/spool/amavisd/quarantine/spam-xxx.gz. If I use the resend buton from web interface (webmim clamav quarantine module) to recover some

Re: quarantine and junkmailbox configuration

2007-11-22 Thread Mark Martinec
Morvan Daniel, I use amavisd-new with spamassassin loaded as a perl module. My actual config: /etc/amavisd/amavisd.conf: $sa_tag_level_deflt = 2.0; # 2+ put X-Spam-Status headers only $sa_tag2_level_deflt = 5.0;# 5+ put X-Spam-Flag = YES $sa_kill_level_deflt = 8; # 8+ send to

Re: bug 5589 patching

2007-11-14 Thread Mark Martinec
Ram, http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5589 I had patched my SA 3.2.3 with the Big Combo patch , but that patch is apparently cancelled with now a replacement patch Do I need to bother ? No need to worry. Either keep it as it is, or apply the current version of the

Re: Disabling speciffic RBLs

2007-10-22 Thread Mark Martinec
John Rudd wrote: If you want to disable JUST spamhaus, and not the other RBLs: Find the rules cf files (probably in /usr/local/share/spamassassin) grep through the files to find the names of the various spamhaus rules. Go to /etc/mail/spamassassin/local.cf (or wherever your site wide

Re: Mailman cooler [Was Re: unsubscribed]

2007-10-15 Thread Mark Martinec
On Monday 15 October 2007 23:52:04 Daryl C. W. O'Shea wrote: [EMAIL PROTECTED] wrote: BP comprised of people who know how email works. Wish this list would use e.g., mailman, where one can turn off delivery. I wish I had an ice cream cone. :) We use what the ASF provides to us for free.

Re: 8bit encoding in mail header by SpamAssassin

2007-10-11 Thread Mark Martinec
Lars, Oct 10 09:17:05 www amavis[2981]: (02981-06) BAD HEADER from [EMAIL PROTECTED]: Non-encoded 8-bit data (char FC hex) in message header 'X-Spam-Report'\n X-Spam-Report: ... Nachricht wurde nur \\374bervertrauensw...\n The administrator claims to be using version 3.2.3 and

Re: What I want to see in SA RBL support

2007-10-10 Thread Mark Martinec
On Wednesday October 10 2007 09:58:35 John Rudd wrote: I want: use_rbls zen.spamhaus.org list.dsbl.org foo.bar.baz A concept of per-zone settings (not per-rule) would also allow other similar configurations, such as specifying timeouts individually for each zone, allowing to quickly give up

Re: header lines being folded into one?

2007-10-10 Thread Mark Martinec
On Tuesday October 9 2007 20:19:36 Loren Wilton wrote: To me it looks like a misfeature. I think I would agree that it may be a misfeature in the case of this specific header. In general though it may not be. Consider the case of two separate Subject: headers, often with completely

Updated patch on async events handling and DNS lookup completions for SA 3.2.3

2007-10-10 Thread Mark Martinec
I prepared a new version of the async timeout handlings patch for SpamAssassin 3.2.3, to include the more recent feedback and findings on compatibility. The issue is decribed at: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5589 I would appreciate if anyone is willing to give it a

Re: header lines being folded into one?

2007-10-09 Thread Mark Martinec
Per, X-Originating-IP: [17.148.16.66] X-Originating-IP: 134.32.140.207 ... It looks to me like the two X-Originating-IP lines are merged into one, and my regex is then applied to: X-Originating-IP: [17.148.16.66]134.32.140.207 True (with newline inbetween). Is this normal/correct

Re: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Mark Martinec
Frank, Oct 2 09:15:57 localhost spamd[6032]: info: entering helper-app run mode Oct 2 09:15:57 localhost spamd[6032]: pyzor: opening pipe: /usr/bin/pyzor check /tmp/.spamassassin6032naLz9htmp Oct 2 09:15:57 localhost spamd[6033]: util: setuid: ruid=0 euid=0 Oct 2 09:16:02 localhost

Re: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Mark Martinec
Frank, pyzor_timeout 5 where do I have to look for this parameter? I grepped through /etc recursive but there was no value pyzor_timeout. $ man Mail::SpamAssassin::Plugin::Pyzor A different question is why pyzor took longer than 5 seconds. Make sure pyzor works from a command line first.

Re: Bayes innodb problems

2007-09-27 Thread Mark Martinec
SELECT count(*) FROM bayes_token WHERE id = '4' AND ('1190846660' - atime) '345600'; Who the hell wrote *that* query? Is MySQL smart enough to rearrange that equation to give an indexable comparison? It doesn't seem to make any

Re: Async timeouts in SA

2007-09-27 Thread Mark Martinec
Giampaolo, how to catch timeouts from outstanding asynchronous queries in SA 3.2.3. Justin Mason writes: could you open an enhancement request? there should be a callback function that we call on the $obj hash, timeout_callback maybe. Until that's implemented, see the code for

Re: Problem logging from SA when running Amavisd

2007-09-25 Thread Mark Martinec
Jeff, Thanks for the patch Mark. I'll put it in production tomorrow. For your purpose, you want to run it with option '-d info', e.g.: # amavisd -d info which will give you the 'info'-level debug at amavisd log level 1 or above (set: $log_level=1); With the next version I'll make the '-d

Re: Q about mail proxy servers and setups

2007-09-24 Thread Mark Martinec
Michael, I tried. That was my first suggestion. That would fix graylisting (which I don't do), fix SPF an SPF HELO, and SENDER ID, blacklisting, tarpitting, etc. SPF, sid, blacklisting etc. work just fine on an internal host as long as the proxy is preserving the information about the

Re: Every e-mail is now getting a new score, creating a lot of false postive.

2007-09-24 Thread Mark Martinec
Just in case, make sure the --lint passess with no complaints, e.g: # su vscan -c 'spamassassin --lint' David B Funk writes, Cannot tell for sure (I don't use amavisd) but that looks like something is broken in the way that messages are being passed into the SA engine so that it no longer

Re: R: Non-DNS async support

2007-09-20 Thread Mark Martinec
Giampaolo, Almost. One of the biggest problems I see is that one can't register a socket with AsyncLoop.pm. Thereby, when DNS lookups are finished, the whole loop stops regardless of outstanding non-DNS-based lookups. See sub complete_lookups in AsyncLoop.pm: my $nfound =

Re: Non-DNS async support

2007-09-20 Thread Mark Martinec
Giampaolo, Well, I have 3.2.1 and the excerpt from AsyncLoop.pm was from there. But anyway, how is supposed to be set the timeout value of a non-DNS query? The current code in trunk is able to specify and honour individual timeouts for each async request - and it defaults to rbl_timeout if not

Re: Problem logging from SA when running Amavisd

2007-09-20 Thread Mark Martinec
Jeff, I'm working on a SpamAssassin plugin for a university research project. I've debugged a lot of it by running SpamAssassin from the command line, and using the SA logger's dbg() and info() methods to output stuff. Now I need to put it in a production server and see the same debug

Re: spamd and plugins

2007-09-19 Thread Mark Martinec
jonathan, so given that amavisd is already daemonized... does this suggest that there would be minimal gains in moving to spamd called from postfix? Yes, practically no difference in throughput, possibly even some loss in throughput due to spamc/spamd being invoked once per recipient, and

Re: Authenticated SMTP and RBLs

2007-09-12 Thread Mark Martinec
On Wednesday September 12 2007 20:36:50 [EMAIL PROTECTED] wrote: while setting proper trust relatios can solve the problem for mails internal to the system, without that auth'd bit in the received header everybody outside the system will still see the message as coming from a dialup and

Re: Problem after upgraded.

2007-09-11 Thread Mark Martinec
On Monday September 10 2007 10:24:58 [EMAIL PROTECTED] wrote: I use perl and it upgraded my system from spamassassin 3.1.8 to 3.2.3, once that happen when mail comes into the box I get this error... parts_decode_ext FAILED: parsing file(1) results - missing last 1 results at (eval 65) line

Re: can I specify timeouts for a specific DNS rule

2007-09-07 Thread Mark Martinec
ram, On Fri, 2007-09-07 at 08:36 -0400, Matt Kettler wrote: No, because all the DNS tests are run together as a batch. (this way the lookups run in parallel) Besides, if completewhois is the only slow RBL, the timeout for it is going to effectively be 4 seconds anyway. (ie: if 90% of the

Re: Parsing Received Headers

2007-09-03 Thread Mark Martinec
Bret, I'm trying to get received headers to parse correctly because the ones from CommuniGate Pro don't always. And, since I'm already modifying the headers in my connector due to the MTA not being able to do RDNS without rejecting based on it, I'm not aware that certain types of headers

Re: Error: Day '39' out of range 1..31

2007-09-02 Thread Mark Martinec
On Sunday September 2 2007 12:16:30 Yves Goergen wrote: I'm getting tons of these log messages in the last days: Sep 2 11:06:37 mond spamd[11276]: Day '39' out of range 1..31 at /usr/local/share/perl/5.8.4/Mail/SpamAssassin/Util.pm line 445 The number varies from 0 and 32 to 39... Using

Re: header /^\Q...\E$/m

2007-09-01 Thread Mark Martinec
On Saturday September 1 2007 05:06:24 [EMAIL PROTECTED] wrote: If header J Delivered-To =~ /.mailing list [EMAIL PROTECTED]/ doesn't match this mail, but header J Delivered-To =~ /mailing list [EMAIL PROTECTED]/ does, why doesn't header J Delivered-To =~ /^mailing list [EMAIL PROTECTED]/

Re: two supposedly identical SA boxes, with slightly different report output -- help find the diff?

2007-08-29 Thread Mark Martinec
Andy Dills wrote: For what it's worth, the fuzzyocr hashing is of very limited value, and in many cases is a severe performance hit. I found that scanning the hashes, due to the fuzzy nature, is more costly than just rescanning the file with OCR, as *each* *and* *every* hash must be checked

Re: Occasional spamassassin: Connection refused

2007-08-29 Thread Mark Martinec
Simon, connect to transport spamassassin: Connection refused You do not have a transport named 'spamassassin' in Postfix master.cf file. The name of a transport comes from a content_filter setting, a FILTER action in an access map or header/body checks, or a transport map entry. The name of a

Re: spamd keeps running at 99% CPU until i kill the process

2007-08-28 Thread Mark Martinec
Richard, To add information to this problem, it appears that spamd does eventually give up after 5 minutes Capture a message causing touble from a MTA queue, and feed it to a command line spamassassin with -t -D options. Mark

Re: debug returns misleading information (dns/async)

2007-08-13 Thread Mark Martinec
Bug 5581 / patch attachment 4081 seems to solve my problem BTW Mark, very nice DNS timings in debug output :) Thanks for trying it out! Regards Mark

Re: Detecting short-TTL domains?

2007-08-11 Thread Mark Martinec
On Saturday August 11 2007 02:13:32 John D. Hardin wrote: What I had in mind was a custom DNS client code, or playing with the options to Net::DNS to query the authoritative server directly. Regardless, obtaining that information will be rather ugly. It may also be impractical or imposssible

Re: Detecting short-TTL domains?

2007-08-10 Thread Mark Martinec
John, Hm. So, I'm sure I can figure this out eventually, but does anyone know the right Net::DNS way to extract the TTL? I don't think it is possible to obtain the original TTL from DNS responses. The information received in a reply only indicates a remaining time this information has,

Re: FW: Performance problem after upgrading from SA 3.2.1 to 3.2.2

2007-08-10 Thread Mark Martinec
Donald, I had posted before, but we couldn't figure out what was adding 3+ seconds processing time after I upgraded from SA 3.2.1 to 3.2.2. One reason for slowness is a missing call to {async}-set_response_packet in Plugin::ASN, which leds SpamAssassin think the request never arrived and waits

Re: DK_POLICY_SIGNSOME

2007-08-07 Thread Mark Martinec
Dan, Yes, this is normal. An absence of a policy record implies a default policy, which is a neutral 'signs some mail'. True, but perhaps, SA could hit a different rule when encountering the EXPLICIT signsome policy versus the IMPLICIT, i.e. DK_POLICY_SIGNSOME_DEFAULT or something

Re: DK_POLICY_SIGNSOME

2007-08-07 Thread Mark Martinec
Kai, Mark Martinec wrote on Tue, 7 Aug 2007 10:22:22 +0200: Domains which choose a default policy are not required to publish a policy (or SSP) record. Penalizing them for choosing not to explicitly publish what is a default anyway, would be unjust. I think that's not the point

Re: DK_POLICY_SIGNSOME

2007-08-06 Thread Mark Martinec
Rob, When the domainkey policy record for the domain in question says the domain signs some of its email. Heheh.. Yeah, I guessed that much, but, we *don't* sign email. Not DK(IM) or anything else. Yes, this is normal. An absence of a policy record implies a default policy, which is a

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Mark Martinec
John, Botnet 0.8 is up and available. It took me a while (things have been REALLY busy at work for the last 6 months), but it's there. http://people.ucsc.edu/~jrudd/spamassassin/Botnet-0.8.tar Thanks, very nice. What changed between 0.7 and 0.8: It seems a patch by Daniel J McDonald was

Re: DK_POLICY_SIGNSOME

2007-08-06 Thread Mark Martinec
Rob, Yes, this is normal. An absence of a policy record implies a default policy, which is a neutral 'signs some mail'. Personally, I find it strange to call 'signs some mail' neutral if there's nothing that indicates that we might actually do 'sign some mail'. But I haven't read all docs

Re: No Bayes!!

2007-06-28 Thread Mark Martinec
So what's the best fix for this? Should one just freeze SA at an earlier version on a production server until this is fixed upstream? Is upstream aware of the problem and working on a fix for it? Find out where the problem lies. When the component that needs fixing is known, then something

PayPal DomainKeys/DKIM whitelisting - update

2007-06-18 Thread Mark Martinec
With the PayPal transitioning its service for European customers from UK to Luxemburg, it is beginning to use new sending address, which may not be in people's whitelist, so here is my update to facilitate legitimate PayPal mail reaching its customers (I'm including ebay entries for good measure):

Re: Troubleshooting SA: regex time_t 3 min delays

2007-06-18 Thread Mark Martinec
Peter, I blew away SA today and am re-installing via CPAN - I think it may be something to do w/ my Perl installation as a whole... Plausible??? Can't say, my first suspects would be DNS resolver or complex regexps. I've reinstalled 3 times w/ the same appalling results 10-15 minute

Re: These are getting through SA...

2007-06-15 Thread Mark Martinec
Phil, Bill, Mark, I patched Dns.pm but this didn't resolve the issue for me. You can test with the sample messages I posted to bugzilla: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5506 I was getting this sort of symptom without using Botnet. It's almost as if something's

Re: missing tag

2007-06-15 Thread Mark Martinec
Daryl writes: Make sure your milter is providing a return path header field so that SA gets the correct envelope-from address. I believe old versions of amavisd-new don't do this. If the milter fails to do this SA will end up using the From: header field value and, yeah, you'll get SPF fail.

Re: These are getting through SA...

2007-06-15 Thread Mark Martinec
Bill, There is now an additional patch at: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5511 which should fix this. Mark, thanks for the patches. However, even with both Dns.pm patches applied, unless I set rbl_timeout to a high enough time interval, SA still misses the

Re: These are getting through SA...

2007-06-15 Thread Mark Martinec
...a bug pause here... bug - big (29 seconds)

Re: These are getting through SA...

2007-06-15 Thread Mark Martinec
Bill, Hmmm, once I patched the correct SA version Dns.pm file, Mark's patches worked fine. However, perhaps my error caused Mark to find a bug, as noted by his follow-up e-mail, which might have gone undetected otherwise. :-) Indeed, thanks! (but there were two other similar reports as

Re: Freebsd Port of SA 3.2.1

2007-06-14 Thread Mark Martinec
(now if we could decide how to fix/check umask. No real way of knowing if it's a install/reinstall, Only flag is during portupgrade I think. I see, I thought the ports Makefile explicitly makes these directories if missing, but now I see the perl makefile does it: ... Installing

Re: missing tag

2007-06-14 Thread Mark Martinec
Jerry, This came in with no tag or subject modification. Any idea what's up? Amavis log follows the message. (09479-05) Passed, [EMAIL PROTECTED] - [EMAIL PROTECTED], quarantine HhrEwzHAq2Ia, Message-ID: ..., Hits: 10.769 Most likely reason: recipient domain (durandinterstellar.com) is

Re: No buffer space available

2007-06-13 Thread Mark Martinec
spamd[46771]: bayes: cannot open bayes databases /usr/local/share/spamassassin/bayes_* R/W: lock failed: No buffer space available That wouldn't be TCP buffers. It's doing file I/O not network I/O. Since it's file buffers, which on nearly every OS are dynamic, it implies Mike's machine

Re: These are getting through SA...

2007-06-13 Thread Mark Martinec
Phil, What happens if Botnet is patched to use Mail::SpamAssassin::DnsResolver instead of Net::DNS::Resolver? I'm musuing about Net::DNS::Resolver's default timeouts and retries... Phil (probably barking up the wrong tree) It would do good if Botnet would impose a time limit on its DNS

Re: DNS tests getting aborted

2007-06-13 Thread Mark Martinec
Actually my DNS is working fine. Other DNS rulesets are hitting fine like RCVD_IN_BL_SPAMCOP_NET In order to get URI tests working I have to put rbl_timeout 40 in my local.cf The default rbl_timeout of 15 is too less, but that is strange. It had been working with my older SA 3.1.5 though

Re: Freebsd Port of SA 3.2.1

2007-06-13 Thread Mark Martinec
Michael, I am using FBSD-6.2 amd64 and ran into this problem when running make: bunch of other stuff all okay stopped here: Manifying blib/man3/Mail::SpamAssassin::Plugin::RelayCountry.3 make -f spamc/Makefile spamc/libspamc.so gcc -Wl,-R/usr/local/lib/perl5/5.8.8/mach/CORE

Re: Freebsd Port of SA 3.2.1

2007-06-13 Thread Mark Martinec
I am using FBSD-6.2 amd64 and ran into this problem when running make: bunch of other stuff all okay stopped here: Manifying blib/man3/Mail::SpamAssassin::Plugin::RelayCountry.3 make -f spamc/Makefile spamc/libspamc.so gcc -Wl,-R/usr/local/lib/perl5/5.8.8/mach/CORE

Re: Freebsd Port of SA 3.2.1

2007-06-13 Thread Mark Martinec
+.if ${ARCH} == i386 +.endif Please don't do that! Both of the following cc commands need option -fPIC in order to be able to build a shareable library: gcc -fPIC -Wl,-R/usr/local/lib/perl5/5.8.8/mach/CORE spamc/libspamc.c spamc/utils.c -o spamc/libspamc.so -shared

Re: These are getting through SA...

2007-06-12 Thread Mark Martinec
Luis, I don't have any URIBL rules firing up (SA 3.2.0 from source here, most of the other relevant info is in the header of the mail I sent before to test). Where did you get them? [...] But the main difference between the live run and the ones I did with SA by itself (both as root and as

Re: These are getting through SA...

2007-06-12 Thread Mark Martinec
Luis, Namely with 22 RBL results coming back, the last one (which was the crucial URIBL test) had a timeout of 0 and was ignored even though dns result did arrive. Moreover, there is a bug in Mail::SpamAssassin::Dns, where a late-spawned URIBL queries (which only start after Razor,

Re: These are getting through SA...

2007-06-12 Thread Mark Martinec
Bill, Mark, just curious if you are running Botnet? I found that some messages cause the Botnet RDNS test to timeout after hanging for about 30 seconds, and then network test randomly fail (primarily URIBL tests). I found that if I disable Botnet, then all network tests will run fine on

Re: These are getting through SA...

2007-06-12 Thread Mark Martinec
Bill, Mark, I patched Dns.pm but this didn't resolve the issue for me. You can test with the sample messages I posted to bugzilla: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5506 Yes, it is the same problem as I describe in

Re: What score do you get on this Nigerian Scam?

2007-05-30 Thread Mark Martinec
Can people scan the attached spam for me and let me know what scores they get? I got the following hits: ADVANCE_FEE_1, BAYES_00, HTML_MESSAGE Content analysis details: (8.2 points, 6.8 required) pts rule name description --

Re: What score do you get on this Nigerian Scam?

2007-05-30 Thread Mark Martinec
where are the RELAY_JP and RELAY_NG rules coming from? Local rules: # countries prone to abuse and low legit mail volume # can't count these as spam outright as there is legitamate mail here # but a slight bias is in order for countries with high spam:ham ratios header RELAY_TW

Re: What score do you get on this Nigerian Scam?

2007-05-30 Thread Mark Martinec
where are the RELAY_JP and RELAY_NG rules coming from? header RELAY_NG X-Relay-Countries=~/\bNG\b/ describe RELAY_NG Relayed through Nigeria Old cf from Matt Kettler Indeed. It might be useful to place these in the base set, or at least sa-updated rules. I have the impression that not many

Re: Spamassassin 3.20 and Amavis-New

2007-05-29 Thread Mark Martinec
Martin, Since I upgraded to Spamassassin 3.20 I get this (amavis) messages in my logfiles (for each incoming mail) Amavis New 2.4.3 May 29 08:21:05 linux1.rk /usr/sbin/amavisd[4365]: (04365-01) extra modules loaded: Mail/SpamAssassin/Locales.pm, Mail/SpamAssassin/Plugin/Bayes.pm,

Re: Spamassassin 3.20 and Amavis-New

2007-05-29 Thread Mark Martinec
Martin, You got the syntax wrong, remove the commas, the qw Perl operator splits on whitespace and commas remain part of a filename. Removing the commas has one effect: Starting virus-scanner (amavisd-new):Subroutine is_charset_ok_for_locales redefined at

Re: Out of memory when deleting address from AWL

2007-05-26 Thread Mark Martinec
Matt Kettler wrote: Alexander Shikoff wrote: I get an error when trying to remove an address from AWL: # spamassassin -x --remove-addr-from-whitelist [EMAIL PROTECTED] [85023] warn: auto-whitelist: open of auto-whitelist file failed: Out of memory during ridiculously large request at

Re: Spamassassin 3.2.0

2007-05-21 Thread Mark Martinec
Ming Hou, My issue Mail::DKIM and Mail::DomainKeys are required Crypt::OpenSSL::Random and Crypt::OpenSSL::RSA. But, I could not get Crypt::OpenSSL::Random to be built successfully because it always complained the following messages: Edit Makefile.PL and add -lssl and -lcrypto to the

Re: SA with no score/no tests

2007-05-18 Thread Mark Martinec
Jerry Durand wrote: Someone had asked about a no tests/no score result, one just popped up in my logs and it's even explains why there are no tests. This could be a reason for that sort of result. May 17 21:26:11 interstellar.com /usr/bin/amavisd[15704]: (15704-02) spam_scan: not wasting

Re: SA and Amavisd-new 2.5.0

2007-05-15 Thread Mark Martinec
Jerry, I understand they're not true virus files, but the default value of 0.1 is way low and was causing them to be passed on to users. It seems the SA rules to catch these should be in the standard set. Release notes suggest a set of SA rules to match these. Although high scores can be

Re: test=none

2007-05-15 Thread Mark Martinec
No, score=0 tagged_above=-999 required=1.7 tests=[none] What does tests=[none] mean? Matt Kettler wrote: That's generated by amavis, not spamassassin. My guess, based on my limited knowledge of amavis, is that message means one of the following: Amavis did run the message through SA, but

Re: perl version

2007-05-14 Thread Mark Martinec
Is there a standard perl version that the SA team aspires to and uses as a baseline or some sort? From the README file: Perl 5.6.1 or a later version is required. But 5.8.8 is the workhorse of the day... Mark

Re: Poor performance with v3.2.0

2007-05-10 Thread Mark Martinec
Justin Mason wrote: I have a theory that this would indeed cause major slowdowns, since every warning message has to be transmitted via UDP to the syslogd daemon, who then writes it synchronously to disk. That is a pretty slow operation, and causes I/O. Just a guess: if strings being

Re: 3.2.0-rc2?

2007-04-17 Thread Mark Martinec
Justin Mason wrote: How's this working out? Any good/bad reports? No problems here, 3.2.0-rc2 is fine and runs nicely as far as I am concerned (using it with amavisd-new; no experience with spamd here). Thanks for the hard work! Mark

Re: domainkey

2007-04-16 Thread Mark Martinec
[31077] warn: plugin: failed to parse plugin (from @INC): Can't locate Mail/DKIM.pm [EMAIL PROTECTED] ~]# rpm -q perl-Mail-DomainKeys perl-Mail-DomainKeys-1.0 What other package do i need? Like the message says, you need Mail::DKIM if you have SA::Plugin::DKIM enabled. (Mail::DomainKeys

Re: CentOS 5 with FuzzyOCR

2007-04-16 Thread Mark Martinec
These seem to be conflicts between the POSIX and Fcntl modules from Perl; not something inherently in FuzzyOcr. FuzzyOcr's author(s) should really look at whether importing these from two places is really necessary, however. Is there anything i can do to fix this? It is a cosmetic

Re: yahoo groups: Date: fields flagged as non-rfc-2822-compliant?

2007-04-13 Thread Mark Martinec
On Saturday April 14 2007 01:24:47 John Clements wrote: Date: 05 Apr 2007 05:05:39 -0700 Date: 05 Apr 2007 05:05:39 -0700 Date: Thu, 05 Apr 2007 06:46:01 -0500 Now, I took a quick look at rfc 2822, and all of the Date fields in this e-mail would appear to be compliant. Yes, the

<    1   2   3   4   5   6   7   8   >