[SAtalk] just noticed something..

...about pyzor & razor. I installed SpamAssassin 2.43 on a Mac OS X Server, but I did *not* install Razor2. I installed only Pyzor on that machine. Pyzor works just fine. On my production mail server, I have Razor2 installed and Pyzor. Pyzor does not work, no matter what. I tried sending it vario

Re: [SAtalk] blacklists, razor2, dcc or none?

Theo Van Dinter <[EMAIL PROTECTED]> [2003-01-09 15:02:25 -0500]: > > Stats since 2002-12-09 > Scores: 0.7 19 45 > Total Messages: 4213 > SA Caught : 4102(97.4 %) > Razor Caught : 3237(76.8 %) > Razor Not SA : 1 (0.0 %) > Razor Cause SA: 87 (2.1 %) Very nice. I ch

[SAtalk] hits -95 but subject tag ****SPAM***** still added

I have the domain in whitelist_from but the subject still gets re-written with ***SPAM. X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 2.43 (1.115.2.20-2002-10-15-exp) X-Spam-Report: 4.80 hits, 4.5 required; X-SA-Exim-Scanned: Yes X-SA-Exim-Rcpt-To: [EMAIL PROTECTED] Subject: *SP

Re: [SAtalk] web interface?

Hi! Any chance this script might be available? Much Appreciated, David On Wed, 11 Dec 2002, Chris LaFrance wrote: > (EST) > X-Spam-Status: No, hits=-3.4 required=6.0 > tests=EMAIL_ATTRIBUTION,IN_REP_TO,KNOWN_MAILING_LIST, > QUOTED_EMAIL_TEXT,SPAM_PHRASE_01_02,USER_AGENT_PINE

[SAtalk] Re: spamd frozen?

Spamassassin works VERY well except when Razor fails. Today my servers load rose to 30+. This of course brings my qmail to a crawl. This has happened 3 times in the last year or so. The best way to avoid this in the future is to add the following to local.cf: score RAZOR_CHECK

RE: [SAtalk] How does TO_HAS_SPACES

| was triggered. I don't get it; the To: line that I see is | | To: [EMAIL PROTECTED] | | and there don't appear to be any extraneous spaces in there. There's a space after your e-mail address. --- This SF.NET email is sponsored by: So

Re: [SAtalk] Problem with Razor2 reporting...

Thanks... unfortunately, when I ran with -D, everything worked... I removed -D and it still works... perhaps it was a server issue... but the message didn't make it seem that way. Theo Van Dinter wrote: On Wed, Jan 08, 2003 at 11:35:06PM -0500, Michael Breuer wrote: razor2 report

[SAtalk] How does TO_HAS_SPACES

Hi, all -- I see in the SA report header in the attached email that TO_HAS_SPACES was triggered. I don't get it; the To: line that I see is To: [EMAIL PROTECTED] and there don't appear to be any extraneous spaces in there. Was this rule accidentally matched, perhaps, because there is no

[SAtalk] for help : how to use only my customized rulesets? (remove internal rulesets)

Hi ,   here 2 problems below 4 help:   1. how can i remove the internal rulesets(that's tests), using my own tests instead?    4 I want to accelerate the processing speed of Spamassassin. I have tried : delete all .cf file in /use/share/spamassassin (such as 10_*,20_*,25_* ..

RE: [SAtalk] Another install problem

Title: RE: [SAtalk] Another install problem I just restarted the machine, still same result.  Insidentially how would I know if I am using spamd.  I took whatever the defaults were for mimedefang. -Brook > -Original Message- > From: Rick Macdougall [mailto:[EMAIL PROTECTED]] > Sent:

Re: [SAtalk] Guidelines for Mass Mailings

On Thu, 9 Jan 2003 the voices made Vivek Khera write: VK> > "JM" == Justin Mason <[EMAIL PROTECTED]> writes: VK> VK> >> Well written, good content, and industry specific. Also simply having a real VK> >> email address to reply back is good. VK> VK> JM> Actually -- that's a very good point -- r

[SAtalk] interesting "From" mail pattern

We are getting flooded with emails that have a From address consisting of a single word name all in caps, e.g.: From: "ARLINDA" <[EMAIL PROTECTED]> They are already way over the limit and are flagged. Anyone know what spamware generates this kind of signature? Received: from ilpalxr-dnsmx

Re: [SAtalk] Another install problem

Hi, If you are using spamd/spamc then you need to restart spamd for any changes to take affect. Regards, Rick - Original Message - From: "Brook Stevens" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, January 09, 2003 6:22 PM Subject: [SAtalk] Another install problem Okay,

[SAtalk] Another install problem

Title: Another install problem Okay, seeing as you were all so helpful in my first problem (that's honest thankfulness not nasty sarcasm) I got far enough to have another problem.  I set up mimedefang and spamassassin and everything works great, except it is not re-writing the subject line. I

Re: Re: [SAtalk] spamd frozen?

Man you forget how GREAT SA is until it dies and you have 160 emails of which 3 are good!! Thanks Jim On Thu, 9 Jan 2003, Bernd Schmelter ([EMAIL PROTECTED]) wrote: > Lindsey Simon wrote: > > I can attest to the same situation on two different servers, both > > debian woody, happenin

RE: [Razor-users] RE: [SAtalk] Razor down - Works for me

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday, January 09, 2003 3:29 PM Theo Van Dinter wrote: > On Thu, Jan 09, 2003 at 03:10:35PM -0600, Mike Loiterman wrote: >> [15:09:21 root@fat_man: /home/mike/Mail-SpamAssassin-2.43]# >> razor-discover -d debug: Raz

[SAtalk] sql spamassassin mimedefang

Hi, First of all I would like to know which user preferences can be configured in the database ? Are these the local scores, whitelist_from required_hits and auto_report_threshhold ? And what about the auto_whitelist for example and blacklists ? I'm trying to use spamassassin's sql features for r

Re: [Razor-users] RE: [SAtalk] Razor down - Works for me

On Thu, Jan 09, 2003 at 03:10:35PM -0600, Mike Loiterman wrote: > [15:09:21 root@fat_man: /home/mike/Mail-SpamAssassin-2.43]# razor-discover -d > debug: Razor Agents 1.19, protocol version 2. > debug: Read server list from /root/.razor.lst > debug: Discovering closest server in the razor.vipul.net

Re: [SAtalk] spamd frozen?

The -L switch seems to fix my situation as well. At least it appears that way. Rob Bos in message Re: [SAtalk] spamd frozen? (Thu, 01/09 12:42): > On Thu, Jan 09, 2003 at 02:29:14PM -0600, Daniel W. Halverson wrote: > > Just an FYI, it looks like there is a problem with Razor that caused us > >

RE: [SAtalk] Razor down - Works for me

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday, January 09, 2003 1:30 PM Matt Kettler wrote: > Some clippings from razor-check -d > Jan 09 14:23:12.707051 check[24680]: [ 5] Connecting to > truth.cloudmark.com ... Jan 09 14:23:13.153109 check[24680]: [ 8]

Re: [SAtalk] spamd frozen?

Lindsey Simon wrote: > I can attest to the same situation on two different servers, both > debian woody, happening since two days ago. The load avg on one was @ > 60. > > What's bizarre is that spamassassin was doing fine for a few months > before this. > > Very DoS like. Spambombs? exploits? An

Re: [SAtalk] spamd frozen?

On Thu, Jan 09, 2003 at 12:33:25PM -0800, Rob Bos wrote: > that seems possible, but razor_timeout should take care of that. My > spamc processes are hanging indefinitely, and not for ten seconds only. Sort of. Depending on which version of razor_agents you have installed, they may override and d

Re: [SAtalk] blacklists, razor2, dcc or none?

On Thu, Jan 09, 2003 at 12:45:02PM -0800, [EMAIL PROTECTED] wrote: > should i read this as 76.8% of total messages received were caught by > razor? For me anyway. > (should i believe that only 100%-97.4% of your messages are non-spam, > only 111 messages in the last month? maybe i don't understan

Re: [SAtalk] blacklists, razor2, dcc or none?

thank you and martin for quantitating this. but... should i read this as 76.8% of total messages received were caught by razor? (should i believe that only 100%-97.4% of your messages are non-spam, only 111 messages in the last month? maybe i don't understand what the *total* represents.) (als

Re: [SAtalk] spamd frozen?

On Thu, Jan 09, 2003 at 02:29:14PM -0600, Daniel W. Halverson wrote: > Just an FYI, it looks like there is a problem with Razor that caused us > the same problem. (See earlier message about Razor down.) Under debug, > it looks like it's timing out trying to reach the razor1 servers. I've set "

Re: [SAtalk] spamd frozen?

On Thu, Jan 09, 2003 at 02:29:14PM -0600, Daniel W. Halverson wrote: > Just an FYI, it looks like there is a problem with Razor that caused us > the same problem. (See earlier message about Razor down.) Under debug, > it looks like it's timing out trying to reach the razor1 servers. that seems

Re: [SAtalk] spamd frozen?

Just an FYI, it looks like there is a problem with Razor that caused us the same problem. (See earlier message about Razor down.) Under debug, it looks like it's timing out trying to reach the razor1 servers. Thanks Dan Rob Bos wrote: I'm not quite sure how to describe this pr

Re: [SAtalk] spamd frozen?

On Thu, Jan 09, 2003 at 01:25:15PM -0600, Lindsey Simon wrote: > I can attest to the same situation on two different servers, both > debian woody, happening since two days ago. The load avg on one was @ > 60. > > What's bizarre is that spamassassin was doing fine for a few months > before this. >

Re: [SAtalk] Razor down

Hi, Mike Loiterman wrote: > > It appears that the Razor server is down. Anyone else notice this? my server ( munitions2.xs4all.nl - 194.109.217.74 ) seems to be down too. Where do I get an alternative list? razor-discover doesn't help. It sets the server IP to munitions2.xs4all.nl again. Ciao

Re: [SAtalk] spamd frozen?

rODbegbie wrote: > Something similarly wacky happened here today. My mailserver was freaking > out: load at about 30 and suchlike. Oh, and the base of my machine is RedHat 7.3 (although there's not a great deal still on it that came from those RPMs!) rOD. -- He gave his life for tourism. >> D

Re: [SAtalk] spamd frozen?

Rob Bos wrote: > This morning I woke up with a system load around thirty Something similarly wacky happened here today. My mailserver was freaking out: load at about 30 and suchlike. Very interesting. (qmail -> maildrop -> spamc -> spamd, running 2.43 release) rOD. -- "Fast! Fast! Faster!

Re: [SAtalk] blacklists, razor2, dcc or none?

On Thu, Jan 09, 2003 at 07:27:42PM +, Martin Radford wrote: > Be that as it may, I still find that around 50% of my spam is caught > by Razor. Stats since 2002-12-09 Scores: 0.7 19 45 Total Messages: 4213 SA Caught : 4102(97.4 %) Razor Caught : 3237(76.8 %) Razor Not SA :

Re: [SAtalk] blacklists, razor2, dcc or none?

At Thu Jan 9 04:29:26 2003, [EMAIL PROTECTED] wrote: > > my impression (not from measuring, just from looking at spam) is that > the checksum databases are relatively inefficient because spammers > have started to routinely introduce random components into the message > body such as customized gr

Re: [SAtalk] spamd frozen?

I can attest to the same situation on two different servers, both debian woody, happening since two days ago. The load avg on one was @ 60. What's bizarre is that spamassassin was doing fine for a few months before this. Very DoS like. Spambombs? exploits? Anybody gotta guess? -l Rob Bos in mes

Re: [SAtalk] Guidelines for Mass Mailings

> "JM" == Justin Mason <[EMAIL PROTECTED]> writes: >> Well written, good content, and industry specific. Also simply having a real >> email address to reply back is good. JM> Actually -- that's a very good point -- read the replies, and (important) JM> honour the bounce messages. If an addr

Re: [SAtalk] Guidelines for Mass Mailings

Chris Santerre said: > I'm fighting the same problem here. I've passed thru our weekly newsletter > thru SA and it scores low. We only send to current customers and people in > the industry. SO I'm not trying to sell an Eskimo Nigerian weight loss sex > enhancers. :) > > Well written, good conte

Re: [SAtalk] RE: OT: Dynamically updating /etc/mail/access

Andrew M. Hoying wrote: They don't get individual email addresses like this list does. And you can't tailor them for your environment. They are too bold, often, or not bold enough, in their blocking. Andrew Sure they do (spam-list-extented.txt): [EMAIL PROTECTED] REJECT [EMAIL PROTECTED]

Re: [SAtalk] Razor down

On Thu, Jan 09, 2003 at 12:11:25PM -0600, Mike Loiterman wrote: > It appears that the Razor server is down. Anyone else notice this? They're working fine for me. -- Randomly Generated Tagline: "My girlfriend always laughs during sex -- no matter what she's reading." - Emo Philips ms

RE: [SAtalk] Razor down

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday, January 09, 2003 12:36 PM Theo Van Dinter wrote: > On Thu, Jan 09, 2003 at 12:11:25PM -0600, Mike Loiterman wrote: >> It appears that the Razor server is down. Anyone else notice this? > > They're working f

[SAtalk] spamd frozen?

I'm not quite sure how to describe this problem; if I could, I'd probably have it solved. So I'll go into the symptoms. For about a year spamassassin has worked pretty much flawlessly, with the occasional hiccup attributable to my own mistakes. I run spamassassin from qmail-scanner as email get

Re: [SAtalk] RE: OT: Dynamically updating /etc/mail/access

On Thu, 9 Jan 2003 the voices made Andrew M. Hoying write: AMH> > The spamlist (http://basic.wirehub.nl/spamlist-extended.txt, 3,5 MB) AMH> > is updated every hour. If you like, you can just use the domain names AMH> > by grepping "JUNK$" from http://basic.wirehub.nl/spamlist.txt. I did a quick

[SAtalk] whitelist_from_rcvd and exim

Hello again, I see that whitelist_from_rcvd checks the domain in the Received headers and also requires an IP dot quad after the domain. However, with my Exim v4.10, it doesn't add a dot-quad for local mail. If I open a root shell and type: echo hello | mail skye Then I get this in my

[SAtalk] Razor down

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 It appears that the Razor server is down. Anyone else notice this? - --- Randomly Generated Quote: Cats must hold the pen in their mouth while their human is trying to write. Mike Loiterman PGP K

RE: [SAtalk] RE: OT: Dynamically updating /etc/mail/access

They don't get individual email addresses like this list does. And you can't tailor them for your environment. They are too bold, often, or not bold enough, in their blocking. Andrew > -Original Message- > From: Steve Thomas [mailto:[EMAIL PROTECTED]] > Sent: Thursday, January 09, 2003 1

Re: [SAtalk] RE: OT: Dynamically updating /etc/mail/access

You can get an access.db RBL for Sendmail/Postfix from http://basic.wirehub.nl/spamstats.html if you don't want to do DNS RBL for some reason. Rsync every hour or so. Steve Thomas wrote: Isn't that the point of DNS RBLs? | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PR

RE: [SAtalk] RE: OT: Dynamically updating /etc/mail/access

Isn't that the point of DNS RBLs? | -Original Message- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]]On Behalf Of | Andrew M. Hoying | Sent: Thursday, January 09, 2003 9:29 AM | To: MailScanner mailing list | Cc: SpamAssassin Users' list | Subject: [SAtalk] RE: OT: Dynamically upda

[SAtalk] Re: pyzor errors with spamassassin

Jan 8 23:19:36 mail spamd[4084]: debug: Pyzor: got response: Traceback (most recent call last): This is probably a bug with Pyzor on its own, as I've seen similar results calling it directly - both with individual messages and with mbox files (in which case sometimes it gets through some of

[SAtalk] RE: OT: Dynamically updating /etc/mail/access

I'm including the spamassassin list in this because I think it is relevant there as well. Has anyone thought about starting some kind of distributed (like razor and dcc) or community (like spamassassin) based effort to build a near real time access list like this? Obviously this list doesn't catch

Re: [SAtalk] NAI did not buy SpamAssassin!

On Thu, 9 Jan 2003 the voices made Adrian 'Dagurashibanipal' von Bidder write: ADvB> They probably signed any number of NDAs during the negotiation, so ADvB> warning the community before the deal was complete was obviously not ADvB> possible. A short explanation to the list at the time when the de

[SAtalk] razor problem when using mimedefang/milter

Hi, I installed debian's spamassassin (vers. 2.20-1woody) in combination with MIMEDefang (build form source) and sendmail/Milter (8.12.3). Everything is working fine and GREAT!!! Now I'm trying to integrate RAZOR into spamassassin. A "spamassassin -D < spammail.txt" shows that razor is connecting

[SAtalk] Spamassassin causing mail to reject with Service Unavailable

SPAMD just stopped and started really messing things up. I bounced the server, stoped and started the processes for sendmail and spamd, but it keeps hosing Here is what happens: I start getting messages stating the the email service is not available and the message is sent back to the sender

Re: [SAtalk] Uninstalling Spamassassin

Careful with that -r switch, it is very unforgiving. Jonathan Theo Van Dinter <[EMAIL PROTECTED]> said: > On Thu, Jan 09, 2003 at 11:11:41AM -0500, Ted Teknos wrote: > > Can anyone point me to some documentation or tell me how to go about > > removing spamassassin? Thank you. > > rm - rf /etc

Re: [SAtalk] what's with my whitelist?

Agreed, you most certainly don't need -a for a "static" white/black list rule.. And for David's edification, a static one is where you manually enter a "whitelist_from" type rule into your spamassassin config. There is no command-line interface to automatically add those, you must edit your use

Re: [SAtalk] Uninstalling Spamassassin

On Thu, Jan 09, 2003 at 11:11:41AM -0500, Ted Teknos wrote: > Can anyone point me to some documentation or tell me how to go about > removing spamassassin? Thank you. rm -rf /etc/mail/spamassassin /usr/share/spamassassin /usr/lib/perl5/site_perl/5*/Mail/SpamAssassin* \ /usr/bin/{spamassa

Re: [SAtalk] Did the acquisition kill the lists?

On Thu, 9 Jan 2003 the voices made Jason Levine write: JL> Where else are the lists archived online? I've always just read the list JL> on the SourceForge archives, which truly don't have any messages to any of JL> the SA lists since 1/7/03 in the morning; I just signed up for sa-talk JL> today s

[SAtalk] Uninstalling Spamassassin

Can anyone point me to some documentation or tell me how to go about removing spamassassin? Thank you. --- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com __

Re: [SAtalk] NAI did not buy SpamAssassin!

On Tue, 2003-01-07 at 23:56, Barry Jaspan wrote: > Everyone, please calm down! > > The amount of confusion on this list is staggering. One very important > point that many people seem to be missing: > > Network Associates did *not* buy SpamAssassin! > > NAI bought Deersoft, Inc. Deersoft deve

Re: [SAtalk] Missing spamass.sock

On Thu, Jan 09, 2003 at 05:42:33PM +1100, Ian Thomas Dale wrote: > When I try to start the spammilter and sendmail daemon it says they both > start OK but the spammilter hasn't started. When I look at the system logs, > it shows that sendmail was unable to find /var/run/spammilter/spamass.sock. >

Re: [SAtalk] Problem with Razor2 reporting...

On Wed, Jan 08, 2003 at 11:35:06PM -0500, Michael Breuer wrote: > razor2 report failed: Bad file descriptor Died at >/usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Reporter.pm line 77, line 1. > > Any thoughts? That typically happens when the razor server is unavailable. If you run with -D,

RE: [SAtalk] Guidelines for Mass Mailings

I'm fighting the same problem here. I've passed thru our weekly newsletter thru SA and it scores low. We only send to current customers and people in the industry. SO I'm not trying to sell an Eskimo Nigerian weight loss sex enhancers. :) Well written, good content, and industry specific. Also sim

[SAtalk] Re: [SAdev] Future SA development

"Tom Kistner (Astaro)" <[EMAIL PROTECTED]> writes: > First of all, thanks for developing SA. It makes my "delete" button rust > in disuse :) > > I currently work for Astaro AG (www.astaro.com) and am also the author > of the exiscan patch for exim that glues SA to the exim MTA > (duncanthrax.net/

Re: [SAtalk] Re: [Bug 1153] DNS Revisions

Justin Mason said: > (In passing) don't count on it -- apparently it's running off a > generator. :( actually, apparently it's fixed now. --j. --- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Somethi

[SAtalk] Future SA development

Hello, First of all, thanks for developing SA. It makes my "delete" button rust in disuse :) I currently work for Astaro AG (www.astaro.com) and am also the author of the exiscan patch for exim that glues SA to the exim MTA (duncanthrax.net/exiscan). We (Astaro AG) will include include SA with e

[SAtalk] Re: [Bug 1153] DNS Revisions

> Hmmm... seems like osirusoft is up again. (In passing) don't count on it -- apparently it's running off a generator. :( --j. --- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://

Re: [SAtalk] Guidelines for Mass Mailings

Matthew Davis <[EMAIL PROTECTED]> writes: > On the unsubscribe subject, IMO, having the > List-(Un)Subscribe/Help/Id: headers will make it look less like spam. Only if it's not spam to begin with -- specifically a double opt-in one so the user knows he subscribed. Spammers use those headers ofte

Re: [SAtalk] Custom Rules

"Doug Eubanks" <[EMAIL PROTECTED]> writes: > Is it possible to create a custom rule and have it applied only for > certain users? We are using a MySQL database for the preferences and > would like to write a rule that filters out common pornographic terms > and assigns them a VERY high score to s

[SAtalk] why wont my whitelist work

Good morning. I am running SA & EXIM. Here is my problem: Whitelist in local.cf does not seem to be working. Shouldn't the whitelisted address have 0 hits? I have restarted the spamd PID, no luck PID is: spamd -a -x -u xadmin Received: from mogwai.mtnns.net ([209.212.109.209]) by protea.int.c

[SAtalk] Respamassassin usage for vitual domain user

--- Begin Message --- Got the MySQL, but can I build like - $USER_HOME/.spamassassin/user_prefs: where $USER_HOME = /var/MailRoot/mydomain/user/MailDir The Readme file claim http://www.spamassassin.org/dist/README **users can add new rules for their own use in the "~/.spamassass

[SAtalk] Re: spamassassin usage for vitual domain user

Got the MySQL, but can I build like - $USER_HOME/.spamassassin/user_prefs: where $USER_HOME = /var/MailRoot/mydomain/user/MailDir The Readme file claim http://www.spamassassin.org/dist/README **users can add new rules for their own use in the "~/.spamassassin/user_prefs" >

Re: [SAtalk] Too quick to delete...

"Steve Thomas" <[EMAIL PROTECTED]> writes: > Can someone forward me the message with the new mass-check instructions? I > seem to be a bit too quick with the delete key this morning and the archives > aren't working... Just read the top of the mass-check file. It should be pretty straightforward