W dniu 2020-12-12 o 17:56, RW pisze:
> On Thu, 10 Dec 2020 17:40:42 +0100
> Marcin Mirosław wrote:
>
>> Hi!
>> I use spamassassin 3.4.4 and I try txrep. When I run sa-learn --spam
>> it put six tuples to database (postgres):
>> # select * from txrep ;
> ...
Hi!
I use spamassassin 3.4.4 and I try txrep. When I run sa-learn --spam
it put six tuples to database (postgres):
# select * from txrep ;
username | email |
ip | msgcount | totscore | signedby | last_hit
W dniu 2019-12-28 o 21:07, RW pisze:
> On Sat, 28 Dec 2019 20:06:04 +0100
> Marcin Mirosław wrote:
>
>> Hello,
>> it looks something changed in mimeheader check. After upgrade to 3.4.3
>> this rule throws error:
>>
>> warn: config: SpamAssassin failed to par
Hello,
it looks something changed in mimeheader check. After upgrade to 3.4.3
this rule throws error:
warn: config: SpamAssassin failed to parse line, "__LRM_BAD_ZIPSRULE
Content-Type:raw =~
/^application\/zip;.*xls\s\.zip|^application/zip;.*\.zip\"/" is not
valid for "mimeheader", skipping:
W dniu 2019-05-01 o 10:05, A. Schulze pisze:
> Hello,
>
> we've a number of SA instances that need rule updates. For now we configured
> them to use a proxy. Works...
> But there are also instances that can't us a proxy at all.
>
> My idea was to setup a private SA-Mirror (apache+rsync) but,
W dniu 20.03.2019 o 15:27, Dominic Raferd pisze:
> On Wed, 20 Mar 2019 at 13:14, piecka wrote:
>>
>> Hello
>>
>> We've encountered a high false positive rate with MIXED_ES rule for emails
>> written in Czech language. Czech naturally uses all of the e,ě and é.
>>
>> The situation is similar for
W dniu 2019-01-10 o 12:05, Kevin A. McGrail pisze:
> I believe this is a known issue fixed in svn. We need to get 3.4.3 out
> the door for this. Are you able to test with the 3.4 branch from svn?
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7623
W dniu 19.12.2018 o 16:16, Kris Deugau pisze:
> RW wrote:
>> It looks like sa-update has lost support for paths in mirror URLs. The
>> SA mirrors don't currently have paths, but the commented-out dostech
>> entry suggests that they have been supported in the past.
>
> I came across this myself
W dniu 03.12.2018 o 15:42, Marcin Mirosław pisze:
> Hi!
> I have problem with sa-update and my own channel. sa-update queries for
> A record of strange domain:
>
> # /usr/bin/sa-update --channel sa.mejor.pl --no-gpg -vv
> DNS TXT query: 2.4.3.sa.mejor.pl -> 3209
> Upda
Hi!
I have problem with sa-update and my own channel. sa-update queries for
A record of strange domain:
# /usr/bin/sa-update --channel sa.mejor.pl --no-gpg -vv
DNS TXT query: 2.4.3.sa.mejor.pl -> 3209
Update available for channel sa.mejor.pl: -1 -> 3209
DNS A query update.sa.mejor.pl/sa-updates
W dniu 30.01.2018 o 14:51, Kevin A. McGrail pisze:
> On 1/30/2018 4:11 AM, Marcin Mirosław wrote:
>> Can error pasted below be related to this commit?
>
> Yes, without a doubt the same bug.
Hi!
I'm answering with one email, thanks for your anwsers and now sa-update
works fine.
Have a nice day
W dniu 29.01.2018 o 08:26, Giovanni Bechis pisze:
> On 01/29/18 06:00, Alex wrote:
>> Hi,
>>
>>> FORGED_HOTMAIL_RCVD2 (hotmail.com 'From' address, but no 'Received:')
>>> triggers for valid hotmail messages... (SA 3.4.1)
>>>
>>> This small change solves the problem but i do not know whether it is
W dniu 2017-03-14 16:23, Kris Deugau napisał(a):
mar...@mejor.pl wrote:
Hi!
Thanks to AXB seek-in-phrases-in-log works OK. Now I'm on the next
step with automated creating rules.
I suspect that mk_meta_rule_scores doesn't assign scores correctly. I
set in mk_meta_rule_scores:
my %scoremap = (
Hi!
W dniu 16.08.2016 o 17:36, Nicola Piazzi pisze:
> It is difficoult to write a doc of what this plugin that I wrote do
> But here is the ow.cf file, so you can see what this plugin do
You didn't attach ow.(cf|pm).
> It can be used ONLY when box is the same for send and receive emails
> What
Hi!
I've got simple rule with eval:check_uridnsbl to make check against own
uribl. And notice that uribl strips subdomains from uri so instead
querying for sub4.sub3.sub2.sub1.org.myuribl spamassassin makes query
for sub1.org.myuribl. But I prefer to query for full domain, without any
striping.
W dniu 2015-06-28 o 15:57, Axb pisze:
On 28.06.2015 15:17, Marcin Mirosław wrote:
Hi!
I've got simple rule with eval:check_uridnsbl to make check against own
uribl. And notice that uribl strips subdomains from uri so instead
querying for sub4.sub3.sub2.sub1.org.myuribl spamassassin makes
W dniu 06.05.2015 o 14:46, Kevin A. McGrail pisze:
On 5/5/2015 3:56 PM, Marcin Mirosław wrote:
W dniu 2015-05-05 o 21:47, Kevin A. McGrail pisze:
On 5/5/2015 3:38 PM, Marcin Mirosław wrote:
I'm thinking about removing all Received headers from email except
added
by my MTA, storing
W dniu 2015-05-05 o 20:29, RW pisze:
On Tue, 05 May 2015 10:51:22 +0200
Marcin Miros?aw wrote:
Hi!
I'm ashamed to ask because this problem is like boomerang but still
can't find solution. I'm reading e.g.:
W dniu 2015-05-05 o 21:28, Reindl Harald pisze:
Am 05.05.2015 um 21:21 schrieb Marcin Mirosław:
Thanks for both answers. I'll try to describe it using ascii art:
----
|random user sending email |sends email |89.161.182.208
Hi!
I'm ashamed to ask because this problem is like boomerang but still
can't find solution. I'm reading e.g.:
http://spamassassin.1065346.n5.nabble.com/How-to-ignore-multiple-Received-headers-td52450.html
I set trusted_networks but I can't see how can it helps (and it doesn't
work as I wish).
W dniu 2015-05-05 o 21:47, Kevin A. McGrail pisze:
On 5/5/2015 3:38 PM, Marcin Mirosław wrote:
I'm thinking about removing all Received headers from email except added
by my MTA, storing it, sending email to spamd and restoring headers. But
it looks like using a sledgehammer to crack a nut
W dniu 2015-05-05 o 22:07, Benny Pedersen pisze:
Marcin Mirosław skrev den 2015-05-05 21:21:
My goal is to configure SA to not check IP of client (in this example
31.61.129.221).
Can you elaborate about what's going on here? What do the two hand-overs
represent? What do you mean by real
Hi!
As I mentioned earlier I'm (and not only me but other users postmasters
in Poland) getting a lot of spam from botnet. Usually it gets high
scores but from time to time spam is delivered to mailbox. Because this
spam is sended to many mailservers I think it could be worth to create
official or
W dniu 2015-02-25 o 19:17, Benny Pedersen pisze:
On February 25, 2015 2:55:16 PM Marcin Mirosław mar...@mejor.pl wrote:
http://pastebin.com/bAm2yk8z , http://pastebin.com/6zLjMtM8 .
blacklist_uri_host businessanalyse.be
blacklist_uri_host 143businesssecrets.com
and blacklist_from
W dniu 2015-02-24 o 19:22, Yves Goergen pisze:
Am 24.02.2015 um 19:00 schrieb Jeremy McSpadden:
Your better off to implement RBL at SMTP time, not SA. IMO
Which MTA are you using ?
Exim. But why should I do that? See my other message in this thread.
RBLs make mistakes. But then, only one of
W dniu 2015-02-24 o 19:56, Axb pisze:
[...]
- Please post missed spam samples in pastebin.com - do not post samples
to mailing lists
Yes, please share it, I'll take a look what kind of spamt it is.
W dniu 2015-02-24 o 21:28, Yves Goergen pisze:
Am 24.02.2015 um 19:56 schrieb Axb:
- Please post missed spam samples in pastebin.com - do not post samples
to mailing lists
It's too many to process them individually in pastebin. Here's an
archive with ~60 messages in files:
W dniu 2015-01-11 o 04:49, Reindl Harald pisze:
Am 10.01.2015 um 22:07 schrieb Marcin Mirosław:
W dniu 2015-01-10 o 15:27, Reindl Harald pisze:
Am 10.01.2015 um 15:19 schrieb David Flanigan:
Is anyone using the Malware Patrol 3rd party Spamassassin Rules
(https://www.malwarepatrol.net
P.S.2. All grepping was made in directory contains only spam.
W dniu 2015-01-10 o 15:27, Reindl Harald pisze:
Am 10.01.2015 um 15:19 schrieb David Flanigan:
Is anyone using the Malware Patrol 3rd party Spamassassin Rules
(https://www.malwarepatrol.net/index.shtml)?
I have downloaded and looked them over and, in concept, they look pretty
good.
W dniu 10.09.2014 o 06:57, John Hardin pisze:
On Tue, 9 Sep 2014, Marcin Mirosław wrote:
W dniu 09.09.2014 o 15:19, John Hardin pisze:
On Tue, 9 Sep 2014, Marcin Mirosław wrote:
Hi again,
I noticed FP on mentioned rule when checking ham email. Due to
confidential content I don't want
W dniu 09.09.2014 o 23:53, Jose Borges Ferreira pisze:
Hi Marcin,
I'm affiliated with Mailspike and just want to say that we have
changed the contact form so you now have a option specify that you are
contacting as Self-employed or private.
We have also configured ab...@mailspike.org if
W dniu 29.08.2014 o 23:36, Dave Warren pisze:
On 2014-08-29 02:38, Marcin Mirosław wrote:
So what should I do in your opinion? I'm getting spam to my private
spamtrap so I can't fill fields about company - it doesn't matter where
I'm hired for reporting spam. What if I would be unemployed
Hi again,
I noticed FP on mentioned rule when checking ham email. Due to
confidential content I don't want to share it on ML. Is somebody willing
to improve mentioned rule or one case is not enough to look at it? If
somebody would like to look insight it I can send such email offlist.
Regrds
W dniu 28.08.2014 o 11:20, Reindl Harald pisze:
Am 28.08.2014 um 11:11 schrieb Marcin Mirosław:
I've noticed growing volume of emails listed by mailspike. Usually it's
spam listed as good reputation. On his webpage I can see only page
http://mailspike.org/contact.html , they want to fill
Hi!
I've noticed growing volume of emails listed by mailspike. Usually it's
spam listed as good reputation. On his webpage I can see only page
http://mailspike.org/contact.html , they want to fill many personal
information, I don't want to send it to them and I don't want to lie.
abuse@ doesn't
W dniu 20.08.2014 o 14:42, Axb pisze:
On 08/20/2014 02:25 PM, Matteo Dessalvi wrote:
Hi all.
I am managing a bunch of Linux MTAs which are placed in
front of some Exchange servers. In such a configuration
the Bayes filter is deployed site-wide.
For a new deployment of these servers I am
W dniu 21.08.2014 o 13:45, Matteo Dessalvi pisze:
I am pretty sure SA support the Redis authentication mechanism.
For my tests I have used the following line:
bayes_sql_dsn server=127.0.0.1:6379;password=MySecretPWD;database=2
Thanks Matteo,
firstly I should try then write to ML:) So now I
W dniu 21.08.2014 o 15:20, Matteo Dessalvi pisze:
Which version of Redis are you using? I did have some
problems with the 2.4 version packaged by Debian and
I did solve a similar problem using a more recent
version, like the 2.7 or 2.8.
And you fixed my problem! Indeed, upgrading from
W dniu 24.02.2014 16:24, John Hardin pisze:
Hi!
On Mon, 24 Feb 2014, Marcin Mirosław wrote:
Sorry for silly question. I'd like to know if mentioned rules catches
all email address or only user part?
It's not a silly question. All of the TO_EQ_FROM rules compare the full
email address
Hi!
Sorry for silly question. I'd like to know if mentioned rules catches
all email address or only user part?
I'd like to catch such spam:
From: Charlene Torres zawod...@johnnywinslow.com
To: zawodynn zawod...@bielin.pl
Where user part in header From: and To: is the same (and SPF_FAIL and
W dniu 19.12.2013 16:13, Alex pisze:
Hi,
Hi,
On Thu, Dec 19, 2013 at 10:02 AM, Joe Quinn jqu...@pccc.com wrote:
Isn't that where Kevin works too? Couldn't you just walk down the hall
and ask him? lol
We are noticing a lot of spam coming from domains that are less than two
months old.
Hi!
I'm not sure if false positives should be reported here or in bugzilla.
If I choosen wrong place please let me know.
Innocent phrase in Polish language brakuje Ci aliasów[1] triggers
rules mentioned above.
[1] - it means: [...] you are missing aliases [...]
Regards,
Marcin
W dniu 18.10.2013 15:23, Axb pisze:
On 10/18/2013 03:07 PM, Marcin Mirosław wrote:
Hi!
I'm not sure if false positives should be reported here or in bugzilla.
If I choosen wrong place please let me know.
Innocent phrase in Polish language brakuje Ci aliasów[1] triggers
rules mentioned above
W dniu 23.10.2012 22:24, RW pisze:
Hi,
On reading you your question more thoroughly I see that your main
point was that you aren't getting as many processes as expected.
The number of child processes isn't adjusted immediately, it's
incremented or decremented when a child announces that it
Hello list!
I'm playing with options min-spare,max-spare,min-children and
max-children, I'd like to save memory on my vps. So I'd like to have one
children awaiting for connection from MTA, when MTA receives more emials
in short time I'd like SA to spawn more children (max-children=6). I
thinks
W dniu 23.10.2012 12:03, Arthur Dent pisze:
[...]
Just thought I'd ask...
You did restart SA after you made the changes?
Yes I did. In meanwhile I've found bug
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6843 . But it
doesn't give me anwser why max-spare limit max childs. (And
W dniu 23.10.2012 15:52, Bowie Bailey pisze:
On 10/23/2012 7:30 AM, Marcin Mirosław wrote:
W dniu 23.10.2012 12:03, Arthur Dent pisze:
[...]
Just thought I'd ask...
You did restart SA after you made the changes?
Yes I did. In meanwhile I've found bug
https://issues.apache.org/SpamAssassin
W dniu 2012-04-21 15:29, Axb pisze:
Hello,
http://spamassassin.apache.org/full/3.3.x/doc/Mail_SpamAssassin_Conf.txt
You want:
use_bayes 1
use_bayes_rules 0
use_learner 1
I found use_learner 0 is better for me, bayes engine isn't called while
message is reported.
Thanks for tip!
Marcin
Hello,
i've notice when i set use_bayes 0 then spamc -C report stops to work.
I've got in log: spamd: Can't call method learn on an undefined value
at /usr/lib64/perl5/vendor_perl/5.12.4/Mail/SpamAs
sassin/PerMsgLearner.pm line 111, GEN187 line 117.
Whay i've to use bayes when i want to report
W dniu 2012-04-21 04:58, dar...@chaosreigns.com pisze:
On 04/20, Marcin Mirosław wrote:
Hello,
i've notice when i set use_bayes 0 then spamc -C report stops to work.
I've got in log: spamd: Can't call method learn on an undefined value
bayes_learn_during_report 0
Hi darxus,
thanks
W dniu 2012-04-21 07:38, Marcin Mirosław pisze:
I'm guessing, as for now, it's the best to set
connection to non existent database (disadvantage is high number of
error messages in log).
I tried, it looks none rror messages appears in logs. Fine for me:)
Regards,
Marcin
W dniu 2011-10-30 18:37, Jeremy McSpadden pisze:
I have several MS boxes and it seems that the RCVD_IN_DNSWL_HI rule in
72_active is allowing way to much through. Running at a score of 5 for
spam, and it -5 on score is pushing it as clean. How do i disable the
rule completely, even on
W dniu 2011-10-30 21:36, Jeremy McSpadden pisze:
Yes, that is in place. (not a newbie here)
Only newbie can say I'm not newbie.
Hello!
I'd like to ask you if this rule works correctly? I've sended email from
thunderbird and roundcube and in both cases this rule scores email. Here
is sample email: http://pastebin.com/rVTwNp5X (with little mungled
recipient).
Rules are in version: 1162027, spamassassin-3.3.2
Thanks for
W dniu 26.09.2011 15:52, Matus UHLAR - fantomas pisze:
I don't see other X-Spam headers there. How are you running
spamassassin? Aren't you using amavis ot other software using just
spamassassin libraries?
Are you sure some 3rd party does not modify mail headers?
No, i don't use any 3rd
W dniu 26.09.2011 15:53, Bowie Bailey pisze:
There is nothing in that sample that would cause the rule to fire. I
downloaded it and ran it against my SA and did not get a match for
MISSING_SUBJECT. The only thing I can think of is that the headers end
at the first blank line. If there is a
W dniu 12.09.2011 13:18, Tomasz Chmielewski pisze:
Are SpamAssassin descriptions available in other languages?
For example, the following would produce SpamAssassin output below - are
localized versions of it available anywhere?
$ cat /tmp/new.eml | spamassassin -Lt
[...]
Hello,
short
W dniu 12.09.2011 13:59, Tomasz Chmielewski pisze:
On 12.09.2011 13:25, Marcin Mirosław wrote:
Hello,
short answer: yes.
What's the long answer?
I wanted to say as a user i know there are available translations, but
i don't know informations about how many translations are available
W dniu 10.08.2011 12:00, akrohnke pisze:
Hello,
Currently one of our clients are getting spam that looks like it comes from
the sender itself. Spamassassin only occasionally catches it.
Hello!
It should be done at smtp level.
if (sender domain is my domain) and sender didn't authenticated
W dniu 30.03.2011 16:27, Adam Moffett pisze:
Your watchdog idea is a valid one,
Should i fill bug with this idea (or bug descibed there:
http://osdir.com/ml/users-spamassassin/2011-03/msg00481.html or there:
http://www.gossamer-threads.com/lists/spamassassin/users/161931#161931 ) ?
Or it's
Hi!
Sometimes (for example bug 6558) happen than spamd child(s) utilizes
100% cpu for a long time (until i kill them myself). My suggestion is to
add new functionality to SA, something like watchdog for spamd child
processes. If child hangs to long with email, it should be killed by
parrent
W dniu 30.03.2011 12:33, Daniel Lemke pisze:
You mean something like --timeout-child=secs as a spamd starting option? ;)
http://spamassassin.apache.org/full/3.3.x/doc/spamd.html
Thanks for quick reply!
This option doesn't work as i wish ;) spamd child isn't killing after
time set in
W dniu 30.03.2011 14:06, Per Jessen pisze:
Have you looked at what spamd is doing when it so busy?
Did You mean spamd child? At this moment bayes engine do very hard
work with email.
W dniu 30.03.2011 15:47, Per Jessen pisze:
Yes, I meant the child - obviously, it sounds as if it's a problem in
the bayes processing. I don't use SA bayes, but that problem ought to
be investigated first before we look at work-arounds. IMHO.
I'm expecting that bayes can do its work for long
W dniu 30.03.2011 16:21, Per Jessen pisze:
Well, isn't the behaviour you're seeing working-as-expected then? If it
was an indefinite loop, setting up a time-out would be a possible
work-around. If the bayes code is doing what it is supposed to do, but
just taking long to do it, no
W dniu 30.03.2011 16:21, Per Jessen pisze:
Well, isn't the behaviour you're seeing working-as-expected then? If it
was an indefinite loop, setting up a time-out would be a possible
work-around. If the bayes code is doing what it is supposed to do, but
just taking long to do it, no
W dniu 30.03.2011 16:27, Adam Moffett pisze:
Your watchdog idea is a valid one, but if you can improve bayes
performance it may become a non-issue. Have you tried moving bayes to a
MySQL database? It consumes more disk space and memory, but it's
dramatically faster than using the default
W dniu 30.03.2011 16:34, Kris Deugau pisze:
My experience here has been that if a spamd child is pegging a CPU core
for an extended period, there's simply a *lot* of body text to run
(raw)body rules against (eg, ~ 200K).
We've found that a fairly effective defense against this is to set up a
W dniu 30.03.2011 17:12, RW pisze:
Are you sure that there were idle spamd children? The above is
consistent with ~14 seconds queuing for a child, followed by a
timeout after 10 seconds.
I was watching cpu time of spamd child (i took delta, not last cpu time
;) ). 14+10 is coincidence.
W dniu 07.03.2011 13:40, Michelle Konzack pisze:
Hello,
since 2011-01-19 I have a problem because my FTTH was accidently cuted
and now no one want ot be responsable including my ISP.
OK, 88.168.69.36 had an rDNS to mail.tamay-dogan.net and was working
perfectly and gotten never rejects
W dniu 23.11.2010 00:18, Byung-Hee HWANG pisze:
Marcin Mirosław mar...@mejor.pl writes:
I'm using SA-3.3.1, NetAddr-IP-4.033.
May you give any advice?
Sorry, i don't know about 3.3.1 Version. By the way there is somewhat
similar patchs for IPv6. You would check out as following
Hi all!
I've created custom rbl with own dns. I've noticed problem when
connection from remote smtp is via ipv6. It looks like SA dosen't query
rbl about address ipv6.
Example 1:
client(address BB, ipv4)-MTA( CC, ipv4)-dest. MTA
in this case, SA checks for both addresses BB and CC
example 2:
I'm going to use own rbl to do it.
Hello,
I'd like to write rule for scoring mails originated from given CIDR.
Value of CIDR is in _ASNCIDR_ but i don't know hot to use it value. Or
mayby should i make lookup asn.routeviews.org ?
Thanks for help.
W dniu 09.11.2010 17:14, Karl Meyer pisze:
Hi,
I want to configure bayes learning and still having some problems and
questions after reading several tutorials:
I executed sa-learn for my inbox
# su -c /usr/bin/sa-learn --dbpath /var/amavis/.spamassassin/bayes/ --ham
--showdots
W dniu 2010-11-09 17:24, Bowie Bailey pisze:
If you learn a message as ham, it will not learn the same message as ham
a second time (same with spam). However, you can change your mind and
learn the message as spam. Bayes will forget what it learned the
first time and re-learn the message.
W dniu 2010-11-10 07:37, Karl Meyer pisze:
But the 15 new messages weren't learnd yet.
I had 10 messages in my inbox and run sa-learn on that folder. Then I got 15
different new messages and re-run sa-learn again. But it said that it
learned from 0 messages.
Do you run SA from smtp server?
W dniu 02.11.2010 10:26, Sharma, Ashish pisze:
How can I migrate this Bayesian knowledge from one installation to other.
Hello,
Do sa-learn --backup and the sa-lear --restore
Regards
79 matches
Mail list logo