Rare (?) error message

2010-04-07 Thread Jari Fredriksson
Apr 7 10:07:41 lancaster check[1339]: Use of uninitialized value $origip in concatenation (.) or string at /usr/local/share/perl/5.10.0/Mail/SpamAssassin/AutoWhitelist.pm line 346. 3.3.1 in Debian Lenny, compiled via CPAN. I have not seen this message before, but now it came. I have no idea of

Re: Some problems after update to SpamAssassin 3.3.1 and Perl 5.10.1

2010-04-02 Thread Jari Fredriksson
On 2.4.2010 14:31, Cecil Westerhof wrote: > Jari Fredriksson writes: > >> On 2.4.2010 14:02, Cecil Westerhof wrote: >>> >>> My problem with Net::Ident did not go away. >>> >> >> I might try "force install Net::Ident" and then pre

Re: Some problems after update to SpamAssassin 3.3.1 and Perl 5.10.1

2010-04-02 Thread Jari Fredriksson
On 2.4.2010 14:14, Cecil Westerhof wrote: > Most of my problems where solved by installing db-dev abd running > 'install Bundle::CPAN'. But some problems remain. > > >> When I give: >> i Razor2::Client::Agent >> I get: >> No objects found of any type for argument Razor2::Client::Agent >

Re: Some problems after update to SpamAssassin 3.3.1 and Perl 5.10.1

2010-04-02 Thread Jari Fredriksson
On 2.4.2010 14:02, Cecil Westerhof wrote: > > My problem with Net::Ident did not go away. > I might try "force install Net::Ident" and then prepare to format my HD :( It has worked sometimes, and never failed. But I have not done it too often. Installing from CPAN can be pain. -- http://www.

Re: Some problems after update to SpamAssassin 3.3.1 and Perl 5.10.1

2010-04-02 Thread Jari Fredriksson
On 2.4.2010 11:30, Cecil Westerhof wrote: > I just updated my SpamAssassin to 3.3.1. Maybe not the correct place to > mention it, but I find the > perl -MCPAN -e shell > not working very well. There was a message that the Perl version 5.8.6 > was outdated, but I only saw it, because I was watch

Re: sa-update

2010-03-31 Thread Jari Fredriksson
On 31.3.2010 14:02, Andrea Bencini wrote: > I installed with yum lhe following pakages: > postfix, amavisd-new and spamassassin. > > I have *.cf in /usr/share/spamassassin/ directory and now I would like > update them. > > Is it possible? with sa-update? > If yes which is the complete command to

Re: Bayes is causing MySQL performance issues

2010-03-30 Thread Jari Fredriksson
On 30.3.2010 12:04, Martin Svensson wrote: > > Thanks for your response. The problem is unfortunately still not solved. > > Yesterday I dropped the database and re-created it from bayes_mysql.sql > file that is bundled with the SpamAssassin package (and added a > lastupdate field). Just a double

Re: trusted_networks

2010-03-29 Thread Jari Fredriksson
On 29.3.2010 18:40, Kaleb Hosie wrote: > I'm having a problem with the trusted_networks option. Right now I have it > set to: > > trusted_networks 10.0.1/24 > > In postfix, I need to have spamassassin listed under > "smtpd_recipient_restrictions" so that it will only scan incoming emails > how

Re: SA rules don't seem to be getting hit

2010-03-26 Thread Jari Fredriksson
On 27.3.2010 0:44, Brody wrote: > Hi, > > I've got a linux box running sa 3.2.5 > > normally sa is invoked via amavis, however for this test I'm running it > via spamassassin -D > It seems that sa isn't hitting any of the more useful rules i.e. ones > that should cause it to increase the score.

Re: Bayes improvement

2010-03-25 Thread Jari Fredriksson
On 25.3.2010 20:30, Giampaolo Tomassoni wrote: >> I have increased BAYES_00 and BAYES_99. It seems that those are pretty >> good and cause no FP's, but BAYES_05 may sometimes be spam. I have >> BAYES_99 as a killer, it has 5 points, sending the mail to a 'probable >> spam' alone. > > Ah, that is e

Re: Bayes improvement

2010-03-25 Thread Jari Fredriksson
On 25.3.2010 10:14, Giampaolo Tomassoni wrote: > Having this in the bayes db: > > 335424 nspam > 144915 nham > 129892 ntokens > > and a fairly good hit rate by Bayes in detecting both spam and ham, how > would you improve Bayes scores? > > In example, would you increase every b

Re: Botnet plugin still relevant?

2010-03-22 Thread Jari Fredriksson
On 22.3.2010 16:51, micah anderson wrote: > On Wed, 17 Mar 2010 14:45:53 -0700, John Rudd wrote: >> Some people need to put in some alternate values for DNS timeouts, but >> if you've got a local caching name server, you typically don't need >> that. >> >> There aren't any actual bugs in it that I

Re: My First Spam Mail Today

2010-03-11 Thread Jari Fredriksson
On 11.3.2010 16:41, Carlos Mennens wrote: > On Thu, Mar 11, 2010 at 9:28 AM, Jari Fredriksson wrote: >> You still posted not enough data. There is only the headers the link. > > Here is the entire message: > > http://pastebin.com/MtXWXdvc That is hard. Only one URL in the

Re: My First Spam Mail Today

2010-03-11 Thread Jari Fredriksson
On 11.3.2010 15:18, Carlos Mennens wrote: > On Wed, Mar 10, 2010 at 6:04 PM, Martin Gregorie wrote: >> Post the entire message to pastebin or a similar site and send the URL >> here together with your explanation of what happened so we have >> something to work with. > > I am sorry I didn't post

Re: problem with the Bayesian filter

2010-03-09 Thread Jari Fredriksson
On 9.3.2010 20:24, Curtis MacDuff wrote: > My Bayesian filter keeps getting screwed up and causing mail flow to > stop. The problem seems to be expiring tokens out of the database. My > expiry setting is set to 200,000. I've tried many different settings for > this but they all seem to behave about

Re: rules

2010-03-08 Thread Jari Fredriksson
On 8.3.2010 21:33, Renata Dias wrote: > > Some messages receive score 0.00/0.00 and other receive the correct > score like the example below. > ... > I'm updated SpamAssassin to p5-Mail-SpamAssassin-3.3.0_3 and rules are > /var/db/spamassassin/3.003000/ . > > Can someone help me? > You show

Re: Spamassassin with Bayes/MySQL

2010-03-05 Thread Jari Fredriksson
On 5.3.2010 17:23, Stephane MAGAND wrote: > Hi > > ok i have put > bayes_sql_override_username > > and now that's work thanks ;=) > > Another small question, after bayes, can i put AWL in MySQL ? > Yes you can, it's all in the doku or wiki. Anyway: --- local.cf -- # Enable awl auto_w

Re: Spam Score

2010-03-04 Thread Jari Fredriksson
On 5.3.2010 0:04, Walter Breno wrote: > Hi, i have some problems with false positives so i need that the e-mails > with spamassassin score 2 or 3 has being marked as spam but delivered to > the user, what is the parameter that can help me with this problem? SpamAssassin does not do anything in ord

Re: error closing STDOUT

2010-03-04 Thread Jari Fredriksson
On 4.3.2010 17:07, Blake101 wrote: > > Sorry if there is already a tread about this. > > When trying to send a test message, I get the following error. > > error closing STDOUT: Broken pipe at /usr/bin/spamassassin line 409. > > any ideas why I get this "Sending a message" is an alien concept

Re: UPS Delivery problem

2010-03-03 Thread Jari Fredriksson
On 3.3.2010 15:34, Jari Fredriksson wrote: > On 3.3.2010 15:22, twofers wrote: >> I have 52 of these sitting in my inbox this morning when I came in to >> work. this is just the beginning. I get literally hundreds of these a >> day and Spamassassin does not even check them. &

Re: UPS Delivery problem

2010-03-03 Thread Jari Fredriksson
On 3.3.2010 15:22, twofers wrote: > I have 52 of these sitting in my inbox this morning when I came in to > work. this is just the beginning. I get literally hundreds of these a > day and Spamassassin does not even check them. > > Thats hundreds of these every day for weeks and weeks and weeks on

Re: Rationale behind FREEMAIL_ENVFROM_END_DIGIT?

2010-02-20 Thread Jari Fredriksson
On 20.2.2010 17:29, LuKreme wrote: > On 20-Feb-2010, at 08:21, Jari Fredriksson wrote: >> >> I just found this rule in SA >> >> 1.6 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in >>digit (alv.john2[at]gmail.c

Rationale behind FREEMAIL_ENVFROM_END_DIGIT?

2010-02-20 Thread Jari Fredriksson
I just found this rule in SA 1.6 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit (alv.john2[at]gmail.com) What's the rationale? Many FreeMail users end up having a digited username, as the wanted username is reserved. How is it a sign of spa

Re: is bayes learning?

2010-02-19 Thread Jari Fredriksson
On 19.2.2010 12:42, tonjg wrote: > > > Jari Fredriksson wrote: >> >> That is not the recipe I meant. That calls SA yes, but does not >> "reject". I can't provide a recipe for procmail as I personally use >> maildrop, but the recipe that is neede

Re: is bayes learning?

2010-02-18 Thread Jari Fredriksson
On 19.2.2010 1:48, Chris wrote: > On Thu, 2010-02-18 at 09:59 -0800, tonjg wrote: >> >> Jari Fredriksson wrote: >>> >>> How does MimeDefang reject anything if it does not scan it? Your log >>> header sample looked like it was scanned by MimeDefang. Propa

Re: is bayes learning?

2010-02-18 Thread Jari Fredriksson
On 19.2.2010 1:48, Chris wrote: > On Thu, 2010-02-18 at 09:59 -0800, tonjg wrote: >> >> Jari Fredriksson wrote: >>> >>> How does MimeDefang reject anything if it does not scan it? Your log >>> header sample looked like it was scanned by MimeDefang. Propa

Re: is bayes learning?

2010-02-18 Thread Jari Fredriksson
On 18.2.2010 18:16, tonjg wrote: > > > Matus UHLAR - fantomas wrote: >> you seem to be running mimedefang which takes care about the e-mail. I >> have no idea how does mimedefang interact with spamassassin, but I think >> you should ask your question in mimedefang mailing list, or at least >> sea

Re: How should this tricky spam be filtered?

2010-01-30 Thread Jari Fredriksson
On 30.1.2010 19:14, Ralph Bornefeld-Ettmann wrote: > > in the "Raw Message" tab you can get the plain message > (http://spamalyser.com/v/5cbffujq/raw) > It's not raw message, it has a line number on each row. -- http://www.iki.fi/jarif/ You may be recognized soon. Hide. signature.asc Des

Re: AWL structure for 3.3.0?

2010-01-27 Thread Jari Fredriksson
On 27.1.2010 10:43, Henrik K wrote: > On Wed, Jan 27, 2010 at 10:38:38AM +0200, Jari Fredriksson wrote: >> >> I'm trying to install it via CPAN or debian deb, so I do not have the >> sql-readme available. >> >> The AWL format changed, can someone post t

AWL structure for 3.3.0?

2010-01-27 Thread Jari Fredriksson
I'm trying to install it via CPAN or debian deb, so I do not have the sql-readme available. The AWL format changed, can someone post the MySQL desc output please? -- http://www.iki.fi/jarif/ That secret you've been guarding, isn't. signature.asc Description: OpenPGP digital signature

Debian maintainers online? 3.3.0 availability Q

2010-01-27 Thread Jari Fredriksson
Will the new 3.3 be announced for Lenny (possibly via backports) or do I need to use CPAN? Thanks for info. -- http://www.iki.fi/jarif/ That secret you've been guarding, isn't. signature.asc Description: OpenPGP digital signature

Re: SpamAssassin, One Baye for a lot of SpamAssassin server

2010-01-22 Thread Jari Fredriksson
On 22.1.2010 10:53, Mariusz Kruk wrote: > On Fri, 2010-01-22 at 19:47 +1100, Jean-Yves Avenard wrote: >>> In a previous post, i have request a information, can i use one >>> central bayes database >>> for a lot of SpamAssassin Server. >>> >>> I have received a answer: Yes >>> >>> But what is the pr

Re: Spam getting through while SA restarts

2010-01-15 Thread Jari Fredriksson
On 15.1.2010 10:21, geoff.spamassass...@alphaworks.co.uk wrote: > I occasionally get a spam leaking through without having been processed > by SA despite passing the part of my procmail filtering where SA is > called. These spams are always at the time of scheduled SA restarts so I > assume they sl

Re: hostkarma false positive

2010-01-11 Thread Jari Fredriksson
On 11.1.2010 10:35, Michael Monnerie wrote: > Another FP on hostkarma: > > bsmtp5.bon.at[195.3.86.187] > > Please investigate and fix. And put them on YELLOW, they are an ISP here > in Austria. Please check bsmtp[1-9] also. > Hello. Your PGP key has expired, my software says. Just FYI. -- ht

Re: spamassassin or spamd with amavisd-new?

2010-01-05 Thread Jari Fredriksson
On 5.1.2010 13:09, Angel L. Mateo wrote: Hello, Because FH_DATE_PAST_20XX bug, I have found that when I run spamassassin through amavisd-new (in a postfix server) I need to restart spamassassin and amavisd-new after any change in spamassassin. Debugging this, I found that amavisd-new doesn't co

Re: OT: Museum piece...

2009-12-17 Thread Jari Fredriksson
On 17.12.2009 23:10, Jari Fredriksson wrote: > > > On 16.12.2009 18:15, Benny Pedersen wrote: >> On ons 16 dec 2009 16:49:52 CET, Charles Gregory wrote >> >>> On Tue, 15 Dec 2009, Chris Hoogendyk wrote: >>>> Marc Perkel wrote: >>>>> h

Re: OT: Museum piece...

2009-12-17 Thread Jari Fredriksson
On 16.12.2009 18:15, Benny Pedersen wrote: > On ons 16 dec 2009 16:49:52 CET, Charles Gregory wrote > >> On Tue, 15 Dec 2009, Chris Hoogendyk wrote: >>> Marc Perkel wrote: http://www.vintage-computer.com/asr33.shtml >>> There was actually a time when I had one of those in my house. >> >> Fo

Re: Smart Smoker spam sailing past SA scores

2009-12-05 Thread Jari Fredriksson
On 5.12.2009 16:03, LuKreme wrote: > > > On Dec 4, 2009, at 13:42, Jari Fredriksson wrote: > >> Content analysis details: (14.9 points, 5.0 required) > > 14 of your points come from the IP being listed. It was not listed > initially, and score 0.9 on your test

Re: Smart Smoker spam sailing past SA scores

2009-12-04 Thread Jari Fredriksson
On 4.12.2009 18:00, Thomas Harold wrote: > SA had a lot of trouble identifying this as spam. The IP > (174.139.37.196) is not yet listed in a lot of the DNSBLs. So it only > scored around a 1.0 on the spam meter. > > http://pastebin.com/m1d0a75b7 > > It uses a block of foreign language spam a

Re: HOTMAIL SPAM =Rule to bite on X-Originating-IP or length of FROM list?

2009-10-31 Thread Jari Fredriksson
31.10.2009 23:26, Adam Katz kirjoitti: > Brilliant minds think alike ;-) I have very similar rules in my > khop-general channel: > > header KHOP_BIG_TO_CC ToCc =~ /(?:[^,\...@]{1,6...@[^,]{4,30},){10,19}/ > describe KHOP_BIG_TO_CC Sent to 10+ recipients instaed of Bcc or a list > scoreKHO

Re: Spam with my company domain

2009-10-28 Thread Jari Fredriksson
28.10.2009 22:07, Jeremy Davila kirjoitti: > > Hi all, > > I'm getting Spam which is addressed to another person in my company , > but it getting sent to me . So in my inbox the To Field is Kristin , but > in Jeremy's inbox. Hello. That is possible, the email is sent to whoever is in the RCPT-

Re: How to reject spam where sender = receiver

2009-10-28 Thread Jari Fredriksson
28.10.2009 16:42, Adam Katz kirjoitti: > > I scored that 0.1 ... rejecting based on sender==recipient would > effectively be scoring it far higher, and would most certainly reject > legitimate mail (lots of people send announcements via Bcc or Cc while > addressing the message back to themselves

Re: Error from sa-update script

2009-10-27 Thread Jari Fredriksson
27.10.2009 23:14, fugtruck kirjoitti: > > I have an SMTP gateway setup with Postfix+SpamAssassin on a CentOS 5.3 server > that is functioning. Lately, I've noticed an increase in the amount of SPAM > getting through the gateway. That's when I discovered an error that is > showing up daily in t

Re: Spamassassin not tagging some emails

2009-10-23 Thread Jari Fredriksson
23.10.2009 20:04, MySQL Student kirjoitti: > Hi, > >> SpamAssassin DOES NOT bypass scanning, if the internal or trusted >> networks contain the server in it. > > Hmm.. thanks for correcting me. > > How would you, then, go about preventing SA from scanning the > localhost or a specific domain w

Re: OT: Thunderbird filter

2009-10-23 Thread Jari Fredriksson
23.10.2009 18:26, Adam Katz kirjoitti: > Dan Schaefer wrote: >> The emails being sent to postfix-users-dig...@cloud9.net are >> messing with my head. I setup a filter to put emails sent to >> users@spamassassin.apache.org into a SA folder. Whenever an email >> gets sent to postfix-users-dig...@c

Re: Spamassassin not tagging some emails

2009-10-23 Thread Jari Fredriksson
23.10.2009 4:52, MySQL Student kirjoitti: > Hi, > > On the message that should have been scanned: > >> The emails that has not been tagged at all: > > [...] >> From: "Angus - 3idea" >> To: > > Are you forwarding this spam from your internal account to this other > internal supp...@3idea.com

Re: Elena wants an iron cast oven

2009-10-22 Thread Jari Fredriksson
22.10.2009 23:39, Benny Pedersen kirjoitti: > On tor 22 okt 2009 21:37:28 CEST, Jari Fredriksson wrote > >> The message does not have any attachments, it is a plain text from a >> poor woman in Russia. > > how do you know ?, was there picture in the mail ?, if so how c

Re: Elena wants an iron cast oven

2009-10-22 Thread Jari Fredriksson
22.10.2009 23:24, Michael Scheidell kirjoitti: > > > Jari Fredriksson wrote: >> "If you have any old portable oven and in case you don't use it anymore, >> we will be very grateful to you if you can donate it to us and organize >> transport of this oven to

Re: Elena wants an iron cast oven

2009-10-22 Thread Jari Fredriksson
22.10.2009 22:26, John Hardin kirjoitti: > On Thu, 22 Oct 2009, Jari Fredriksson wrote: > >> What's the business model of this scam? I can't believe they really >> want millions of iron cast ovens from all around the world. Maybe I >> should answer and ask dir

Elena wants an iron cast oven

2009-10-22 Thread Jari Fredriksson
"If you have any old portable oven and in case you don't use it anymore, we will be very grateful to you if you can donate it to us and organize transport of this oven to our address (200km from Moscow). This ovens are different, usually they made from cast iron." Dozens of these for months alrea

Re: Mail not scanned

2009-10-21 Thread Jari Fredriksson
21.10.2009 18:40, Lars Ebeling kirjoitti: > Why aren't mail from "United Parcel Service" scanned? > > The last 24 hours have i got about 20 of them and none scanned. > > Those are not scanned in *my* system just because they are scanned by amavisd-new before they will be scanned by SA. As the

Re: Pulling my hair out

2009-10-20 Thread Jari Fredriksson
20.10.2009 18:43, RW kirjoitti: > On Tue, 20 Oct 2009 18:12:21 +0300 > Jari Fredriksson wrote: > >> >> >> 20.10.2009 17:27, RW kirjoitti: >>> On Tue, 20 Oct 2009 16:38:14 +0300 >>> Jari Fredriksson wrote: >>> >>>> I have trie

Re: Problems with high spam

2009-10-20 Thread Jari Fredriksson
20.10.2009 17:44, McDonald, Dan kirjoitti: >> whitelist_from *...@enerquimica.com > > whitelist_from should generally be avoided. find out if these senders > have published an spf record, or use DKIM signing, then use > whitelist_from_spf or whitelist_from_dkim instead of whitelist_from > IMO

Re: Pulling my hair out

2009-10-20 Thread Jari Fredriksson
20.10.2009 17:27, RW kirjoitti: > On Tue, 20 Oct 2009 16:38:14 +0300 > Jari Fredriksson wrote: > >> I have tried to compile spamd for cygwin, >> but could not make it. I would have used it as one spamd instance in >> my LAN in addition to the working Linux ones, >

Re: Pulling my hair out

2009-10-20 Thread Jari Fredriksson
20.10.2009 16:25, jp kirjoitti: As an admin with two years of CS education... I think Spamassassin is one of the easiest programs to get, install, etc.. The documentation on it's tests is great. There's no voodoo like many anti-spam products. Stopping spam is not simple, and there are no illus

Re: KHOP_NO_FULL_NAME

2009-10-17 Thread Jari Fredriksson
18.10.2009 2:22, Adam Katz kirjoitti: Jari Fredriksson quoted himself (both on the 17th): I have not yet analysed what whitehats cause this, but this rule seems suspipicious to me at moment. Now I have. Legitimate bulk mailers. From: "NYTimes.com" From: "Iltalehti.fi&qu

Re: KHOP_NO_FULL_NAME

2009-10-16 Thread Jari Fredriksson
17.10.2009 3:12, Jari Fredriksson kirjoitti: I have not yet analysed what whitehats cause this, but this rule seems suspipicious to me at moment. Now I have. Legitimate bulk mailers. From: "NYTimes.com" From: "Iltalehti.fi" Newspapers. And others. Guestio

KHOP_NO_FULL_NAME

2009-10-16 Thread Jari Fredriksson
I have not yet analysed what whitehats cause this, but this rule seems suspipicious to me at moment. At the bright side: HOSTKARMA is a pleasant thing to have, now that my config is fixed with the community aid. Email: 1280 Autolearn: 765 AvgScore: 13.53 AvgScanTime: 11.23 sec Spam: 632

Re: [SA] sneaky pharma spam shooting past standard rules

2009-10-16 Thread Jari Fredriksson
15.10.2009 22:43, Adam Katz kirjoitti: A score of 6 is FREAKISHLY high, even for something with a very low FP rate. I'd score that around 1.2 if I trusted it. I like it, so I'm throwing it in khop-general as MC_TAB_IN_FROM scoring at 0.6 for now: # @Mike Cappella on sa-users, 20090806 20:50

Re: sneaky pharma spam shooting past standard rules

2009-10-15 Thread Jari Fredriksson
15.10.2009 18:38, Jason Haar kirjoitti: I just received what appeared to be a standard "certain north american country" pharma spam that went straight by rules I have that normally catch it. Within Thunderbird (and any other HTML-capable MUA) it's blatantly shouting its wares. Clever usage of

Date in report safe page

2009-10-15 Thread Jari Fredriksson
It seems that SpamAssassin attaches the Date header from the original (attached) email when it creates the announcement email. Would it be better to create a new current Date for the "new" email? The idea here is to fix forged Date, as it often is. I sort my mail with Date, and hate when the spa

Re: Hostkarma whitelist needs something.. (No more; SOLVED)

2009-10-14 Thread Jari Fredriksson
15.10.2009 8:48, Jari Fredriksson kirjoitti: iki.fi is a famous Finnish email forwarding service and as such should be added as internal_networks, if you are using it. Things like this are hard to know unless you really understand TruthPaths.. All right. I removed internal_networks which

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 8:29, Henrik K kirjoitti: On Thu, Oct 15, 2009 at 03:33:54AM +0200, Karsten Bräckelmann wrote: On Thu, 2009-10-15 at 02:44 +0300, Jari Fredriksson wrote: -1.0 RCVD_IN_HOSTKARMA_WRBL: HostKarma: relay in white list (first pass) [212.16.98.53 listed

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 3:37, Marc Perkel kirjoitti: TOP HAM RULES FIRED -- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM -- 1 RCVD_IN_JMF_W 1115 6.88 0.06 74.98 This is

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 4:33, Karsten Bräckelmann kirjoitti: On Thu, 2009-10-15 at 02:44 +0300, Jari Fredriksson wrote: -1.0 RCVD_IN_HOSTKARMA_WRBL: HostKarma: relay in white list (first pass) [212.16.98.53 listed in hostkarma.junkemailfilter.com] $ host 212.16.98.53

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 6:41, Adam Katz kirjoitti: Karsten Bräckelmann wrote: 3.0 RCVD_IN_BRBL_RELAY RBL: received via a relay rated as poor by Barracuda [187.10.243.78 listed in bb.barracudacentral.org] Hmm, a different IP. ... Any chance your internal and trusted

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 0:42, Rick Knight kirjoitti: Jari Fredriksson wrote: 15.10.2009 0:21, Rick Knight kirjoitti: Here's the url for the newer version "http://www.rulesemporium.com/programs/sa-stats-1.0.txt";. It's not newer, it's exactly the same version, without or la

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
15.10.2009 0:21, Rick Knight kirjoitti: Here's the url for the newer version "http://www.rulesemporium.com/programs/sa-stats-1.0.txt";. It's not newer, it's exactly the same version, without or later additions. Please to not reply to my INBOX, I get confused. My Thunderbird sees your repli

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 23:55, Rick Knight kirjoitti: Jari, Thanks again for putting the script up. I found the original site and downloaded the 3.1 version. In the instructions it says "If your top 5 does not contain URIBL_BLACK, see http://www.uribl.com/usage.shtml";. On my system URIBL_BLACK is number

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 23:55, Rick Knight kirjoitti: Jari Fredriksson wrote: 14.10.2009 21:49, Mike Cardwell kirjoitti: Jari Fredriksson wrote: Jari, How did you produce the great looking statistics? Thanks, Rick It's a perl script called sa-stats.pl I tried not google it for you, but coul

Re: symlink for spamassassin directory

2009-10-14 Thread Jari Fredriksson
14.10.2009 22:45, Bowie Bailey kirjoitti: I have several virtual users and I want them to all use the same Bayes DB (and user_prefs, etc). The are all using the same UID/GID. Is it safe to make all of the $HOME/spamassassin directories symlinks to a common directory? I can't think of a probl

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 21:49, Mike Cardwell kirjoitti: Jari Fredriksson wrote: Jari, How did you produce the great looking statistics? Thanks, Rick It's a perl script called sa-stats.pl I tried not google it for you, but could not find the original. Many scripts with the same name though..

Re: dns query timed out while sa-update

2009-10-14 Thread Jari Fredriksson
14.10.2009 21:48, Benny Pedersen kirjoitti: On Wed 14 Oct 2009 07:57:35 PM CEST, Jari Fredriksson wrote This is how I have it, I have a local bind, and OpenDNS as forwarders. dont put all eggs in one basket :) (remove opendns forwards in bind) after i learned bind more i found that its

Re: dns query timed out while sa-update

2009-10-14 Thread Jari Fredriksson
14.10.2009 20:57, Jari Fredriksson kirjoitti: If I'm not mistaken, it is always good to run a local nameserver when using SpamAssassin anyway, and not use any router for that. This is how I have it, I have a local bind, and OpenDNS as forwarders. And a special zone like thi

Re: dns query timed out while sa-update

2009-10-14 Thread Jari Fredriksson
14.10.2009 20:51, Karsten Bräckelmann kirjoitti: On Wed, 2009-10-14 at 13:44 -0400, Terry Carmen wrote: Karsten Bräckelmann wrote: However, the single point of failure is your router -- assuming you actually are using its DNS. It's entirely possible his ISP is intercepting his DNS request

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 20:50, Jari Fredriksson kirjoitti: which works for me (Debian), the script not runs without arguments. *now* runs. (s/not/now/g) -- http://www.iki.fi/jarif/ Q: How many WASPs does it take to change a light bulb? A: One. pgpEguqewsBA6.pgp Description: PGP signature

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 20:33, Rick Knight kirjoitti: Jari, How did you produce the great looking statistics? Thanks, Rick It's a perl script called sa-stats.pl I tried not google it for you, but could not find the original. Many scripts with the same name though.. I put that to my server as http://w

Re: DCCPROC and / or DCCIFD

2009-10-14 Thread Jari Fredriksson
14.10.2009 19:52, Rick Knight kirjoitti: Eduardo Casarero wrote: 2009/10/14 Rick Knight mailto:rick_kni...@rlknight.com>> With the help of people here, I have gotten DCCIFD working. Now I have another question. Should I use DCCIFD with DCCPROC or instead of DCCPROC? Can they work together o

Re: Hostkarma whitelist needs something..

2009-10-14 Thread Jari Fredriksson
14.10.2009 19:17, R-Elists kirjoitti: All I can say is that if these numbers were real or typical I would be out of business. perkel, i might be wrong, yet it doesnt appear to me that Jari have enough mail volume to have a reasonable statistical base... - rh You are not wrong,

Hostkarma whitelist needs something..

2009-10-12 Thread Jari Fredriksson
Email: 911 Autolearn: 603 AvgScore: 13.10 AvgScanTime: 12.16 sec Spam: 462 Autolearn: 414 AvgScore: 33.17 AvgScanTime: 10.80 sec Ham:449 Autolearn: 189 AvgScore: -7.55 AvgScanTime: 13.55 sec Time Spent Running SA: 3.08 hours Time Spent Processing Spam

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
Thank you all guys, on list and especially off list.. You know who you are. Thanks. I Put this to the list because I have certain difficulties to write a letter to each of you separately. Thanks.

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
> DCC identifies mail that has been sent often. That's what > the rule checks for, if other recipients have seen it, > too. > > You voluntarily installed DCC, knowing SA will use it. > This was on your discretion, and it's your duty to > evaluate if it actually is, what you want. > > > [1] Onc

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
> From: "Jari Fredriksson" > Date: Fri, 9 Oct 2009 19:25:15 +0300 > > > Is someone trying to poison DCC? > > > > Yes, you are(:-) If you haven't whitelisted the > > mailing list then > > you are reporting th

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
> > Is someone trying to poison DCC? > > Yes, you are(:-) If you haven't whitelisted the > mailing list then > you are reporting the email from the mailing list to DCC, > which will > increase the DCC count. Me? But I do report to DCC/Razor2/SpamCop only spam. I do not report ALL my e

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
>> Auto correct: That should be 'I know it is *not* a spam >> indicator but a bulk indicator.' > > Correct ;) > >> >> You have to whitelist the mailing list in the dcc >> whiteclnt file. >> > > Ok, have to learn something new here. I have whiteclnt > now in my vi as a starting point. > > Tha

Re: Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
> > Auto correct: That should be 'I know it is *not* a spam > indicator but a bulk indicator.' Correct ;) > > You have to whitelist the mailing list in the dcc > whiteclnt file. > Ok, have to learn something new here. I have whiteclnt now in my vi as a starting point. Thanks all for your

Incresing numbers of DCC_CHECK in ham

2009-10-09 Thread Jari Fredriksson
This looks worrying. I have it at 2.2 pts, and not caused any false positives, but still, odd. Or is it? I know it is a SPAM indicator but a bulk indicator. But it is triggered for example by some mailing list posts which are genuine and not bulk. Is someone trying to poison DCC? sa-stats: E

Re: Subject Rewrite Based on Score

2009-10-08 Thread Jari Fredriksson
> Spamassassin Version 3.2.5 > > I am curious if it is possible to rewrite the subject > based on the value of the score. A example of this would > be if a score of 4.0 was given the subject would state > [Potential Spam], but if it was 5.0-10.0 then it is > [SPAM] if it was greater then 10.0 it w

Re: OT bad news

2009-10-05 Thread Jari Fredriksson
> We have been running Spamassassin for maybe eight years > now. But, my coworkers do not like OpenSource. So they > have finally complained enough that my boss is going to > replace our reliable FreeBSD/Spamassassin boxes. They > are planning on purchasing something that runs ON > Exchange. Wh

Re: Low score? Recommendations?

2009-10-05 Thread Jari Fredriksson
> Keep getting similar obvious (to me) spam - tuning > recommendations? My threshold is torqued down to 3.5 > > X-Spam-Level: * > X-Spam-Status: No, score=1.1 required=3.5 > tests=BAYES_50,RAZOR2_CHECK, SPF_HELO_PASS,US_DOLLARS_3 > autolearn=no version=3.2.4 > Please don't send spam to the

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
> On Sat, 2009-10-03 at 00:03 +0300, Jari Fredriksson wrote: >> This is something that I have no knowledge. >> > It was a surprise to me too! > >> Could you see the "source" format of the mail? I can't >> think anything except it being in HTML form

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
> On Fri, 2009-10-02 at 23:28 +0300, Jari Fredriksson wrote: >> There is a blank line between Content-Type and Hello, >> but the Content-Type line WILL get to the body, and the >> html gets injected after it as raw html code, not as >> html (because the actual content ty

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
> On Fri, 2009-10-02 at 21:33 +0300, Jari Fredriksson wrote: >>> On Fri, 2009-10-02 at 20:45 +0300, Jari Fredriksson >>> wrote: >>> >>>> Sendmail command is available with sendmail and postfix >>>> emailers, dunno about others. >>&g

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
>> http://ruleqa.spamassassin.org/ >> If you are capable of processing your mail nightly in >> cron, why don't you join the nightly mass check? You can >> help to test the rules and make the sa-update channel >> better. We especially need non-English ham in the >> nightly masscheck. >> >> http:/

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
> http://ruleqa.spamassassin.org/ > If you are capable of processing your mail nightly in > cron, why don't you join the nightly mass check? You can > help to test the rules and make the sa-update channel > better. We especially need non-English ham in the > nightly masscheck. > > http://wiki.a

Re: Daily statistics into email

2009-10-02 Thread Jari Fredriksson
> On Fri, 2009-10-02 at 20:45 +0300, Jari Fredriksson wrote: > >> Sendmail command is available with sendmail and postfix >> emailers, dunno about others. >> > You don't need to use sendmail: if the cron job writes > anything to stdout (or stderr) this is autom

Daily statistics into email

2009-10-02 Thread Jari Fredriksson
Some just mentioned sa-stats.pl statistics, and I then wrote a script for me to post daily stats for me into email. This is not nuclear science, but I still share it. It is HTML formatted because I use Outlook Express to read mail, but it is easy to fix The file is named so that it runs just

Re: Understanding the hostKarma Lists

2009-09-29 Thread Jari Fredriksson
> On tir 29 sep 2009 23:30:15 CEST, Warren Togami wrote >> Could you please decide between the existing JMF rule >> names or the above proposed HOSTKARMA names? It seems >> opinions are split here. > > let it be the long names that loose ? > > ironical you wanted to be shurt names but created a

Re: Understanding the hostKarma Lists

2009-09-29 Thread Jari Fredriksson
> > It seems that people have already been using the rules > copied from your site. It will be confusing to them if > we change the official name. Some will accidentally have > your lists twice. > > RCVD_HOSTKARMA_BL Black > RCVD_HOSTKARMA_WL White > RCVD_HOSTKARMA_YL Yellow > RCVD_HOSTKARMA_BR

Re: Report in header of SPAM emails

2009-09-25 Thread Jari Fredriksson
> Hello > > if I restarted the spamd > You need more words when communicating ;) Does this mean the report still does not show up, even if you restarted SA after the setting? Well. SpamAssassin does not have a Quarantine. Something in your system has, and that is what is calling the SpamAssa

<    1   2   3   4   5   6   7   >