Re: Re-running SA on an mbox

2009-09-20 Thread Theo Van Dinter
You probably want spamassassin --mbox. :) It won't modify the messages in-place, but you can do something like spamassassin --mbox infile outfile. If you're talking about sa-learn, though, it also knows --mbox. On Sun, Sep 20, 2009 at 9:46 PM, MySQL Student mysqlstud...@gmail.com wrote: Yeah,

Re: About reporting

2009-09-13 Thread Theo Van Dinter
On Sun, Sep 13, 2009 at 5:08 PM, João Eiras joao.ei...@gmail.com wrote: Should the file message.txt in the example contain the full -mail with headers, attachments and everything ? Yes. It should be the original and complete message. Does the reporting tool remove all information about the

Re: Filtering depending mail header

2009-09-08 Thread Theo Van Dinter
There's no way to do that with SpamAssassin itself. Once you send something to SA, it will do the whole process (there's short circuiting, but that's not really what you want here). It sounds like you're trying to not filter internal mail but filter external mail, so I would recommend two

Re: How do I make Net::DNS::Resolver take /etc/hosts into account?

2009-07-01 Thread Theo Van Dinter
On Wed, Jul 1, 2009 at 3:23 AM, Per Jessenp...@computer.org wrote: Back to the subject line - how do I make Net::DNS::Resolver take /etc/hosts into account? a) of course it doesn't, /etc/hosts isn't DNS, so why would Net::DNS look at it? :) b) my guess is that you can't, but it's a question for

Re: Plugin extracting text from docs

2009-06-25 Thread Theo Van Dinter
On Thu, Jun 25, 2009 at 11:48 AM, Matus UHLAR - fantomasuh...@fantomas.sk wrote: I am not sure but I think something alike was done. What I mean is to have generic chain of format converters, where at the end would be plain image or even text, that could be processed by classic rules like

Re: Plugin extracting text from docs

2009-06-25 Thread Theo Van Dinter
On Thu, Jun 25, 2009 at 1:12 PM, Jonas Eckermanjonas_li...@frukt.org wrote: Already exists, check recent list history for set_rendered. I though that was for text only. It is only for text. In any case, any plugin looking for images, or a PDF, will most likely look at MIME type and/or file

Re: Plugin extracting text from docs

2009-06-25 Thread Theo Van Dinter
On Thu, Jun 25, 2009 at 3:41 PM, Jonas Eckermanjonas_li...@frukt.org wrote: Matus example was a Word document that contained as PDF wich (might in turn contain an image). A plugin that knows how to read word document could extract th text of the word document and then use set_rendered to make

Re: How many people are still using perl 5.6.x?

2009-06-25 Thread Theo Van Dinter
Well, the point is that if it works, don't break it. Yes, you can totally avoid upgrades, depending on your environment. Sometimes you have no choice and continue to run old versions of software or firmware or ... Get over it. :) If you want to continue debating system administration issues,

Re: Bayes and SQL.

2009-06-22 Thread Theo Van Dinter
On Mon, Jun 22, 2009 at 6:06 AM, Kasper Sacharias Eenbergk...@hovmark.dk wrote: I'm not completely sure that force-expire does anything. I ran it several times last week, and nothing showed up in the 'last expiry atime' column. So i figured it wasn't working. Please keep in mind that

Re: BAYES_99 score lint

2009-06-22 Thread Theo Van Dinter
The debug output is saying that the meta rule, LOCAL_BAYES_RTF, has a dependency, BAYES_99, which has a 0 score. In the score line, there are two zero values. ;) It depends what scoreset you're running in. Also, just because 50_scores.cf has something set doesn't mean something later on doesn't

Re: new spam using large images

2009-06-19 Thread Theo Van Dinter
On Fri, Jun 19, 2009 at 3:04 AM, Jason Haarjason.h...@trimble.co.nz wrote: Speaking of image/rtf/word attachment spam; is there any work going on to standardize this so that the textual output of such attachments could be fed back into SA? That functionality already exists (has for almost 3

Re: new spam using large images

2009-06-19 Thread Theo Van Dinter
On Fri, Jun 19, 2009 at 4:42 PM, Charles Gregorycgreg...@hwcn.org wrote: H. Big question for developers: Does the performance 'burden' of a large e-mail come from the 'reading' of that mail into spamassassin and initial processing? Or is the 'cost' of a large message only 'paid' when SA

Re: new spam using large images

2009-06-19 Thread Theo Van Dinter
, Larry M.rosenbau...@ornl.gov wrote: From: felic...@kluge.net On Behalf Of Theo Van Dinter On Fri, Jun 19, 2009 at 3:04 AM, Jason Haarjason.h...@trimble.co.nz wrote: Speaking of image/rtf/word attachment spam; is there any work going on to standardize this so that the textual output

Re: Suggested Change For FS_TEEN_BAD

2009-06-18 Thread Theo Van Dinter
On Thu, Jun 18, 2009 at 7:26 AM, Michael Monneriemichael.monne...@is.it-management.at wrote: On Mittwoch 17 Juni 2009 Theo Van Dinter wrote: Yes, it matters (one path is tried then the other has to be tried, as opposed to having a single path) So which is better performance wise? I guess [sz

Re: Suggested Change For FS_TEEN_BAD

2009-06-17 Thread Theo Van Dinter
Yes, it matters (one path is tried then the other has to be tried, as opposed to having a single path), though the overall amount is probably negligible. Perl's RE compiler could well optimize this away anyway. On Wed, Jun 17, 2009 at 7:45 PM, Kelsonkel...@speed.net wrote: Wouldn't it be more

Re: Suggested Change For FS_TEEN_BAD

2009-06-15 Thread Theo Van Dinter
On Tue, Jun 16, 2009 at 12:23 AM, Andy Dormanador...@ironicdesign.com wrote: However, I was a little surprised that SpamAssassin did not have a test for a phrase in the subject that seemed to clearly indicate potential child porn like girls getting f**ked. SpamAssassin is not a porn filter,

Re: Capturing and using values....

2009-06-14 Thread Theo Van Dinter
No, SA doesn't do that. The best way to do this is to write a plugin where you can do whatever you want. :) On Sun, Jun 14, 2009 at 3:18 PM, Charles Gregorycgreg...@hwcn.org wrote: Got a usage question. Is there a simple mechanism, similar to Perl's use of parantheses and $1 to 'capture' a

Re: Question on add-to-blacklist

2009-06-02 Thread Theo Van Dinter
Well, the first problem is that the AWL has no impact on Bayes. They're totally independent. Perhaps you want sa-learn ? On Tue, Jun 2, 2009 at 2:32 PM, Larry Starr lar...@fullcompass.com wrote: I have been using the AWL ( --add-addr-to-blacklist ) for some time, to bump new spam senders above

Re: Identifying Source of False Positives

2009-06-01 Thread Theo Van Dinter
fwiw, even if there isn't a blank line, SA will figure it out (though it'll trigger a MISSING_HB_SEP rule hit). As for the debug output ... it depends, how did you run the command (ie: what was the command you tried). My guess is you did something like spamassassin -D filename, where filename

Re: Plugin/TVD.pm

2009-05-31 Thread Theo Van Dinter
That depends, what's TVD.pm? ;) Doing a quick search shows http://mail-archives.apache.org/mod_mbox/spamassassin-users/200603.mbox/%3c20060316233124.gv22...@kluge.net%3e which was a conversation we had way back in 2006 about SA 3.1 and bug 4255. There was a TVD.pm in discussion, so I assume

Re: sa-learn doesn't remember messages it's already learned from

2009-05-31 Thread Theo Van Dinter
When you say the database, do you mean bayes_toks or bayes_toks and bayes_seen? If the former, you need to grant write privs to bayes_seen as well. Also, when in doubt, run w/ -D to see what's going on. On Sun, May 31, 2009 at 1:41 PM, Russell Jones rjo...@eggycrew.com wrote: I am running a

Re: Problem with check_invalid_ip()

2009-05-29 Thread Theo Van Dinter
None of the IPs you listed will match. Have you tried simply running a loop in Perl to see what the results are? Also, negation ~ ? What do you mean? =~ is not a negation (that would be !~). Also also, the ^ and $ chars are important. If you remove them, you change the RE. On Fri, May 29,

Re: Filtering through mailing lists

2009-05-29 Thread Theo Van Dinter
Sure, change your mail system so it doesn't call SA more than once on the same message. :) On Fri, May 29, 2009 at 9:26 AM, Garik garik@gmail.com wrote: Is there anything that can be done so there's only one instance of [**SPAM**] in the subject? Have postfix strip out the spam headers from

Re: Error when running sa-update

2009-05-20 Thread Theo Van Dinter
What version of IO::Zlib do you have installed? sa-update line 82 is it trying to load IO::Zlib 1.04 or later: use IO::Zlib 1.04; So my guess is that you either have an early non-version exporting version, or a strange/corrupted module. Either way, reinstalling it would be the way to go. On

Re: catch22: MIRRORED.BY wrong, sa-update won't

2009-05-19 Thread Theo Van Dinter
just fyi, I left spamassassin.kluge.net up for over a month after removing it from the MIRRORED.BY file, and forced a new update to deal with https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6083. I figured that anyone using sa-update would run it at least once a month, and then get the new

Re: Boxtrapper and Spamassassin Cpanel 11 strange behaviour.

2009-05-11 Thread Theo Van Dinter
fwiw, I also confirm any CR mails that I get. I just wanted to paste in this quote... :) challenge response is a great way to tell people they are less important than you - Dan Quinlan via IRC On Mon, May 11, 2009 at 2:33 PM, Dave Pooser dave...@pooserville.com wrote: Not necessarily

Re: Errors during installation spamassasssin

2009-05-05 Thread Theo Van Dinter
Mail::SPF replaced Mail::SPF::Query. You should pick one or the other, though Mail::SPF is preferred. See the INSTALL doc. Also note, the module diag output is not a list of things that you need to install, it's just a list that can help when debugging. On Tue, May 5, 2009 at 4:58 AM, Jack

Re: Error: spamc: connection attempt to spamd aborted after 3 retries

2009-05-05 Thread Theo Van Dinter
This has been said before, but there seems to still be some confusion. In short -- you seem to think you're using amavis, and have an amavis config file ... But instead you seem to be calling spamc/spamd, which is completely different and unrelated. If you want to use amavis, then stop using

Re: bayes training doesn't seem to have any affect

2009-05-05 Thread Theo Van Dinter
On Tue, May 5, 2009 at 5:40 PM, Micah Anderson mi...@riseup.net wrote: Eh?  Last journal sync atime is Jan 1 1970? Try running:   sa-learn --sync Doesn't seem to change the 'last journal sync atime' from 0. [...] I'm using a mysql DB and I've got the following set in my local.cf: SQL Bayes

Re: [sa] Re: The weirdest problem .....

2009-05-04 Thread Theo Van Dinter
You're wrong (but you're close). :) You can configure your own whitelist_from_* and blacklist_from_* (or the other whitelist/blacklist commands) in your user_prefs/configs. Either you have the config or you don't, and the scores are for the rule not each sender, so in that sense, it's permanent.

Re: Spam from windows live

2009-05-04 Thread Theo Van Dinter
2009/5/4 Karsten Bräckelmann guent...@rudersport.de: Bear in mind that an email that gets a Bayes score of more than one point can't be autolearned as ham. Nope, this is wrong. The Bayes rules (as well as some other rules) do NOT have any impact on the auto-learning. In fact, the

Re: The weirdest problem

2009-05-04 Thread Theo Van Dinter
just cause more confusion. On Mon, May 4, 2009 at 1:27 PM, Adam Katz antis...@khopis.com wrote: Theo Van Dinter wrote: Then there's the AWL, aka the historical score averager, which has some commands via spamassassin to do simple manipulation, usually to correct undesired entries.  The score

Re: Error: spamc: connection attempt to spamd aborted after 3 retries

2009-05-04 Thread Theo Van Dinter
If you're using amavis, what is calling spamc? It sounds like something changed your config somewhere. Did someone put in a procmailrc entry? On Mon, May 4, 2009 at 2:57 PM, Alejandro Cabrera Obed aco1...@gmail.com wrote: Dear all, I use Postfix (version 2.3.8-2+etch1) + amavisd-new (version

Re: Spam from windows live

2009-05-04 Thread Theo Van Dinter
2009/5/4 Karsten Bräckelmann guent...@rudersport.de: via https://issues.apache.org/SpamAssassin/show_bug.cgi?id=2865.  In No commit pointer. I'm lazy, Theo, any hints to the actual commit so I don't have to dig? :) Sure. I found it by a) looking at the code and validating my understanding,

Re: Can't locate File/Scan/ClamAV.pm

2009-05-03 Thread Theo Van Dinter
Apparently the clamav.pm plugin requires other modules which you didn't install. You need to find out what the dependencies are, and make sure they're met before trying to use the plugin. On Sun, May 3, 2009 at 12:05 PM, Chris cpoll...@embarqmail.com wrote: Can't locate File/Scan/ClamAV.pm in

Re: Restarting bayes

2009-05-02 Thread Theo Van Dinter
bayes_seen is rather irrelevant. bayes_toks is very binary-oriented, and uses lots of pack() calls. There is no SA-based validity check for the DB files/data. If you think the DB file itself is corrupt, you could try the appropriate DBM tools (db_verify, etc.) The dump/restore method really

Re: Looks like sa-learn --spam troubles

2009-05-01 Thread Theo Van Dinter
I would say it's less someone poisoning your DB and more your DB becoming corrupt. As it says, a pack format of dec(73) is not a valid value. It's set by the BayesStore module itself, not influenced by the token in question. You can try to do a dump/verify/restore ... ala: sa-learn --sync

Re: trying to score based on image name and image size

2009-04-30 Thread Theo Van Dinter
There could be various reasons ranging from plugin isn't loaded (though you'd get an error w/ the rules then) to image isn't exactly that size, to plugin can't determine width+height from image, to ... Assuming the plugin is loaded (spamassassin -D plugin --lint would tell you), and you've

Re: [SA] 419 emailBL?

2009-04-29 Thread Theo Van Dinter
On Wed, Apr 29, 2009 at 6:24 PM, Adam Katz antis...@khopis.com wrote: The mechanism for sa-update is brilliant, but doesn't lend itself to enormous indices of frequently-changing rulesets. I guess it depends what you mean by enormous. A sought rule update is 135k. The likelihood is, imo, that

Re: 419 emailBL?

2009-04-29 Thread Theo Van Dinter
On Wed, Apr 29, 2009 at 8:06 PM, John Hardin jhar...@impsec.org wrote: And 135k doesn't add up to a lot of bandwidth? ...so don't look for updates more than once every day or two. Yeah, but I think the point was that a frequently changing ruleset would be downloaded frequently. And if

Re: 419 emailBL?

2009-04-29 Thread Theo Van Dinter
On Wed, Apr 29, 2009 at 7:56 PM, Adam Katz antis...@khopis.com wrote: I guess it depends what you mean by enormous.  A sought rule update is 135k. And 135k doesn't add up to a lot of bandwidth?  I suppose it depends on the number of users, and I'm figuring worst-case scenario, e.g. when/if

Re: Procmail Setup NOT Working

2009-04-28 Thread Theo Van Dinter
2009/4/28 Robert Ober ro...@robob.com: It was global and I want it to stay global.  The old procmailrc is: DROPPRIVS=yes :0fw | /usr/bin/spamc That's a global config, but you're running it per-user due to the DROPPRIVS line. fyi. All I want to do now is have all the identified

Re: Code Rot?

2009-04-27 Thread Theo Van Dinter
fwiw, I was going to say Yes to the first question. Not sure about the second question, though I've always wanted to see more sharing/give-back from those folks. While there have been a bunch of mails on the dev list, most of it is incorrectly opened bugs, or other randomness. IMO, there hasn't

Re: Image spam and failing rule

2009-04-26 Thread Theo Van Dinter
It's already been mentioned, but mimeheader is the right way to look at the headers of MIME parts. The rule of thumb is if you are using 'full' you're probably doing it wrong. :) On Sun, Apr 26, 2009 at 11:57 AM, Charles Gregory cgreg...@hwcn.org wrote: On Sat, 25 Apr 2009, Gary Forrest wrote:

Re: DATE_IN_FUTURE

2009-04-24 Thread Theo Van Dinter
You'd really want to post the message headers in pastebot or something so people can look at them. It's not just the Date header, the rule also looks at the Received headers, etc. On Fri, Apr 24, 2009 at 1:44 PM, Rik hlug090...@buzzhost.co.uk wrote: I was stumped on a question today about

Re: Bayes filter not always triggered

2009-04-20 Thread Theo Van Dinter
On Mon, Apr 20, 2009 at 8:47 AM, m.b mbarc...@f451.net wrote: scantime=3.2,size=2745,user=(unknown),uid=104,required_score=5.0,rhost=,raddr=..,rport=57786,mid= Do you have any suggestions why not every message is passing through BAYESS? I thought it is was locking problem

Re: Bayes filter not always triggered

2009-04-20 Thread Theo Van Dinter
at 11:27 AM, m.b mbarc...@f451.net wrote: If user would be missing, it would always cause problems. But it works 75% of the time. Mark Theo Van Dinter-2 wrote: On Mon, Apr 20, 2009 at 8:47 AM, m.b mbarc...@f451.net wrote: scantime=3.2,size=2745,user=(unknown),uid=104,required_score=5.0,rhost

Re: accept only gpg/pgp mail

2009-03-07 Thread Theo Van Dinter
It's already been mentioned, but SpamAssassin doesn't accept, deliver, or route mail. It simply marks up a message, particularly with some added headers, and then you would need something else to filter/route mails as you want. As for looking for encrypted vs unencrypted mails, you'd have to

Re: how to make a custom ruleset

2009-03-06 Thread Theo Van Dinter
Just fyi, this particular topic keeps getting raised here. It'd be great if people would search the list archives. :) One of the last times around: http://www.nabble.com/forum/ViewPost.jtp?post=21296293framed=y In short, if you want to do this, write a plugin. REs are great until you get

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Theo Van Dinter
It sounds like an issue w/ kmail/vim and not so much a nefarious spammer ability. And I'm not sure what you mean by unlisted header. If you mean: [other headers] To: unlisted header Then the answer is unlisted header is actually the first line of the body. On Mon, Feb 23, 2009 at 5:55 PM,

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Theo Van Dinter
Oh, and having a sample mail via pastebin/etc would be handy if you want more commentary about the mail. :) On Mon, Feb 23, 2009 at 6:52 PM, Theo Van Dinter felic...@apache.org wrote: It sounds like an issue w/ kmail/vim and not so much a nefarious spammer ability. And I'm not sure what you

Re: cpan question

2009-02-22 Thread Theo Van Dinter
Since you don't need Net::Ident for SA, I'm going to say no. :) On Sat, Feb 21, 2009 at 10:28 PM, Gene Heskett gene.hesk...@verizon.net wrote: On Saturday 21 February 2009, Bill Landry wrote: Gene Heskett wrote: Using cpan, trying to install Net::Ident (the other bits except razor were

Re: NO_RELAYS FP on relayed mail via IPv6

2009-02-21 Thread Theo Van Dinter
On Sat, Feb 21, 2009 at 7:11 PM, Greg Troxel g...@ir.bbn.com wrote: This is a funny case, since the message in question is generated by a machine that I would set as TRUSTED. I am the moderator for regional-bos...@netbsd.org, and it gets spam, stunningly enough. The mail is sent to me over

Re: Everything gets a score of 0

2009-02-21 Thread Theo Van Dinter
According to the debug output, you just have the openprotect channel and not the SA updates channel. Hence, none of the standard rules exist. Run sa-update. :) On Sat, Feb 21, 2009 at 8:15 PM, oliver oli...@schinagl.nl wrote: This is a clean install on a gentoo hardened box. I'm using SA 3.2.5

Re: misc_10.cf

2009-02-09 Thread Theo Van Dinter
10_misc.cf isn't in 3.2, 3.1 was the last version to have it. In 3.2 it's called 10_default_prefs.cf. You should have it installed in the default rules dir, probably /usr/share/spamassassin. And no, it's not editable. Or more specifically, you shouldn't edit it. On Mon, Feb 09, 2009 at

Re: Calling spamc and looping through files

2009-02-08 Thread Theo Van Dinter
I would use formail -s to go through the mbox file, and pipe the mail through procmail w/ an appropriate recipe file to filter the mails as you'd want. SpamAssassin is happy to markup your mails, but has no filtering capabilities since it doesn't deliver mail. On Sun, Feb 08, 2009 at 04:37:30PM

Re: html experts: empty style tags.

2009-01-29 Thread Theo Van Dinter
On Thu, Jan 29, 2009 at 08:50:32PM +0100, Per Jessen wrote: you have LEGIT EMAIL with this in it? style I do too. AFAICT, it's Microsoft related. taking a look at my january corpus, there are a relative lot of hits for that, including things like STYLE/STYLE. a lot of the mails, as

Re: bayes autolearn off but journal updated

2009-01-20 Thread Theo Van Dinter
On Tue, Jan 20, 2009 at 04:49:12PM +0100, Matus UHLAR - fantomas wrote: Why does it update the journal? Why does it try to open journal in R/W mode? $ man sa-learn [...] bayes_journal While SpamAssassin is scanning mails, it needs to track which tokens it uses in its cal-

Re: Test order

2009-01-17 Thread Theo Van Dinter
On Sun, Jan 18, 2009 at 01:58:48AM +0100, mouss wrote: Then I should use postfix regexp capabilities to rewrite subject and replace [SPAM] with [VIRII] in case X-Spam-Virus: Yes If you mean header_checks, you can't. header_checks operate on headers ONE at a time. you can't tell it to

Re: more habeas spam

2009-01-09 Thread Theo Van Dinter
On Thu, Jan 08, 2009 at 04:37:37PM +0100, Karsten Bräckelmann wrote: It appears to me that the HABEAS rules are hitting only a very tiny fraction of mail, many of the nightly mass-checks don't have a hit at all (or is it that those checks don't contain any network checks?). The

Re: custom post-processing. Howto?

2009-01-08 Thread Theo Van Dinter
On Thu, Jan 08, 2009 at 11:12:47PM +0300, JVlad wrote: Thanks, but is there a way to get this perl script executed as part of Spamassassin work and pass there score, ip, and address? Does spamassassin support such post-processing plugins? Yes, though unfortunately writing plugins is rather

Re: Spam with clean URI's which forward to DNSBListed URL (by HTML redirect header)

2009-01-07 Thread Theo Van Dinter
On Wed, Jan 07, 2009 at 04:46:44PM +0100, Florian Lagg wrote: So - if possible - I want spamassassign to: 1. Request the links in the mail body and check them for http-error 302 or meta redirects 2. Check the links we got by doing this against some DNSBL's Is this possible? Is there a

Re: AND logical operation for scoring options

2009-01-07 Thread Theo Van Dinter
rtm for meta rules :) On Wed, Jan 07, 2009 at 09:45:18AM -0800, ml wrote: Concerning scoring options defined on “user_prefs”, is there a way to apply AND logical operation for two or more SYMBOLIC_TEST_NAMEs describing like “score A B 2.0”? If it is not available now, let me know how to

Re: What does it mean?

2009-01-05 Thread Theo Van Dinter
On Mon, Jan 05, 2009 at 08:46:37AM -0800, schnee wrote: 1: MIME_HTML_ONLY BODY: Message only has text/html MIME parts So what ? Do I have to send a text only part also? All my users can read HTML. It'd probably be a good idea to do multipart/alternative w/ an appropriate text/plain

Re: TO: and FROM: line are the same.

2009-01-05 Thread Theo Van Dinter
On Sun, Jan 04, 2009 at 05:28:45PM -0500, Matt Kettler wrote: I don't know that anyone said it couldn't be done. It is however rather expensive. That long multi-header regex could take a very long time to run because it may have to scan the entire header block if one of the From/To headers is

Re: Problem with spamassassin not finding razor-agent.conf

2008-12-11 Thread Theo Van Dinter
On Thu, Dec 11, 2008 at 05:33:36PM +, Johan Borch wrote: [22640] warn: razor2: razor2 check failed: No such file or directory razor2: Can't read conf file: = /etc/razor/razor-agent.conf at /usr/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin/Plugin/Razor2.pm line 326. Do you have a

Re: 1000 times easier to just do sa-update --nogpg

2008-12-09 Thread Theo Van Dinter
On Tue, Dec 09, 2008 at 10:54:23PM -0700, LuKreme wrote: echo 24F434CE gpg.keys echo 6C6191E3 gpg.keys echo 856AA88A gpg.keys The three lines that are echo HEXCODE gpg.keys are the issue for me, I guess. Where do those numbers come from? They're the keyids for the given channels

Re: Log

2008-12-06 Thread Theo Van Dinter
On Sat, Dec 06, 2008 at 01:50:20PM +0100, Jon Essen-Moller wrote: So you look in the /var/log/maillog (maybe with grep) and find messages and their id you are interested in. I get you that far. :) Are there a log somewhere where one can find information like the last log entry you pasted

Re: Single URI spam not checked against URIBLs

2008-12-06 Thread Theo Van Dinter
On Sat, Dec 06, 2008 at 11:16:03PM +0100, Wolfgang Zeikat wrote: Could you describe more elaborately how you did that? You may wish to take a look at cpan2rpm, fwiw. -- Randomly Selected Tagline: ... Either this man is suffering from serious brain damage, or the new vacuum cleaner's

Re: Spam slipping through

2008-12-06 Thread Theo Van Dinter
On Sat, Dec 06, 2008 at 08:00:10PM -0800, John Hardin wrote: mechanism for. Devs: there've been wishes for this before; how hard would it be to add the ability to match on the substring match captured by another rule? Add a flag to say capture the match for this rule and a syntax for

Re: Backup command for AWL?

2008-12-05 Thread Theo Van Dinter
On Fri, Dec 05, 2008 at 11:58:26AM -0500, Rosenbaum, Larry M. wrote: The Bayes database can be backed up and restored with sa-learn --backup/--restore. Is there any similar way to back up and restore a MySQL-based AWL database? The check_whitelist command is only good for DBM files. If

Re: Log

2008-12-05 Thread Theo Van Dinter
On Fri, Dec 05, 2008 at 12:53:20AM +0100, Jon Essen-Moller wrote: the mail was in HTML, so it's basically unreadable. text please. I did get out of it: I wish to check a specific mail address and see if many mails are classified as spam that are sent to that address.br It sounds like you want

Re: Running message through a single SA test

2008-12-04 Thread Theo Van Dinter
On Wed, Dec 03, 2008 at 06:46:32PM -0700, Kelly Jones wrote: I want to run a message through ONE SpamAssassin test w/o the overhead of running all the tests. Does SA have a --run-just-this-test=FOO option? It sounds like you want to take a look at the mass-check tool. :) -- Randomly

Re: Log

2008-12-04 Thread Theo Van Dinter
On Thu, Dec 04, 2008 at 10:52:18PM +0100, Jon wrote: Does anyone know if it is possible to retrieve information from any of theses files below about mails that are classified as spam? Or in general. I there a way to view statistics from spammassassin? bayes_seen bayes_toks What kind

Re: Bad check_for_from_to_same code in EvalTests.pm?

2008-12-03 Thread Theo Van Dinter
On Wed, Dec 03, 2008 at 07:13:26AM -0700, Kelly Jones wrote: SA doesn't use EvalTests.pm's check_for_from_to_same test, but part of the code looks like this: Wow. Had to whip out the 3.1 code to find this... Is that right? Shouldn't the 'eq' be 'ne'? As the comment about 6 lines up from

Re: Change Score Set

2008-12-01 Thread Theo Van Dinter
On Mon, Dec 01, 2008 at 08:30:32AM -0800, jlefvendahl wrote: I am new to administrating a server with SpamAssassin. Currently, our server is using score set (0), and I would like for it to be (3) - Bayes + network. I need some specific instructions on how to change this server-wide -

Re: Auto-whitelist not closing file

2008-12-01 Thread Theo Van Dinter
On Mon, Dec 01, 2008 at 03:42:05PM -0500, Dan Barker wrote: How do I go about trapping this error in locker? (Specifically, how do I figure out who Called locker, to find the code that's not closing the file it opened?) Has anyone else run into this sort of issue? The last time this sort of

Re: Custom rules

2008-12-01 Thread Theo Van Dinter
On Mon, Dec 01, 2008 at 10:37:36PM +0100, Fabrizio Regalli wrote: uri LOCAL_URI_VIAPAYPAL /www\.viapaypal\.com\// score LOCAL_URI_VIAPAYPAL 5.0 (for add five points to e-mail contains www.viapaypal.com http://www.viapaypal.com/ into body) I've add it to

Re: OS Upgrade Broke SpamAssassin; Help Needed to Fix

2008-11-30 Thread Theo Van Dinter
On Sun, Nov 30, 2008 at 04:39:49PM -0800, Rich Shepard wrote: [EMAIL PROTECTED] ~]$ /usr/local/bin/spamassassin -V spamassassin: spamassassin script is v3.001007, but using modules v3.002005 How should I proceed to fix the installation so there's only one copy (either in

Re: spamc and extra rules

2008-11-23 Thread Theo Van Dinter
Tagline: You're not significant until someone complains about you publically. - Theo Van Dinter pgpxYO9qf7Rtd.pgp Description: PGP signature

Re: prefork: oops! no idle kids in need_to_del_server?

2008-10-27 Thread Theo Van Dinter
On Mon, Oct 27, 2008 at 10:07:15PM +0100, Per Jessen wrote: I was about to open a bugreport on this until I did a search for spamd reports: https://issues.apache.org/SpamAssassin/buglist.cgi?quicksearch=spamd There are 195 reports, of which 90% or more seem to be new. Has the spamd

Re: URIBL_BLACK

2008-10-10 Thread Theo Van Dinter
This has come up on the list before, but... Looking at my most recent network run: OVERALLSPAM% HAM% S/ORANK SCORE NAME 0 460740215640.955 0.000.00 (all messages) 0.0 95.5290 4.47100.955 0.000.00 (all messages as %) 74.714 78.1593

Re: URIBL_BLACK

2008-10-10 Thread Theo Van Dinter
On Sat, Oct 11, 2008 at 12:01:48AM +0200, Benny Pedersen wrote: meta URIBL_BLACK_ADJ (URIBL_BLACK) describe URIBL_BLACK_ADJ Meta: i trust uribl more :) score URIBL_BLACK_ADJ 1.5 that way you still benefit from score adjust on sa-rules The right way to do this is: score URIBL_BLACK (1.5)

Re: URIBL_BLACK

2008-10-10 Thread Theo Van Dinter
On Sat, Oct 11, 2008 at 12:15:00AM +0200, Yet Another Ninja wrote: 74.714 78.1593 1.11300.986 0.780.00 URIBL_BLACK Would you pls post those FP URIs so ppl can judge what your rating is based upon. (imperfect) command posted for my future reference ... $ grep URIBL_BLACK

Re: check_whitelist

2008-10-08 Thread Theo Van Dinter
On Wed, Oct 08, 2008 at 07:49:41PM +0200, Per olof Ljungmark wrote: The check_whitelist tool is apparently gone, - can we use this tool from older releases with 3.2.5? Not sure. Probably, unless the format changed. Is there any work to get tools/ back? It got removed from the tarball

Re: Turning off all tests

2008-10-06 Thread Theo Van Dinter
On Mon, Oct 06, 2008 at 08:19:49AM -0700, NeoSHNIK wrote: I am making a new plugin and in order gather enough data about its performance I need to turn off all other tests. I was very surprised that there aren't any topics about it. So how does one turn off all SA tests? Set their scores to 0

Re: bayes_token table too big?

2008-10-06 Thread Theo Van Dinter
On Mon, Oct 06, 2008 at 03:42:53PM -0400, Rosenbaum, Larry M. wrote: And here is the information from the local.cf file: bayes_expiry_max_db_size 50 So the config file says 500 thousand tokens, but the database has 105 million entries. Have I misunderstood something, or is expiry

Re: updates.spamassassin.org 2ndaries not updating (was re dsbl)

2008-09-26 Thread Theo Van Dinter
On Fri, Sep 26, 2008 at 03:04:56PM +0100, Justin Mason wrote: Kelsey, Theo, can you check and see why your secondaries aren't picking up the zone change on updates.spamassassin.org? cheers, Grrr. I really need to fix this stupid bind package: Sep 26 11:31:05 eclectic named[29926]: dumping

Re: MATCH_WORDS false positives

2008-09-24 Thread Theo Van Dinter
On Wed, Sep 24, 2008 at 01:52:27PM -0500, Alan Lehman wrote: I've seen a few false positives that hit MATCH_WORDS_5. Can someone point me to this rule so I can try to determine what is causing the hit? As far as I can see, there is no such rule in the standard or updates rulesets. Perhaps it's

Re: Folder Redirection Besides classification

2008-09-11 Thread Theo Van Dinter
On Thu, Sep 11, 2008 at 05:03:06PM +0100, David Carvalho wrote: Is it possible to redirect classified spam to another file, just after classification, instead of No. appending to the user regular mail file (like /var/mail/usermail) ? SA isn't doing that either. It's just marking up the

Re: Setting up razor

2008-09-06 Thread Theo Van Dinter
On Sat, Sep 06, 2008 at 11:32:54AM -0400, Skip wrote: [EMAIL PROTECTED] [~]# telnet discovery.razor.cloudmark.com 2703 Trying 208.83.137.205... telnet: connect to address 208.83.137.205: Connection timed out Trying 208.83.137.117... telnet: connect to address 208.83.137.117: Connection timed

Re: How to avoid localhost mails tagged as spam

2008-08-25 Thread Theo Van Dinter
Since you're using amavis, you'd have to ask those folks. SA will scan anything given to it, so ... On Tue, Aug 26, 2008 at 01:05:39AM +0200, GoodnGo.de (R) Zentrale wrote: Easy solution: Don't pass mail from localhost to spamassassin. Hello Evan, how can I do that? (I am newbie) --

Re: SA scores MISSING_SUBJECT, but message _has_ a Subject

2008-08-20 Thread Theo Van Dinter
If you think there's an issue, feel free to pastebot the message somewhere and folks can take a look. Otherwise there's not much people are going to be able to comment on. My guess is that however you're feeding mails into SA is having issues. On Wed, Aug 20, 2008 at 09:18:37AM -0700, Bob

Re: SA scores MISSING_SUBJECT, but message _has_ a Subject

2008-08-20 Thread Theo Van Dinter
On Wed, Aug 20, 2008 at 09:34:34AM -0700, Bob Gereford wrote: Here's the paste of the raw message content from the last message http://pastebin.com/d57d0894d Yeah, nothing strange there. Passing it through spamassassin shows what you'd expect: X-Spam-Status: No, score=0.8 required=5.0

Re: sa-update needs --nogpg

2008-08-20 Thread Theo Van Dinter
http://wiki.apache.org/spamassassin/SaUpdateKeyNotCrossCertified On Thu, Aug 21, 2008 at 01:36:30AM +0800, [EMAIL PROTECTED] wrote: Just want to mention that $ sa-update -D [7581] dbg: gpg: gpg: WARNING: signing subkey 24F434CE is not cross-certified [7581] dbg: gpg: gpg: please see

Re: RCVD_ILLEGAL_IP question(s)

2008-08-13 Thread Theo Van Dinter
On Wed, Aug 13, 2008 at 03:33:56PM -0700, SM wrote: They are not the only ones using these IP addresses for internal use. It will be interesting to see what happens when these IP addresses are assigned. Reminds me of a time where I ran into a company who internally were using long-time

Re: Pharma spam getting through again

2008-08-12 Thread Theo Van Dinter
On Tue, Aug 12, 2008 at 12:41:17PM -0700, Owen Mehegan wrote: Here are two more that got through today. Even several hours later, these haven't shown up in blacklists. Do anyone else's rules catch these? Your main problem is that both messages hit BAYES_00: X-Spam-Status: No, score=2.0

Re: Mass-check not scanning all messages.

2008-08-10 Thread Theo Van Dinter
On Sun, Aug 10, 2008 at 12:16:38PM -0700, RN-Chris wrote: I have a custom spam corpus that I am trying to run rules against to test their effectiveness however mass-check will only scan a few ( 5 ) messages of the spam and usually only 1 or 2 of the ham messages. Any clues? Roughly a week of

Re: rules dataset archive with creation_date

2008-08-07 Thread Theo Van Dinter
On Thu, Aug 07, 2008 at 11:36:57AM -0700, Gigi Albertosi wrote: I'm wondering if there is a place where I can find an archive of spamassassin official rules and their associated date of creation/update. For example, a dataset of the type RULE_NAME1LAST_UPDATE RULE_NAME2

Re: Sa-update failures? Yerp AND kluge Offline? DOS?

2008-08-04 Thread Theo Van Dinter
I don't know of any connectivity issues w/ the kluge.net server. There were some ISP issues last month that took it offline for a day or so, but nothing in the last couple of days. On Mon, Aug 04, 2008 at 11:34:22AM +0100, Rob Sharp wrote: There was a message recently posted saying that Yerp

  1   2   3   4   5   6   7   8   9   10   >