Fix for RDJ update issue

2006-10-19 Thread Bowie Bailey
After the domain went back to normal, I continued to have a problem with RDJ. It still reported lint errors. The problem was that the RulesDuJour directory had become corrupted with the temporary page that had been downloaded during the outage. The fix was to simply delete the contents of the

RE: No DNS resolution for URIDNSBL

2006-10-20 Thread Bowie Bailey
David Berten wrote: I am trying to use URIDNSBL but can not get DNS resolution SpamAssassin 3.1.7 Output::: Net-DNS-0.59]# spamassassin -D dns --lint [22770] dbg: dns: is Net::DNS::Resolver available? yes [22770] dbg: dns: Net::DNS version: 0.59 [22770] dbg: dns: is DNS available? 0

RE: Custom scores -- how to..

2006-10-20 Thread Bowie Bailey
Debbie D wrote: Can someone please remind me how to create custom scores for existing rules?? I do not want to manually go in and change any particular score, any update will over ride that.. I want to manually change them to hit on a higher [or lower as the case might be] score. If memory

RE: Fix for RDJ update issue

2006-10-20 Thread Bowie Bailey
files. Because of this, the if-modified-since checks all returned false and the real rulesets didn't clobber the broken ones. Chris Bowie Bailey wrote: The fix was to simply delete the contents of the directory and try again. rm /etc/mail/spamassassin/RulesDuJour

RE: sa-update versus rulesdujour questions

2006-10-20 Thread Bowie Bailey
Bret Miller wrote: Theo Van Dinter wrote: FWIW, it happens to be the official tool since no one ever submitted RDJ to be the official tool, so we had to write our own. I would have offered, had I known there was any interest. Chris T. I'm glad it isn't the official tool

RE: scoring spam

2006-10-20 Thread Bowie Bailey
R Lists06 wrote: I am sorry if I am asking this question and it is answered in the archives. I will try to go back and read those past posts but is there a site where I can download the SARE stock rules and the plugins? I am aware of Rules Du Jour but whenever I have attempted to

Re: SA on outgoing SMTP

2010-02-16 Thread Bowie Bailey
Alexandre Chapellon wrote: Le mardi 16 février 2010 à 20:29 +, Martin Gregorie a écrit : Obvious choices for (4), in order of hitting the infected user with a successively bigger clue stick, are: - silently discard the spam, but you'll also throw away false positives. Using

Re: Most hilarious spam ever

2010-02-17 Thread Bowie Bailey
Igor Chudov wrote: This is a very funny spam, takes the title of dumbest spam of Feb 2010. http://igor.chudov.com/tmp/spam010.txt The person who sent it, probably thinks that he is the best phister in the world. i The sad thing is that some people are going to fall for this...

Re: T_FROM_MISSPACED score

2010-02-22 Thread Bowie Bailey
RW wrote: On Mon, 22 Feb 2010 08:05:10 -0800 (PST) John Hardin jhar...@impsec.org wrote: On Mon, 22 Feb 2010, RW wrote: Why does T_FROM_MISSPACED score 0.0, when it's score isn't defined? Rounding. The actual defined score is 0.01, so it rounds down when reported.

Re: RetrunPath and Bayes Poisoning

2010-02-23 Thread Bowie Bailey
Michael Scheidell wrote: On 2/23/10 9:03 AM, Jason Bertoch wrote: Are there any internal checks that disable Bayes autolearn when these artificial whitelist rules match? I'd disabled these rules in versions prior to 3.3.0 but, with all the discussion on the matter, I thought I'd leave them

Re: RetrunPath and Bayes Poisoning

2010-02-23 Thread Bowie Bailey
Michael Scheidell wrote: On 2/23/10 9:28 AM, Bowie Bailey wrote: Michael Scheidell wrote: On 2/23/10 9:03 AM, Jason Bertoch wrote: Are there any internal checks that disable Bayes autolearn when these artificial whitelist rules match? I'd disabled these rules in versions prior

Re: Off Topic - SPF - What a Disaster

2010-02-23 Thread Bowie Bailey
Jeff Koch wrote: In an effort to reduce spam further we tried implementing SPF enforcement. Within three days we turned it off. What we found was that: - domain owners are allowing SPF records to be added to their zone files without understanding the implications or that are just not correct

Re: Off Topic - SPF - What a Disaster

2010-02-24 Thread Bowie Bailey
Matus UHLAR - fantomas wrote: On 23.02.10 16:17, Bowie Bailey wrote: SPF enforcement at the MTA is useless for the reasons you specified. The only exception is if you have a strict SPF policy for your own domain, you can use it to reject spam pretending to be from your users

Re: DNSWL --report plugin

2010-03-01 Thread Bowie Bailey
Michael Scheidell wrote: On 3/1/10 10:31 AM, dar...@chaosreigns.com wrote: You must create an account here to use this: http://www.dnswl.org/registerreporter.pl I did, thanks, using the manual reported. you need some way to exclude the reporters ip address. (i just reported a spam

Re: Block Spammers Spoofing My Domain

2010-03-01 Thread Bowie Bailey
Carlos Williams wrote: Bill - I got my example from Ralph Hildebrandt's Postfix config directly from his site: http://www.arschkrebs.de/postfix/#chapter5 Respectfully it's 3 years old but he does have it the exact way I do: /^localhost$/ 550 Don't use my own domain

Re: About Training ( sa-learn )

2010-03-04 Thread Bowie Bailey
Henrique Fernandes wrote: Nops, i wnat that after i trained, the same email, should get a higher score cause the spamassassin was trained that is a spam, so when it comes again , it should look in the database and add some extra point on the score right ? That is a fairly common

Re: About Training ( sa-learn )

2010-03-04 Thread Bowie Bailey
(Please send replies to the list) Henrique Fernandes wrote: On Thu, Mar 4, 2010 at 2:22 PM, Bowie Bailey bowie_bai...@buc.com mailto:bowie_bai...@buc.com wrote: Henrique Fernandes wrote: Nops, i wnat that after i trained, the same email, should get a higher score cause

Re: About Training ( sa-learn )

2010-03-04 Thread Bowie Bailey
Henrique Fernandes wrote: Thanks! I will discuss here and find out with one is better. What are the weight of the bayser score after they well trained ? Have any ideas about it ? I'm not sure what you are asking. What do you mean by weight? The default scores (as of 3.2.5) are: BAYES_00

Re: About Training ( sa-learn )

2010-03-04 Thread Bowie Bailey
Right. Henrique Fernandes wrote: It was wht i asked, sorry i am not fluent in english It is the score that the bayes add to the final scores right ? []'sf.rique On Thu, Mar 4, 2010 at 4:36 PM, Bowie Bailey bowie_bai...@buc.com mailto:bowie_bai...@buc.com wrote: Henrique Fernandes

Re: SA Skipped Message

2010-03-05 Thread Bowie Bailey
Carlos Mennens wrote: I noticed someone sent me an email and there are no SA heading info in the message. SA didn't provide a score or status on the message headers for some weird reason. I then checked my mail logs and saw this message: Mar 5 08:52:18 mail spamc[2635]: skipped message,

Re: user_prefs not recognized?

2010-03-05 Thread Bowie Bailey
Ron Johnson wrote: My wife and I don't need to white-list the same people. But if it simplifies the configuration, is there any harm in having everything on a global whitelist? How often are you likely to receive spam from someone your wife wanted whitelisted? -- Bowie

Re: How to find where email server has been blacklisted

2010-03-08 Thread Bowie Bailey
Rops wrote: How to find out if some mail server is blacklisted and where? Is there any central database for queries from all different blacklists? Also IP based search is required and data when and why. I've been using this one: http://www.mxtoolbox.com/blacklists.aspx I'm not sure what

Re: Spanish/Brazilian/Mexican spam

2010-03-08 Thread Bowie Bailey
Martin Gregorie wrote: On Mon, 2010-03-08 at 14:56 -0500, Charles Gregory wrote: Can anyone take a look at this crud and see a header or flag/type that I could score in SA? I can't see anything immediately apart from the rather wackamoleish track of scoring the hidden URL in the

Re: A possibly suspect idea

2010-03-12 Thread Bowie Bailey
Martin Gregorie wrote: On Fri, 2010-03-12 at 08:15 +0200, Henrik K wrote: Why don't you simply maintain your wordlists in some files and use a script to generate portmanteau.cf? You could use Regexp::Assemble module to optimize also. Who cares what the actual rules look like? The more

Re: A possibly suspect idea

2010-03-12 Thread Bowie Bailey
Martin Gregorie wrote: On Fri, 2010-03-12 at 16:27 +0200, Henrik K wrote: If you have enough words to require multiple REs, then sorting doesn't hurt. So the start boundaries for a single RE to catch on are minimized. OK, so there are benefits if every alternate in a regex starts

Re: What happened to SOUGHT rules' server?

2010-03-16 Thread Bowie Bailey
j wrote: I've been having the same problem from several locations/ISPs, since mid-Saturday. 500 Can't connect to yerp.org:80 (connect: timeout) Dave Anyone figure this out? I have received the same yerp.org down errors and it's screwing up my SA royally. I guess this is what we

Re: bayes, numbers of tokens and performance

2010-03-18 Thread Bowie Bailey
tonjg wrote: Kai Schaetzl wrote: So, how many tokens do you have in your db now? I hope this command gives the correct answer... # sa-learn --dump magic 0.000 0 3 0 non-token data: bayes db version 0.000 0514 0 non-token data:

Re: bayes, numbers of tokens and performance

2010-03-18 Thread Bowie Bailey
tonjg wrote: Yet Another Ninja wrote: Did you also install the plugins? These two are not delivered with SA. I thought they were. In my system I've got: /var/lib/spamassassin/3.002005/updates_spamassassin_org/25_razor2.cf /usr/share/spamassassin/25_razor2.cf and

Re: Sa-update

2010-03-19 Thread Bowie Bailey
Kaleb Hosie wrote: I've just finished updating my production server to SpamAssassin 3.3.0 and I immediately ran sa-update to get the latest rule set for SpamAssassin. Is there a way to tell whether sa-update downloaded the latest definitions correctly? A user has just emailed me with some

Re: Limit SA to scan messages 100k and below

2010-03-31 Thread Bowie Bailey
Keith De Souza wrote: I'm trying to understand why is it taking 300.0 seconds to scan a message only 24Kb in size?? I'm begeining to think that because SA is taking so long to scan the message, it is timing out and hence Exim returning a temporarily reject after DATA. My thoughs so far is

Re: Domain specific configuration files??

2010-04-06 Thread Bowie Bailey
martinmcnally wrote: Is it possible to have domain specific configuration files for spamassassin? I am using spamd and would like to set a different required_score for my different domains for example. example1.com required_score 6.0 example2.com required_score 8.0 Anyone know if this is

Re: Domain specific configuration files??

2010-04-07 Thread Bowie Bailey
I think you intended this for the list. Rajesh M wrote: hi there is a work around for this if you standard score is say : 5.0 you can write a header rule to allocate a positive or negative score if the to field contains the specific domain example required_score 5 header header1 To

Re: AWL

2010-04-09 Thread Bowie Bailey
Dennis B. Hopp wrote: I have AWL enabled and it seems to be ok with helping out legitimate senders that occasionally send a spammy type message, but lately I have seen an increase where AWL is adding a negative score to a very blatant spam. So my questions are, do people feel AWL is worth

Re: How do I filter out phishing email?

2010-04-14 Thread Bowie Bailey
yongke wrote: Hi guys Is there anyway to filter out phishing emails using spam assassin? My current test email wasn't blocked and SA had a score 0f 0: [ Wire transfer scam email ] This is a fairly innocuous email. There is not much there to key on. You could try adding rules for things

Re: dcc: [26896] terminated: exit 241

2010-04-16 Thread Bowie Bailey
Micah Anderson wrote: This is version '1.2.74-4' from Debian... but now looking closer, it seems as if dcc was removed after Debian Etch. It seems that it was removed because the upstream authors changed its license to non-free (according to Debian's DFSG) in version 1.30. This also means that

Re: What happens to a rule file when removed from sa-update channels

2010-04-20 Thread Bowie Bailey
Jari Fredriksson wrote: 90_2tld.cf has been replaced by the official rule file 20_aux_tlds.cf. I have this in my channels.txt that I use with sa-update. Is it enough to remove the channel, and the rule file disappears on next sa-update, or does the old remnant keep on ghosting on the system

Re: checking and processing scores different

2010-04-21 Thread Bowie Bailey
Raphael Bauduin wrote: Hi, I'm trying to help someone using Exim with the Debian packaged spamassassin 3.2.5-2 and sa-exim 4.2.1-11 I've looked for information on how a mail is processed precisely but didn't find any explanation of the following. In the spamd logs, I see that each mail is

Re: bypass spam check if SPF is OK

2010-04-22 Thread Bowie Bailey
Rejaine Monteiro wrote: Sorry if I was not very clear (my english is a little poor) in fact, I wanted to decrease the score obtained if SPF return OK Probably not a good idea. The last set of stats that I saw indicated that SPF_PASS was more likely to occur in spam than in ham. This is why

Re: SA-3.2 need help

2010-04-22 Thread Bowie Bailey
Tux Techie wrote: hi, I'm new to linux and Need help in configuring spamassassin on my mail server,I'm using spamassassin-3.2.4-1.el4.1 on CentOS4 with sendmail-8.13.1-3.3.el4 This is my local.cf http://local.cf/ bayes_ignore_header X-Spam-Flag

Re: SA-3.2 need help

2010-04-23 Thread Bowie Bailey
Tux Techie wrote: I've inserted score FH_DATE_PAST_20XX 0 without the quotes to the end of your local.cf http://local.cf file to disable the rule for 2010 bug. You need to double-check this entry and then restart spamd since the rule is still hitting on all of the examples you gave. If

Re: SA-3.2 need help

2010-04-26 Thread Bowie Bailey
Anshul Chauhan wrote: This rule is in my /etc/mail/spamassassin/local.cf http://local.cf as FH_DATE_PAST_20XX 0 and in /var/lib/spmassassin//3.002004/updates_spamassassin_org as #score FH_DATE_PAST_20XX 2.075 3.384 3.554 3.188 # n=2 i've commented the line in /var/lib/spamassassin. How

Re: spamc output

2010-04-27 Thread Bowie Bailey
Christian Gregoire wrote: Hi, Using SA v3.3.1 spamc command-line client : the message analyzed being either spam or ham, can I have the message left untouched except for the X-Spam headers ? For example, in case of a spam message, I'd like to have: From: Test t...@example.com To:

Re: spamd[18549]: config: failed to parse line, skipping, in /etc/mail/spamassassin/local.cf: use_auto_whitelist 1

2010-04-28 Thread Bowie Bailey
ram wrote: /usr/bin/spamd -V SpamAssassin Server version 3.3.1 running on Perl 5.8.8 with SSL support (IO::Socket::SSL 1.01) with zlib support (Compress::Zlib 1.42) On Wed, Apr 28, 2010 at 12:14 PM, Jari Fredriksson ja...@iki.fi mailto:ja...@iki.fi wrote: On 28.4.2010 9:10,

Re: Auto Learn Spam

2010-04-28 Thread Bowie Bailey
Carlos Mennens wrote: On Wed, Apr 28, 2010 at 12:10 PM, Dennis B. Hopp dh...@coreps.com wrote: Autolearn kicks in at certain scores. I believe the default is 12.0 for spam and 0.1 for ham. You can customize those settings in your local.cf file. bayes_auto_learn 1

Re: How many Froms?

2010-04-28 Thread Bowie Bailey
David B Funk wrote: On Wed, 28 Apr 2010, Frank Heydlauf wrote: Hi, On Wed, Apr 28, 2010 at 08:05:27PM +0100, Martin Gregorie wrote: [snip..] Or could I just use a rule like: header From =~ /\...@.*\@/ This regex matches i.e. From: u...@example.com

Re: spamd[18549]: config: failed to parse line, skipping, in /etc/mail/spamassassin/local.cf: use_auto_whitelist 1

2010-05-05 Thread Bowie Bailey
ram wrote: i still see this errors May 5 10:28:03.484 [3153] dbg: config: warning: score set for non-existent rule SHORTCIRCUIT May 5 10:28:03.485 [3153] dbg: config: warning: score set for non-existent rule SUBJ_RE_NUM May 5 10:28:03.485 [3153] dbg: config: warning: score set for

Re: spamd[18549]: config: failed to parse line, skipping, in /etc/mail/spamassassin/local.cf: use_auto_whitelist 1

2010-05-10 Thread Bowie Bailey
ram wrote: On Wed, May 5, 2010 at 6:49 PM, Bowie Bailey bowie_bai...@buc.com mailto:bowie_bai...@buc.com wrote: ram wrote: i still see this errors May 5 10:28:03.484 [3153] dbg: config: warning: score set for non-existent rule SHORTCIRCUIT May 5 10

Re: Setting negative pontuation can cause false positives?

2010-05-10 Thread Bowie Bailey
Lauro Costa G. Borges wrote: I configured some addresses to be -9.0 or even -20.0 on Amavis (there were some addresses with -3.0, from default config on Ubuntu), does that make it possible that SpamAssassin will mark some emails with a pontuation higher than they should be, or were in the

Re: remmonded max children settings

2010-05-21 Thread Bowie Bailey
Jean-Paul Natola wrote: Hi all, I am constantly getting the server reached --max children setting entries in my log I started with 10 max children and have been raising it by 2. I am now at 40 , but still getting the messages (though not as often) how high can I go given these

Re: remmonded max children settings

2010-05-21 Thread Bowie Bailey
Jean-Paul Natola wrote: Just accept the fact that mail gets into a queue when using processes like SA. If outgoing spam is not a concern, set your system so that outbound mail is not passed thru SA. I actually only use the exim/sa as incoming filter, I do not send through it. The

Re: protocol is caSE sensitive, but should not be

2010-05-26 Thread Bowie Bailey
Benny Pedersen wrote: On Tue 25 May 2010 10:01:12 PM CEST, Benny Pedersen wrote # save rule as 99_local_bugs_331.cf # SA = 3.3.1 if (version == 3.003001) uri __PROTOCOL_OK m{^https?://\w+} meta PROTOCOL_FIX (!__PROTOCOL_OK) describe PROTOCOL_FIX protocol in uri is not lowercase

Re: Sa-learn huh

2010-06-02 Thread Bowie Bailey
Randy Ramsdell wrote: IIRC, when I sent messages through sa-learn on the old mail server as spam, then checking with spamassassin debug, this would show a 3.5 BAYES score. I will double check this, but I would hope to at least add a positive score when training a spam message. Training a

Re: spam assassin custom rule sets

2010-06-04 Thread Bowie Bailey
aquero wrote: Hi, When i checked the third party softwares for spam-assassin i found many custom rule sets. Do I have to install these rule sets manually? If I perform sa-update, will it will include all these rule sets into my spam-assassin rules list? Before you start adding a bunch of

Re: spam assassin custom rule sets

2010-06-07 Thread Bowie Bailey
aquero wrote: Bowie Bailey wrote: aquero wrote: Hi, When i checked the third party softwares for spam-assassin i found many custom rule sets. Do I have to install these rule sets manually? If I perform sa-update, will it will include all these rule sets into my spam-assassin

Rule overlap

2010-06-09 Thread Bowie Bailey
I was looking at the hits on a drug spam and I noticed these two: * 1.1 NO_PRESCRIPTION BODY: No prescription needed * 1.5 FB_NO_SCRIP_NEEDED BODY: Phrase: no prescription needed. The rules themselves are very similar. Should these two be combined? -- Bowie

Suggested scores for iXhash

2010-06-09 Thread Bowie Bailey
I just noticed the new version of iXhash (from over a year ago). The config file in this version has all of the scores set to 0.1. I can't copy my old scores over because I have no idea how (or if) the new domains map to the old ones. Are there a set of recommended scores for this rule set?

Re: Rule overlap

2010-06-10 Thread Bowie Bailey
Ned Slider wrote: On 06/10/2010 10:45 AM, Matus UHLAR - fantomas wrote: On 09.06.10 10:10, Bowie Bailey wrote: I was looking at the hits on a drug spam and I noticed these two: * 1.1 NO_PRESCRIPTION BODY: No prescription needed * 1.5 FB_NO_SCRIP_NEEDED BODY: Phrase: no prescription needed

Re: perl experts - \1 better written as $1 ?

2010-06-10 Thread Bowie Bailey
Per Jessen wrote: I have a bit of SA code where I strip leading and trailing whitespace - foreach (@addrs) { s/^\s*([^\s]+)\s*$/\1/; } Whenever I run this I get the warning \1 better written as $1 which I understand to be perl telling me that the right side of s/// should use $digit, not

Re: regex for short messages

2010-06-14 Thread Bowie Bailey
Daniel Lemke wrote: Hi, I want to check some mails for their char count (will be part of a meta rule) but spamassassin does hit the rule, even if the mail has less chars than defined in regex. The regex was tested in Perl and was working fine, so what did I miss? body

Re: regex for short messages

2010-06-14 Thread Bowie Bailey
Bowie Bailey wrote: Daniel Lemke wrote: Hi, I want to check some mails for their char count (will be part of a meta rule) but spamassassin does hit the rule, even if the mail has less chars than defined in regex. The regex was tested in Perl and was working fine, so what did I miss

Re: unable to find logic behind spamassassin rule

2010-06-21 Thread Bowie Bailey
Michael Scheidell wrote: On 6/21/10 3:25 PM, Sharma, Ashish wrote: Hi, I have the latest version of spamassassin, I am unable to find the logic behind the following rule and it's high spam score. MANY_SPAN_IN_TEXT 3.099 Can anybody give a reason? grep MANY_SPAN_IN_TEXT *

Re: header To =~ question

2010-06-22 Thread Bowie Bailey
David Michaels wrote: I don't mean to be stupid.. and I know that this should be done with sieve but.. Is there a obvious reason this doesn't work? I think it's the To thats messing up.. header __GK__PHARMS_01 To =~ micha...@ucrwcu.rwc.uc.edu header __GK__PHARMS_02 Subject =~

Re: header To =~ question

2010-06-22 Thread Bowie Bailey
David Michaels wrote: I'm still not matching it the rule is a derivative of this other that does work for me.. header __GK_CANA_PHARMS_01 Subject =~ /DISCOUNT|GOOD|CANADA|FREE|ONLINE|SALE|STORE|BEST|USA|Product|BUY/i header __GK_CANA_PHARMS_02 Subject =~ /PHARMA|cialis|MEDICAL/i meta

Re: regex for short messages

2010-06-28 Thread Bowie Bailey
Daniel Lemke wrote: Hmm, I've just noticed that my rule is working fine for simple text messages, but is also been triggered when checking mails containing html (http://pastebin.com/xB7SKnFV). rawbody T__SHORT_MAIL /\A.{0,150}\z/s -D reports: Jun 28 13:32:40.961 [4200] dbg: rules:

Re: FPs on FH_FAKE_RCVD_LINE_B

2010-06-29 Thread Bowie Bailey
Mike Grau wrote: Hello, I'm getting a lot of FPs from FH_FAKE_RCVD_LINE_B RCVD line looks faked (B) since the default score for this rule is a whopping 4.000. It's matching on this header: Received: from 68.103.178.110 by webmail.east.cox.net; Mon, 28 Jun 2010 18:02:23 -0400 This rule

Re: Flagged as spam but accepted

2010-07-08 Thread Bowie Bailey
On 7/8/2010 10:52 AM, Adam Moffett wrote: 2010-07-08 09:05:01 1OWqmi-0005N3-JU /*SA: Action: flagged as Spam but accepted: score=4.0 required=4.0 */(scanned in 0/0 secs | Message-Id: 20100708130436.52c7d1cb1...@mail.microton.com.br). From care...@habitat.com (host=NULL [189.26.124.122]) for

Re: First run score: 25.7 Second: 2.6

2010-07-14 Thread Bowie Bailey
On 7/14/2010 8:42 AM, Emin Akbulut wrote: I run SA Win32 port 3.3.1 by JAM Software on Windows Server 2008 64 bit. Spamassassin.exe always calculates the same score, coz User_Prefs file is under my docs (C:\Users\ea\.spamassassin) However spamd.exe -which runs as service- calculates the

Re: disable trusted_networks and internal_networks

2010-07-20 Thread Bowie Bailey
On 7/19/2010 8:23 PM, Matt Kettler wrote: On 7/16/2010 2:31 PM, Cliff Hayes wrote: Hello, Our webmail server is on the same server as sendmail and spamassassin. I would like to filter outbound webmail but can't because the most recent versions of spamassassin have 127.0.0.1 trusted by

Re: SA scan internal to external / internal to internal

2010-07-26 Thread Bowie Bailey
On 7/24/2010 10:35 AM, Suhag P Desai wrote: Hi Mailing List users, This is my first message in this mail community and I am evaluating SA very first time. I have few question in my mind regarding working of SA. I gone through a FAQ and some documentation from official SA websites.

Re: Bayes classifier

2010-07-26 Thread Bowie Bailey
On 7/26/2010 5:58 AM, andrij wrote: Hi all, I am new to spamassassin and bayes classifier. I have several questions and I will greatly appreciate your help with that. 1) Training of the bayes classifier with _multipart_ e-mails (e.g., an e-mail contains other e-mails within its body). If I

Re: Bayes classifier

2010-07-26 Thread Bowie Bailey
On 7/26/2010 10:12 AM, andrij wrote: 2) Evaluating whether an email is spam or not. Again, if I set bayes_ignore_header Some-header, will the bayes classifier ignore the header while evaluating an e-mail? Yes. That's what it's for. So, the bayes clasifier will ignore Some-header in both

Re: SA scan internal to external / internal to internal

2010-07-26 Thread Bowie Bailey
problem. I am not sure whethere my SA is working. If I want to scan internal-to-internal / internal to external, what changes to be done in my configuration. ? Thanks, -Original Message- From: Bowie Bailey [mailto:bowie_bai...@buc.com] Sent: Monday, July 26, 2010 7:09 PM To: users

Re: Bayes classifier

2010-07-26 Thread Bowie Bailey
On 7/26/2010 2:46 PM, andrij wrote: Bowie Bailey wrote: 3) Evaluating whether an email is spam or not. Does the bayes classifier analyze headers if I have, for example, the following rule: body BAYES_05 eval:check_bayes('0.00', '0.05'). According to the http://wiki.apache.org/spamassassin

Re: How to run only certain tests?

2010-07-30 Thread Bowie Bailey
On 7/30/2010 10:58 AM, Adam Moskowitz wrote: Background: SpamAssassin version 3.2.5 running on Perl version 5.8.8 on CentOS release 5.2 (Final) -- all set up for me by my sysadmin. Everything works fine when using all the defaults. However . . . I want to use spamassassin's per-user

Re: How to run only certain tests?

2010-07-30 Thread Bowie Bailey
On 7/30/2010 12:14 PM, Adam Moskowitz wrote: Earlier today, I wrote: I want to use spamassassin's per-user whitelisting as part of some mail processing I'm doing. . . . spamassassin takes a long time to load and run . . . Can I arrange to load/run only the tests I need? If so, how? Sorry,

Re: sa-compile has no effect (under Windows.......)

2010-07-30 Thread Bowie Bailey
On 7/30/2010 3:08 PM, Emin Akbulut wrote: Simply disable regular ruleset and test again. If it takes 6.93-5.78 seconds or something similar, you are right. I'm actually having the same issue on my new home server. I set up SA and got it working. Then I ran sa-compile, enabled the plugin in

Re: sa-compile has no effect (under Windows.......)

2010-07-30 Thread Bowie Bailey
On 7/30/2010 3:26 PM, Bowie Bailey wrote: On 7/30/2010 3:08 PM, Emin Akbulut wrote: Simply disable regular ruleset and test again. If it takes 6.93-5.78 seconds or something similar, you are right. I'm actually having the same issue on my new home server. I set up SA and got it working

Re: Text contained in HTML comments causing BAYES_00 to classify as non-spam

2010-08-04 Thread Bowie Bailey
On 8/4/2010 4:23 AM, Happy Chap wrote: Hi, We started getting (over the last 2 months say) lots of spam, which Spamassassin isn't picking up as spam. Analysing these, they all seem to be of the same type where many paragraphs of random text are hidden inside an HTML comment (either

Re: Text contained in HTML comments causing BAYES_00 to classify as non-spam

2010-08-04 Thread Bowie Bailey
On 8/4/2010 4:24 PM, Happy Chap wrote: Bowie Bailey wrote: On 8/4/2010 4:23 AM, Happy Chap wrote: You ARE manually training bayes (sa-learn) on these missed spams, right? That is probably the most useful thing you can do if you are getting Bayes_00 on them. Hi Bowie, oh yes, every night

Re: Text contained in HTML comments causing BAYES_00 to classify as non-spam

2010-08-05 Thread Bowie Bailey
On 8/4/2010 6:07 PM, Happy Chap wrote: No, we're not using an SQL backend and every users has their own bayes database. You mentioned previously that you are using 'sa-learn -u'. I thought that option only worked with SQL databases? In my setup, I have lots of virtual users under the same

Re: Calling SpamAssassin from a Perl Web Form

2010-08-05 Thread Bowie Bailey
On 8/5/2010 5:58 AM, Mike Tonks wrote: Hi folks, I'm looking into hooking the Mail::SpamAssassin module into a perl processor for a couple of web forms - contact us, comments form, and publish an article form (open publishing). The main barrier seems to be the need for a message format

Re: List of banned words/bounce to sender

2010-08-05 Thread Bowie Bailey
On 8/5/2010 2:11 PM, Matthew Kitchin (public/usenet) wrote: Amavisd could reject the mail. I was planning on using Spamassassin (with a custom built rule) to examine the email for the names. We would only use the names of our patients. The names would be dumped out of our patient DB every

Re: List of banned words/bounce to sender

2010-08-05 Thread Bowie Bailey
On 8/5/2010 3:00 PM, Matthew Kitchin (public/usenet) wrote: On 8/5/2010 1:52 PM, Bowie Bailey wrote: My approach to doing something like this would be to have a rule that matches the names (however you implement it), and then have the MTA check for that particular rule hit and bounce

Re: Local rules trigger bug

2010-08-06 Thread Bowie Bailey
On 8/6/2010 12:18 PM, Randy Ramsdell wrote: Ralf Hildebrandt wrote: * Randy Ramsdell rramsd...@activedg.com: I found an bug in spamassassin that can be reliably reproduced when using our local rules. What would be interesting is to track down where this bug is exactly. 1. The process

JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
I was looking through some of the spam rules, and I noticed that the JM_SOUGHT_FRAUD rules are included in the main SA updates channel for SA 3.3.1, but the scores are all 0. Is there a reason for this? The rules from the sought channel have scores, but they are being overridden by the main

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
On 8/11/2010 11:46 AM, Karsten Bräckelmann wrote: On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote: I was looking through some of the spam rules, and I noticed that the JM_SOUGHT_FRAUD rules are included in the main SA updates channel for SA 3.3.1, but the scores are all 0

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
On 8/11/2010 12:17 PM, Karsten Bräckelmann wrote: On Wed, 2010-08-11 at 11:57 -0400, Bowie Bailey wrote: On 8/11/2010 11:46 AM, Karsten Bräckelmann wrote: On Wed, 2010-08-11 at 10:59 -0400, Bowie Bailey wrote: I was looking through some of the spam rules, and I noticed

Re: JM_SOUGHT_FRAUD

2010-08-11 Thread Bowie Bailey
On 8/11/2010 3:30 PM, John Hardin wrote: On Wed, 11 Aug 2010, Bowie Bailey wrote: Right. And I'm checking for updates several times a day. If the updates channel is not keeping up with sought, I need to make sure I am running the rules from the dedicated channel and not the updates

Re: JM_SOUGHT_FRAUD

2010-08-12 Thread Bowie Bailey
On 8/11/2010 7:15 PM, John Hardin wrote: On Wed, 11 Aug 2010, Bowie Bailey wrote: In case anyone else is following this... The sa-update process made things a bit more complex than simply renaming the file after updates. If that's all you do, then sa-update loses track of the file

Re: Sought dedicated AND stock channel

2010-08-12 Thread Bowie Bailey
On 8/11/2010 6:15 PM, Karsten Bräckelmann wrote: The problem is, that not only the sub-rules change, but with them the actually scored meta rules, combining these sub-rules by OR-ing them. That means, stale meta rules in stock will override the fresh meta rules, effectively discarding all

Re: Fw: Spamassassion for each site

2010-08-12 Thread Bowie Bailey
On 8/11/2010 10:32 PM, nonlin wrote: Well I am not out of the Dog House yet. So, by some miracle I was able to get yum to work and was able to use it to update Spamassassion. I was so happy because this was the safest way to do this. But yum didn't have ver 3.3 available so I was able to

Re: SpamAssassin sa-learn issue

2010-08-12 Thread Bowie Bailey
On 8/12/2010 8:49 AM, Tim Thorburn wrote: Hello, I've run into an issue with a mailbox where large amounts of spam are making their way through filters. The majority of these spam messages receive SA scores of 0.3-1.6; for obvious reasons I cannot adjust the filter sensitivity this

Re: Sought dedicated AND stock channel

2010-08-12 Thread Bowie Bailey
. Or, well, any SA or channel provided method, to tweak the order. SA method would be a new feature. Channel method would be a rename, to come last in alphabetical order. Bummer. :( This is a real problem and worth filing a bug. On 12.08.10 09:13, Bowie Bailey wrote: Would it be a reasonable

Re: Fw: Spamassassion for each site

2010-08-12 Thread Bowie Bailey
/spamassassin/RuleUpdates#Using_sa-update - Original Message - From: Bowie Bailey bowie_bai...@buc.com To: users@spamassassin.apache.org Sent: Thursday, August 12, 2010 9:16 AM Subject: Re: Fw: Spamassassion for each site On 8/11/2010 10:32 PM, nonlin wrote: Well I am not out of the Dog House

Re: Fw: Fw: Spamassassion for each site

2010-08-13 Thread Bowie Bailey
On 8/12/2010 7:37 PM, nonlin wrote: Dear friends, I don't mean to be condescending but it look like no one is really reading my posts. I had run sa-update, /var/lib/spamassassin/3.002004 owner is root and I ran sa-update as root. and it looked like it updated. and I just ran it again now

Re: Spamassassion for each site

2010-08-16 Thread Bowie Bailey
On 8/13/2010 8:47 PM, nonlin wrote: Dear all, Thank you all for your assistance. After all the fuss I have been making, I forgot the one rule that I have learned from dealing with electrics, always check your equipment before you use it!. since I was the admin I use outlook express to

Re: controlling channel order (Was: JM_SOUGHT_FRAUD)

2010-08-16 Thread Bowie Bailey
On 8/14/2010 5:51 PM, mouss wrote: Le 12/08/2010 00:37, Karsten Bräckelmann a écrit : On Wed, 2010-08-11 at 17:30 -0400, Bowie Bailey wrote: In case anyone else is following this... The sa-update process made things a bit more complex than simply renaming the file after updates. If that's

Re: Optional argument in regex

2010-08-16 Thread Bowie Bailey
On 8/16/2010 7:00 AM, Mynabbler wrote: I think everybody and their dog made a ruleset regarding 'your email address has won'. Something like: MN_YEAHRIGHT /\bYour (?:email|e-mail) (?:address|account) (?:has won|just won you)\b/ How do you make the second argument optional? So it also hits

Re: short pharma spam shoots straight through

2010-08-16 Thread Bowie Bailey
On 8/16/2010 4:05 PM, Jason Haar wrote: Hi there For the past few weeks we've experienced a large increase in missed spam. It's Pharma-related, one sentence plus a link. The interesting features are: * every Subject line is different. They're aren't Bayes-busters either - all Pharma

Re: two SA folders and sa-updates

2010-08-19 Thread Bowie Bailey
C. Bensend wrote: Then you haven't been getting the regular updates. If you don't have updates.spamassassin.org in your --channelfile, it won't check it... No, I stand corrected, sorry for the misinformation. At the very top of the file (they had scrolled out of my term), I have:

<    1   2   3   4   5   6   7   8   9   10   >