Re: Custom Rule Filtering on X-Mailer Header Not Working

2006-08-23 Thread Loren Wilton
to whatever I want and when I use The Bat!, it too goes right through. Any other ideas? Restart spamd? If it works in test and not in production... BTW, you DO know that The Bat! is a perfectly legit (and very nice) mail program, don't you? Lots of spammers abuse the name, but there are

Re: SA settings

2006-08-23 Thread Loren Wilton
I see. The order is really directory order and not so much as file order. All .cf files within each of the directories are read. Not quite. The files are read from each directory in the order of the file names, which is why many of the names start with numbers. Obviously 99anything.cf is

low score spam

2006-08-23 Thread yossim
Hi forum, recently i get a lot of spam emails with very low score mostly are text emails. How can i fine tune my SA in order to catch those emails? here is an exmple: Hi, Not very good erecxction? You are welcome - http://pdahlmjr.com/l/ jockstrap or sporran woven out of, well possibly,

Re: OCR plugin doesn't seem to work

2006-08-23 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mike Pepe wrote: decoder wrote: Which OCR plugin are you using there? If it is the original OcrPlugin, then you might try FuzzyOcr instead. The original OcrPlugin was more proof-of-concept, and will cause you lots of headaches with the current

Re: low score spam

2006-08-23 Thread John Andersen
Well even your message scored pretty high here. Were this mailing list not whitelisted, it would have gone to /dev/null Maybe you should turn on Network tests and configure Razor? On Tuesday 22 August 2006 23:24, yossim wrote: Spam detection software, running on the system pen.homeip.net,

Re: low score spam

2006-08-23 Thread yossim
Hello John, Thanks for your quick response. I am not sure that i understand your answer. Sorry i am not so experinece with SA. The score that i got for that specific example was: score=0.395,required 6.2, BAYES_20 -0.74, FORGED_RCVD_HELO 0.14,HTML_MESSAGE 1.00) There are many calculation

Re: low score spam

2006-08-23 Thread John Andersen
On Wednesday 23 August 2006 00:48, yossim wrote: Hello John, Thanks for your quick response. I am not sure that i understand your answer. Sorry i am not so experinece with SA. The score that i got for that specific example was: score=0.395,required 6.2, BAYES_20 -0.74, FORGED_RCVD_HELO

Re: Formatting plugin report

2006-08-23 Thread Justin Mason
Daryl C. W. O'Shea writes: John D. Hardin wrote: On Tue, 22 Aug 2006, Matt Kettler wrote: John D. Hardin wrote: Coders (if any): Can anybody point me at a code sample showing how to get details into the report SUMMARY tag from within a plugin? Like the [IP address etc.] in this:

Re: Formatting plugin report

2006-08-23 Thread Justin Mason
John D. Hardin writes: On Tue, 22 Aug 2006, Daryl C. W. O'Shea wrote: I took a casual glance at the code, it seems to be related to the test_log subroutine, which populates test_log_msgs, that later gets added to the REPORT and SUMMARY. I got the same impression, but

Scoring Issue

2006-08-23 Thread aurora
Hi there, Recently we have switched over how our emails get sent. Emails now get sent from our server at the office, they then get scanned and routed through the ISP's mail server and then get forwarded on to the end recipients server. My question is: Due to the configuration, if a customer

Re: Scoring Issue

2006-08-23 Thread Duncan Hill
On Wednesday 23 August 2006 10:19, aurora wrote: Basically, we now get alot of customers calling us saying that they have not received our email and it's because it has been held on their spam server with a score of 6, even though its a plain text email! We have only been getting these issues

Re: Scoring Issue

2006-08-23 Thread aurora
Duncan Hill wrote: On Wednesday 23 August 2006 10:19, aurora wrote: Basically, we now get alot of customers calling us saying that they have not received our email and it's because it has been held on their spam server with a score of 6, even though its a plain text email! We have only

Re: Scoring Issue

2006-08-23 Thread Anthony Peacock
Hi, aurora wrote: Duncan Hill wrote: On Wednesday 23 August 2006 10:19, aurora wrote: Basically, we now get alot of customers calling us saying that they have not received our email and it's because it has been held on their spam server with a score of 6, even though its a plain text email!

Re: Scoring Issue

2006-08-23 Thread Duncan Hill
On Wednesday 23 August 2006 10:37, aurora wrote: ISP's SMTP server which then hits the customers SMTP/POP server. In most cases, your SMTP server will just find a direct route to the destination server and only the sending server and receiving server will be involved without a server being in

Re: Scoring Issue

2006-08-23 Thread aurora
Anthony Peacock wrote: Hi, aurora wrote: Duncan Hill wrote: On Wednesday 23 August 2006 10:19, aurora wrote: Basically, we now get alot of customers calling us saying that they have not received our email and it's because it has been held on their spam server with a score of 6,

Train from Outlook?

2006-08-23 Thread Christopher Mills
Tell me something, is there a pluggin for outlook that would allow me to train spamassassin on the web server?Eg, messages come in, end up in my Junk Mail folder, can i somehow select them, and click a button with this 'addin' and have it find our web server and train spam assassin with the data

razor2 problems: corrupted regexp program at...

2006-08-23 Thread [EMAIL PROTECTED]
Sometimes i get this errors from spamd: Aug 23 08:48:15 dmz spamd[24977]: syslog() failed: corrupted regexp program at /usr/lib/perl5/5.8.7/i586-linux-thread-multi/S ys/Syslog.pm line 320. Aug 23 08:48:16 dmz spamd[24977]: razor2 check skipped: corrupted regexp program at

how to no delivery msg if spamc failed

2006-08-23 Thread [EMAIL PROTECTED]
Hi I'm using spamassassin + qmail-scanner There is a way to tell qmail-scanner or spamassasin to NOT delivery mail if spamc failed? This is beecause sometimes my spamd daemon goes down and all spam messages are passed... Any ideas?

Re: Train from Outlook?

2006-08-23 Thread Steven Stern
Christopher Mills wrote: Tell me something, is there a pluggin for outlook that would allow me to train spamassassin on the web server? Eg, messages come in, end up in my Junk Mail folder, can i somehow select them, and click a button with this 'addin' and have it find our web server and

Exim: spam acl condition: cannot parse spamd output

2006-08-23 Thread Johann Spies
I have just upgraded my Spamassassin on Debian Stable to 3.1.3 (backports) from 3.0.3 and I get this message in Exim's paniclog: spam acl condition: cannot parse spamd output That is not the case with every message. Does My Exim4-acl's: warn message = X-Spam-Score: $spam_score ($spam_bar)

Re: Exim: spam acl condition: cannot parse spamd output (more information)

2006-08-23 Thread Johann Spies
On Wed, Aug 23, 2006 at 02:28:38PM +0200, Johann Spies wrote: I have just upgraded my Spamassassin on Debian Stable to 3.1.3 (backports) from 3.0.3 and I get this message in Exim's paniclog: spam acl condition: cannot parse spamd output At the same time the /var/log/exim4/paniclog reports

Re: Train from Outlook?

2006-08-23 Thread Stuart Johnston
Christopher Mills wrote: Tell me something, is there a pluggin for outlook that would allow me to train spamassassin on the web server? Eg, messages come in, end up in my Junk Mail folder, can i somehow select them, and click a button with this 'addin' and have it find our web server and train

How to whitelist_from ?

2006-08-23 Thread Philip Prindeville
Hmm Maybe if I post with a more obvious subject line What is the notation for writing a whitelist_from or whitelist_from_rcvd when the sender is ? (As in MAIL FROM: ) Thanks, -Philip Philip Prindeville wrote: Well, I have the following issue. When I report abuse to [EMAIL

RE: Train from Outlook?

2006-08-23 Thread Jean-Paul Natola
IMAP2MBOX You take the mail from the junk folder , run imap2mbox, take that mbox file and use it to train SA But Im not sure what you are referring to as far as the web server From: Christopher Mills [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 23, 2006 8:07 AM To:

Re: Custom Rule Filtering on X-Mailer Header Not Working

2006-08-23 Thread John D. Hardin
On Tue, 22 Aug 2006, Loren Wilton wrote: BTW, you DO know that The Bat! is a perfectly legit (and very nice) mail program, don't you? Lots of spammers abuse the name, but there are any number of people that use it to send real mail. I mention that since the score I saw you assigning was

SPF Scoring... SPF_NEUTRAL

2006-08-23 Thread Michael Grey
Has anyone experienced SPF_* rules not actually being scored ? In the debug I see that it comes back as result: none shouldnt this come back as SPF_NEUTRAL ? We are setting up SA with amavisd, and when running amavis in debug mode (amavisd u amavis g amavis debug-sa) I can see

Re: How to whitelist_from ?

2006-08-23 Thread John D. Hardin
On Wed, 23 Aug 2006, Philip Prindeville wrote: Hmm Maybe if I post with a more obvious subject line What is the notation for writing a whitelist_from or whitelist_from_rcvd when the sender is ? (As in MAIL FROM: ) Are you sure you want to use that broad a brush? There is a *lot*

Re: SPF Scoring... SPF_NEUTRAL

2006-08-23 Thread Noel Jones
On 8/23/06, Michael Grey [EMAIL PROTECTED] wrote: Has anyone experienced SPF_* rules not actually being scored ? In the debug I see that it comes back as 'result: none' – shouldn't this come back as SPF_NEUTRAL ? When the domain does not publish SPF records you get result: none. Test

RE: SPF Scoring... SPF_NEUTRAL

2006-08-23 Thread Michael Grey
Since this is not a production system, we have had to do some MX magic on a remote domain to push mail through this new system... that domain doesn't have SPF enabled (curse you Network Solutions !) So the big question is really this : Should NONE get an SPF score ? Thanks Mike -Original

Re: SPF Scoring... SPF_NEUTRAL

2006-08-23 Thread Gino Cerullo
On 23-Aug-06, at 12:45 PM, Michael Grey wrote: Since this is not a production system, we have had to do some MX magic on a remote domain to push mail through this new system... that domain doesn't have SPF enabled (curse you Network Solutions !) So the big question is really this : Should

RE: SPF Scoring... SPF_NEUTRAL

2006-08-23 Thread Michael Grey
Sorry, I was too philosophical in my question... to rephrase; In the standard SA config, should I expect to see an SPF_* rule hit returned when the SPF return value is 'none' ? Thanks Mike -Original Message- From: Gino Cerullo [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 23, 2006

Re: SPF Scoring... SPF_NEUTRAL

2006-08-23 Thread John D. Hardin
On Wed, 23 Aug 2006, Gino Cerullo wrote: So the big question is really this : Should NONE get an SPF score ? That is a matter of internal policy on your part. If you want to penalize domains for not having an SPF record you could give it a negative score. On the other hand, if you wish to

Re: SPF Scoring... SPF_NEUTRAL

2006-08-23 Thread Gino Cerullo
On 23-Aug-06, at 1:09 PM, John D. Hardin wrote: On Wed, 23 Aug 2006, Gino Cerullo wrote: So the big question is really this : Should NONE get an SPF score ? That is a matter of internal policy on your part. If you want to penalize domains for not having an SPF record you could give it a

Re: SPF Scoring... SPF_NEUTRAL

2006-08-23 Thread Gino Cerullo
On 23-Aug-06, at 1:01 PM, Michael Grey wrote: Sorry, I was too philosophical in my question... to rephrase; In the standard SA config, should I expect to see an SPF_* rule hit returned when the SPF return value is 'none' ? This is from the latest 50_scores.cf # SPF # Note that the

RE: Train from Outlook?

2006-08-23 Thread Steven Manross
Matt Yackley wrote/co-authored (not sure which), a plugin for Outlook that moves the messages to a public folder (spam and ham).. Maybe he'll share? From there, a central server could attach to those public folders, create RFC822 text files out of them, and then learn them via a simple perl

RE: Train from Outlook?

2006-08-23 Thread Jean-Paul Natola
What I do here, is that I tell my users to DRAG / MOVE any spam into a public folder, then I run IMAP2MBOX once that is done I then train SA using the mbox file-- Fairly simple , just make sure the users do NOT FORWARD the messages to the public folder -Original Message- From:

RE: Train from Outlook?

2006-08-23 Thread Ray Dzek
Your timing is perfect. I just implemented this yesterday! The script you may be looking for is imap-sa-learn.pl from: http://www.gagravarr.org/code/ The how-to is here: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200406.mbox/[EMAIL PROTECTED] Users then drag (very

RE: Train from Outlook?

2006-08-23 Thread Jean-Paul Natola
SLOW DOWN!! Thats sounds like an awful lot when you can just let imap2mbox do it all. Imap2mbox does everything for you , except moving the messages to the folder http://www.byteplant.com/support/nospamtoday/howtolearnexchange.html

New major FuzzyOcr version: 2.3 (RC1)

2006-08-23 Thread decoder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, I am proud to be able to announce a new release of FuzzyOcr with lots of new features and changes. You can download it at http://users.own-hero.net/~decoder/fuzzyocr/ Before installing this plugin, make sure to read the INSTALL file. If

RE: Train from Outlook?

2006-08-23 Thread Ray Dzek
Imap2mbox resides on a windows server and only converts the imap format into an mbox format. Reading the links you provided there is an executable and external batch files to run on a windows machine. So that would/could be a solution if your environment is windows only. We are running a

RBL Rules Misfiring

2006-08-23 Thread D . J .
Hello all.I searched my archive of the list, and couldn't find a similar issue. This is probably something I've misconfigured, but here goes. Running SA 3.14 via the Mail::SpamAssassin Perl plugin from amavisd-new. Have been running into a problem where some dynamic RBL lists are firing just

analysing the logs

2006-08-23 Thread Nick Rout
Using spamd started from .procmailrc, it logs to syslog and ends up in /var/log/mail.log, along with postfix's log and courier-imap's log. How can I get some analysis of this?, eg positives per day, etc. Have googled a bit, and looked in the archives, a lot of people talk about their stats, not

Re: USER_IN_WHITELIST problem

2006-08-23 Thread Kelson
Nick Rout wrote: So I take it USER_IN_WHITELIST also checks Return-Path? I wonder where Return-Path is being set? Is it likely to be set by the spammer? Or is my system adding it in somewhere (probably in error). Return-Path is usually added by the receiving system, and contains the envelope

RE: Train from Outlook?

2006-08-23 Thread Jean-Paul Natola
My setup is FREEBSD 5.4 SA EXIM CLAMAV filters all incoming mail, once SA CLAMAV clean the mail it goes to exchange The imap2mbox DOES NOT run on the exchange server, I run from my pc as follows D:\imap2mboximap2mbox.exe --path=public folders/ --folder=1spam

Re: USER_IN_WHITELIST problem

2006-08-23 Thread Nick Rout
On Wed, 23 Aug 2006 14:49:19 -0700 Kelson wrote: Nick Rout wrote: So I take it USER_IN_WHITELIST also checks Return-Path? I wonder where Return-Path is being set? Is it likely to be set by the spammer? Or is my system adding it in somewhere (probably in error). Return-Path is usually

Another SARE channel with the most used rules available

2006-08-23 Thread [EMAIL PROTECTED]
Hi, This is to notify you about another SARE channel with the most used rules available as a single channel. If you're not the type to try every single rule in SARE and manually select them, you can instead use this single channel instead. OpenProtect's Sa-update channel for SARE

Filtering Aliases/Forwarders

2006-08-23 Thread DuBois, Joseph
Well met, Just activated SpamAssassin on my website (by my web hosting provider) and wanted to do some simple tests which I read from the Wiki site and FAQ. When it didn't run I opened a ticket with my provider and he said he didn't support it and I needed to find help else where. So here

Re: RBL Rules Misfiring

2006-08-23 Thread Stuart Johnston
As a quick guess, you probably need to fix your Trust Path: http://wiki.apache.org/spamassassin/TrustPath D.J. wrote: Hello all. I searched my archive of the list, and couldn't find a similar issue. This is probably something I've misconfigured, but here goes. Running SA 3.14 via the

Re: analysing the logs

2006-08-23 Thread jdow
From: Nick Rout [EMAIL PROTECTED] Using spamd started from .procmailrc, it logs to syslog and ends up in /var/log/mail.log, along with postfix's log and courier-imap's log. How can I get some analysis of this?, eg positives per day, etc. Have googled a bit, and looked in the archives, a lot

Re: Filtering Aliases/Forwarders

2006-08-23 Thread jdow
Joseph, may I make a slight suggestion for you? For the rewrite try something about the same size that makes eyeball filtering ham out of the spam folder much easier: rewrite_header subject * Rated SPAM: _SCORE(00) * Then the header subject will start with something like this: * Rated SPAM:

sa-learn -q patch in FreeBSD

2006-08-23 Thread Justin Mason
anyone know what this is/does? http://cia.navi.cx/stats/project/FreeBSD/.message/32ba98d/xml --j.

Re: How to whitelist_from ?

2006-08-23 Thread Philip Prindeville
John D. Hardin wrote: On Wed, 23 Aug 2006, Philip Prindeville wrote: Hmm Maybe if I post with a more obvious subject line What is the notation for writing a whitelist_from or whitelist_from_rcvd when the sender is ? (As in MAIL FROM: ) Are you sure you want to use that

Re: How to whitelist_from ?

2006-08-23 Thread John D. Hardin
On Wed, 23 Aug 2006, Philip Prindeville wrote: John D. Hardin wrote: On Wed, 23 Aug 2006, Philip Prindeville wrote: What is the notation for writing a whitelist_from or whitelist_from_rcvd when the sender is ? (As in MAIL FROM: ) Are you sure you want to use that broad a brush?

phishing reports to [EMAIL PROTECTED] bouncing

2006-08-23 Thread Chris
I don't know if anyone other than me does this but thought I'd ask if anyone else is having problems with them. I keep getting these bounces, but not on all messages: A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following

SpamAss-Milter

2006-08-23 Thread Christopher Mills
Hi people, Have any of you used the SpamAss-Milter ?I am still having hell getting all our inbound mail into spamassassin. Mail going to local mailboxes gets scanned, but if they are being forwarded to external addresses (like [EMAIL PROTECTED]) are not. This is frustrating the hell out of me

lint undefined dependencies?

2006-08-23 Thread lists
Hey list, Sorry if this has been covered before. We recently upgraded to SA 3.14 - and I today ran a spamassassin -D --lint to check everything. I saw several lines like the following: [31579] info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'PYZOR_CHECK' So, does this

Re: lint undefined dependencies?

2006-08-23 Thread Theo Van Dinter
On Wed, Aug 23, 2006 at 06:33:03PM -0700, [EMAIL PROTECTED] wrote: Sorry if this has been covered before. We recently upgraded to SA 3.14 - and I today ran a it has. :) [31579] info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'PYZOR_CHECK' So, does this undefined

Re: SpamAss-Milter

2006-08-23 Thread jdow
From: Christopher Mills [EMAIL PROTECTED] Hi people, Have any of you used the SpamAss-Milterhttp://www.sendmail.com/partners/milter/milter.detail/#SpamAss-Milter? I am still having hell getting all our inbound mail into spamassassin. Mail going to local mailboxes gets scanned, but if they are

bayes autolearn acting up

2006-08-23 Thread lists
Hello,Since upgrading to 3.14, when I turn on bayes auto-learn with:bayes_auto_learn 1and I set the learn boundaries with:bayes_auto_learn_threshold_nonspam    -3.5bayes_auto_learn_threshold_spam       15.5I get unexpected auto-learning.  Example:  I just saw a spam come through that scored 9.9,