Re[2]: Uri rules

2005-06-16 Thread Robert Menschel
Hello Keith, Thanks! Did those off the top of my head, just before going to bed, and thought I had forgotten something. I believe your additions are correct, and probably better than what we're actually using. Bob Menschel Wednesday, June 15, 2005, 7:51:52 PM, you wrote: KI Robert Menschel

Re: Limit the size of spamd

2005-06-16 Thread Ronan McGlue
Network Operations wrote: List; We are an isp that currently runs through either qmail-scanner or Plesk spamassassin. 2.6x and i believe 3.x. We are having issues with spamd getting into the 125+mb process size at 4 to 5 processes. We are running from Fedora to FreeBSD 4.9+ and qmail is the

V*I*A*

2005-06-16 Thread hamann . w
I just received some spam built like Vspan style=display: none some words /spanIspan style=display: none more text /spanI Is there any way to detect these? Wolfgang Hamann

Upgrade/install over earlier version

2005-06-16 Thread Dr Robert Young
Does anyone have information on the installation/upgrade of V3 of Spamassassin, on a system already running V2? Should the new version go on top of the older one, or as a separate product install? Any issues one should be aware of? I am installing on RedHat 6.2 and using a fairly recent

Re: V*I*A*

2005-06-16 Thread Kevin Golding
In article [EMAIL PROTECTED], [EMAIL PROTECTED] online.de writes I just received some spam built like Vspan style=display: none some words /spanIspan style=display: none more text /spanI Is there any way to detect these? Working on the logic that display:none is highly unlikely to ever appear in

Re: V*I*A*

2005-06-16 Thread Christian Recktenwald
On Thu, Jun 16, 2005 at 09:42:24AM +0200, [EMAIL PROTECTED] wrote: I just received some spam built like Vspan style=display: none some words /spanIspan style=display: none more text /spanI Is there any way to detect these? If I run this through SA I get: 3.1 HTML_OBFUSCATE_40_50 BODY:

To add or to multiply (slightly OT)

2005-06-16 Thread Chris Hastie
The industry that I work in is currently having its concept of risk assessment thoroughly shaken. The sort of risks we deal with have three main, largely independant factors. For years we've been assigning a value to each of these factors, and then adding them up to come up with a figure

HELO_DYNAMIC_IPADDR And IMP

2005-06-16 Thread jj-ml
Hi all, I discover a problem today with our webmail (Horde/IMP). When i send a message using it, the message is tag as spam if i have a dynamic ISP addess. here is part of the message: Received: from 127.0.0.1 by mx (envelope-from [EMAIL PROTECTED], uid 103) with qmail-scanner-1.24 (clamdscan:

Re: To add or to multiply (slightly OT)

2005-06-16 Thread jdow
From: Chris Hastie [EMAIL PROTECTED] The industry that I work in is currently having its concept of risk assessment thoroughly shaken. The sort of risks we deal with have three main, largely independant factors. For years we've been assigning a value to each of these factors, and then adding

Re: debug: DNS: timeout for ahbl after 20 seconds

2005-06-16 Thread Ugo Bellavance
Ugo Bellavance wrote: Hi, I get this message on 2 servers, while all my other servers, with the same config are ok. debug: DNS: timeout for ahbl after 20 seconds Any idea of what could be wrong? Regards, Ugo Anyone?

spamd 3.1 error messages

2005-06-16 Thread Andy Jezierski
In the process of setting up a new server, so I thought I'd give SA 3.1 a try. Install went fine, but in looking at my maillog, I'm seeing the following errors about every 5 minutes. Anyone have an idea what the cause might be? Running FreeBSD 5.4, Sendmail 8.13.3, SA3.1 SVN snapshot from

Re: Limit the size of spamd

2005-06-16 Thread Matt Kettler
At 03:44 PM 6/15/2005, Network Operations wrote: We are an isp that currently runs through either qmail-scanner or Plesk spamassassin. 2.6x and i believe 3.x. We are having issues with spamd getting into the 125+mb process size at 4 to 5 processes. We are running from Fedora to FreeBSD 4.9+

Re: Upgrade/install over earlier version

2005-06-16 Thread Kai Schaetzl
Dr Robert Young wrote on Wed, 15 Jun 2005 17:39:04 -0400: Should the new version go on top of the older one, or as a separate product install? Any issues one should be aware of? You can just upgrade. But read the upgrade instructions, several options have been removed/added. Also, there

Re: Upgrade/install over earlier version

2005-06-16 Thread Matt Kettler
At 05:39 PM 6/15/2005, Dr Robert Young wrote: Does anyone have information on the installation/upgrade of V3 of Spamassassin, on a system already running V2? Should the new version go on top of the older one, or as a separate product install? Yep. Just install directly on top of the old

Re: Upgrade/install over earlier version

2005-06-16 Thread Rakesh
Dr Robert Young wrote: Does anyone have information on the installation/upgrade of V3 of Spamassassin, on a system already running V2? Should the new version go on top of the older one, or as a separate product install? Any issues one should be aware of? I am installing on RedHat 6.2 and

Re: V*I*A*

2005-06-16 Thread Loren Wilton
I just received some spam built like Vspan style=display: none some words /spanIspan style=display: none more text /spanI Is there any way to detect these? Sure. rawbody or full rule. Loren

Re: debug: DNS: timeout for ahbl after 20 seconds

2005-06-16 Thread Niek
On 6/16/2005 3:35 PM +0200, Ugo Bellavance wrote: debug: DNS: timeout for ahbl after 20 seconds Any idea of what could be wrong? Regards, Ugo Anyone? lookup something something manually on those two boxes: host 2.0.0.127.dnsbl.ahbl.org that should come back with:

SOLVED Re: Bayes? (MORE)

2005-06-16 Thread John Fleming
- Original Message - From: Kai Schaetzl [EMAIL PROTECTED] To: users@spamassassin.apache.org Sent: Thursday, June 16, 2005 8:07 AM Subject: Re: Bayes? (MORE) John Fleming wrote on Wed, 15 Jun 2005 18:25:28 -0500: Note that there -is- a BAYES_ entry! I have some modified Bayes

Re: debug: DNS: timeout for ahbl after 20 seconds

2005-06-16 Thread Ugo Bellavance
Niek wrote: On 6/16/2005 3:35 PM +0200, Ugo Bellavance wrote: debug: DNS: timeout for ahbl after 20 seconds Any idea of what could be wrong? Regards, Ugo Anyone? lookup something something manually on those two boxes: host 2.0.0.127.dnsbl.ahbl.org that should come back with:

Re: To add or to multiply (slightly OT)

2005-06-16 Thread Chris Hastie
On Thu, 16 Jun 2005, jdow [EMAIL PROTECTED] wrote From: Chris Hastie [EMAIL PROTECTED] Thus if a piece of mail has failed all three of these tests, the probability of it being ham is 0.05 * 0.2 * 0.4 = 0.004, or 1/250. Or put another way, we can be 99.6% sure it is spam. They got there

AWL Question

2005-06-16 Thread Richard Ozer
I have a particular address whitelisted via spamassassin [EMAIL PROTECTED] It works for a while, but then comes back reported as spam after a week or two. I recieve mail from this user, tagged with AWL, as well as BAYES40. However there are a couple of spammy rules fired that seem to

re: spamd 3.1 error messages

2005-06-16 Thread Justin Mason
Andy, can you open a bug at bugzilla, run with debugs on for a while and collect 1 or 2 of those cases, and attach the debug log to the bug? sounds like it warrants checking out. --j.

Re: V*I*A*

2005-06-16 Thread Chris Stone
On Thursday 16 June 2005 01:42 am, [EMAIL PROTECTED] wrote: I just received some spam built like Vspan style=display: none some words /spanIspan style=display: none more text /spanI Is there any way to detect these? Here's what I use: rawbody SENET_DISPNONE

re: spamd 3.1 error messages

2005-06-16 Thread Andy Jezierski
[EMAIL PROTECTED] wrote on 06/16/2005 02:10:27 PM: Andy, can you open a bug at bugzilla, run with debugs on for a while and collect 1 or 2 of those cases, and attach the debug log to the bug? sounds like it warrants checking out. --j. Done. Bug 4407. Andy

Re: To add or to multiply (slightly OT)

2005-06-16 Thread mouss
Chris Hastie wrote: The industry that I work in is currently having its concept of risk assessment thoroughly shaken. The sort of risks we deal with have three main, largely independant factors. For years we've been assigning a value to each of these factors, and then adding them up to come up

Re: SOLVED Bayes? (MORE)

2005-06-16 Thread Kai Schaetzl
John Fleming wrote on Thu, 16 Jun 2005 13:08:22 -0500: I'm not sure I fully understand why the single digit entries allowed BAYES_ score headers on spam but not ham, but I'm happy to use the multiple scores and have all of my BAYES_ entries back. Hm, just checked our setup and we changed

OT: Insecure dependency in connect?

2005-06-16 Thread Eric A. Hall
I'm trying to update my ldap plugin to use SRV lookups for server discovery but am getting barked at during tests with the Insecure dependency in connect... error. I'm not having much luck with googling this error, but I remember this was a problem with razor and spamassassin before, and I'm

Re: AWL pokes, and SAGray.pm

2005-06-16 Thread Eric A. Hall
On 6/15/2005 3:20 PM, Justin Mason wrote: Eric -- you may have to patch the AutoWhitelist class to throw those numbers into variables hanging off the PerMsgStatus object. Then the plugin can access those values safely. I'd be +1 on applying a patch that simply sets a variable or two on

Re: AWL Question

2005-06-16 Thread Kris Deugau
Richard Ozer wrote: I have a particular address whitelisted via spamassassin [EMAIL PROTECTED] It works for a while, but then comes back reported as spam after a week or two. This is normal due to the way the AWL works. I recieve mail from this user, tagged with AWL, as well as BAYES40.

Re: AWL pokes, and SAGray.pm

2005-06-16 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Eric A. Hall writes: On 6/15/2005 3:20 PM, Justin Mason wrote: Eric -- you may have to patch the AutoWhitelist class to throw those numbers into variables hanging off the PerMsgStatus object. Then the plugin can access those values safely.

Re: To add or to multiply (slightly OT)

2005-06-16 Thread jdow
Pardon me - I misread your memo. They use adding rather than multiplying. Adding is more appropriate for scores related to spam than to ham. (The proper would be to somehow invert the probability of being spam score, multiply them together, and then reinvert to get a spaminess score. The additions

Re: HELO_DYNAMIC_IPADDR And IMP

2005-06-16 Thread Daryl C. W. O'Shea
jj-ml wrote: Hi all, I discover a problem today with our webmail (Horde/IMP). When i send a message using it, the message is tag as spam if i have a dynamic ISP addess. here is part of the message: Are these the (only) received headers that were given to SpamAssassin? Received: from

spamc -L ?

2005-06-16 Thread Neal Becker
There is spamassassin -L, but not spamc -L. Why not? I want to use with kmail, and spamc (with network check) is too slow on my home machine. spamassassin -L is OK, but woundn't a spamc -L be faster since it avoids startup cost?

Exceptions to all_spam_to?

2005-06-16 Thread Tom Lanyon
Hi All, Forgive me if this is a common question or one which has been answered elsewhere, but I cannot find the answer anywhere. I want to enable spamassassin on our production mail server, however I only want to filter for spam on selected email accounts. I was thinking of doing an all_spam_to

Re: spamc -L ?

2005-06-16 Thread jdow
spamd -L {^_^} - Original Message - From: Neal Becker [EMAIL PROTECTED] To: users@spamassassin.apache.org Sent: 2005 June, 16, Thursday 19:09 Subject: spamc -L ? There is spamassassin -L, but not spamc -L. Why not? I want to use with kmail, and spamc (with network check) is too slow

Re: Exceptions to all_spam_to?

2005-06-16 Thread Bob McClure Jr
On Fri, Jun 17, 2005 at 11:39:50AM +0930, Tom Lanyon wrote: Hi All, Forgive me if this is a common question or one which has been answered elsewhere, but I cannot find the answer anywhere. I want to enable spamassassin on our production mail server, however I only want to filter for spam

Re: Exceptions to all_spam_to?

2005-06-16 Thread Tom Lanyon
On Thu, 2005-06-16 at 23:07 -0500, Bob McClure Jr wrote: On Fri, Jun 17, 2005 at 11:39:50AM +0930, Tom Lanyon wrote: Hi All, Forgive me if this is a common question or one which has been answered elsewhere, but I cannot find the answer anywhere. I want to enable spamassassin on our

Re: Bayes Database RW Lock

2005-06-16 Thread Paul R. Ganci
Matt Kettler wrote: Paul R. Ganci wrote: -rw-rw-rw-1 prganci users 165988 May 14 10:05 bayes_journal -rw---1 pangione users 34 May 14 10:00 bayes.lock That's a little troubling.. are you having problems with spamd instances crashing? The lock is at least 5

Re: Spamd skipping messages on respawn

2005-06-16 Thread Paul R. Ganci
Paul R. Ganci wrote: I am running Spamassassin 3.0.2 on a RaQ 550 using spamd and calling spamc from procmail. I have found several instances now where the spamd child is respawned just as it is about to start processing a message. Can anybody give me even a wild guess on this one? Believe