Re: rule for To: undisclosed-recipients:;

2010-10-25 Thread Cedric Knight
On 25/10/10 04:21, Dennis German wrote: Is there? should there be a rule for a header like: To: undisclosed-recipients:; There was a rule UNDISC_RECIPS in version 3.1, and it scored about 0.8 points. I don't know why it was removed; presumably it hit too much ham. It used to go: header

Re: Spammassassin is slow on poll_dns_idle and tests_pri_500 tests

2010-10-25 Thread Mark Martinec
On Sunday 24 October 2010 14:34:04 escalera wrote: Fol all messages, spamassassin takes 14++ seconds. Version: 3.3.1 Debuging it, the times are: Oct 24 14:03:20 email spamd[22477]: timing: total 14237 ms - read_scoreonly_config: 4 (0.0%), signal_user_changed: 6 (0.0%), parse: 6 (0.0%),

Re: compare 2 headers

2010-10-25 Thread Benny Pedersen
On søn 24 okt 2010 22:33:21 CEST, Lawrence @ Rogers wrote I am writing a rule that deals with spam that claims to be coming from AOL's webmail client, where the e-mail has malformed HTML, references to remote images, and a high ratio of images to content. I guess I will have to find another

Re: rule for To: undisclosed-recipients:;

2010-10-25 Thread Darxus
On 10/24, Dennis German wrote: Is there? should there be a rule for a header like: To: undisclosed-recipients:; There is a meta rule in spamassassin version 3.3.1: header __TO_UNDISCLOSEDTo =~ /(?:undisclosed-recipients|destinataires inconnus):/i It has no score on its own, and

Re: Profiling rules with DProf problems

2010-10-25 Thread Mark Martinec
On Sunday 24 October 2010 16:09:08 Cedric Knight wrote: I'm trying to get some performance data on a customised ruleset using the instructions at http://wiki.apache.org/spamassassin/ProfilingRulesWithDprof and have two problems. Firstly, I'm not actually getting any *_body_test or

spamc not scanning file, spamassassin command ok

2010-10-25 Thread a . smith
Hi all, a couple of spam email messages got passed our spamassassin scanner today, and on investigation I found some odd behaviour. Our mail system scans via a pipe using the following command /usr/local/bin/spamc -u mailnull. If I cat the spam mail file in question by doing a cat and

Re: spamc not scanning file, spamassassin command ok

2010-10-25 Thread John Hardin
On Mon, 25 Oct 2010, a.sm...@ukgrid.net wrote: The dodgy email contains an attachment, if I make a copy of the mail file and delete the email attachment and then scan via scanc it IS correctly processed and marked as spam. The file with attachment is only 600K so I dont see why this should

Re: spamc not scanning file, spamassassin command ok

2010-10-25 Thread a . smith
Quoting John Hardin jhar...@impsec.org: Yes, the default size limit on messages that spamc enforces is less than 600k. If you want to scan larger messages you must override that default. Please see the list archives for the pros and cons. Ah ok! Thanks! Think I can up it to at least 1Mb

Re: spamc not scanning file, spamassassin command ok

2010-10-25 Thread Karsten Bräckelmann
In case its of interested to the list, the spam in question gets very high spamassassin rating of 15.3 but was passing by the scanner on the size limit. The attachment is a JPG of 600k which is a scan of a scam 600k JPEG? That'd be about 800k base64 encoded. letter about bank transfers

Re: Spammassassin is slow on poll_dns_idle and tests_pri_500 tests

2010-10-25 Thread escalera
Thanks This solved my problem. Mark Martinec wrote: On Sunday 24 October 2010 14:34:04 escalera wrote: Fol all messages, spamassassin takes 14++ seconds. Version: 3.3.1 Debuging it, the times are: Oct 24 14:03:20 email spamd[22477]: timing: total 14237 ms - read_scoreonly_config: 4

Re: Collecting IP reputation data from many people

2010-10-25 Thread Dennis German
On Oct 23, 2010, at 12:31 PM, Royce Williams wrote: On Sat, Oct 23, 2010 at 7:31 AM, Per Jessen p...@computer.org wrote: Royce Williams wrote: On Fri, Oct 22, 2010 at 5:19 AM, Michael Scheidell michael.scheid...@secnap.com wrote: On 10/21/10 8:50 PM, dar...@chaosreigns.com wrote: I'd

Re: Collecting IP reputation data from many people

2010-10-25 Thread Benny Pedersen
On man 25 okt 2010 21:24:38 CEST, Dennis German wrote Have you pulled your own data from auto-whitelist ? or use spamcop worst spam ipranges ? awl is usefull if one change the default mask to /32 else the ip counts will be to fussy to make anything there -- xpoint