Re: Custom rule in local.cf

2011-09-06 Thread J4K
On 09/06/2011 10:58 AM, Axb wrote: On 2011-09-06 10:43, J4K wrote: Hi, I know that this is probably the hundredth time I have emailed to the list about my custom rules. Usually, someone points out the blindingly obvious when I fail to note it. This has been going on for months. I'll

Re: Custom rule in local.cf

2011-09-06 Thread J4K
On 09/06/2011 12:07 PM, Axb wrote: On 2011-09-06 12:03, J4K wrote: On 09/06/2011 10:58 AM, Axb wrote: On 2011-09-06 10:43, J4K wrote: Hi, I know that this is probably the hundredth time I have emailed to the list about my custom rules. Usually, someone points out the blindingly

Quicky custom rule in local.cf question - dbg: rules: PRIVATE_PHONICA2 merged duplicates: PRIVATE_RULE1

2011-09-01 Thread J4K
Hi there, I've got these two rules in the local.cf. describe PRIVATE_RULE1 English language job opportunity body __PR1/(Employment opportunity|Job offer match, respond to apply|Employment you've been searching|Job opportunity|Career opportunity inside|Position opening in your

Re: Quicky custom rule in local.cf question - dbg: rules: PRIVATE_PHONICA2 merged duplicates: PRIVATE_RULE1

2011-09-01 Thread J4K
On 09/01/2011 04:33 PM, John Wilcock wrote: Le 01/09/2011 16:23, J4K a écrit : meta PRIVATE_RULE1 (__PR1 __PR2) ... meta PRIVATE_PHONICA2 (__PR1 __PR2) Spamassassin -D -lint records this: Sep 1 15:45:56.313 [11484] dbg: rules: PRIVATE_PHONICA2 merged duplicates: PRIVATE_RULE1

[Q] Bayes dB: ratio of spam and ham heavily in favour of ham

2011-08-22 Thread J4K
Afternoon gentlemen, Seems the Bayes dB has become lop-sided in favour of ham. SA is doing its job as there is little spam coming through these recently. I had hoped we could keep it one third spam and two thirds spam. Does the slant shown below (nspam verses nham) cause any problems

Re: Self addressed spam

2011-08-10 Thread J4K
On 08/10/2011 12:08 PM, Marcin Mirosław wrote: W dniu 10.08.2011 12:00, akrohnke pisze: Hello, Currently one of our clients are getting spam that looks like it comes from the sender itself. Spamassassin only occasionally catches it. Hello! It should be done at smtp level. if (sender

malware.blocklist.cf : www.malware.com.br unavailable

2011-08-09 Thread J4K
Hi, I noticed that the site that provided the malware.blocklist.cf has been unavailable since at least the 8th of August. URL for the file was on http://www.malware.com.br/cgi/submit?action=list_sa The FQDN no longer resolves to an address. I have tried our local DNS, Level3 4.2.2.2 and

SOLVED Re: malware.blocklist.cf : www.malware.com.br unavailable

2011-08-09 Thread J4K
On 08/09/2011 10:50 AM, J4K wrote: Hi, I noticed that the site that provided the malware.blocklist.cf has been unavailable since at least the 8th of August. URL for the file was on http://www.malware.com.br/cgi/submit?action=list_sa The FQDN no longer resolves to an address. I have

[Q] Skip Bayes classification of emails with a certain From: address

2011-07-20 Thread J4K
Morning all, I had a route around in the SA dox, and in /usr/share/spamassassin/*.cf, to try and find out how to disable Bayes classification for particular From: address. In particular, I don't want Bayes to classify, or put into the database, messages from this mailing list. You can see

Re: improving the score for specific types of spam

2011-07-13 Thread J4K
On 07/13/2011 02:43 PM, Martin Gregorie wrote: On Wed, 2011-07-13 at 14:06 +0200, J4K wrote: I assume you tested it as well as running it through lint (spamassassin spam_sample.txt), so is it firing on samples of that type of spam? Comments: As written the rule won't work because __PR2

60_whitelist_spf.cf - whitelist SPF

2011-07-01 Thread J4K
Hi everyone, Is 60_whitelist_spf.cf the correct place to whitelist SPF for a sender? def_whitelist_from_spf *.junkemailfilter.com It looks correct as per http://spamassassin.apache.org/full/3.3.x/doc/Mail_SpamAssassin_Plugin_SPF.txt Also, I have added their delivery servers to the

Re: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/29/2011 09:55 PM, Lawrence @ Rogers wrote: On 29/06/2011 4:58 PM, JKL wrote: select count(spam_count) from bayes_vars Run this query SELECT username,spam_count,ham_count FROM bayes_vars This will give a list of usernames that have been used to learn ham and spam into SpamAssassin's

Re: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 11:09 AM, J4K wrote: On 06/29/2011 09:55 PM, Lawrence @ Rogers wrote: On 29/06/2011 4:58 PM, JKL wrote: select count(spam_count) from bayes_vars Run this query SELECT username,spam_count,ham_count FROM bayes_vars This will give a list of usernames that have been used to learn

Re: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 11:38 AM, Benny Pedersen wrote: On Thu, 30 Jun 2011 11:09:18 +0200, J4K wrote: loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody should not be in a cf file but in a pre file, check other pre files to enable it Thank-you. Moved this into v320.pre

Re: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 11:37 AM, J4K wrote: On 06/30/2011 11:09 AM, J4K wrote: On 06/29/2011 09:55 PM, Lawrence @ Rogers wrote: On 29/06/2011 4:58 PM, JKL wrote: select count(spam_count) from bayes_vars Run this query SELECT username,spam_count,ham_count FROM bayes_vars This will give a list

Now: Bayes with mysql Was: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 01:45 PM, J4K wrote: On 06/30/2011 11:37 AM, J4K wrote: On 06/30/2011 11:09 AM, J4K wrote: On 06/29/2011 09:55 PM, Lawrence @ Rogers wrote: On 29/06/2011 4:58 PM, JKL wrote: select count(spam_count) from bayes_vars Run this query SELECT username,spam_count,ham_count FROM

Re: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 01:45 PM, J4K wrote: On 06/30/2011 11:37 AM, J4K wrote: On 06/30/2011 11:09 AM, J4K wrote: On 06/29/2011 09:55 PM, Lawrence @ Rogers wrote: On 29/06/2011 4:58 PM, JKL wrote: select count(spam_count) from bayes_vars Run this query SELECT username,spam_count,ham_count FROM

Re: Bayes and mysql Was: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
[SNIP] Hi there, This is the table I have in mysql, and the one I intend to populate with data:- mysql describe bayes_vars; ++--+--+-+++ | Field | Type | Null | Key | Default| Extra |

Re: Bayes and mysql Was: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 05:27 PM, Axb wrote: spamassassin --lint -D bayes Hi Axb, Spamd runs as root. # spamassassin --lint -D bayes Jun 30 17:32:10.858 [2775] dbg: FuzzyOcr: focr_bin_helper: 'pnmnorm,pnminvert,ppmtopgm' Jun 30 17:32:10.858 [2775] info: FuzzyOcr: Adding 3 new helper apps Jun 30

Re: Bayes and mysql Was: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 05:54 PM, Axb wrote: ok.. you said Spamd runs as root. in that case: bayes_sql_override_username spamd then as per Bowie: sa-learn --username=spamd --ham /path/to/ham sa-learn --username=spamd --spam /path/to/spam then sa-learn --dump magic Ahh, I meant that spamd

Re: Bayes and mysql Was: [Q] Writing rule for career opportunity type messages

2011-06-30 Thread J4K
On 06/30/2011 06:02 PM, Axb wrote: Please only reply to the list... On 2011-06-30 18:00, J4K wrote: # sa-learn --username=spamd --ham .HAM/cur/ Learned tokens from 717 message(s) (764 message(s) examined) # sa-learn --username=spamd --spam .Junk/cur Learned tokens from 311 message(s) (368

[Q] Writing rule for career opportunity type messages

2011-06-29 Thread J4K
Dear all, Over the past few months I noticed an increase in 'Start New Employment Today | Career Opportunity' style email. The rules I use, that are pretty much stock rules, correctly tag the email as spam. Usually the Spam score hovers between 5.5 and 6.9. I would like to add a rule that adds

[Q] SA mis-configuration question: Empty dirs username being created in /var/mail

2011-03-11 Thread J4K
Dear everyone, I wonder if I have some misconfiguration in my SA set-up, and if someone would be able to send me off in the right direction, or has seen it before. As shown below, some messages are scanned by SA with just the user name, while others are scanned using the full login. Fri Mar

Re: Should Emails Have An Expiration Date

2011-03-01 Thread J4K
On 03/01/2011 04:13 PM, Jari Fredriksson wrote: On 1.3.2011 0:06, Matt wrote: Looking at top 8 newest messages from my personnel email account: [Spammy subjects deleted] None of them are SPAM. If I wanted to unsubscribe from them I would. Its just if I do not read them within 30 days why

[Q] Adjusting Rule Scores - Which file?

2011-02-17 Thread J4K
Hi, I am interested in raising the score for the rule RDNS_DYNAMIC. However, I cannot find it in any of the files under /etc/spamassassin. I thought that it would be listed somewhere in this directory. In which file is this located? * Why do I want to raise the bar for RDNS_DYNAMIC? I

Re: [Q] Adjusting Rule Scores - Which file?

2011-02-17 Thread J4K
On 02/17/2011 04:45 PM, John Hardin wrote: On Thu, 17 Feb 2011, J4K wrote: You do not want to alter the distributed files, as any alterations would be lost on the next upgrade. That rule doesn't appear in any of your local customization files (under /etc/spamassassin) because you've never

Re: [Q] Adjusting Rule Scores - Which file?

2011-02-17 Thread J4K
On 02/17/2011 05:33 PM, Bowie Bailey wrote: On 2/17/2011 10:51 AM, J4K wrote: On 02/17/2011 04:45 PM, John Hardin wrote: On Thu, 17 Feb 2011, J4K wrote: You do not want to alter the distributed files, as any alterations would be lost on the next upgrade. That rule doesn't appear in any

Re: Irony

2011-02-15 Thread J4K
Not a chance. Philip Prindeville philipp_s...@redfish-solutions.com wrote: On 2/7/11 1:28 AM, Matus UHLAR - fantomas wrote: On Tue, 1 Feb 2011 09:49:36 -0500 Michael Scheidellmichael.scheid...@secnap.com wrote: because HELO doesn't match RDNS. On 01.02.11 09:54, David F. Skoll wrote:

[Q] sa-compile: not compiling; 'spamassassin --lint' check failed!

2011-02-15 Thread J4K
Hi chaps, I added the FuzzyOCR (via Debian repos) into sa a few days ago, and finally got around to running sa-compile which looks like it fails. I tried with the -D option, but the verbosity was too great for me to make head nor tail of it. I don't know if this is FuzzyOCR or Where could

Re: [Q] sa-compile: not compiling; 'spamassassin --lint' check failed!

2011-02-15 Thread J4K
On 02/15/2011 02:19 PM, Lawrence @ Rogers wrote: On 15/02/2011 9:27 AM, J4K wrote: spamassassin --lint This may seem obvious, but did you run spamassassin --lint like sa-compile suggested? I assume DCC is probably not loaded, or disabled in your setup. Open up /etc/spamassassin/local.cf

Re: [Q] sa-compile: not compiling; 'spamassassin --lint' check failed!

2011-02-15 Thread J4K
On 02/15/2011 02:43 PM, Lawrence @ Rogers wrote: On 15/02/2011 10:07 AM, J4K wrote: Its pretty moot any way, because now after running spamassassin -lint, sa-compile still fails with the same error. Hi, Just because DCC is running doesn't mean SA is configured to use it. Can you post

Re: [Q] sa-compile: not compiling; 'spamassassin --lint' check failed!

2011-02-15 Thread J4K
On 02/15/2011 03:21 PM, Michael Scheidell wrote: On 2/15/11 8:46 AM, J4K wrote: use_dcc 1 dcc_path /usr/local/bin/dccproc dcc_home /var/dcc dcc_add_header 1 just like lint says, dcc_add_header is NOT valid. locate DCC.pm /usr/local/lib/perl5/site_perl/5.10.1/Mail/SpamAssassin/Plugin

X-IronPort-AV: E=Sophos;i=4.60,386,1291590000; d=scan'208;a=41500553

2011-01-28 Thread J4K
Good morning everyone (almost the week-end), Is X-IronPort-AV added by SA, or from something else (DCC Clamav ? ) I just noticed that all email from a certain company was flagged with X-IronPort-AV, and I wonder why this is so. I have searched on the usual engine, and saw refereces

Re: X-IronPort-AV: E=Sophos;i=4.60,386,1291590000; d=scan'208;a=41500553

2011-01-28 Thread J4K
On 01/28/2011 10:13 AM, Giles Coochey wrote: On 28/01/2011 10:11, Giles Coochey wrote: On 28/01/2011 10:02, J4K wrote: Good morning everyone (almost the week-end), Is X-IronPort-AV added by SA, or from something else (DCC Clamav ? ) I just noticed that all email from a certain

Re: spamhaus dbl considered safe for mta blocking?

2011-01-27 Thread J4K
On 01/27/2011 05:58 AM, Sahil Tandon wrote: On Sat, 2011-01-22 at 12:43:55 -0500, Michael Scheidell wrote: oh, and to be safe: reject_rhsbl_helo dbl.spamhaus.org=127.0.1.2, reject_rhsbl_client dbl.spamhaus.org=127.0.1,2, reject_rhsbl_sender dbl.spamhaus.org=127.0.1,2, Sound advice to

Re: score=100.0 required=3.0 tests=SHORTCIRCUIT,,USER_IN_BLACKLIST

2011-01-27 Thread J4K
On 01/27/2011 01:55 PM, Florescu, Dan Alexandru wrote: Fire up what? Correct me if I'm wrong, but as far as I know SA does not reject at SMTP session level. I myself am using it with amavis and I have: $sa_quarantine_cutoff_level = 12.0; which will drop any spammy message with that score or