Re: Best Choice for Bayes filtering on SpamAssassin

2006-12-02 Thread Nigel Frankcom
On Sat, 02 Dec 2006 18:31:47 +0100, Noc Phibee <[EMAIL PROTECTED]> wrote: >Thanks to your answer > >Yes 6 server in load balancing with for all 70 concurrency incoming >only for spam detect and 3 server for virus scan > > > > > >Michael Scheidell a écrit : >>> -Original Message- >>> From:

Re: My Credit rateing does TOO matter

2006-12-01 Thread Nigel Frankcom
On Fri, 01 Dec 2006 09:15:35 -0500, "Joe Zitnik" <[EMAIL PROTECTED]> wrote: > On 12/1/2006 at 7:01 AM, Justin Mason <[EMAIL PROTECTED]> wrote: > >> Guys -- vague hints as to the contents of the mail really don't help. > >> >> It's spam -- we're all getting thousands of spams a day, most of

Re: optional score in local.cf is not working

2006-11-29 Thread Nigel Frankcom
On Wed, 29 Nov 2006 10:10:58 +0200, "Leon Kolchinsky" <[EMAIL PROTECTED]> wrote: >Hi, > >I thought I was wrong and "amavis restart" didn't really helped there, but >there is an update for this problem I had with configuration in local.cf not >catching. > >It seems that only when I do /etc/init.d

Re: rbl insight and wisdom please

2006-11-27 Thread Nigel Frankcom
On Mon, 27 Nov 2006 13:06:58 -0800, Quinn Comendant <[EMAIL PROTECTED]> wrote: >I'm using the following with qmail's rblsmtpd: > >-r zen.spamhaus.org >-r bl.spamcop.net >-r relays.ordb.org >-r cbl.abuseat.org > >I do find it very hard to determine if a list is "malfunctioning" and honest >emails

Re: rbl insight and wisdom please

2006-11-27 Thread Nigel Frankcom
On Mon, 27 Nov 2006 12:42:40 -0800, "R Lists06" <[EMAIL PROTECTED]> wrote: >Hopefully this hasn't been rehashed to death on this list yet has there ever >been a general consensus as to which rbl's and similar lists are best to use >if you are going to engineer your mail systems with such? > >Anyon

Re: Bayes - Autoexpiry, bayes_seen, and bayes_tok

2006-11-25 Thread Nigel Frankcom
On Sat, 25 Nov 2006 13:55:37 -0500, Theo Van Dinter <[EMAIL PROTECTED]> wrote: >On Sat, Nov 25, 2006 at 01:41:50PM -0500, Jason Frisvold wrote: >> With respect to bayes_tok though, can that be trimmed at all with >> minimal impact? 3GB is a tad large for the database, though I guess >> that depen

Re: Percentage of email that is spam after filtering?

2006-11-25 Thread Nigel Frankcom
On Sat, 25 Nov 2006 10:59:52 -0700, "Kelly Jones" <[EMAIL PROTECTED]> wrote: >Thanks to everyone who is replying here. Additional replies/comments >always appreciated. > >What started me thinking about this is this non-intuitive but >mathematically valid "paradox" that Bookworm and others have not

Re: Email Probs

2006-11-25 Thread Nigel Frankcom
On Sat, 25 Nov 2006 12:00:55 -0500, "rtartar" <[EMAIL PROTECTED]> wrote: >I have some type of email mining where they send to a dictionary of names and >combos to [EMAIL PROTECTED] What is the best way to combat this? > > > >Thanks > Don't allow catchall accounts on your servers. They are far

Re: Percentage of email that is spam after filtering?

2006-11-25 Thread Nigel Frankcom
On Fri, 24 Nov 2006 23:51:23 -0600, Bookworm <[EMAIL PROTECTED]> wrote: >Marc Perkel wrote: >> >> >> Kelly Jones wrote: >>> I know that most (90%+) email sent now is spam, but what are the >>> numbers for people who use spam filtering? >>> >>> I realize it varies by user, sensitivity to false posi

Re: Spamassassin does not rewrite jubject

2006-11-23 Thread Nigel Frankcom
On Thu, 23 Nov 2006 12:43:12 +0200, "Cristi Tudose" <[EMAIL PROTECTED]> wrote: >Hi all . > >I have some problem with subject rewriting. > >I use qmail+vpopmail+clamav+spamassassin+qmail-scanner > >This is my local.cf > >## local.cf ### > ># Add *SPAM**

Re: FP because of HELO_DYNAMIC_IPADDR

2006-11-23 Thread Nigel Frankcom
On Thu, 23 Nov 2006 00:15:16 -0900, John Andersen <[EMAIL PROTECTED]> wrote: >On Wednesday 22 November 2006 22:04, Bob Proulx wrote: >> But in this case it is an example of poor form for the forward and >> reverse dns not to match.  If you are running a mail server this is >> one of the things tha

Re: I've got TORA.08 spelled with numbers?

2006-11-18 Thread Nigel Frankcom
On Sat, 18 Nov 2006 11:16:30 -0600, Chris <[EMAIL PROTECTED]> wrote: >On Saturday 18 November 2006 10:59 am, Nigel Frankcom wrote: >> Hi All, >> >> After a fair bit of discussion on and off list,and a fair bit of >> thought I've decided to change tack a li

Re: I've got TORA.08 spelled with numbers?

2006-11-18 Thread Nigel Frankcom
Hi All, After a fair bit of discussion on and off list,and a fair bit of thought I've decided to change tack a little with stock spam. As of this morning (GMT) I'm reporting all stock spam to the SEC (they have a semi-dedicated address for it). I figure they'll either tell me to quit, block me or

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Nigel Frankcom
On Fri, 17 Nov 2006 17:46:08 +0100, Charlie Clark <[EMAIL PROTECTED]> wrote: > >Am 17.11.2006 um 17:32 schrieb Nigel Frankcom: > >> If the company is still trading in a month I'd be surprised. I >> wouldn't be at all surprised if it's just a shell any

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Nigel Frankcom
On Fri, 17 Nov 2006 09:20:39 -0700, "" <[EMAIL PROTECTED]> wrote: >| >| >| >| http://finance.yahoo.com/q?s=TORA.OB >| > >| >Trading up 4.5%! >| > >| >Geez... >| >| At a rough guess that would be 'salt' money. So when someone does >| click on it/look it up they see rising stock and buy. Check

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Nigel Frankcom
On Fri, 17 Nov 2006 17:09:21 +0100, "Giampaolo Tomassoni" <[EMAIL PROTECTED]> wrote: >> From: Stuart Johnston [mailto:[EMAIL PROTECTED] >> >> Evan Platt wrote: >> > At 07:44 AM 11/17/2006, you wrote: >> >> I'm getting a bunch of spams this morning that have >> >> TORA.08 spelled out with numbers

Re: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Nigel Frankcom
On Fri, 17 Nov 2006 09:03:54 -0700, "" <[EMAIL PROTECTED]> wrote: > >| > Wasn't there a stock image spam with TORA.TORA or something? >| >| AH HA! It is not a url, its a stock symbol! >| >| http://finance.yahoo.com/q?s=TORA.OB > >Trading up 4.5%! > >Geez... At a rough guess that would be '

Re: change spamhaus.org's score

2006-11-14 Thread Nigel Frankcom
On Tue, 14 Nov 2006 14:35:33 -0500, "Peter H. Lemieux" <[EMAIL PROTECTED]> wrote: >Matt Kettler wrote: >> Should be something like this in 50_scores.cf: >> score RCVD_IN_BL_SPAMCOP_NET 0 1.332 0 1.558 >> Just add score RCVD_IN_BL_SPAMCOP_NET 1.0 in your local.cf. >> >> That said, I would NOT advi

Re: Confirmation about sa-learn

2006-11-13 Thread Nigel Frankcom
On Mon, 13 Nov 2006 10:49:11 +0100, Cedric BUSCHINI <[EMAIL PROTECTED]> wrote: >Hello List, > >I d just like to have a confirmation about how to use sa-learn. > >1 - create a directory containing spams (mails tagged as spam and mails not >tagged as spam but which are real spams) >2 - create a

Re: Using sa-learn on separate systems?

2006-11-09 Thread Nigel Frankcom
On Thu, 09 Nov 2006 12:36:08 +0100, Federico Giannici <[EMAIL PROTECTED]> wrote: >Rick Macdougall wrote: >> Anders Norrbring wrote: >>> I have a slight "problem".. I thought I'd finally start using sa-learn >>> to train the Bayes, the catch is that I have Cyrus and its mailboxes >>> on another s

Re: spamassasin --lint

2006-11-09 Thread Nigel Frankcom
On Thu, 9 Nov 2006 18:43:12 +0800, <[EMAIL PROTECTED]> wrote: >hi > >i new here.. > >can anyone know after i adding new domain for whitelist, how can i me it >active immediately with out stop and start the service. > >because when restart , some spam mail already pass throught... > >what is the

Re: Can't upgrade w/ RPM

2006-11-02 Thread Nigel Frankcom
On Thu, 02 Nov 2006 12:00:50 -0700, Philip Prindeville <[EMAIL PROTECTED]> wrote: >Hi. > >I'm running FC3 on an AMD64 platform for my mail server, >and I had last installed SpamAssassin 3.1.5. Well, I grabbed the >tarball for 3.1.7, and did a "rpmbuild -tb ..." of the tarball. > >Worked fine. > >

Re: --lint ok but still have errors

2006-11-02 Thread Nigel Frankcom
On Thu, 02 Nov 2006 22:53:38 +0530, Dhawal Doshy <[EMAIL PROTECTED]> wrote: >Nigel Frankcom wrote: >> On Thu, 2 Nov 2006 12:03:14 -0500, "Debbie D" >> <[EMAIL PROTECTED]> wrote: >> >>> Last week I made some changes to my rules an

Re: --lint ok but still have errors

2006-11-02 Thread Nigel Frankcom
On Thu, 2 Nov 2006 12:03:14 -0500, "Debbie D" <[EMAIL PROTECTED]> wrote: >Last week I made some changes to my rules and I performed >-- lint >which showed no errors.. > >Yesterday AM there was a HUGE influx of spam and I SSH'd in when I saw the >loads jumping up. > >The first thing I did after ve

Re: Spam

2006-11-02 Thread Nigel Frankcom
On Thu, 02 Nov 2006 16:31:26 +, "Markus Braun" <[EMAIL PROTECTED]> wrote: >I would like also to report the spams, but i dont wont get so much spams as >i can see there. > > >>This is probably because you have an unconditional >> >> warn message = X-Spam-Report: $spam_report >> >>in your Exim

Re: TVD tests?

2006-11-02 Thread Nigel Frankcom
On Thu, 02 Nov 2006 10:28:18 +, [EMAIL PROTECTED] (Justin Mason) wrote: > >Nigel Frankcom writes: >>On Thu, 2 Nov 2006 01:47:31 -0500, "Dylan Bouterse" >><[EMAIL PROTECTED]> wrote: >> >>>In the 80_additional.cf file I have a list of

Re: TVD tests?

2006-11-01 Thread Nigel Frankcom
On Thu, 2 Nov 2006 01:47:31 -0500, "Dylan Bouterse" <[EMAIL PROTECTED]> wrote: >In the 80_additional.cf file I have a list of TVD* rules that are not >explained on the http://spamassassin.apache.org/tests_3_1_x.html page >(I'm running SA 3.1.7 and up to date with sa-update). Are these new >rules a

Re: Re[2]: why this spam has a negative score?

2006-11-01 Thread Nigel Frankcom
On Wed, 1 Nov 2006 08:56:07 +0100, [EMAIL PROTECTED] wrote: >Dobrý den, >24. ríjna 2006, 8:05:06, napsal jste: > >> [EMAIL PROTECTED] wrote to me off list: >>> So, how whitelist the e-mail from users in my domain? > >> I'd be asking myself why there's a need to whitelist my own users. >> Afterall

Re: Net::DNS and Perl 5.8.1

2006-11-01 Thread Nigel Frankcom
On Wed, 1 Nov 2006 08:58:26 +0100, [EMAIL PROTECTED] wrote: >It? possible on perl version 5.8.1 install the Net::DNS? > [EMAIL PROTECTED] > mailto:[EMAIL PROTECTED] CPAN is the usual way to do it, tho iirc that has caused some problems (it did here). I got round it by installing through yum (yum

Re: Re[2]: why this spam has a negative score?

2006-11-01 Thread Nigel Frankcom
On Wed, 1 Nov 2006 08:56:07 +0100, [EMAIL PROTECTED] wrote: >Dobrý den, >24. ríjna 2006, 8:05:06, napsal jste: > >> [EMAIL PROTECTED] wrote to me off list: >>> So, how whitelist the e-mail from users in my domain? > >> I'd be asking myself why there's a need to whitelist my own users. >> Afterall

Re: How to score mail to a defined address when not coming from a defined IP list

2006-10-31 Thread Nigel Frankcom
On Tue, 31 Oct 2006 11:19:40 +0100, "Fabio" <[EMAIL PROTECTED]> wrote: >Hi, >I have a small site with some users and a sendmail mailing lists that contain >all users. This mailing list is used almost exclusively by internal users, >sending mail to all other users. >Unfortunately, I receive a lot

Re: rules_du_jour question

2006-10-29 Thread Nigel Frankcom
On Sun, 29 Oct 2006 11:33:54 -0400, "Shaun T. Erickson" <[EMAIL PROTECTED]> wrote: >On 10/29/06, Leander Koornneef <[EMAIL PROTECTED]> wrote: >> >> If you are using spamassassin 3.1, you can use sa-update to get the SARE >> rulesets from the channel provided by http://saupdates.openprotect.com/. >

Re: Explain the spammer mind to me...

2006-10-26 Thread Nigel Frankcom
On Thu, 26 Oct 2006 02:25:37 -0700, "Loren Wilton" <[EMAIL PROTECTED]> wrote: >> Where do these guys all get on the same kick at the same time? >> Or is it really ONE spammer who just got fired? >> >> Do they hold meetings about what topics to use next month >> or what? > >I'd lay odds that it is

Re: Explain the spammer mind to me...

2006-10-26 Thread Nigel Frankcom
On Thu, 26 Oct 2006 02:25:37 -0700, "Loren Wilton" <[EMAIL PROTECTED]> wrote: >> Where do these guys all get on the same kick at the same time? >> Or is it really ONE spammer who just got fired? >> >> Do they hold meetings about what topics to use next month >> or what? > >I'd lay odds that it is

Re: Statistics and reporting

2006-10-24 Thread Nigel Frankcom
On Wed, 25 Oct 2006 14:24:55 +1000, Christopher Martin <[EMAIL PROTECTED]> wrote: >Anyone have any suggested statistics suites I can use for reporting at >the MTA level and from within spamassassin? Would be great to be able to >present some metrics on total mail statistics and then compare what

Re: RFC: spam trapping with policyd-weight and DNSBLs?

2006-10-24 Thread Nigel Frankcom
On Tue, 24 Oct 2006 18:42:58 +0100, [EMAIL PROTECTED] (Justin Mason) wrote: >Hey -- > >just to turn the tables for a bit ;), I've recently been considering a >problem and a possible solution, and could do with SpamAssassin users' >advice. > >These days, I've been forced to use SBL/XBL as an upfron

Re: Psst!

2006-10-20 Thread Nigel Frankcom
On Fri, 20 Oct 2006 11:13:31 -0400, Chris Santerre <[EMAIL PROTECTED]> wrote: > > >> -Original Message- >> From: Mark Johnson [mailto:[EMAIL PROTECTED] >> Sent: Friday, October 20, 2006 10:41 AM >> To: users@spamassassin.apache.org >> Subject: Re: Psst! >> >> >> Chris Santerre wrote: >>

Re: Psst!

2006-10-19 Thread Nigel Frankcom
On Thu, 19 Oct 2006 12:18:27 -0700, Kelson <[EMAIL PROTECTED]> wrote: >Giampaolo Tomassoni wrote: >> Any suggestion to spread a spamtrap e-mail address? > >Subscribe it to some mailing lists. Make a few posts, preferably using >the address in your signature. Unsubscribe it. Then wait for spamm

Re: improving the sa-update process etc. etc. etc.

2006-10-19 Thread Nigel Frankcom
ust my 2 pence worth. Nigel. On Thu, 19 Oct 2006 01:46:31 -0700, Jo Rhett <[EMAIL PROTECTED]> wrote: >Nigel Frankcom wrote: >> On Thu, 19 Oct 2006 01:18:18 -0700, Jo Rhett >> <[EMAIL PROTECTED]> wrote: >> >>>>> And as I've stated several times

Re: improving the sa-update process etc. etc. etc.

2006-10-19 Thread Nigel Frankcom
On Thu, 19 Oct 2006 01:18:18 -0700, Jo Rhett <[EMAIL PROTECTED]> wrote: >>> And as I've stated several times before, spamassassin *DOES* run. >>> Always. It's just whether or not it's doing anything useful. When it >>> can't talk to the sockets, it's dead in the water. > >Frank Bures wrote:

Re: any real downside to setting maxsize to 600Kbytes?

2006-10-16 Thread Nigel Frankcom
On Mon, 16 Oct 2006 20:13:53 +1300, Jason Haar <[EMAIL PROTECTED]> wrote: >I'm getting a small continual number of Asian spam coming in with >message sizes in the 400-500Kbyte range. > >Obviously the default 250K size in spamc is too small and these drop >through the defenses. > >Upping it to 600K

Re: OT - verify addresses

2006-10-05 Thread Nigel Frankcom
On Thu, 05 Oct 2006 12:32:07 +0200, [EMAIL PROTECTED] wrote: >back a few years, some mail servers (e.g. qmail) disabled the verify command >to avoid address probing - and as a consequence would send bounces. >Nowadays, the majority of mail servers (apart from aol :) rejects unknown >users with a 5

RE: Migrate dependencies problem

2006-09-27 Thread Nigel Frankcom
On Wed, 27 Sep 2006 12:50:37 -0400, Bowie Bailey <[EMAIL PROTECTED]> wrote: >Benny Pedersen wrote: >> On Wed, September 27, 2006 16:26, Sietse van Zanen wrote: >> > It's best to use cpan for this. It's very easy to use and will >> > automagically resolve any dependencies. >> >> just one problem w

Re: Anyon eelse hit errors with the SARE stock rule update?

2006-09-22 Thread Nigel Frankcom
On Fri, 22 Sep 2006 12:07:22 +0200, Matthias Haegele <[EMAIL PROTECTED]> wrote: >Nigel Frankcom schrieb: >> Hi, >> >> I got this error today... >> >>> ***WARNING***: spamassassin --lint failed. >>> Rolling configuration files back, not resta

Anyon eelse hit errors with the SARE stock rule update?

2006-09-22 Thread Nigel Frankcom
Hi, I got this error today... > >***WARNING***: spamassassin --lint failed. >Rolling configuration files back, not restarting SpamAssassin. >Rollback command is: mv -f /etc/mail/spamassassin/70_sare_stocks.cf >/etc/mail/spamassassin/RulesDuJour/70_sare_stocks.cf.2; mv -f >/etc/mail/spamassassi

Re: Not all messages passing through SA

2006-09-20 Thread Nigel Frankcom
On Wed, 20 Sep 2006 10:20:18 +0100, [EMAIL PROTECTED] wrote: >I'm using SA 3.1.1 and am calling it from a .procmailrc file as >suggested in http://wiki.apache.org/spamassassin/UsedViaProcmail, the >relevant lines are: > >:0 f >| formail -A"X-Procmail: Before SpamAssassin" > >:0fw: spamassassin.l

Re: import/export bayes database ?

2006-09-15 Thread Nigel Frankcom
On Fri, 15 Sep 2006 10:11:58 +0200, Noc Phibee <[EMAIL PROTECTED]> wrote: >Hi > >i want change my mail server, actually, i use SpamAssassin 3.0.4 >I want put the latest version > >Can i export from old server the bayes database and import it into the new ? > >Thanks bye > > You should be able to

Re: add headers

2006-09-06 Thread Nigel Frankcom
On Tue, 5 Sep 2006 19:36:17 -0700 (PDT), "John D. Hardin" <[EMAIL PROTECTED]> wrote: >On Tue, 5 Sep 2006, Nigel Frankcom wrote: > >> >John D. Hardin wrote: >> >> >> >> On Mon, 4 Sep 2006, e2rd wrote: >> >> >> &g

Re: Get rid of wrong/outdated manual SA-Rules?

2006-09-06 Thread Nigel Frankcom
On Wed, 06 Sep 2006 11:11:09 +0200, Matthias Haegele <[EMAIL PROTECTED]> wrote: >Hello! > >Accidently (or foolishly) i didnt deactivitate "wrong" rules in config >of RulesDuJour [1]. from site: rulesemporium [2]. >Now i have some rules in my /etc/spamassassin/ not for my SA-Version [3] >namely: t

Re: Re: add headers

2006-09-05 Thread Nigel Frankcom
On Tue, 5 Sep 2006 01:18:55 -0700 (PDT), e2rd <[EMAIL PROTECTED]> wrote: > >Hi, > >"report_safe 0" doesn't help. > >I have also: >always_add_headers 1 >spam_level_stars 1 >always_add_report 1 > >Do you have any other idea? > >Best regards, >e2rd > > >John D. Hardin wrote: >> >> On Mon, 4 Sep 2006

Re: Spam levels up or down?

2006-09-03 Thread Nigel Frankcom
On Sun, 3 Sep 2006 04:22:07 -0700, "jdow" <[EMAIL PROTECTED]> wrote: >From: "Nigel Frankcom" <[EMAIL PROTECTED]> >On Sun, 03 Sep 2006 01:10:25 -0800, John Andersen <[EMAIL PROTECTED]> >wrote: > >>On Sunday 03 September 2006 01:03, Nigel Fr

Re: Spam levels up or down?

2006-09-03 Thread Nigel Frankcom
On Sun, 03 Sep 2006 11:10:14 +0100, [EMAIL PROTECTED] (Justin Mason) wrote: > >John Andersen writes: >> On Sunday 03 September 2006 01:03, Nigel Frankcom wrote: >> > On Sat, 2 Sep 2006 10:25:40 -0700 (PDT), "John D. Hardin" >> > >> > <[EMAIL PRO

Re: Spam levels up or down?

2006-09-03 Thread Nigel Frankcom
On Sun, 03 Sep 2006 01:10:25 -0800, John Andersen <[EMAIL PROTECTED]> wrote: >On Sunday 03 September 2006 01:03, Nigel Frankcom wrote: >> On Sat, 2 Sep 2006 10:25:40 -0700 (PDT), "John D. Hardin" >> >> <[EMAIL PROTECTED]> wrote: >> >On Sat,

Re: Re: Spam levels up or down?

2006-09-03 Thread Nigel Frankcom
On Sat, 2 Sep 2006 10:25:40 -0700 (PDT), "John D. Hardin" <[EMAIL PROTECTED]> wrote: >On Sat, 2 Sep 2006, jdow wrote: > >> Hm, I have a suspicion that the spam is being targeted quite >> differently then. Until the end of June I used to get about 250 to >> 300 spams a day. I am down to 90 to 150 p

Re: Spam levels up or down?

2006-09-03 Thread Nigel Frankcom
On Sat, 2 Sep 2006 22:13:28 -0400, David Cary Hart <[EMAIL PROTECTED]> wrote: >On Sat, 02 Sep 2006 02:28:14 -0800, John Andersen ><[EMAIL PROTECTED]> opined: >> The Register is running an article saying spam is back up to 81% of >> all email traffic due to newer versions of the Mocbot worm. >> >>

Re: Spam levels up or down?

2006-09-02 Thread Nigel Frankcom
On Sat, 2 Sep 2006 06:15:28 -0700, "jdow" <[EMAIL PROTECTED]> wrote: >From: "Nigel Frankcom" <[EMAIL PROTECTED]> >On Sat, 02 Sep 2006 02:28:14 -0800, John Andersen <[EMAIL PROTECTED]> >wrote: > >>The Register is running an article saying sp

Re: Spam levels up or down?

2006-09-02 Thread Nigel Frankcom
On Sat, 02 Sep 2006 02:28:14 -0800, John Andersen <[EMAIL PROTECTED]> wrote: >The Register is running an article saying spam is back up to 81% of all >email traffic due to newer versions of the Mocbot worm. > >If anything, my traffic has been less of late, and almost non-existant >since in install

Re: IO::Socket::INET6 problems

2006-09-01 Thread Nigel Frankcom
On Fri, 01 Sep 2006 12:43:36 +0200, Anders Norrbring <[EMAIL PROTECTED]> wrote: >I'm trying to get IO::Socket::INET6 to install since I actually use >IPv6.. But so far no luck, and I haven't found any cure when Googling >around on the subject either. > >Anyone on the list who can help out? The

Re: AW: AW: Problems with ClamAV Plugin

2006-08-29 Thread Nigel Frankcom
On Tue, 29 Aug 2006 13:23:47 +0200, Jürgen Ladstätter <[EMAIL PROTECTED]> wrote: >it does the following when it finds a virus: > >} elsif($code eq 'FOUND') { >Mail::SpamAssassin::Plugin::dbg("ClamAV: Detected virus: $virus"); >$header = "Yes ($virus)"; >$isspam = 1; > >so it adds a fla

Re: AW: Problems with ClamAV Plugin

2006-08-29 Thread Nigel Frankcom
On Tue, 29 Aug 2006 13:07:50 +0200, Jürgen Ladstätter <[EMAIL PROTECTED]> wrote: >x-virus header is now shown, but it doesnt drop the file. i think it would >be better, because outlook doesnt show any warning, header isnt rewritten, >file isnt dropped. so its still unsecure :-/ > > > >Mit freundl

Re: AW: Problems with ClamAV Plugin

2006-08-29 Thread Nigel Frankcom
On Tue, 29 Aug 2006 13:07:50 +0200, Jürgen Ladstätter <[EMAIL PROTECTED]> wrote: >x-virus header is now shown, but it doesnt drop the file. i think it would >be better, because outlook doesnt show any warning, header isnt rewritten, >file isnt dropped. so its still unsecure :-/ > > > >Mit freundl

Re: Re: bayes not run on some mail

2006-08-14 Thread Nigel Frankcom
On Mon, 14 Aug 2006 16:28:21 +0700, Beast <[EMAIL PROTECTED]> wrote: >Nigel Frankcom wrote: >> >>>> I will turn on auto leaarn mostly because I need to feed more HAM to SA >>>> (so far I only feed ham for any false positive which is very low daily >&

Re: Re: bayes not run on some mail

2006-08-14 Thread Nigel Frankcom
On Mon, 14 Aug 2006 01:52:33 -0700, "jdow" <[EMAIL PROTECTED]> wrote: >From: "Beast" <[EMAIL PROTECTED]> > >> jdow wrote: >>> From: "Beast" <[EMAIL PROTECTED]> >>> Hi, From some (spam) mail which not caught by SA, it seems that bayes is not applied to this mail. X-Sp

Re: bayes not run on some mail

2006-08-13 Thread Nigel Frankcom
On Mon, 14 Aug 2006 12:21:16 +0700, Beast <[EMAIL PROTECTED]> wrote: >Hi, > > From some (spam) mail which not caught by SA, it seems that bayes is >not applied to this mail. > >X-Spam-Report: > * 0.0 HTML_MESSAGE BODY: HTML included in message > * 1.7 SARE_SPEC_ROLEX Rolex watch spam >X-S

Re: Sa-learn doesn't seem to work

2006-08-11 Thread Nigel Frankcom
On Fri, 11 Aug 2006 11:49:16 +0300, "Halid Faith" <[EMAIL PROTECTED]> wrote: >Hello > >I use spamassassin3.1 with simscan1.2 on qmail. >I want my mailserver to deny some messages which are spam using sa-learn. So I >typed as below; >sa-learn --spam /path/badmails/ > >Learned tokens from 6 message

Re: 0451.com

2006-08-10 Thread Nigel Frankcom
On Thu, 10 Aug 2006 18:04:06 -0400, Bill Horne <[EMAIL PROTECTED]> wrote: >On Mon, Aug 07, 2006 at 01:29:36PM +0200, Ralf Hildebrandt wrote: >> * Tony Finch <[EMAIL PROTECTED]>: >> >> > All-numeric domains are popular in China because they are easier for >> > people to deal with than alphabetic d

Re: Re: Memory requirements

2006-08-09 Thread Nigel Frankcom
On Wed, 9 Aug 2006 01:10:59 -0700, "jdow" <[EMAIL PROTECTED]> wrote: >From: "Nigel Frankcom" <[EMAIL PROTECTED]> > >On Wed, 9 Aug 2006 00:52:58 -0700, "jdow" <[EMAIL PROTECTED]> wrote: > >>From: "James Lay" <[EMAIL PR

Re: Memory requirements

2006-08-09 Thread Nigel Frankcom
On Wed, 9 Aug 2006 00:52:58 -0700, "jdow" <[EMAIL PROTECTED]> wrote: >From: "James Lay" <[EMAIL PROTECTED]> > >> On Mon, 7 Aug 2006 20:46:05 -0700 >> "jdow" <[EMAIL PROTECTED]> wrote: >> >>> From: "James Lay" <[EMAIL PROTECTED]> >>> >>> > Hey all! >>> > >>> > Anyone happen to know the memory re

Re: Re: Bayes errors...

2006-08-08 Thread Nigel Frankcom
On Tue, 08 Aug 2006 12:08:52 +0100, Hamish Marson <[EMAIL PROTECTED]> wrote: >-BEGIN PGP SIGNED MESSAGE- >Hash: SHA1 > >Nigel Frankcom wrote: >> I'm not sure what you've done there, I didn't realise it was >> possible to mix collation types in

Re: Bayes errors...

2006-08-08 Thread Nigel Frankcom
On Tue, 08 Aug 2006 12:02:04 +0100, Hamish Marson <[EMAIL PROTECTED]> wrote: >-BEGIN PGP SIGNED MESSAGE- >Hash: SHA1 > >Nigel Frankcom wrote: >> I'm not sure what you've done there, I didn't realise it was >> possible to mix collation types in

Re: Bayes errors...

2006-08-08 Thread Nigel Frankcom
I'm not sure what you've done there, I didn't realise it was possible to mix collation types in the same table. Have you checked that all tables are the same type? MyISAM or Inno? If they are all the same, I'd be inclined to pull it down, rebuild from the SA supplied SQL and retrain. Did you merge

Re: SA-Update required modules

2006-08-07 Thread Nigel Frankcom
I had similar problems on CentOS 32 & 64; I ended up installing the Net::Ident with yum instead (off the dag repo), that worked ok... yum install perl-Net-Ident.noarch The INET6 can be installed the same way, though I don't think it's critical to have it in. HTH Nigel On Mon, 7 Aug 2006 20:45:

Re: 0451.com

2006-08-07 Thread Nigel Frankcom
On Mon, 7 Aug 2006 08:21:41 +0100, Duncan Hill <[EMAIL PROTECTED]> wrote: >On Monday 07 August 2006 00:02, wrote: >> | 2250 0733.com > >> Here are my numbers from last week: >> >>5006 0451.com >>3845 53.com > >Not seeing anywhere near as high, but this is only on my personal server: >

Re: Always add report headers

2006-08-05 Thread Nigel Frankcom
On Sat, 05 Aug 2006 14:08:45 +0200, Arik Raffael Funke <[EMAIL PROTECTED]> wrote: >Hi, > >how to I get spamd/spamc to always add the spamassassin report headers? >I.e. also to ham messages... > >I have the following in my local.cf and user_pref.cf but to no apparent use: > >use_auto_whitelist 0 >

Re: Always add report headers

2006-08-05 Thread Nigel Frankcom
On Sat, 05 Aug 2006 14:08:45 +0200, Arik Raffael Funke <[EMAIL PROTECTED]> wrote: >Hi, > >how to I get spamd/spamc to always add the spamassassin report headers? >I.e. also to ham messages... > >I have the following in my local.cf and user_pref.cf but to no apparent use: > >use_auto_whitelist 0 >

Re: 0451.com

2006-08-05 Thread Nigel Frankcom
On Sat, 05 Aug 2006 14:38:56 +0100, Ben Wylie <[EMAIL PROTECTED]> wrote: >A question for those of you who have large databases of spam and ham to >check, do genuine emails come from the domain 0451.com or whether it is >genuinely just spam? > >I get a lot of spam claiming to be from emails on th

Allowing IMAP/POP to Send Email & United Nations etc....

2006-08-03 Thread Nigel Frankcom
I'll put on my flameproof underwear for this There's been a huge amount of crossfire on these/this subject, but I don't see how it has anything to do with SA; or am I missing the point? Different protocols, yet another level of policing, but nothing about the fact that SA does a damned fine j

Re: sa-update error

2006-08-03 Thread Nigel Frankcom
On Thu, 3 Aug 2006 10:06:31 -0400, Theo Van Dinter <[EMAIL PROTECTED]> wrote: >On Thu, Aug 03, 2006 at 10:19:44AM +0100, Nigel Frankcom wrote: >> channel: attempt to rm channel pre file failed, attempting to continue >> anyway at /usr/bin/sa-update line 694 >> --li

sa-update error

2006-08-03 Thread Nigel Frankcom
Hi All, I ran sa-update across several Centos 64 & 32 bit machines here yesterday and today and received the following error... channel: attempt to rm channel pre file failed, attempting to continue anyway at /usr/bin/sa-update line 694 --lint -D shows no errors, just wondering if I should be co

Re: This list using SORBS?

2006-08-02 Thread Nigel Frankcom
I had a similar problem recently, after 5 years on the same static Business IP it suddenly appeared in SORBS. In true Murphy's law fashion the first I knew of it was about 8PM on a Saturday night, when a message to this list bounced with reference to SORBS. After a few days dickering with my ISP t

Re: Re: What changes would you make to stop spam? - United Nations Paper

2006-08-02 Thread Nigel Frankcom
On Wed, 02 Aug 2006 05:53:17 -0700, Marc Perkel <[EMAIL PROTECTED]> wrote: > > >Nigel Frankcom wrote: >> On Wed, 02 Aug 2006 05:37:32 -0700, Marc Perkel <[EMAIL PROTECTED]> >> wrote: >> >> >>> Why not just eliminate the SMTP protocol

Re: What changes would you make to stop spam? - United Nations Paper

2006-08-02 Thread Nigel Frankcom
On Wed, 02 Aug 2006 05:37:32 -0700, Marc Perkel <[EMAIL PROTECTED]> wrote: >Why not just eliminate the SMTP protocol for end users and keep SMTP as >a server to server protocol and have users send theit email to the >server by extending POP/IMAP to send email. It created an authenticated >conne

Re: Re: spamassasin learn

2006-07-31 Thread Nigel Frankcom
on a mail folder containing only spam >is the bayes database going to apply the spam rules learnt globally on >mailboxes. > >Thanks, >Kailash > > >On 7/31/06, Nigel Frankcom <[EMAIL PROTECTED]> wrote: >> Hi, >> >> The sa-learn instruction trains

Re: spamassasin learn

2006-07-31 Thread Nigel Frankcom
Hi, The sa-learn instruction trains the bayes database; without it bayes will not tag any messages. You need to do the training with at least 200 spam and 200 ham. Be very careful that the messages in each are correct, so no spam in the ham folder. There are options to learn from the mbox format

Re: DNS timeout and debugging

2006-07-24 Thread Nigel Frankcom
On Mon, 24 Jul 2006 22:12:14 +0100, Ben Wylie <[EMAIL PROTECTED]> wrote: >I am running SpamAssassin 3.1.2 on Windows 2003 Server. > >Is there any way for me to change the DNS timeout period? > >Is there a way for me to increase debugging info on DNSBL tests? >When for some reason, if all DNS tests

Re: meta rule format

2006-07-24 Thread Nigel Frankcom
On Mon, 24 Jul 2006 19:25:23 +0100, Ben Wylie <[EMAIL PROTECTED]> wrote: >Am running SpamAssassin 3.1.2 on Windows 2003 Server. > >I have written a meta rule and i want it to only hit if it hits the >first rule AND one of the three in brackets. > >This syntax doesn't seem to work as it hits when

Re: Delivery failure notification (fwd)

2006-07-21 Thread Nigel Frankcom
They have a nice feedback link :-> http://www.accessintel.com/feedback.htm On Fri, 21 Jul 2006 22:00:52 -0800, John Andersen <[EMAIL PROTECTED]> wrote: >On Friday 21 July 2006 21:42, John D. Hardin wrote: >> On Fri, 21 Jul 2006, John Andersen wrote: >> > On Friday 21 July 2006 18:03, John D. Har

Sort of related to Whitelisting abuse and <>

2006-07-20 Thread Nigel Frankcom
Hi, I'm looking at the feasibility of using all_spam_to for my local abuse@ addresses. Since abuse@ is intended as reporting mechanism about local abusers I don't want mail sent to the local abuse addresses scanned/binned by SA. Am I opening myself up to problems? Is there a better way to do i

Re: Re: Bayes corrupt?

2006-07-19 Thread Nigel Frankcom
<[EMAIL PROTECTED]> wrote: >Nigel Frankcom blue-canoe.net> writes: > >> http://spamassassin.apache.org/full/3.0.x/dist/doc/sa-learn.html >> >> http://spamassassin.apache.org/full/3.1.x/dist/doc/sa-learn.html >> >> On Wed, 19 Jul 2006 05:37

Re: Re: Bayes corrupt?

2006-07-18 Thread Nigel Frankcom
http://spamassassin.apache.org/full/3.0.x/dist/doc/sa-learn.html http://spamassassin.apache.org/full/3.1.x/dist/doc/sa-learn.html On Wed, 19 Jul 2006 05:37:29 + (UTC), martin <[EMAIL PROTECTED]> wrote: >just wonder, how can make sa-learn/spamassassin to unlearn a message? thx > >jdow eart

Re: spamassassin sql lookup

2006-07-18 Thread Nigel Frankcom
Previous message aside, either the user name is wrong or the db for that user is empty On Tue, 18 Jul 2006 20:18:12 +0200, "Martin Schiøtz" <[EMAIL PROTECTED]> wrote: >Hi > >I am using spamassassin-3.1.3 with bayes_pg.sql. Everything is working >fine but in maillog it looks like spamassassin is m

Re: spamassassin sql lookup

2006-07-18 Thread Nigel Frankcom
Do you have sql whitelist and user prefs enabled? On Tue, 18 Jul 2006 20:18:12 +0200, "Martin Schiøtz" <[EMAIL PROTECTED]> wrote: >Hi > >I am using spamassassin-3.1.3 with bayes_pg.sql. Everything is working >fine but in maillog it looks like spamassassin is making the bayes >lookup 3 times for e

Re: Re: Why is there so much hype behind Image spam

2006-07-15 Thread Nigel Frankcom
I'd have said the tools were the spammers and the image spams their implements - but that'd just be semantics :-} On Sat, 15 Jul 2006 04:08:51 -0700, "Loren Wilton" <[EMAIL PROTECTED]> wrote: >> marketing.. or should I expect a huge deluge of Image spam this weekend > >Maybe. Who knows. > >Image

Re: modifying log

2006-07-12 Thread Nigel Frankcom
I think you'll need to take those info out of you smtp/MTA logs We do similar here using an AWK script which goes on to tally ham/spam and various other stats. On Tue, 11 Jul 2006 05:38:22 -0700 (PDT), Pezhman Lali <[EMAIL PROTECTED]> wrote: >hi >in my /var/log/maillog, foreach spam checking, th

Re: Training Bayes properly

2006-06-29 Thread Nigel Frankcom
On Fri, 30 Jun 2006 09:45:07 +1000, "Leigh Sharpe" <[EMAIL PROTECTED]> wrote: >So it looks like I have to reset my Bayes and re-train it. I want to do >it properly this time. I will be making sure I personally review every >message that our users put into the spam folder first, to make sure they >

Re: Re: razor is not working ...

2006-06-25 Thread Nigel Frankcom
Hi, Did you enable: loadplugin Mail::SpamAssassin::Plugin::Razor2 in your /etc/mail/spamassassin/v310.pre file? KR Nigel On Sun, 25 Jun 2006 09:51:50 -0400, "Screaming Eagle" <[EMAIL PROTECTED]> wrote: >Hmm, I know I installed razor, because I just ran a razor-report. >razor-report -v >Raz

Re: razor2 - strange --lint messages

2006-06-25 Thread Nigel Frankcom
Hi, Did you do: 'razor-admin -discover' 'razor-admin -register' After installing razor? KR Nigel On Sun, 25 Jun 2006 10:58:53 +0200, numE <[EMAIL PROTECTED]> wrote: >Hi, > >i installed spamassassin and razor2 via cpan. > >but i get this message, when running "spamassassin --lint" > >--- >[72

Re: RE: RE: Various plugins for Windows version?

2006-06-23 Thread Nigel Frankcom
For all my comments earlier, SA with Razor, Pyzor & DCC work well,; far better since the SA rig was moved to nix. I use CentOS & FC3/4 here. The net results are most agreeable. I hit maybe 1 - 5 FP/FN a week - which is pretty good on the local setup. All things considered I'm most happy. I've jus

Re: RE: Various plugins for Windows version?

2006-06-23 Thread Nigel Frankcom
Hi, We use a Win32 mail server that passes mail over to a nix SA box; one thing that's been noted is that win can lock the file on occasion and cause SA to fail. It seems windows file locks have much to answer for. One possible culprit is the index server; this may or may not apply to you. Disabli

Re: What is normal period for SA retraining ?

2006-06-15 Thread Nigel Frankcom
On Thu, 15 Jun 2006 13:17:51 -0700, "Harris, Jason \(DIS\)" <[EMAIL PROTECTED]> wrote: >I'm wanting to know many times per year do SA admins have to retrain ? > >Our setup sends mail to SA client for a score, then depending on score >stores a backup of the mail in spam/ham mail folders for late

<    1   2   3   4   >