Re: Messages Not detected as Spam

2006-04-26 Thread Paul Wetter
Ok, I added what you said. I think things may be back on the up and in operation. Some spam however is still not detected, which brings me to my next question. I have one other question about razor checks. They do not appear to be working. If I do a manual check (with the amavis user) it

Re: Advanced regex question - backtracking vs. negative lookaheads

2006-04-26 Thread Jeremy Fairbrass
Good point, you're completely right! Thanks for pointing that out... :) Cheers, Jeremy John Rudd [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] On Apr 25, 2006, at 6:33 AM, Jeremy Fairbrass wrote: /style=[^]+color:blue/ span style=color:blue; font-size:small;

Re: Messages Not detected as Spam

2006-04-26 Thread Paul Wetter
Probably would also like this output, i think: [EMAIL PROTECTED] ~]# spamassassin -D --lint 21 | grep -i razor [4398] dbg: diag: module installed: Razor2::Client::Agent, version 2.75 [4398] dbg: config: read file /usr/share/spamassassin/25_razor2.cf [4398] dbg: plugin: fixed relative path:

Re: Messages Not detected as Spam

2006-04-26 Thread Jim Maul
Paul Wetter wrote: Ok, I added what you said. I think things may be back on the up and in operation. Some spam however is still not detected, which brings me to my next question. I have one other question about razor checks. They do not appear to be working. If I do a manual check (with

Re: Charity spam - is this a new kind of 419?

2006-04-26 Thread Jeff Chan
On Monday, April 24, 2006, 5:42:16 AM, Craig McLean wrote: Smells like 419 to me, given (among other things) the level of literacy displayed. If you have no objections I'll drop the sender a line and see what the scam is... Or better, ask savethechildren.org to comment: [DOMAIN whois

scores

2006-04-26 Thread Pablo Allietti
hi all i recently install spamassassin in freebsd but i can't find the file that contain the scores i need to chage for example NO_RDNS rule to give 3.0 but i can't find the file 0.5 NO_RDNSSending MTA has no reverse DNS (Postfix variant) 0.8 BR_REMOVER_QUOTE BODY: Inclui

RE: scores

2006-04-26 Thread Bowie Bailey
Pablo Allietti wrote: hi all i recently install spamassassin in freebsd but i can't find the file that contain the scores i need to chage for example NO_RDNS rule to give 3.0 but i can't find the file 0.5 NO_RDNSSending MTA has no reverse DNS (Postfix variant) 0.8

Re: Messages Not detected as Spam

2006-04-26 Thread Matt Kettler
Paul Wetter wrote: Ok, I added what you said. I think things may be back on the up and in operation. Some spam however is still not detected, which brings me to my next question. I have one other question about razor checks. They do not appear to be working. If I do a manual check (with

Domain Keys

2006-04-26 Thread Jeferson Pessoa Santana
Hello List, It's me again with another doubt =P I'm stuck in this Domain Keys thing because I don't know how to create a public and a private key for my server. I already read the http://antispam.yahoo.com/domainkeys to understand how Domain Keys work but I can't go on with only this

Re: Domain Keys

2006-04-26 Thread Matt Kettler
Jeferson Pessoa Santana wrote: Hello List, It's me again with another doubt =P I'm stuck in this Domain Keys thing because I don't know how to create a public and a private key for my server. I already read the http://antispam.yahoo.com/domainkeys to understand how Domain Keys work but I

SA script to get bayes score

2006-04-26 Thread Ramprasad
I want to run just the bayes test on several files and get bayes scores I tried writing my own script using Mail::SpamAssassin but thats seems to not give any score at all. Is there any ready script available Or can I get any pointers Thanks Ram

Re: Spam that is nothing but one large image

2006-04-26 Thread Matt
Unfortunately this is what I may be forced to do. I hate to let one item give a high score, but when the message is nothing but an IMAGE... no HTML... no link... and the blacklists have not yet picked it up.. and Pyzor doesn't see it yet... what else can you do? On 4/22/06, John D. Hardin [EMAIL

RE: scores

2006-04-26 Thread Bowie Bailey
Pablo Allietti wrote: On Wed, Apr 26, 2006 at 10:20:22AM -0400, Bowie Bailey wrote: The file that has scores for the default rules is /usr/share/spamassassin/50_scores.cf. However, you do not want to make changes to that file, because they will be overwritten every time you upgrade.

Spam coming thru w/high score different SA version

2006-04-26 Thread Tracey Gates
Title: Message I got this email with a high score of 101.6 and the version as 3.0.2. I have my score limit set to 3.5 in my local.cf file. Why wasn't this detected as spam? Also when I run spamassassin -v on my server I get the version as 3.1.1 but the email header has 3.0.2 as the version?

Spam coming thru w/high score different SA version

2006-04-26 Thread Tracey Gates
Title: Message I got this email with a high score of 101.6 and the version as 3.0.2. I have my score limit set to 3.5 in my local.cf file. Why wasn't this detected as spam? Also when I run spamassassin -v on my server I get the version as 3.1.1 but the email header has 3.0.2 as the version?

Re: Spam coming thru w/high score different SA version

2006-04-26 Thread Dale Morin
I got this email with a high score of 101.6 and the version as 3.0.2. I have my score limit set to 3.5 in my local.cf file. Why wasn't this detected as spam? HEADER OF PROBLEM EMAIL: X-Spam-Status: No, score=-101.6 required=3.5 tests=BAYES_00,FM_NO_STYLE,

Re: scores

2006-04-26 Thread Pablo Allietti
On Wed, Apr 26, 2006 at 10:20:22AM -0400, Bowie Bailey wrote: Pablo Allietti wrote: hi all i recently install spamassassin in freebsd but i can't find the file that contain the scores i need to chage for example NO_RDNS rule to give 3.0 but i can't find the file 0.5 NO_RDNS

RE: Spam coming thru w/high score different SA version

2006-04-26 Thread Tracey Gates
DOH! Thanks Dale for pointing that out. Of course I didn't see the negative sign. Tracey Gates Lead Developer [EMAIL PROTECTED] 1350 South Boulder, Third Floor / Tulsa, OK 74119-3203 Phone 918-663-0991 / Fax 918-663-0840 This communication is intended only for the recipient(s) named above;

RE: scores

2006-04-26 Thread Bowie Bailey
Pablo Allietti wrote: ok and i need to restart spamass after modify the local.cf? Yes. -- Bowie

RE: Spam coming thru w/high score different SA version

2006-04-26 Thread Tracey Gates
OK. Now I understand the high (actually negative) score but what about the version difference? Anyone have any idea about that issue? Tracey Gates Lead Developer [EMAIL PROTECTED] 1350 South Boulder, Third Floor / Tulsa, OK 74119-3203 Phone 918-663-0991 / Fax 918-663-0840 This communication

RE: Virtual user config and auto-whitelist

2006-04-26 Thread Rosenbaum, Larry M.
From: Bart Schaefer [mailto:[EMAIL PROTECTED] ... (Someone remind me why the spamd option to disable the auto-whitelist was dropped? I could instead chmod 0 the auto-whitelist file, I suppose, but then the maillog is cluttered with extra warning output, and it's still not scalable.) It

Re: Spam coming thru w/high score different SA version

2006-04-26 Thread Matt Kettler
Tracey Gates wrote: OK. Now I understand the high (actually negative) score but what about the version difference? Anyone have any idea about that issue? Possible double-install. One in /usr/ and one in /usr/local?

Re: Virtual user config and auto-whitelist

2006-04-26 Thread Bart Schaefer
On 4/26/06, Rosenbaum, Larry M. [EMAIL PROTECTED] wrote: From: Bart Schaefer [mailto:[EMAIL PROTECTED] ... (Someone remind me why the spamd option to disable the auto-whitelist was dropped?) It hasn't been dropped; they just moved the documentation into Plugin/AWL.pm. Ah, right, duh.

Re: scores

2006-04-26 Thread Michael Monnerie
On Mittwoch, 26. April 2006 16:09 Pablo Allietti wrote: i need to chage for example  NO_RDNS rule to give 3.0 Don't do that, it's not required for a mail server to have an RDNS. At least, it used to be the last time I looked into the RFCs. mfg zmi -- // Michael Monnerie, Ing.BSc-

Rule to select sender starting with string

2006-04-26 Thread Al Danks
We are getting a lot of spam where the sender domain name changes, but the sender always starts with a specific string. We've only done a little bit of custom rule writing. How do we do a rule to get the sender starting with a specific string? Thanks, Al

Re: Rule to select sender starting with string

2006-04-26 Thread Mike Jackson
We are getting a lot of spam where the sender domain name changes, but the sender always starts with a specific string. We've only done a little bit of custom rule writing. How do we do a rule to get the sender starting with a specific string? You could probably just do something like this:

RE: Spam that is nothing but one large image

2006-04-26 Thread Gaute Lund
-Original Message- From: Matt [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 26, 2006 8:51 PM Unfortunately this is what I may be forced to do. I hate to let one item give a high score, but when the message is nothing but an IMAGE... no HTML... no link... and the blacklists

Re: Rule to select sender starting with string

2006-04-26 Thread Matt Kettler
Al Danks wrote: We are getting a lot of spam where the sender domain name changes, but the sender always starts with a specific string. We've only done a little bit of custom rule writing. How do we do a rule to get the sender starting with a specific string? Try a rule something like

Re: Spam that is nothing but one large image

2006-04-26 Thread Matt Kettler
Gaute Lund wrote: -Original Message- From: Matt [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 26, 2006 8:51 PM Unfortunately this is what I may be forced to do. I hate to let one item give a high score, but when the message is nothing but an IMAGE... no HTML... no link... and

Re: Spam that is nothing but one large image

2006-04-26 Thread Andrzej Adam Filip
Matt [EMAIL PROTECTED] writes: Hi, We have received a large quantity of spam that is nothing but a large image. Spamassassin is tagging it a little because it is an image, and only an image, however I'm wondering how other people are handeling this type of spam?I don't want to score

Re: Spam that is nothing but one large image

2006-04-26 Thread Matt Kettler
Andrzej Adam Filip wrote: Matt [EMAIL PROTECTED] writes: Hi, We have received a large quantity of spam that is nothing but a large image. Spamassassin is tagging it a little because it is an image, and only an image, however I'm wondering how other people are handeling this type of spam?

Re: Rule to select sender starting with string

2006-04-26 Thread Matt Kettler
Al Danks wrote: Matt Kettler mkettler at evi-inc.com writes: Try a rule something like this: L_FROM_STRING header From =~ /$string/ It appears that the rule is also hitting senders with the string following a . I.e. From =~ /$com/ hits comalksdfl.net aksafjdla.com

Re: scores

2006-04-26 Thread jdow
From: Pablo Allietti [EMAIL PROTECTED] hi all i recently install spamassassin in freebsd but i can't find the file that contain the scores i need to chage for example NO_RDNS rule to give 3.0 but i can't find the file 0.5 NO_RDNSSending MTA has no reverse DNS (Postfix variant)

Re: scores

2006-04-26 Thread jdow
From: Bowie Bailey [EMAIL PROTECTED] Pablo Allietti wrote: hi all i recently install spamassassin in freebsd but i can't find the file that contain the scores i need to chage for example NO_RDNS rule to give 3.0 but i can't find the file 0.5 NO_RDNSSending MTA has no reverse

bayes stuck at nspam 2165

2006-04-26 Thread Marc Dufresne
I am using Freebsd 5.4 with Mailscanner-4.52.2-1. I have always encountered this when bayes approaches nspam of arounf 2500. It just locks. I have had this problem on numerous occassions. My bayes database will not learn anymore than 2165 nspam. It seems to be stuck there. My tokens increase,

Re: Messages Not detected as Spam

2006-04-26 Thread Paul Wetter
Paul Wetter wrote: Ok, I added what you said. I think things may be back on the up and in operation. Some spam however is still not detected, which brings me to my next question. I have one other question about razor checks. They do not appear to be working. If I do a manual check (with the