Spamassassion for each site

2010-08-11 Thread nonlin
Dear sirs, I am new to this list, So I hope I have the right email address. I am running a Blue Quartz with spamassassin pre installed. I don't know the version. I have run the gtube test and it works fine for my admin email account, it is marking them as spam. but it is marking any of emails

Re: Spamassassion for each site

2010-08-11 Thread Daniel Lemke
nonlin wrote: I am running a Blue Quartz with spamassassin pre installed. I don't know the version. I have run the gtube test and it works fine for my admin email account, it is marking them as spam. but it is marking any of emails for my clients, yet there are several files like the

Re: List of banned words/bounce to sender

2010-08-11 Thread Martin Gregorie
On Tue, 2010-08-10 at 19:24 -0700, jdow wrote: From: Martin Gregorie mar...@gregorie.org Sent: Monday, 2010/August/09 18:08 On Mon, 2010-08-09 at 17:42 -0700, jdow wrote: From: Martin Gregorie mar...@gregorie.org Something like this will match a sequence of two capitalised name

Fw: Spamassassion for each site

2010-08-11 Thread nonlin
Sorry about that I just simply pressed reply, I expected the reply to have sent my message back to us...@spamassassin.apache.org. So I had to use forward instead. anyway, I will start to look into it. but before I do, you said something that made me think you might have slightly miss understood

Re: AWL demoted??

2010-08-11 Thread RW
On Tue, 10 Aug 2010 19:55:45 -0400 Dennis German dger...@real-world-systems.com wrote: On Jul 22, 2010, at 10:47 AM, Michael Scheidell wrote:... due to performance vs accuracy issues, AWL was demoted in SA 3.3x. Can you please define demoted. It's no longer

Re: AWL demoted??

2010-08-11 Thread Matt Kettler
On 8/10/2010 7:55 PM, Dennis German wrote: On Jul 22, 2010, at 10:47 AM, Michael Scheidell wrote:... due to performance vs accuracy issues, AWL was demoted in SA 3.3x. Can you please define demoted. Changed from enabled by default to disabled by default,

Re: spamc REPORT/PROCESS Confusion

2010-08-11 Thread Karsten Bräckelmann
Please keep threads on-list, unless you specifically want to talk to me. Even boring end-of-line posts are worthwhile information to the full thread. On Tue, 2010-08-10 at 18:43 +0200, Andreas Dunkl wrote: Am 10.08.2010 13:42, schrieb Karsten Bräckelmann: Well, that one paragraph isn't a good

DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Alex
Hi, How does DNS_FROM_OPENWHOIS work? I have a system where every message triggers on DNS_FROM_OPENWHOIS and I can't figure out why. I had some problems with the headers being mangled, but I was pretty sure that was fixed. Could this be a postfix or amavisd configuration? I did notice this one

JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
I was looking through some of the spam rules, and I noticed that the JM_SOUGHT_FRAUD rules are included in the main SA updates channel for SA 3.3.1, but the scores are all 0. Is there a reason for this? The rules from the sought channel have scores, but they are being overridden by the main

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 10:58 -0400, Alex wrote: How does DNS_FROM_OPENWHOIS work? I have a system where every message triggers on DNS_FROM_OPENWHOIS and I can't figure out why. Bug 6157 [1], remove open-whois.org rules since domain is cybersquatted. The rule has been removed a *year* ago, and

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 17:24 +0200, Karsten Bräckelmann wrote: On Wed, 2010-08-11 at 10:58 -0400, Alex wrote: How does DNS_FROM_OPENWHOIS work? I have a system where every message triggers on DNS_FROM_OPENWHOIS and I can't figure out why. Bug 6157 [1], remove open-whois.org rules since

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote: I was looking through some of the spam rules, and I noticed that the JM_SOUGHT_FRAUD rules are included in the main SA updates channel for SA 3.3.1, but the scores are all 0. Is there a reason for this? Yes, an explicit request by Justin

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Alex
Bug 6157 [1], remove open-whois.org rules since domain is cybersquatted. The rule has been removed a *year* ago, and is neither part of 3.3, nor 3.2 stock rules. Forgot to mention: After running sa-update WRT 3.2. Great, thanks so much. Best, Alex

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
On 8/11/2010 11:46 AM, Karsten Bräckelmann wrote: On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote: I was looking through some of the spam rules, and I noticed that the JM_SOUGHT_FRAUD rules are included in the main SA updates channel for SA 3.3.1, but the scores are all 0. Is there a

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 11:51 -0400, Alex wrote: Bug 6157 [1], remove open-whois.org rules since domain is cybersquatted. The rule has been removed a *year* ago, and is neither part of 3.3, nor 3.2 stock rules. Forgot to mention: After running sa-update WRT 3.2. Great, thanks so

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Alex
Hi, Forgot to mention: After running sa-update WRT 3.2. Great, thanks so much. Well, you *did* run sa-update since then, no? I mean, at the very least early this year. Begs the question, why you still do have that rule. It's another system that I just adopted, and haven't finished

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 11:57 -0400, Bowie Bailey wrote: On 8/11/2010 11:46 AM, Karsten Bräckelmann wrote: On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote: I was looking through some of the spam rules, and I noticed that the JM_SOUGHT_FRAUD rules are included in the main SA updates

Re: DNS_FROM_OPENWHOIS always triggers

2010-08-11 Thread Noel Jones
On Wed, Aug 11, 2010 at 9:58 AM, Alex mysqlstud...@gmail.com wrote: ... I did notice this one header discrepancy: Received: by mail.mydomain.net (Postfix, from userid 78) What's with the Postfix, from user 78)? This should be the server's IP address, no? That header is normal when you're

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
On 8/11/2010 12:17 PM, Karsten Bräckelmann wrote: On Wed, 2010-08-11 at 11:57 -0400, Bowie Bailey wrote: On 8/11/2010 11:46 AM, Karsten Bräckelmann wrote: On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote: I was looking through some of the spam rules, and I noticed that the

Re: AWL demoted??

2010-08-11 Thread RW
On Wed, 11 Aug 2010 07:48:11 -0400 Matt Kettler mkettler...@verizon.net wrote: 1) lack of expiry process causes unbounded database growth. There's a script to clean out single-hit entries, but multi-hit persist forever, even when stale. (there are no timestamps on entries, so expiry isn't

Re: AWL demoted??

2010-08-11 Thread RW
On Wed, 11 Aug 2010 18:30:17 +0100 RW rwmailli...@googlemail.com wrote: On Wed, 11 Aug 2010 07:48:11 -0400 Matt Kettler mkettler...@verizon.net wrote: 1) lack of expiry process causes unbounded database growth. There's a script to clean out single-hit entries, but multi-hit persist

Moving from Solaris to Red Hat

2010-08-11 Thread Rosenbaum, Larry M.
We are currently running SA v3.3.1 on Solaris 9 and Solaris 10 and are planning to move to Red Hat. I don't have much experience with Red Hat (or Linux in general). Could you point me to some tips and documentation about installing and running SA on Red Hat? FYI, on Solaris I install by

Re: Moving from Solaris to Red Hat

2010-08-11 Thread Kris Deugau
Rosenbaum, Larry M. wrote: We are currently running SA v3.3.1 on Solaris 9 and Solaris 10 and are planning to move to Red Hat. I don’t have much experience with Red Hat (or Linux in general). Could you point me to some tips and documentation about installing and running SA on Red Hat?

Re: AWL demoted??

2010-08-11 Thread Benny Pedersen
On ons 11 aug 2010 19:35:35 CEST, RW wrote That should be count/total-score not count/token. total-score/count will also work with mask of 0.0.0.0/8 ? sa below 3.3.x had it hardcoded to /16 -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
On 8/11/2010 3:30 PM, John Hardin wrote: On Wed, 11 Aug 2010, Bowie Bailey wrote: Right. And I'm checking for updates several times a day. If the updates channel is not keeping up with sought, I need to make sure I am running the rules from the dedicated channel and not the updates

Re: AWL demoted??

2010-08-11 Thread RW
On Wed, 11 Aug 2010 22:26:31 +0200 Benny Pedersen m...@junc.org wrote: On ons 11 aug 2010 19:35:35 CEST, RW wrote That should be count/total-score not count/token. total-score/count I actually meant it in the sense of a-stroke-b rather than a-divided-by-b will also work with mask

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread RW
On Wed, 11 Aug 2010 17:30:40 -0400 Bowie Bailey bowie_bai...@buc.com wrote: On 8/11/2010 3:30 PM, John Hardin wrote: On Wed, 11 Aug 2010, Bowie Bailey wrote: Right. And I'm checking for updates several times a day. If the updates channel is not keeping up with sought, I need to make

Sought dedicated AND stock channel (was: Re: JM_SOUGHT_FRAUD)

2010-08-11 Thread Karsten Bräckelmann
On Wed, 11 Aug 2010 17:30:40 -0400 Bowie Bailey bowie_bai...@buc.com wrote: On 8/11/2010 3:30 PM, John Hardin wrote: The current situation is: automatic rule updates are only generated when the corpa of recent messages used in the nightly masscheck is sufficiently large (150k+ of

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Karsten Bräckelmann
On Wed, 2010-08-11 at 17:30 -0400, Bowie Bailey wrote: In case anyone else is following this... The sa-update process made things a bit more complex than simply renaming the file after updates. If that's all you do, then sa-update loses track of the file and will download a new copy on

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread John Hardin
On Wed, 11 Aug 2010, Bowie Bailey wrote: In case anyone else is following this... The sa-update process made things a bit more complex than simply renaming the file after updates. If that's all you do, then sa-update loses track of the file and will download a new copy on every run. What I

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread John Hardin
On Wed, 11 Aug 2010, RW wrote: 1) Rename the .cf file back to the original name so sa-update can find it 2) Run sa-update 3) Rename the .cf file to z_sought_rules_yerp_org.cf 4) Restart spamd Would it not be simpler just to do something like this grep -E ^score

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread John Hardin
On Thu, 12 Aug 2010, Karsten Br?ckelmann wrote: On Wed, 2010-08-11 at 17:30 -0400, Bowie Bailey wrote: In case anyone else is following this... The sa-update process made things a bit more complex than simply renaming the file after updates. If that's all you do, then sa-update loses track

Re: AWL demoted??

2010-08-11 Thread Matt Kettler
On 8/11/2010 1:30 PM, RW wrote: On Wed, 11 Aug 2010 07:48:11 -0400 Matt Kettlermkettler...@verizon.net wrote: 1) lack of expiry process causes unbounded database growth. There's a script to clean out single-hit entries, but multi-hit persist forever, even when stale. (there are no timestamps

Fw: Spamassassion for each site

2010-08-11 Thread nonlin
Well I am not out of the Dog House yet. So, by some miracle I was able to get yum to work and was able to use it to update Spamassassion. I was so happy because this was the safest way to do this. But yum didn't have ver 3.3 available so I was able to update to: SpamAssassin version 3.2.4