How is the resource useage with clamav? I'm tempted to install it, but
the cpus on that server are already pretty stressed just dealing with
spamc (I already offloaded spamd to another box) and everything else it
has to do, and am hesitant to add much more...
TIA,
On Wed, 28 Jan 2004, Richard
On Tue, 27 Jan 2004, John Hall wrote:
This is a list of all the filenames I've seen so far today:
body.bat
body.exe
body.zip
data.pif
data.scr
doc.zip
document.pif
document.zip
kcmnw.exe
message.scr
message.zip
pqoew.pif
readme.scr
readme.zip
text.exe
text.zip
On Tue, 27 Jan 2004, Russell Mann wrote:
I got one of these guys yesterday, then ClamAV has stopped them since. If
you're using a QmailScanner setup, it can easily be configured to block
these guys.
I configured qmail-scanner to do just that...I'm not sure I want yet
another process on the
thoughts?
is spamd still running? This is typically what you'll get if you run
spamc
when spamd is down.
---
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
We tag it as spam at 6.0 and delete it after 5 days. Since we get over
200MB of spam a day (for less than 1300 email accounts), keeping it
indefinitely is not an option. The user has 5 days to check the Spam
folder in their web email to catch any FPs. If they like we can bypass
the filtering
Can someone point me to some good rules to catch most Chinese, Korean, etc
spam? We're talking non-ASCII characters, which show up in most mailers
here as a bunch of question marks...
thanks!
James Smallacombe PlantageNet, Inc. CEO and Janitor
[EMAIL PROTECTED
You need to wait for all of spamd's children to die, including all of the
spamc's. This can take a while on a busy and/or slow server. This works
for me most of the time:
#!/bin/bash
PID=`awk '{print $1}' /var/run/spamd.pid`
kill -TERM $PID wait || echo ERROR!
I just figured this out the other day. This is not an SA issue, but a
qmail-scanner.pl issue. To address it directly, edit this line in
qmail-scanner.pl:
my $spamc_subject='***SPAM***';
The one downside is that having (_HITS_/_REQD_) doesn't work. I suspect
that if you rebuild
Sorry, I rushed through your post...I thought you were referring to the
problem with the subject not being re-writtenwell, if anyone running
spamd and spamc from qmail-scanner is wondering why it doesn't work, here
it is :)
On Fri, 7 Nov 2003, Jennifer Fountain wrote:
SA labels other spam
I can't help you with the subject issue (I have the same problem with
2.60), but for the version number in the header, that's a qmail-scanner
thing...you need to rebuild qmail-scanner.pl with the new spamd running
and it will fix that.
On Sun, 2 Nov 2003, Posts wrote:
Hi,
I'm new to the
Well, I just upgraded the RAM on this server to 1GB, and if anything, the
proc load went up. At times, it was over 50.00, usually in the high
30.'s. Limiting the number of spamd's seems to have abated the crashes,
but the smtp performance is so poor that I was getting inundated with
complaints
I'm in the process of moving most of the work SA has been doing on the
mail pop3/smtp server off onto a separate box that's very lightly loaded.
So far, so good, but the maillog keeps showing the following errors for
users that aren't on the local box that spamd is running on. The mail
then gets
In the quest to offload spamd onto another box, I checked the man pages
and FAQ, but I still get this error when I try to run spamd on a separate
box. From the client, I get:
Oct 30 22:27:12 mail spamc[60581]: connect(AF_INET) to spamd at
208.8.16.10 failed, retrying (#3 of 3): Connection
uh, never mind...I figured it out...if you have the server listen on
localhost, it can't take remote connections (unlike bind, IIRC). I put it
on the ext IP and it works fine now..sorry!
On Thu, 30 Oct 2003 [EMAIL PROTECTED] wrote:
In the quest to offload spamd onto another box, I checked
I've never had much use for rewriting the subject before, but now I may
have a use for it, and just noticed that it doesn't work, In the
local.cf, I have:
rewrite_subject 1
subject_tag ***SPAM*** (_HITS_/_REQD_) **
The spams get the header report, but not the subject tag. I saw no
references
Once again, I think I might be answering my own question here, but it is
starting to dawn on me that maybe the subject tag isn't meant to work with
spamd, but only the spamassassin perl script? If not, I'm stumped...I
also tried:
report_safe 0
But that's not doing anything that I can see...
On
For the past couple of weeks or so, like most of you, I've seen total spam
volume almost double again. At this point, the server in question (dual
PIII-550 L440GX) is seeing loads as high as 30.00 and beyond, usually
during the day. However, it hasn't rebooted itself that I can recall in
over a
If you use maildrop as your MDA (it's Maildir native), you can do
something like this in your maildroprc
MAILBOX=$HOME/Maildir/
if ((/^X-Spam-Status:.*Yes/))
{
to ./Maildir/.Spam/.
}
-Original Message-
From: Francesco [mailto:[EMAIL PROTECTED]
Sent: Monday, October 27, 2003 6:18
Trying to install SA 2.60, everyting builds and installs fine, but when I
try to start spamd, in complains about bytes.pm not being installed. it
is, but under the perl 5.8 libs. The reason for this is that a long time
ago, I thought I'd join the CPAN bandwagon and install SA with it. To my
is to make sure that you're running the perl 5.005 binary, fire up the
CPAN shell, install *just* CPAN (not the bundle) to get the most recent
version, quit and restart the CPAN shell, and *then* install Bundle::CPAN.
If necessary -- and if you decide to stay with perl 5.005 -- delete all
On Mon, 22 Sep 2003, drew wrote:
Once you get the hang of it, its not too bad I personally find it much
easier to configure then sendmail. Just be careful with the scripts, thats
the easiest place to booger something. All I did to integrate SA into my
Qmail install was to download the perl
On 18 Sep 2003, Daniel Quinlan wrote:
up wrote:
The last time this happened, the only way I could get sa-learn to start
working again was to remove _journal, _msgcount, _seen and _toks, which
presumably wipes out all existing bayes data. Is there a better way?
Abigail Marshall [EMAIL
On Thu, 18 Sep 2003, Daniel Quinlan wrote:
up [EMAIL PROTECTED] writes:
This is perl, version 5.005_03 built for i386-freebsd
Not sure which DB module is installed...perl -V doesn't say...I presume
there's an easy way to tell?
Not super easy, but not too hard. Sometimes you can tell
The last time this happened, the only way I could get sa-learn to start
working again was to remove _journal, _msgcount, _seen and _toks, which
presumably wipes out all existing bayes data. Is there a better way?
Cannot open bayes_path /usr/local/etc/mail/spamassassin/ R/W:
Inappropriate file
I've been feeding sa-learn the following way for months now, but even
though I've changed nothing, I can no longer do it. I now get:
su-2.05a# sa-learn --spam --mbox ~up/mail/SPAM
Cannot open bayes_path /usr/local/etc/mail/spamassassin/ R/O:
Inappropriate file type or format
Cannot open
...or from my domain (see address). I've actually had it caught in
certain large sites filters. It may well be that they just have no clue
what .am is...
On Thu, 24 Jul 2003, Evan Platt wrote:
--On Thursday, July 24, 2003 3:31 PM +0300 Turgut Kalfaoglu
[EMAIL PROTECTED] wrote:
also,
On Thu, 17 Jul 2003, Malte S. Stretz wrote:
On Thursday 17 July 2003 20:21 CET Justin Mason wrote:
[EMAIL PROTECTED] writes:
1) Have spamd re-read local.cf when it receives a HUP signal, rather
that having to be stopped and restarted
Yep, that'll be in for 2.60.
But only in Perl
Sorry if this has already been broached, but this seems like it would be a
great idea and not too difficult to implement (but I could be way off):
1) Have spamd re-read local.cf when it receives a HUP signal, rather
that having to be stopped and restarted
2) Whether the #1 is doable or not,
I use qmail-scanner, because it gives you the option of virus scanning as
well, but there are probably more efficient/elegant ways of doing this
now. In short, you'll want to install in this order:
qmail (Maildir)
maildrop (or a procmail that understands Maildir)
qmail-queue patch (see
: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
$HOME/mail/almost-certainly-spam
:0:
* ^X-Spam-Status: Yes
$HOME/mail/probably-spam
:0
* ^^rom[ ]
{
LOG=*** Dropped F off From_ header! Fixing up.
:0 fhw
| sed -e '1s/^/F/'
}
:0:
$MAILDIR
-/cut--
Let me know if this helps
Replying to my own email: If this anyone is actually trying to figure this
one out, you can stop now. Although a make clean didn't help, deleting
the tree and unpacking the source again did. Go figure...
On Fri, 21 Feb 2003 [EMAIL PROTECTED] wrote:
Ok, CPAN was hell for me, so I tried
On 15 Jan 2003, Jeremy Turner wrote:
2. As discussed previously on this thread (I believe), it might be a
bad idea to send an email back to a spam source. At best, the address
doesn't exist, creating a returned bounce email and wasting bandwidth.
At worst, the spam source could be a valid
; I've given up. Sorry it didn't work
out.
***@*.net:
Your Email was Rejected by our SPAM filters. Sorry.
Hmmm. I'll have to try this with my postfix installation here at home. I
don't recall seeing anything that indicated it would behave similarly, but
perhaps it does. I am
On 19 Dec 2002, Daniel Quinlan wrote:
When downloading a lot of mail at once, it might make sense to use a
local instance of spamd/spamc instead of the spamassassin script. That
will probably get you a nice speed-up, even with the procmail problem.
This brings me to a newbie question
Following up on this...it turns out that the problem of email being
rejected with a threshold of 0 was NOT the result of a bug in SA. but an
issue (I'd call it a bug, but it looks like it was intentional) with
qmail-scanner 1.15. There's a quick patch that fixes it in the email
from the QS list
I thought I had this setup (SA, qmail, qmail-scanner, maildrop, etc) all
tested, but I'm finding in production mode, I'm several clues short :-/
First: running spamd, I can't seem to get it to recognize the
whitelist_from rule, either in local.cf or user_prefs (does user_prefs
even work with
I'm not able to duplicate this problem sending attachments from a shell
account, but customers are having problems with some attachments. For
some reason, it's pushing the hit threshold to 0 :
X-Spam-Status: Yes, hits=0 required=0
when there's an attachment instead of:
X-Spam-Status: No,
whitelisting in the local.cf file worked only after killing and restarting
spamd, even though changes to the hits threshold in the same config file
work after killing and restarting qmail-send.
I must be doing something seriously wrong here:
If spamd is killed, all email is rejected as spam
On Mon, 16 Dec 2002, Duncan Findlay wrote:
On Mon, Dec 16, 2002 at 02:39:09PM -0500, [EMAIL PROTECTED] wrote:
On Mon, 16 Dec 2002, Duncan Findlay wrote:
I feel like I'm repeating my self now.
Sorry...maybe this should be in the FAQ.
There's a bug in spamd in 2.43 that occurrs
On Mon, 16 Dec 2002 [EMAIL PROTECTED] wrote:
I'd look in the archives, but they seem to be down right now.
Actually, I looked for the patch. It was applied before 2.43. You are
using 2.43, right?
yes.
How are you calling spamassassin/spamc?
It's being called from
This varies depending on the MDA. With maildrop (used with Maildir), you
would have something like:
if ((/^X-Spam-Status:.*Yes/))
{
echo Your Email was Rejected by our SPAM filters. Sorry.
EXITCODE=100
exit
}
to ./Maildir/.
On Fri, 13 Dec 2002, James D. Stallings wrote:
Does
The docs indicate that setting required_hits to 8.0 to 10.0 is prudent to
prevent false positives, but on the test server with one account, I've
already noticed several spams getting through with 7.8 and 7.9 hits (are
the spammers on to SA?) with required_hits set to 8.0.
I'm just wondering if
Thanks for the help, Mike, Matt and Dave! I misunderstood the
qmail-scanner docs to mean that SA just needed to be installed properly.
not that spamd needed to be running.
On that note, is it best to just run spamd standalone in the background or
inetd (not interested in using daemontools
Need to get spamassassin working system-wide with:
qmail (with the qmail-queue patch)
tcpserver
maildrop
sqwebmail (w/ vpopmail, but no virtual users)
All the docs I could find (including the archives to this list) say to use
qmail-scanner to use spamassassin with qmail. However, qmail-scanner
44 matches
Mail list logo
