Re: Check $HOME for an ever growing razor-agent.log

2007-10-19 Thread Bill Landry
[EMAIL PROTECTED] wrote the following on 10/18/2007 11:01 PM -0800: Check your $HOME for an ever growing ~/razor-agent.log apparently brought in by sa-update two days ago, which will one day fill your disk, according to a web search. How to tell it that just like the other 99% of

99_sare_fraud??

2007-10-19 Thread A J Thew
This seems quite old, does anyone find it useful? I'm running 3.2.3 Thanks A Thew

Re: unsubscribed

2007-10-19 Thread Michelle Konzack
Hello Steve, when I subscribed to this Mailinglist I have gotten a CONFIRMATION message and a WELCOME message which told me HOW TO UNSUBSCRIBE. I do not know the exact text of the WELCOME message, but AFAIK there was written, YOU SHOULD SAVE THE MESSAGE FOR FURTHER USE/INFOS. Thanks, Greetings

Re: How to Reject Messages

2007-10-19 Thread Per Jessen
Yoda Woda wrote: Here my scenario: I have postfix and spamassassin installed in a gateway machine. Postfix accepts incoming messages, pipes them to spamassassin for scoring, which then pipes them back to postfix to be relayed to another machine. This work fine for us What I am

Re: Disabling URIDNSBL plugin

2007-10-19 Thread Daryl C. W. O'Shea
Justin Kim wrote: I don't know what is causing my postfix server to defer messages couple of times daily. By looking at the logs, I can only tell there is something that keeps one spam checking process running for 5~10 mins. Likely bayes auto expiry. Disable bayes_auto_expiry and do the

Re: Disabling URIDNSBL plugin

2007-10-19 Thread Byung-Hee HWANG
Hi Justin, On Fri, 2007-10-19 at 13:09 -0700, Justin Kim wrote: Hi All, I need a help. I don't know what is causing my postfix server to defer messages couple of times daily. When postfix server is deferring messages, our users does not get the email delivery until the deferring action is

only blocking one kind of Chinese

2007-10-19 Thread jidanni
Mail::SpamAssassin::Plugin::TextCat says zh - Chinese (both Traditional and Simplified) zh.big5 - Chinese (Traditional only) zh.gb2312 - Chinese (Simplified only) I want to block zh.gb2312. OK, I should use ok_languages en zh.big5 but what about UTF-8 etc. zh messages? I don't want to

Re: spam scores for reverse DNS

2007-10-19 Thread mouss
YMGT wrote: Hi Guys, I am sending two emails from the same system. One of these emails is giving me extra spam penalty scores for failed reverse DNS tests. The header of that email is: I have no idea what these REVDNS_* rules come from. can you grep your config files to find them?

Re: Check $HOME for an ever growing razor-agent.log

2007-10-19 Thread jidanni
TVD In short, add the following to your ~/.razor/razor-agent.conf file: TVD debuglevel = 0 OK, I did mkdir .razor echo debuglevel=0 .razor/razor-agent.conf That was at 7:56. Now the activity has shifted to that new directory: $ ls -ogt .razor -rw--- 1 854 2007-10-20 09:01

Disabling URIDNSBL plugin

2007-10-19 Thread Justin Kim
Hi All, I need a help. I don't know what is causing my postfix server to defer messages couple of times daily. When postfix server is deferring messages, our users does not get the email delivery until the deferring action is done. It usually takes 5 mins to 10 mins. I was looking at the maillog.

Re: Disabling URIDNSBL plugin

2007-10-19 Thread Micah Anderson
* Daryl C. W. O'Shea [EMAIL PROTECTED] [071019 14:59]: Justin Kim wrote: I don't know what is causing my postfix server to defer messages couple of times daily. By looking at the logs, I can only tell there is something that keeps one spam checking process running for 5~10 mins. Likely

RE: coming to your inbox: mp3 stock spams

2007-10-19 Thread Kurt Buff
-Original Message- From: Rob Sterenborg [mailto:[EMAIL PROTECTED] Sent: Thursday, October 18, 2007 22:48 To: users@spamassassin.apache.org Subject: RE: coming to your inbox: mp3 stock spams Luis Hernán Otegui wrote: Anyway, the Faculty I work for tries to keep the e-mail system

Re: How to Reject Messages

2007-10-19 Thread Noel Jones
On 10/19/07, David B Funk [EMAIL PROTECTED] wrote: On Fri, 19 Oct 2007, Noel Jones wrote: On 10/19/07, Yoda Woda [EMAIL PROTECTED] wrote: Here my scenario: I have postfix and spamassassin installed in a gateway machine. Postfix accepts incoming messages, pipes them to spamassassin

Re: How to Reject Messages

2007-10-19 Thread Per Jessen
David B Funk wrote: Using sendmail and a milter it is easily possible to do a proper reject (571) at incoming SMTP time. How can this be properly done using postfix? You can do pre-queue filtering with postfix - whether you'll want to do so depends on your inbound transaction rate. /Per

Re: How to Reject Messages

2007-10-19 Thread David B Funk
On Fri, 19 Oct 2007, Noel Jones wrote: On 10/19/07, Yoda Woda [EMAIL PROTECTED] wrote: Here my scenario: I have postfix and spamassassin installed in a gateway machine. Postfix accepts incoming messages, pipes them to spamassassin for scoring, which then pipes them back to postfix to be

Re: Trusted relays and SPF usable envelope sender

2007-10-19 Thread Daryl C. W. O'Shea
ram wrote: On Thu, 2007-10-18 at 13:55 -0400, Daryl C. W. O'Shea wrote: ram wrote: spf: relayed through one or more trusted relays, cannot use header-based Envelope-From, skipping [31516] dbg: spf: def_spf_whitelist_from: could not find useable envelope sender Enable

Re: unsubscribed

2007-10-19 Thread Daryl C. W. O'Shea
Steve Ingraham wrote: Too often I get responses to a question that do not help me to understand what is happening because they are condescending, short or too vague for me to understand. My intent for my post was to ask those of you who do understand these systems to be aware that many of us

Re: How to Reject Messages

2007-10-19 Thread Evan Platt
SpamAssassin won't / can't reject mail. You'd need to use procmail or another similar method. At 07:30 AM 10/19/2007, Yoda Woda wrote: Here my scenario: I have postfix and spamassassin installed in a gateway machine. Postfix accepts incoming messages, pipes them to spamassassin for scoring,

Re: How to Reject Messages

2007-10-19 Thread Noel Jones
On 10/19/07, Yoda Woda [EMAIL PROTECTED] wrote: Here my scenario: I have postfix and spamassassin installed in a gateway machine. Postfix accepts incoming messages, pipes them to spamassassin for scoring, which then pipes them back to postfix to be relayed to another machine. This work fine

How to Reject Messages

2007-10-19 Thread Yoda Woda
Here my scenario: I have postfix and spamassassin installed in a gateway machine. Postfix accepts incoming messages, pipes them to spamassassin for scoring, which then pipes them back to postfix to be relayed to another machine. This work fine for us What I am trying to do now is to

Re: How to Reject Messages

2007-10-19 Thread LEVEAU Stanislas
hi use a filter as amavisd-new for example. Spamassassin give a score and amavisd-new with this score reject or accept a message in amavisd.conf (file configuration) : $sa_tag2_level_deflt = 5; (score) $sa_kill_level_deflt = $sa_tag2_level_deflt; $final_spam_destiny = D_DISCARD; if

Re: coming to your inbox: mp3 stock spams

2007-10-19 Thread Luis Hernán Otegui
Hi, Rob, 2007/10/19, Rob Sterenborg [EMAIL PROTECTED]: Luis Hernán Otegui wrote: Anyway, the Faculty I work for tries to keep the e-mail system only for research purposes, and mostly students and (sadly) technicians tend to goof around with mail. Bandwidth isn't cheap here, so they

RE: unsubscribed

2007-10-19 Thread Steve Ingraham
-Original Message- From: Michelle Konzack [mailto:[EMAIL PROTECTED] Sent: Friday, October 19, 2007 7:49 AM To: users@spamassassin.apache.org Subject: Re: unsubscribed Hello Steve, when I subscribed to this Mailinglist I have gotten a CONFIRMATION message and a WELCOME

Re: MP3 Spam

2007-10-19 Thread Justin Mason
I don't think the MIMEHeader plugin in 3.1.x supports :raw checks, though. This is bug 5127, which was never backported, as far as I can tell. http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5127 --j. Jeremy Fairbrass writes: No, MIMEHeader works fine with 3.1.x - Jeremy

Re: MP3 Spam

2007-10-19 Thread Justin Mason
yep, the ones I have here do. however the Storm output is mutating daily so it'll probably change tomorrow ;) UxBoD writes: Thanks Justin. Do they all follow the same patterns ? Regards, --[ UxBoD ]-- // PGP Key: curl -s https://www.splatnix.net/uxbod.asc | gpg --import //

Re: Trusted relays and SPF usable envelope sender

2007-10-19 Thread ram
On Thu, 2007-10-18 at 13:55 -0400, Daryl C. W. O'Shea wrote: ram wrote: Hi, I have been using spamassassin on my MX server ( postfix + MailScanner + SA ) Now I want to run the MX on a different server and relay to the SA server, but my SPF checks have stopped working In

Re: MP3 Spam

2007-10-19 Thread Justin Mason
Martin.Hepworth writes: Hmm I'm still running 3.1.8.. I think you need 3.2.x for the MIMEHeader plugin. --j. Content analysis details: (7.4 points, 5.0 required) pts rule name description --

spamd hangs at 100% cpu

2007-10-19 Thread Peter Fastré
Hello I have a severe problem with one of my mailservers. I'm using spamassassin 3.2.3 in combination with exim 4.66, and experience hanging spamd processes which consume all my server resources. I've searched these mailing lists, searched google, searched documentation, ... I found very much old

Re: MP3 Spam

2007-10-19 Thread UxBoD
Thanks Justin. Do they all follow the same patterns ? Regards, --[ UxBoD ]-- // PGP Key: curl -s https://www.splatnix.net/uxbod.asc | gpg --import // Fingerprint: C759 8F52 1D17 B3C5 5854 36BD 1FB1 B02F 5DB5 687B // Keyserver: www.keyserver.net Key-ID: 0x5DB5687B // Phone: +44 845 869 2749 SIP

Re: trusted_networks and RCVD_IN_DNSWL_*

2007-10-19 Thread Matus UHLAR - fantomas
For this, SA 3.2.* has its own rules for DNSWL, which you throw away with your custom rule, since they are identically named. The built-in rule for SA 3.2.* is: header RCVD_IN_DNSWL_LOW eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.1') describe RCVD_IN_DNSWL_LOW

Re: Check $HOME for an ever growing razor-agent.log

2007-10-19 Thread Theo Van Dinter
On Fri, Oct 19, 2007 at 02:01:25PM +0800, [EMAIL PROTECTED] wrote: Check your $HOME for an ever growing ~/razor-agent.log apparently brought in by sa-update two days ago, which will one day fill your disk, according to a web search. sa-update doesn't impact the razor config at all. If you're

some of us never use bayes

2007-10-19 Thread jidanni
LW At that point Bayes should kick in. Now you get to the hard part. LW You need to watch Bayes like a hawk for a few weeks to make sure you I have always had them turned off use_auto_whitelist 0 use_bayes 0 and seem to be doing fine. A couple spams slip through each day out of 100. The key to

Re: spamd hangs at 100% cpu

2007-10-19 Thread Micah Anderson
I too have experienced strange hangs with spamc/spamd combos on my postfix box running maildrop/mailfilter. At first I was convinced it was my bayes DB because it was using MyISAM tables and these are slow and I'm doing a lot of mail. So I switched to InnoDB and then I was convinced that the

Re: spamd hangs at 100% cpu

2007-10-19 Thread longjos
I am also having this same problem, Just noticed it starting two days ago. -- View this message in context: http://www.nabble.com/spamd-hangs-at-100--cpu-tf4651889.html#a13298064 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

RE: MP3 Spam

2007-10-19 Thread Martin.Hepworth
Justin Well it's there, just doesn't seem to work ! -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: 19 October 2007 10:55 To: Martin.Hepworth Cc: [EMAIL PROTECTED]

RE: spamd hangs at 100% cpu

2007-10-19 Thread Martin.Hepworth
Peter Get the latest ruleset for SA using sa-update, this works around an issue with whois lookups. Only run a few RBL's - you're running them all and this will take some time. Running a local caching nameserver on the box will help as well. -- Martin Hepworth Snr Systems Administrator Solid

RE: MP3 Spam

2007-10-19 Thread Martin.Hepworth
Hmm I'm still running 3.1.8.. Content analysis details: (7.4 points, 5.0 required) pts rule name description -- -- 1.5 HOST_EQ_NL HOST_EQ_NL 3.0 BOTNET_IPINHOSTNAMEHostname contains

Re: MP3 Spam

2007-10-19 Thread UxBoD
Hmmm, hit okay here Martin :- X-Spam-Status: Yes, score=27.6 required=10.0 tests=BAYES_99,BOTNET,CRM114_CHECK, HELO_DYNAMIC_CHELLO_NL,JM_STORM_MP3,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_DUL, RCVD_IN_XBL,RDNS_DYNAMIC,TVD_SPACE_RATIO autolearn=unavailable version=3.2.3 Regards,

RE: MP3 Spam

2007-10-19 Thread Martin.Hepworth
http://www.solidstatelogic.com/mp3-spam.txt -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -Original Message- From: UxBoD [mailto:[EMAIL PROTECTED] Sent: 19 October 2007 09:01 To: Martin.Hepworth Cc: [EMAIL PROTECTED] Subject: Re: MP3 Spam

Re: MP3 Spam

2007-10-19 Thread UxBoD
Can you post a copy online Martin ? need a few examples to find the common elements. Regards, --[ UxBoD ]-- // PGP Key: curl -s https://www.splatnix.net/uxbod.asc | gpg --import // Fingerprint: C759 8F52 1D17 B3C5 5854 36BD 1FB1 B02F 5DB5 687B // Keyserver: www.keyserver.net Key-ID: 0x5DB5687B

Re: spamd hangs at 100% cpu

2007-10-19 Thread Peter Fastré
Thank you for your response, Michael. I've done your suggestions (sa-update + less RBL's), but still the same problem. We already have a caching nameserver in the same subnet. Some further investigation learns that it's always the same mail which spamassassin is crashing on! But I don't have

Check $HOME for an ever growing razor-agent.log

2007-10-19 Thread jidanni
Check your $HOME for an ever growing ~/razor-agent.log apparently brought in by sa-update two days ago, which will one day fill your disk, according to a web search. How to tell it that just like the other 99% of spamassassin, logging should be off by default? Docs not clear. Or must one rm

RE: MP3 Spam

2007-10-19 Thread Martin.Hepworth
Just tried this on an example we had overnight and it's didn't hit ;-( -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -Original Message- From: UxBoD [mailto:[EMAIL PROTECTED] Sent: 19 October 2007 08:45 To: Justin Mason Cc:

Re: trusted_networks and RCVD_IN_DNSWL_*

2007-10-19 Thread Matus UHLAR - fantomas
On 18.10.07 17:32, Lars Ippich wrote: Now I added IPs to trusted_networks and that causes another problem: The trusted_network IPs are in the DNSWL and therefore get a positive bonus from SA. I guess that's the meaning of trusted_networks setting (or at least one of its meanings) Hm,

Re: MP3 Spam

2007-10-19 Thread Jeremy Fairbrass
No, MIMEHeader works fine with 3.1.x - Jeremy Justin Mason [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] Martin.Hepworth writes: Hmm I'm still running 3.1.8.. I think you need 3.2.x for the MIMEHeader plugin. --j. Content analysis details: (7.4 points, 5.0