Spammassassin is slow on poll_dns_idle and tests_pri_500 tests

2010-10-24 Thread escalera
Hello: Fol all messages, spamassassin takes 14++ seconds. Version: 3.3.1 (2010-03-16) Debuging it, the times are: Oct 24 14:03:20 email spamd[22477]: timing: total 14237 ms - read_scoreonly_config: 4 (0.0%), signal_user_changed: 6 (0.0%), parse: 6 (0.0%), extract_message_metadata: 80 (0.6%),

Profiling rules with DProf problems

2010-10-24 Thread Cedric Knight
Hello I'm trying to get some performance data on a customised ruleset using the instructions at http://wiki.apache.org/spamassassin/ProfilingRulesWithDprof and have two problems. Firstly, I'm not actually getting any *_body_test or *_head_test data in tmon.out. Instead, after running dprofpp,

Re: rule to catch subject spamming

2010-10-24 Thread Lawrence @ Rogers
On 23/10/2010 5:47 PM, RW wrote: On Sat, 23 Oct 2010 14:28:38 -0230 Lawrence @ Rogerslawrencewilli...@nl.rogers.com wrote: Hello all, I noticed recently that our users are getting spam with the subject similar to the following:

compare 2 headers

2010-10-24 Thread Lawrence @ Rogers
Hi, Is there a quick way to compare 2 headers? I am seeing spam lately that has an invalid e-mail address (one not hosted by us) set in the To: header, but has the intended one in the Envelope-To: header What I would like to do is take the Envelope-To and run a regex to check if the To:

Re: rule to catch subject spamming

2010-10-24 Thread Karsten Bräckelmann
On Sun, 2010-10-24 at 16:05 -0230, Lawrence @ Rogers wrote: I have settled on the following as it's more specific and less prone to FPs (I can't think of any possibilities right now) header __LOCAL_SUBJECT_SPAMMY Subject =~ /^[0-9a-zA-Z,.+]{42,}$/ meta LOCAL_SUBJECT_SPAMMY1

Re: compare 2 headers

2010-10-24 Thread Karsten Bräckelmann
On Sun, 2010-10-24 at 16:26 -0230, Lawrence @ Rogers wrote: Is there a quick way to compare 2 headers? I am seeing spam lately that has an invalid e-mail address (one not hosted by us) set in the To: header, but has the intended one in the Envelope-To: header What I would like to do is

Re: compare 2 headers

2010-10-24 Thread Lawrence @ Rogers
On 24/10/2010 5:44 PM, Karsten Bräckelmann wrote: On Sun, 2010-10-24 at 16:26 -0230, Lawrence @ Rogers wrote: Is there a quick way to compare 2 headers? I am seeing spam lately that has an invalid e-mail address (one not hosted by us) set in the To: header, but has the intended one in the

Re: rule to catch subject spamming

2010-10-24 Thread Karsten Bräckelmann
On Sun, 2010-10-24 at 22:08 +0200, Karsten Bräckelmann wrote: On Sun, 2010-10-24 at 16:05 -0230, Lawrence @ Rogers wrote: I have settled on the following as it's more specific and less prone to FPs (I can't think of any possibilities right now) header __LOCAL_SUBJECT_SPAMMY Subject =~

Re: compare 2 headers

2010-10-24 Thread Martin Gregorie
On Sun, 2010-10-24 at 18:03 -0230, Lawrence @ Rogers wrote: On 24/10/2010 5:44 PM, Karsten Bräckelmann wrote: There are perfectly valid reasons to not have the actual recipient in the To header. Ever sent a message with Bcc recipients? Ever received a post via a mailing list? I had not

Re: compare 2 headers

2010-10-24 Thread Lawrence @ Rogers
On 24/10/2010 9:27 PM, Martin Gregorie wrote: On Sun, 2010-10-24 at 18:03 -0230, Lawrence @ Rogers wrote: On 24/10/2010 5:44 PM, Karsten Bräckelmann wrote: There are perfectly valid reasons to not have the actual recipient in the To header. Ever sent a message with Bcc recipients? Ever

rule for To: undisclosed-recipients:;

2010-10-24 Thread Dennis German
Is there? should there be a rule for a header like: To: undisclosed-recipients:;