The googolbees are getting craftier

2008-01-18 Thread Loren Wilton
I guess btnl is no longer working. Now they are doing a redirect: http://google.co.uk///pagead/iclk?sa=lai=livermorenum=970adurl=http://christmas-low-rate.tw?beast Loren

disable all network test except ...

2008-01-18 Thread Stefan Jakobs
Hello list, I'm using amavisd-new with spamassassin and for some tests I have to disable all network tests in spamassassin except for sorbs, njabl, uribl and maybe some other blackhole lists. I guess I can comment out the corresponding header lines in the files 20_dnsbl_tests.cf and

Re: The googolbees are getting craftier

2008-01-18 Thread Jeff Chan
Quoting Justin Mason [EMAIL PROTECTED]: the redirect detection should have no problem finding that... And the redirected-to domain is on two SURBL blacklists, so it should be hitting. Jeff C. Loren Wilton writes: I guess btnl is no longer working. Now they are doing a redirect:

Re: disable all network test except ...

2008-01-18 Thread Stefan Jakobs
On Friday 18 January 2008 13:46, you wrote: Stefan Jakobs wrote: Hello list, I'm using amavisd-new with spamassassin and for some tests I have to disable all network tests in spamassassin except for sorbs, njabl, uribl and maybe some other blackhole lists. I guess I can comment out

Re: disable all network test except ...

2008-01-18 Thread mouss
Stefan Jakobs wrote: Hello list, I'm using amavisd-new with spamassassin and for some tests I have to disable all network tests in spamassassin except for sorbs, njabl, uribl and maybe some other blackhole lists. I guess I can comment out the corresponding header lines in the files

Re: disable all network test except ...

2008-01-18 Thread Matt Kettler
Stefan Jakobs wrote: Hello list, I'm using amavisd-new with spamassassin and for some tests I have to disable all network tests in spamassassin except for sorbs, njabl, uribl and maybe some other blackhole lists. I guess I can comment out the corresponding header lines in the files

Re: The googolbees are getting craftier

2008-01-18 Thread Justin Mason
the redirect detection should have no problem finding that... Loren Wilton writes: I guess btnl is no longer working. Now they are doing a redirect: http://google.co.uk///pagead/iclk?sa=lai=livermorenum=970adurl=http://-low-rate.tw?beast Loren

Disabling eval rules (was: Re: Testing Botnet)

2008-01-18 Thread Karsten Bräckelmann
On Sat, 2008-01-12 at 12:23 -0800, Robert - elists wrote: Sounds like you've been hit by bug 5519 [1] before the upgrade in Oct. Setting rules scores to 0 did *not* prevent these tests from being evaluated for SA 3.2.x before 3.2.3. Fixed since 3.2.3. Plugin eval rules with 0 scores

Re: sa-learn error message

2008-01-18 Thread Brian Eliassen
Hello Craig, I recently ran into this problem myself. The solution, after being a dolt and not running a backup first, was the following sequence followed by line definitions: /etc/init.d/mailserver stop sa-learn --backup /etc/mail/spamassassin/database.bak sa-learn --dump magic

more efficent big scoring

2008-01-18 Thread George Georgalis
Noticed today (again) how long some messages take to test. The first thing that comes to mind is some dns is getting overloaded answering joe-job rbldns backskatter, causing timeouts or slow responce times. Then I was thinking about how some tests are excluded because they generate too much

Re: sa-learn error message

2008-01-18 Thread Jari Fredriksson
Hello Craig, I recently ran into this problem myself. The solution, after being a dolt and not running a backup first, was the following sequence followed by line definitions: /etc/init.d/mailserver stop sa-learn --backup /etc/mail/spamassassin/database.bak sa-learn --dump

Re: more efficent big scoring

2008-01-18 Thread Matt Kettler
You can't run the rules in score-order without driving SA's performance into the ground. The key here is SA doesn't run tests sequentially, it runs them in parallel as it works its way through the body. this allows for good, efficient use of memory cache. By running rules in score-order,

Re: more efficent big scoring

2008-01-18 Thread Theo Van Dinter
Yes and no. There aren't many negative scored rules, which could easily be put into a low priority to run first. The issue, which is where Matt was going I believe, is that the reason score based short circuiting was removed is that it's horribly slow to keep checking the score after each rule

RE: more efficent big scoring

2008-01-18 Thread Robert - elists
You can't run the rules in score-order without driving SA's performance into the ground. The key here is SA doesn't run tests sequentially, it runs them in parallel as it works its way through the body. this allows for good, efficient use of memory cache. By running rules in

Re: more efficent big scoring

2008-01-18 Thread jdow
From: Robert - elists [EMAIL PROTECTED] Sent: Friday, 2008, January 18 21:14 You can't run the rules in score-order without driving SA's performance into the ground. The key here is SA doesn't run tests sequentially, it runs them in parallel as it works its way through the body. this allows