Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Daniel J McDonald wrote the following on 6/15/2007 3:37 PM -0800: On Fri, 2007-06-15 at 15:27 -0700, Bill Landry wrote: Daniel J McDonald wrote the following on 6/15/2007 2:54 PM -0800: On Fri, 2007-06-15 at 22:08 +0100, Randal, Phil wrote: And a few others... Might as well be complet

Re: These are getting through SA...

2007-06-15 Thread Daniel J McDonald
On Fri, 2007-06-15 at 15:27 -0700, Bill Landry wrote: > Daniel J McDonald wrote the following on 6/15/2007 2:54 PM -0800: > > On Fri, 2007-06-15 at 22:08 +0100, Randal, Phil wrote: > > > > And a few others... Might as well be completely consistent. Try this > > patch: > > --- Botnet.pm.orig

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Daniel J McDonald wrote the following on 6/15/2007 2:54 PM -0800: On Fri, 2007-06-15 at 22:08 +0100, Randal, Phil wrote: Bill, The problem is that Botnet uses Net::DNS::Resolver's default retry and timeout values, which are way too high. Spamassassin's DnsResolver.pm uses these values: u

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
John Rudd wrote the following on 6/15/2007 3:00 PM -0800: Bill Landry wrote: Also, I'm not sure if John Rudd is still supporting Botnet or not, since I have sent him 3 e-mails to the address listed in Botnet.pm off-list over the past week about this, and asked him if he would consider addin

Re: These are getting through SA...

2007-06-15 Thread John Rudd
John Rudd wrote: Bill Landry wrote: Also, I'm not sure if John Rudd is still supporting Botnet or not, since I have sent him 3 e-mails to the address listed in Botnet.pm off-list over the past week about this, and asked him if he would consider adding user configurable timeout values, but h

Re: These are getting through SA...

2007-06-15 Thread John Rudd
Bill Landry wrote: Also, I'm not sure if John Rudd is still supporting Botnet or not, since I have sent him 3 e-mails to the address listed in Botnet.pm off-list over the past week about this, and asked him if he would consider adding user configurable timeout values, but have not received a

RE: These are getting through SA...

2007-06-15 Thread Daniel J McDonald
On Fri, 2007-06-15 at 22:08 +0100, Randal, Phil wrote: > Bill, > > The problem is that Botnet uses Net::DNS::Resolver's default retry and > timeout values, which are way too high. > > Spamassassin's DnsResolver.pm uses these values: > > udp_timeout:3 > tcp_timeout:3 > retrans:0 > retry:1

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Mark Martinec wrote the following on 6/15/2007 2:34 PM -0800: So far so good with Mark's patches - although I am awaiting his follow-up regarding a possible bug... Not sure I understand this. My fixes make SA more robust when plugins misbehave. The Botnet problem still causes the mail pro

Re: These are getting through SA...

2007-06-15 Thread Mark Martinec
Bill, > Hmmm, once I patched the correct SA version Dns.pm file, Mark's patches > worked fine. However, perhaps my error caused Mark to find a bug, as > noted by his follow-up e-mail, which might have gone undetected > otherwise. :-) Indeed, thanks! (but there were two other similar reports as

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Randal, Phil wrote the following on 6/15/2007 2:08 PM -0800: Bill, The problem is that Botnet uses Net::DNS::Resolver's default retry and timeout values, which are way too high. Spamassassin's DnsResolver.pm uses these values: udp_timeout:3 tcp_timeout:3 retrans:0 retry:1 try expor

RE: These are getting through SA...

2007-06-15 Thread Randal, Phil
2007 18:18 To: users@spamassassin.apache.org Subject: Re: These are getting through SA... Mark, thanks for the patches. However, even with both Dns.pm patches applied, unless I set "rbl_timeout" to a high enough time interval, SA still misses the URIBL test results in the sample messages I

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Mark Martinec wrote the following on 6/15/2007 10:41 AM -0800: Bill, There is now an additional patch at: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5511 which should fix this. Mark, thanks for the patches. However, even with both Dns.pm patches applied, unless I s

Re: These are getting through SA...

2007-06-15 Thread Mark Martinec
> ...a bug pause here... bug -> big (29 seconds)

Re: These are getting through SA...

2007-06-15 Thread Mark Martinec
Bill, > > There is now an additional patch at: > > http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5511 > > which should fix this. > Mark, thanks for the patches. However, even with both Dns.pm patches > applied, unless I set "rbl_timeout" to a high enough time interval, SA > still misse

Re: These are getting through SA...

2007-06-15 Thread Bill Landry
Mark Martinec wrote the following on 6/15/2007 3:36 AM -0800: Phil, Bill, Mark, I patched Dns.pm but this didn't resolve the issue for me. You can test with the sample messages I posted to bugzilla: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5506 I was getting this sort

Re: These are getting through SA...

2007-06-15 Thread Mark Martinec
Phil, Bill, > Mark, I patched Dns.pm but this didn't resolve the issue for me. > You can test with the sample messages I posted to bugzilla: > http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5506 > I was getting this sort of symptom without using Botnet. > It's almost as if something's dead

Re: These are getting through SA...

2007-06-13 Thread Mark Martinec
Phil, > What happens if Botnet is patched to use Mail::SpamAssassin::DnsResolver > instead of Net::DNS::Resolver? > I'm musuing about Net::DNS::Resolver's default timeouts and retries... > Phil (probably barking up the wrong tree) It would do good if Botnet would impose a time limit on its DNS qu

RE: These are getting through SA...

2007-06-13 Thread Randal, Phil
reford, UK > -Original Message- > From: Bill Landry [mailto:[EMAIL PROTECTED] > Sent: 12 June 2007 23:30 > To: users@spamassassin.apache.org > Subject: Re: These are getting through SA... > > Mark Martinec wrote the following on 6/12/2007 3:05 PM -0800: > > Bill, > >

Re: These are getting through SA...

2007-06-12 Thread Mark Martinec
Bill, > Mark, I patched Dns.pm but this didn't resolve the issue for me. > You can test with the sample messages I posted to bugzilla: > http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5506 Yes, it is the same problem as I describe in http://issues.apache.org/SpamAssassin/show_bug.cgi?i

Re: These are getting through SA...

2007-06-12 Thread Bill Landry
Mark Martinec wrote the following on 6/12/2007 3:05 PM -0800: Bill, Mark, just curious if you are running Botnet? I found that some messages cause the Botnet RDNS test to timeout after hanging for about 30 seconds, and then network test randomly fail (primarily URIBL tests). I found that i

RE: These are getting through SA...

2007-06-12 Thread Randal, Phil
rg Subject: Re: These are getting through SA... Mark, just curious if you are running Botnet? I found that some messages cause the Botnet RDNS test to timeout after hanging for about 30 seconds, and then network test randomly fail (primarily URIBL tests). I found that if I disable Botnet

Re: These are getting through SA...

2007-06-12 Thread Mark Martinec
Bill, > Mark, just curious if you are running Botnet? I found that some > messages cause the Botnet RDNS test to timeout after hanging for about > 30 seconds, and then network test randomly fail (primarily URIBL > tests). I found that if I disable Botnet, then all network tests will > run fine o

RE: These are getting through SA...

2007-06-12 Thread Randal, Phil
ers, Phil -Original Message- From: Mark Martinec [mailto:[EMAIL PROTECTED] Sent: 12 June 2007 17:20 To: users@spamassassin.apache.org Subject: Re: These are getting through SA... Luis, > > Namely with 22 RBL results coming back, the last one > > (which was the crucial URIBL te

Re: These are getting through SA...

2007-06-12 Thread Bill Landry
Mark Martinec wrote the following on 6/12/2007 3:53 AM -0800: Luis, I don't have any URIBL rules firing up (SA 3.2.0 from source here, most of the other relevant info is in the header of the mail I sent before to test). Where did you get them? [...] But the main difference between the live r

Re: These are getting through SA...

2007-06-12 Thread Mark Martinec
Luis, > > Namely with 22 RBL results coming back, the last one > > (which was the crucial URIBL test) had a timeout of 0 > > and was ignored even though dns result did arrive. > > > > Moreover, there is a bug in Mail::SpamAssassin::Dns, where > > a late-spawned URIBL queries (which only start afte

Re: These are getting through SA...

2007-06-12 Thread Luis Hernán Otegui
Well, I dint't have rbl_timeout set, but after your mail, I did. The DNSs I have set in resolv.conf are mine, they both cache and work as internal and external resolvers. But the UNLP NOC got screwed in the last days, so setting the timeout a little higher wont't hurt. Thanks for the suggestion. H

Re: These are getting through SA...

2007-06-12 Thread Mark Martinec
Luis, > I don't have any URIBL rules firing up (SA 3.2.0 from source here, > most of the other relevant info is in the header of the mail I sent > before to test). Where did you get them? >[...] > But the main difference between the live run and the ones I did with > SA by itself (both as root and

Re: These are getting through SA...

2007-06-08 Thread Luis Hernán Otegui
What I copied and pasted into my message was the original spammy message (the source of it) as IMP showed it. The posterior ALL_TRUSTED occured because it has already been scanned and tagged by my servers. But the main difference between the live run and the ones I did with SA by itself (both as r

Re: These are getting through SA...

2007-06-08 Thread guenther
On Fri, 2007-06-08 at 18:46 -0300, Luis Hernán Otegui wrote: > OK, i?ve been googlin' around, and it seems like an issue between > Amavis (or MailScanner, for waht I've found) and some unsupported > versions of Net::DNS, because when I run the message through SA by > itself, this comes out: Whatev

Re: These are getting through SA...

2007-06-08 Thread Bill Landry
Daryl C. W. O'Shea wrote the following on 6/8/2007 2:41 PM -0800: If you've got the current update from updates.spamassassin.org you've got a working set of rules for URIBL_BLACK and URIBL_GREY. It turns out that they didn't hit for Raymond either, so you won't see them in this case. Daryl

Re: These are getting through SA...

2007-06-08 Thread Luis Hernán Otegui
OK, i?ve been googlin' around, and it seems like an issue between Amavis (or MailScanner, for waht I've found) and some unsupported versions of Net::DNS, because when I run the message through SA by itself, this comes out: Content analysis details: (9.7 points, 5.0 required) pts rule name

Re: These are getting through SA...

2007-06-08 Thread Daryl C. W. O'Shea
If you've got the current update from updates.spamassassin.org you've got a working set of rules for URIBL_BLACK and URIBL_GREY. It turns out that they didn't hit for Raymond either, so you won't see them in this case. Daryl Luis Hernán Otegui wrote: Well, right now I'm running these comman

Re: These are getting through SA...

2007-06-08 Thread ian douglas
> X-Spam-Status: No, score=3.964 tagged_above=-100 required=5 > tests=[BAYES_99=3.5, HTML_30_40=0.463, HTML_MESSAGE=0.001] To me, it looks like enough tokens were seen to flag it as BAYES_99, but that the host and IP it came from didn't trigger any RBL hits, which left your point score well

Re: These are getting through SA...

2007-06-08 Thread Luis Hernán Otegui
Well, right now I'm running these commands to get updates: sa-update --gpgkey --channel saupdates.openprotect.com sa-update --gpgkey --channel updates.spamassassin.org sa-update doesn't download URIBL_BLACK and URIBL_GREY What am I doing wrong? Luis 2007/6/8, Daryl C. W. O'Shea <[EMAIL PR

Re: These are getting through SA...

2007-06-08 Thread Raymond Dijkxhoorn
Hi! Hi, Raymond, I don't have any URIBL rules firing up (SA 3.2.0 from source here, most of the other relevant info is in the header of the mail I sent before to test). Where did you get them? X-Prolocation-MailScanner-SpamCheck: spam, SpamAssassin (not cached, score=14.999, required 5,

Re: These are getting through SA...

2007-06-08 Thread Daryl C. W. O'Shea
Luis Hernán Otegui wrote: Hi, Raymond, I don't have any URIBL rules firing up (SA 3.2.0 from source here, most of the other relevant info is in the header of the mail I sent before to test). Where did you get them? Run sa-update to get URIBL_BLACK and URIBL_GREY. Daryl

Re: These are getting through SA...

2007-06-08 Thread Luis Hernán Otegui
Hi, Raymond, I don't have any URIBL rules firing up (SA 3.2.0 from source here, most of the other relevant info is in the header of the mail I sent before to test). Where did you get them? Thanks, Luis 2007/6/8, Raymond Dijkxhoorn <[EMAIL PROTECTED]>: Hi! > They aren't scoring very much here

Re: These are getting through SA...

2007-06-08 Thread arni
Luis Hernán Otegui schrieb: Hi, could somebody run this mail trough SA and give me the scores? They aren't scoring very much here... Hi, your mailing probably broke half of the email so these scores are only an estimate - if you want me to try again attach the mail as a raw text (or .eml as ma

Re: These are getting through SA...

2007-06-08 Thread Raymond Dijkxhoorn
Hi! They aren't scoring very much here... Return-Path: <[EMAIL PROTECTED]> X-Original-To: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED]@domain.com Received: from localhost (localhost [127.0.0.1]) by nahuel.biol.unlp.edu.ar (Postfix) with ESMTP id 660BE7B1FE; Fri, 8 Jun 2007