Re: more efficent big scoring

2008-01-22 Thread Jim Maul
Justin Mason wrote: John D. Hardin writes: On Tue, 22 Jan 2008, George Georgalis wrote: On Sun, Jan 20, 2008 at 09:41:58AM -0800, John D. Hardin wrote: Neither am I. Another thing to consider is the fraction of defined rules that actually hit and affect the score is rather small. The

Re: [guinevere-discuss] Lint errors in 3.4

2007-12-18 Thread Jim Maul
Clay Davis wrote: I've see several people write this. Can someone point me to some debate I can review? It seems to me that if you set the autolearn threshold fairly high and keep any eye on your bayes scoring, it would be a good thing. Thanks, Clay Joe Zitnik [EMAIL PROTECTED] 12/18/2007

Re: spamassassin not starting - new install

2007-09-18 Thread Jim Maul
Michael Martinell wrote: My SpamAssassin is able to start – no idea why, whoever it does not appear to know what thresholds to use: *Received:* (qmail 25671 invoked by uid 1010); 18 Sep 2007 11:59:35 -0500 *Received:* from 64.233.182.188 by mail (envelope-from [EMAIL PROTECTED]

Re: R: And interesting way to detect spambots

2007-08-28 Thread Jim Maul
John D. Hardin wrote: On Tue, 28 Aug 2007, Giampaolo Tomassoni wrote: -Messaggio originale- Da: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Marc Perkel writes: Who finds this concept interesting? SPAM-L. This is OT for this list. Right, Justin, but I see that threads about general

Re: Detecting short-TTL domains?

2007-08-10 Thread Jim Maul
Stream Service || Mark Scholten wrote: For so far I know it isn't possible to have a TTL that is to low (if I may believe the RFC files). It is also impossible to have to many A-records. With both facts in mind I would suggest that you find an other method off detecting SPAM. Most SA rules

Re: Reject spam from my own domain

2007-07-31 Thread Jim Maul
NetComrade wrote: We have whitelisted our domain, but now we have spam coming from users that claim they're in our domain. What's the best way to fight it? You REALLY dont want to whitelist your own domain. Your seeing why right now. Use SPF? or perhaps a whitelist rule thats less prone

Re: How would you provide a 554 rejection notice for spam?

2007-07-30 Thread Jim Maul
Matus UHLAR - fantomas wrote: On 30.07.07 13:25, Spamassassin List wrote: Any idea for qmail? if you excuse a big of irony, I'd say: drop it. There are many better MTA's than qmail. There's imho much less worse solutions... According to who, you? He asked for a solution for qmail. If you

Re: Now its zip attachments ^^

2007-07-23 Thread Jim Maul
John Rudd wrote: Matus UHLAR - fantomas wrote: On 22.07.07 18:47, John Rudd wrote: As I've said for years: we should just ban attachments. They're not really useful for anything that can't be done a better way. Which only leaves them being useful for attacks of one form or another. some

Re: not everyone is happy with SA

2007-07-19 Thread Jim Maul
Per Jessen wrote: http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104STORY=/www/story/07-17-2007/0004626829EDATE= /Per Jessen, Zürich Thats retarded. Might as well say, Uplugging my mail server from the internet is the best method because I received 0 spam since I did it! Challenge

Re: Rulesemporium

2007-07-13 Thread Jim Maul
Theo Van Dinter wrote: On Fri, Jul 13, 2007 at 10:03:07AM -0700, John D. Hardin wrote: I'll bring this up again: coral. Is there some reason pointing everyone at the coral cache of the website won't work? Granted, coral is also intended for large files, but it is distributed and is almost

Re: Overriding Scores

2007-06-11 Thread Jim Maul
[EMAIL PROTECTED] wrote: Server .116 The email attached has been identified by one of our team as legitimate but unfortunately was incorrectly tagged as SPAM. The email address has been whitelisted to ensure this will not happen again and we are currently looking into the reasons why this

Re: 404 while getting RDJ updates?

2007-06-07 Thread Jim Maul
guenther wrote: On Thu, 2007-06-07 at 17:45 +0200, Anders Norrbring wrote: Anyone else getting 404 errors from RDJ lately? Yes, this topic came up just a few hours ago. Probably a dDOS attack. Please disable all RDJ till further notice. guenther I would imagine this is related to

Re: 404 while getting RDJ updates?

2007-06-07 Thread Jim Maul
Chris Santerre wrote: -Original Message- From: Jim Maul [mailto:[EMAIL PROTECTED] Sent: Thursday, June 07, 2007 12:02 PM To: users@spamassassin.apache.org Subject: Re: 404 while getting RDJ updates? guenther wrote: On Thu, 2007-06-07 at 17:45 +0200, Anders Norrbring

Re: bayes autolearn - nonspam threshold

2007-05-23 Thread Jim Maul
Duane Hill wrote: On Wed, 23 May 2007, Abba Communications wrote: Since the introduction of SA v3.2.0, bayes_auto_learn_threshold_nonspam appears to be -1.0. from Duane Duane and others With all sincere and due respect to the DEV's and their excellent hard work... I understand it

Re: Spam bounceback attack

2007-04-10 Thread Jim Maul
John D. Hardin wrote: On Tue, 10 Apr 2007, J. wrote: I didn't realize that most people are denying smtp connections for bad addresses. That's great that this is possible. So most of the people on this list reject connections that are for bad addresses? That's great. I think that would cut down

Re: Is Bayes Dead? Have the spammers won?

2007-03-27 Thread Jim Maul
R Lists06 wrote: Are you sure of this? Have you also trained these ham messages to counter this effect? Not too long ago we were in the same situation. I have autolearn enabled but I have adjusted the thresholds to avoid This is quite possible. I have heard other stories of people using

Re: Is Bayes Dead? Have the spammers won?

2007-03-23 Thread Jim Maul
Marc Perkel wrote: Perhaps what I need to do is to get rid of autolearn and write my own learning system that strips out the body of messages with images and just learns the headers. My problem is that when users get image spam they put it in the spam folders and they get learned. But the text

Re: Is Bayes Dead? Have the spammers won?

2007-03-23 Thread Jim Maul
Marc Perkel wrote: Jim Maul wrote: Marc Perkel wrote: Perhaps what I need to do is to get rid of autolearn and write my own learning system that strips out the body of messages with images and just learns the headers. My problem is that when users get image spam they put it in the spam

Re: Bit OT - SA not running on same time as rest of system

2007-03-16 Thread Jim Maul
Matt Kettler wrote: Chris wrote: I'm running Mandrake 10.1, in order to make sure my system switched to DST on March 11th I downloaded and installed an upgrade to the timezone file. After running it I ran [EMAIL PROTECTED] ~]# zdump -v /etc/localtime | grep 2007 /etc/localtime Sun Mar 11

Re: AW: AW: how to archive/save mails that are scanned by spamd ???

2007-03-15 Thread Jim Maul
Starckjohann, Ove wrote: Hi! What line may i add in /etc/mail/spamassassin/local.cf to archive all mails that are checked by spamd ??? Ove what makes you think that you could even put something in local.cf that would do that? SA does not archive anything. -Jim

Re: AW: AW: AW: how to archive/save mails that are scanned by spamd ???

2007-03-15 Thread Jim Maul
Starckjohann, Ove wrote: I know ! But back to technic: do you know a suitable way, HOW to archive mails that are scanned by spamd ? Perhaps with whatever is calling spamassassin? I use qmail-scanner. There are so many options i couldnt even begin to mention them. -Jim

Re: AW: AW: AW: AW: how to archive/save mails that are scanned by spamd ???

2007-03-15 Thread Jim Maul
Starckjohann, Ove wrote: Hi! I'm not calling spamassassin from the local machine but spamd from a remote machine via a closed source-software which acts as spamc. Ove Starckjohann This does not matter. This question has nothing to do with SA. SA can not/should not archive anything. It

Re: AW: how to archive/save mails that are scanned by spamd ???

2007-03-15 Thread Jim Maul
Starckjohann, Ove wrote: Hi ! the programm acting as spamc is called NoSpamProxy. http://www.nospamproxy.com/ And my thoughts were that it may be possible to archive the mail that is supplied to spamd. Because the spamd get's the whole mail, analyzes it and reports back the spam-score to the

Re: Not Enough Points

2007-03-06 Thread Jim Maul
David Goldsmith wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Here is how this message scored: X-Spam-DCC: PacNet-SG: iceman11.giac.net 1358; Body=65 Fuz1=65 Fuz2=51 X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on iceman11.giac.net X-Spam-Level: *** X-Spam-Status: No,

Re: Not Enough Points

2007-03-06 Thread Jim Maul
David Goldsmith wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jim Maul wrote: David Goldsmith wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Here is how this message scored: X-Spam-DCC: PacNet-SG: iceman11.giac.net 1358; Body=65 Fuz1=65 Fuz2=51 X-Spam-Checker-Version

Re: Low Scoring Message

2007-03-02 Thread Jim Maul
David Goldsmith wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Setup: SA 3.1.8, Pyzor, Razor, DCC, iXhash Botnet, FuzzyOCR 3.5.1, SARE rules, some misc rules This message got 0 points. Does it score over 5 for anyone? http://members.cox.net/dgoldsmi/spam/lowscore01.txt

Re: Low Scoring Message

2007-03-02 Thread Jim Maul
Giampaolo Tomassoni wrote: From: Jim Maul [mailto:[EMAIL PROTECTED] Jim Maul wrote: David Goldsmith wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Setup:SA 3.1.8, Pyzor, Razor, DCC, iXhash Botnet, FuzzyOCR 3.5.1, SARE rules, some misc rules This message got 0 points. Does

Re: [ot-ish] fuzzyocr still being developed?

2007-02-21 Thread Jim Maul
snowcrash+spamassassin wrote: following the numerous questions on list, i've gathered that fuzzyocr is rather popular -- we use it, too. i've not noticed recent bug-fixing, src dev (~ 1 month), or comments here, from the dev. just wondering -- is the proj still alive? dev vacation, maybe? or,

Re: Bayes resolution gettin weaker

2007-02-12 Thread Jim Maul
Jack Gostl wrote: Well... I'm convinced. I turned off autolearn a week ago, and things have never been smoother. Its a shame really, that's a nice feature, but for some reason it waters down the Bayes resolution until its almost useless. Most likely because the autolearn thresholds are too

Re: ALL_TRUSTED rule fires despite no trusted_networks defined

2007-02-08 Thread Jim Maul
Stéphane LEPREVOST wrote: We are actually checking the configuration of our SA installation (SA 3.1.7 + qmail + qmail-scanner 1.25st + clamav running on SLES *) and just saw a very weird thing : despite we don't have any 'trusted_networks' line in our local.cf file, more than 50 000 received

Re: Not just detect, but block

2007-02-07 Thread Jim Maul
Evan Platt wrote: At 10:42 AM 2/7/2007, nh2 wrote: Hello, I am new to spamassassin and have installed it on a Suse 9.3 system with qmail. If my assassin detects spam, it adds *SPAM* to the subject. How can I tell my server that such marked mails shall not be delivered (deleted or

Re: SA-gen'd message report headers appear differently (with/without linebreaks) in different mail clients

2007-02-06 Thread Jim Maul
Andy Figueroa wrote: As an occasional, long-term Thunderbird user, and using a reasonably current version, 1.5.0.9, TB doesn't even have a built-in show header feature. It can be added with a buggy extension called View Headers Toggle Button, which doesn't show long lines without scrolling

Re: Drug spam, some caught some not - none caught by drug rules

2007-01-26 Thread Jim Maul
Rich Shepard wrote: On Fri, 26 Jan 2007, Rich Shepard wrote: Where do I put this file so it's seen and used by SpamAssassin? Nevermind. I put it in /usr/share/spamassassin/ with all the other .cf files. Rich nooo Those are the DEFAULT rules. Do not add/remove/modify anything in

Re: USER_IN_WHITELIST problem

2007-01-22 Thread Jim Maul
Drew Burchett wrote: Well, I certainly don't mean to be argumentative about this, but over the weekend, I had to set USER_IN_WHITELIST score to 0 due to the number of false hits it was receiving. Seeing as I am the only one here who has the ability to add and remove from whitelists or

Re: box trapper filter and wildcard question

2007-01-18 Thread Jim Maul
dan li wrote: Hello. I am wondering if the Box Trapper is a part of spam assasain? If so, I am hoping some of you can give me the correct lines for the addresses I want to whitelist by using wildcard expressions. Boxtrapper appears to be part of (or an add on to) cpanel. It is not related

Re: sa-learn explained

2006-12-29 Thread Jim Maul
Dave Koontz wrote: I guess milage varies. Auto-Learn has been a life saver for us and has drastically reduced false postives we used to get with emails to our College's Health Care Research departments. We pass all local user email through SA as well, so this really helps the system learn

Re: Two Questions

2006-12-27 Thread Jim Maul
ToTheCenter.com wrote: I now am left with more understanding and more questions! 1) Some emails come through twice. Once as the original version and once as: No Message Collected Any ideas? No idea, but does this help? http://forums.ev1servers.net/showthread.php?t=31497 2) I get

Re: Tagging for spam mails

2006-12-14 Thread Jim Maul
Brad Baker wrote: We would like to add a spam report to the body of emails identified as spam to make troubleshooting false positives easier. For instance: To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] Date: November 26, 2006 3:57PM Subject: [spam] Buy ED Pills Now The

Re: Sorry Dhawal - no personal attacks allowed [OT]

2006-12-12 Thread Jim Maul
Ken A wrote: Dhawal Doshy wrote: Marc Perkel wrote: Well - if you don't like me then why don't you write a filter rule to delete message coming from me? I'm not going away so get used to it. If my threads weren't so damn interesting it wouldn't generate so much interest. I think that

Re: Rule update over DNS?

2006-12-07 Thread Jim Maul
Kelson wrote: Jason Haar wrote: May I propose that sa-update should become merged into spamd? (or daemonized) Merging would be bad. There are plenty of us using methods other than spamd to call SpamAssassin. I dont think anyone is using spamd to call SpamAssassin.

Re: Rule update over DNS?

2006-12-07 Thread Jim Maul
Justin Mason wrote: Jim Maul writes: Kelson wrote: Jason Haar wrote: May I propose that sa-update should become merged into spamd? (or daemonized) Merging would be bad. There are plenty of us using methods other than spamd to call SpamAssassin. I dont think anyone is using spamd to call

Re: MX server Queue

2006-11-30 Thread Jim Maul
chisina mike wrote: MX1 sendmail server mail queue is getting bigger, it must forward all mail to Main mail server. [EMAIL PROTECTED] mqueue]# grep stat=queue -c /var/log/maillog 6363 I tried the following commands # vi /etc/MailScanner/MailScanner.conf Deliver In Background = yes Delivery

Re: Odd behaviour (?) of my Qmail / Qmail Scanner / SpamAssassin 3.1.3 Setup?

2006-11-29 Thread Jim Maul
Adam Wilbraham wrote: To follow up on this, the message in question is flagged as spam if i run it through spamassassin, however if I run it through spamc its not. spamc is what Qmail Scanner invokes. Is there a separate configuration for spamc / spamd to spamassassin? I thought not... when

Re: Percentage of email that is spam after filtering?

2006-11-27 Thread Jim Maul
Chris Santerre wrote: Out of total mail hitting our server 12.99% is legit and delivered. You read correctly, 12.99%!! 65% is rejected at MTA w/ RBLs I wonder what percentage of this 65% is legit and blocked. 21% is caught by Spamassassin and not delivered. 12.99% is legit and delivered.

Re: Percentage of email that is spam after filtering?

2006-11-27 Thread Jim Maul
Chris Santerre wrote: -Original Message- From: Jim Maul [mailto:[EMAIL PROTECTED] Sent: Monday, November 27, 2006 12:12 PM To: Chris Santerre Cc: users@spamassassin.apache.org Subject: Re: Percentage of email that is spam after filtering? Chris Santerre wrote: Out

Re: sa-learn treating spam as ham

2006-11-24 Thread Jim Maul
Patrick Sherrill wrote: Sorry, last email was a poor example. Try this one. Before sa-learn: X-Spam-Status: No, score=4.201 required=4.9 tests=[BAYES_50=0.001, HELO_DYNAMIC_IPADDR=4.2] After sa-learn: X-Spam-Status: No, score=-0.2 required=4.8 tests=BAYES_40 autolearn=ham version=3.1.0

Re: Rules Du Jour briken?

2006-11-16 Thread Jim Maul
twofers wrote: Is this link having problems that anyone knows of? http://www.exit0.us/index.php?pagename=RulesDuJour I can't get to Rules Du Jour. Actually, the whole exit0.us site doesnt work. -Jim

Re: bayes_seen on MySQL, growing and growing

2006-11-13 Thread Jim Maul
Paolo Cravero wrote: Hi, while doing some checkup on production servers, I noticed that the bayes_seen table on MySQL is rather big: row: 15'814'021 (15.8Mr) size: 1'853'882'368 bytes ( 1.8GB) I've understood SA doesn't clean-up that table, so it has to be done manually. Can

Re: razor and dcc : high cpu load

2006-11-10 Thread Jim Maul
Rejaine Monteiro wrote: But I have various servers with qmail-ldap configuration, where the a first server (simple qmail installation, without ldap) receives mails from internet and check domain using rcpthosts only, does spam and virus checks and them forwards the mail to the others

Re: mail bounce warning for the list

2006-11-10 Thread Jim Maul
Mike Kenny wrote: On 11/9/06, *Jim Maul* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: I think pretty much everyone understand WHY people use these BLs. This is not the point. The point is, its not a very good solution. Is it even a solution? I guess that depends o nwhat

Re: razor and dcc : high cpu load

2006-11-10 Thread Jim Maul
Rejaine Monteiro wrote: Like a text-file based (it's not a security hole?!) or a ldap-replica on mail-server? I'm searching for more examples and other ideas and find this patch for qmail: http://qmail.jms1.net/patches/validrcptto.cdb.shtml I don't no if this patch is really necessary..

Re: Spam assasin query

2006-11-10 Thread Jim Maul
Ramdas P. Prabhu wrote: Dear All, I have a small query, and shall be highly obliged if you could solve it. Some time back, I had enabled some option in spam assasin whereby anyone who sent me a mail received an automated message to click on a link in order to verify whether he was real or a

Re: Well, that didn't take very bloody long

2006-11-10 Thread Jim Maul
Chris Santerre wrote: -Original Message- From: Steve Lake [mailto:[EMAIL PROTECTED] Sent: Friday, November 10, 2006 12:52 PM To: users@spamassassin.apache.org Subject: Well, that didn't take very bloody long Ok, remember that Name Wrote: :) emails? They've

[Fwd: Your email message was blocked]

2006-11-10 Thread Jim Maul
What!? You gotta be kidding me! My message was BLOCKED because it had damnn in it? People actually use crap like this? Wow... -Jim Original Message Subject: Your email message was blocked Date: Sat, 11 Nov 2006 04:23:23 +0930 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED]

Re: [Fwd: Your email message was blocked]

2006-11-10 Thread Jim Maul
Evan Platt wrote: At 11:08 AM 11/10/2006, you wrote: What!? You gotta be kidding me! My message was BLOCKED because it had damnn in it? People actually use crap like this? Wow... -Jim Original Message Subject: Your email message was blocked Date: Sat, 11 Nov 2006

Re: [Fwd: Your email message was blocked]

2006-11-10 Thread Jim Maul
Coffey, Neal wrote: Jim Maul wrote: Even worse! But (excuse my stupidity) where was the word putz in my email? I sure as hell didnt type it. Jim Maul wrote: Chris Santerre wrote: Can anyone find any common elements in these emails because whoever this putz is, they're adapting a lot

Re: mail bounce warning for the list

2006-11-09 Thread Jim Maul
D.J. wrote: Blocking mail base soley on the IP address (whether because it is a dynamic address or has at some time in the past sent a mail to a spamtrap) is akin to shooting the postman because yesterday you received an advertisement. You obviously don't handle a lot of mail

Re: mail bounce warning for the list

2006-11-07 Thread Jim Maul
Rose, Bobby wrote: So what you're saying is that the rule that people running listservers should maintain valid recipients who want to receive messages from the list shouldn't be followed just because it's a list about an antispam product? The last time I checked, the most common reason for

Re: spam filter working, but not well

2006-11-07 Thread Jim Maul
Brian S. Meehan wrote: Spamassassin is invoked from Courier-MTA. (OS is SUSE Pro 9.3) The /usr/lib/courier/etc/courierd file has the following line: DEFAULTDELIVERY=| /usr/bin/spamassassin | /usr/lib/courier/bin/maildrop I had tried it with 'spamc' but there was no difference. When I tried it

Re: spam filter working, but not well

2006-11-07 Thread Jim Maul
Brian S. Meehan wrote: Jim, I have it set so that i'm using /usr/bin/spamassassin now. Thanks for that info. Here is the relevant message header from an email that was not caught: X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on mail.meehanontheweb.com X-Spam-Level: ***

Re: Bayesian scores

2006-11-03 Thread Jim Maul
Péntek Imre wrote: Hello, Why BAYES_99 have only the score 3.5 while 5.0 is required to identify a mail as spam? I think this rule should have a score about 5.1 (or anything greater than 5.0). because if its wrong in its classification, then that 1 rule alone will cause a FP. The whole

Re: Bayesian scores

2006-11-03 Thread Jim Maul
Péntek Imre wrote: Jim Maul wrote: I've upped the scores on almost all bayes rules here because history has shown it to be incredibly accurate here. Yes. BTW so far I've got no FP but still get false negatives with score 3.5, BAYES_99, using this database: [5816] dbg: bayes: corpus size

Re: Bayesian scores

2006-11-03 Thread Jim Maul
Péntek Imre wrote: Jim Maul wrote: Are you using network tests, razor, surbl, add on rules from sare, etc? I can just guess, as I don't know how to get to be sure. I can find several spams marked with: RCVD_IN_BL_SPAMCOP_NET UNPARSEABLE_RELAY URIBL_AB_SURB Are these mean I also use network

Re: BIG increase in spam today

2006-11-02 Thread Jim Maul
Mark wrote: -Original Message- From: Marc Perkel [mailto:[EMAIL PROTECTED] Sent: donderdag 2 november 2006 19:00 To: users@spamassassin.apache.org Subject: Re: BIG increase in spam today I'm not an appliance vendor but I run a fornt end spam filtering service and it's been a

Re: Can't upgrade w/ RPM

2006-11-02 Thread Jim Maul
Philip Prindeville wrote: Hi. I'm running FC3 on an AMD64 platform for my mail server, and I had last installed SpamAssassin 3.1.5. Well, I grabbed the tarball for 3.1.7, and did a rpmbuild -tb ... of the tarball. Worked fine. Then I tried to upgrade via RPM: # rpm -v -U

Re: AWL score change

2006-11-01 Thread Jim Maul
Steve Ingraham wrote: I am running qmail with spamassassin 3.1.5. I am having a problem with spamassassin scoring. I have been attempting to change the score for AWL to -25. Here is a header from an email I received a short time ago with a score of 1.4 for AWL in the X-Spam-Report section:

Re: AWL score change

2006-11-01 Thread Jim Maul
in the X-Spam-Report section: Jim Maul wrote: You can not change the score of this rule. The AWL is not a whitelist. It is a score averager. Its score changes depending on certain factors. Why not just disable it and use real whitelisting? I did not know that about AWL. As far as using

Re: increase score of rules

2006-10-31 Thread Jim Maul
Pablo Allietti wrote: Hi all i want to increase the score of a images rules how can i do that ? for example HTML_IMAGE_ONLY_28 HTML_IMAGE_RATIO_02 i want to modify the score about this rules for example 4.0 which file i need to modify? how? You read the documentation like a good little

Re: SpamAssassin + sql user prefs

2006-10-31 Thread Jim Maul
Chris Szilagyi wrote: Hello: I have not been able to find the answer to my question so I thought I'd try this mailing list. I have SpamAssassin 3.1.7 (using spamc/spamd) installed on a Red Hat 7.1 system, with Perl 5.6.1. We currently have SQL user prefs enabled in a MySQL db, and put the

Re: Spamassassin effectiveness, BAYES_99

2006-10-20 Thread Jim Maul
Michael Beckmann wrote: Greetings! In the past few weeks, I have noticed significant amounts of spam passing through my filter. It is reaching a level that annoys me. I use Spamassassin 3.1.7. I used to get maybe one or two spam messages a day earlier this year with 200+ spams filtered.

Re: This image is turning frequent..

2006-10-18 Thread Jim Maul
Matt Florido wrote: * Jo Rhett [EMAIL PROTECTED] [10-17-2006 10:25]: score SARE_GIF_STOX 2.5 2.5 2.5 2.5 Can you tell me what each corresponding 2.5 represents? http://spamassassin.apache.org/tests_3_1_x.html Pay particular attention to the rightmost column heading in the table. -Jim

Re: What's with UCEPROTECT List?

2006-10-17 Thread Jim Maul
Kelson wrote: Matt Kettler wrote: That said, some folks still hate it because you're using some (very little) of their CPU and network to handle your spam. Also, a large number of verifications (say, because someone has been sending lots of spam with forged headers) looks suspiciously like a

Re: How to disable autolearn for FuzzyOcr?

2006-10-16 Thread Jim Maul
D.J. wrote: I think what the original poster was asking was how to make the gibberish bodies not get Bayes scanned, so as to not pollute the database with text that isn't spammy. Exactly my point. Slightly off topic here, but I have a dumb question. If you get a message

Re: sa-learn and Caught spams

2006-09-27 Thread Jim Maul
Daniel T. Staal wrote: On Wed, September 27, 2006 10:43 am, Matt Kettler said: Mike Woods wrote: Hi guys, bit of a query regarding sa-learn and messages that have already been tagged as spam. We have spamassassin scanning mail via amavisd and sending any caught spams to a spam folder in the

Re: commerce Antispam Products

2006-09-14 Thread Jim Maul
Richard Collyer wrote: We're looking for a commerce antispam product.It should be high performance and has the strong ability to capture spams. Could you recommend me a good product about it?We are an ISP,have millions of users. (Please don't say Symantec's brightmail,it's fairly good,but

Re: Strange Score

2006-08-25 Thread Jim Maul
Matt Kettler wrote: Christopher Mills wrote: Look at this, X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on chrysalis.chrysalishosting.com http://chrysalis.chrysalishosting.com X-Spam-Level: X-Spam-Status: No, score= 4.3 required=5.0 tests=BAYES_50,HG_HORMONE,

Re: SA-LEARN Question

2006-08-22 Thread Jim Maul
Christopher Mills wrote: Hi, We have over 100 domains on a server, all of which are getting junk mail. SA 3.1.4 installed, but I don't think it's properly trained yet (even though I did upgrade from an earlier version). If I set up a [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] address and

Re: Image spam with inline jpeg image

2006-08-10 Thread Jim Maul
Bowie Bailey wrote: Bret Miller wrote: On Wed, 9 Aug 2006, Gary Funck wrote: Has anyone considered also supplying new rules in the form of rpm's available via a yum-compatible repository? It'd be nice to have the usual versioning and logging support as well as a central update facility. This

Re: Image spam with inline jpeg image

2006-08-10 Thread Jim Maul
Bowie Bailey wrote: It doesn't really matter to me who supports which pieces as long as they all work. Someone may be able to fix sa-update so that it can take over from RDJ, but as of now, that is not possible without configuring about 62 sa-update channels (one for each ruleset RDJ manages).

Re: DEAR_SOMETHING rule scoring issue

2006-08-09 Thread Jim Maul
Gregory T Pelle wrote: What is the procedure to have a rule score reviewed? I have been looking over the scoring for version 3.1.x at http://spamassassin.apache.org/tests_3_1_x.html and think that a score of 1.6 is high for the DEAR_SOMETHING rule. I know that our customer support emails

Re: SA to Outlook built-in junk email filter

2006-08-09 Thread Jim Maul
Matthew V wrote: Hi there, Hello. Server: qmail vpopmail simscan-1.2 spamassassin-3 clamav good Client: Win2k/XP with Office 2003 not so good I've been trying to get Outlook 2003 to automatically deposit mail marked by spamassassin as spam into its junk email folder. What I'm

Re: Image spams getting thru

2006-08-02 Thread Jim Maul
John D. Hardin wrote: On Tue, 1 Aug 2006, Theo Van Dinter wrote: Except now you've also delayed your valid mail by 30 minutes or an hour which sucks (and is sometimes completely unacceptable). Repeat after me: Email is a non-guaranteed, Best Attempt delivery mechanism. There may be delays.

Re: Image spams getting thru

2006-08-01 Thread Jim Maul
John D. Hardin wrote: On Tue, 1 Aug 2006, Ramprasad wrote: How about sending 450 Please Try later to ever mail with an inline image and then somehow verify if it really comes back. (Obviously not my original idea :-) ) The problem there, again, is that you've already used the bandwidth and

Re: Image spams getting thru

2006-08-01 Thread Jim Maul
Ken A wrote: Jim Maul wrote: John D. Hardin wrote: On Tue, 1 Aug 2006, Ramprasad wrote: How about sending 450 Please Try later to ever mail with an inline image and then somehow verify if it really comes back. (Obviously not my original idea :-) ) The problem there, again

Re: Subject header not detected after folded header

2006-07-31 Thread Jim Maul
Ben Wylie wrote: Am running SpamAssassin 3.1.2 on Windows 2003 server. This is an extract from the headers of an incoming email. This triggered the MISSING_SUBJECT Missing Subject: header rule. Why did this not detect the subject header? Because its blank? X-MimeOLE: Produced By Microsoft

Re: Subject header not detected after folded header

2006-07-31 Thread Jim Maul
Ben Wylie wrote: Jim Maul wrote: Ben Wylie wrote: Am running SpamAssassin 3.1.2 on Windows 2003 server. This is an extract from the headers of an incoming email. This triggered the MISSING_SUBJECT Missing Subject: header rule. Why did this not detect the subject header? Because its blank

Re: SA Score - Confidence Percentage

2006-07-26 Thread Jim Maul
Chris Santerre wrote: -Original Message- From: John Rudd [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 26, 2006 10:44 AM To: Chris Santerre Cc: Sietse van Zanen; SpamAssassin Users Subject: Re: SA Score - Confidence Percentage On Jul 26, 2006, at 6:40 AM, Chris

Re: Bayes Always On

2006-07-21 Thread Jim Maul
Duane Hill wrote: On Fri, 21 Jul 2006, Bowie Bailey wrote: Duane Hill wrote: I recently upgraded SA to v3.1.3 on FreeBSD 6.0. I have also ran sa-update. I have found that no matter what I do to the local.cf with turning off bayes, it is still being used. I have searched the system over and

Re: SA not tagging subject

2006-07-18 Thread Jim Maul
Bowie Bailey wrote: tomcatf14 wrote: I've disabled fast spamassassin and now it tag the subject!!!Good but i think i still want to use Fast SA to enhance the performance. What is fast spamassassin??? Basically spamc -c The doc stated this: The doc for what? qmail-scanner I want

Re: SA not tagging subject

2006-07-17 Thread Jim Maul
tomcatf14 wrote: What should i do if i want to use the current SA? Follow the instructions that come with it instead of some outdated guide somewhere. -Jim

Re: Blocking all inline GIF or JPG Images

2006-06-27 Thread Jim Maul
Matt wrote: Hi, What would I need to do to just outright block all e-mail that has an inline gif or jpg (or multiple ones)? You should do this in whatever program you have calling SA/AV/etc.. SA itself doesn't block anything. -Jim

Re: content is being striped

2006-06-16 Thread Jim Maul
Michael Di Martino wrote: jdow wrote: It isn't SpamAssassin doing this. It may be a misconfigured procmail rule. I presume it could also be a misconfigured rule from any OTHER means of tossing mail into your mailbox. But it is NOT SpamAssassin doing it. {^_^} - Original Message -

Re: Newbie question

2006-06-06 Thread Jim Maul
Gary Forrest - Netnorth wrote: Hi All We have been using SA v3.1.1, all seems to work well :) ( FreeBSD 6.1, Sendmail 8.13.6 few milters ) Is it possible to get SA not to scan inbound email addressed to certain domain names. Yes, but not with SA itself. We have looked at the various

Re: Need to edit this rule

2006-06-06 Thread Jim Maul
Will Nordmeyer wrote: Just put score FROM_DOMAIN_NOVOWEL lowerscore in your local.cf (IE: score FROM_DOMAIN_NOVOWEL 0.3 You don't want to adjust it in the master file - your adjustment would be overwritten everytime you upgraded. Not to mention that this will only affect mail TO your

Re: Horde webmail spam report and spam assassin

2006-06-05 Thread Jim Maul
Alejandro Lengua wrote: Horde webmail has a spam reporting feature, however it is a bit useless. Why? Because it sends the email (without headers) to an email address (the spam admin). This way is very difficult to feed the spam mail into spam detection software. I wonder if somebody has done

Re: Spamassassin + Kaspersky SMTP-Scanner

2006-05-11 Thread Jim Maul
Rick Macdougall wrote: Thomas Gross wrote: Hi List! I'm runing a debian mailserver with qmail 1.03, vpopmail and kaspersky anti-virus smtp-scanner 5.5.3. Now i wanted to add the latest spamassassin to filter the spam which grows up to 500 mails per day. I searched the whole

Re: Spam coming thru w/high score different SA version

2006-04-27 Thread Jim Maul
Tracey Gates wrote: I checked and did find 2 spamd files. One was in /usr/bin with the latest install date. The other one was in /etc/rc.d/init.d with the older install date. I backed up the older files and replaced the ones that are in the init.d directory with the ones from the /usr/bin

Re: Spam coming thru w/high score different SA version

2006-04-27 Thread Jim Maul
Tracey Gates wrote: OK. Sorry, I'm a novice at all of this admin stuff. I replaced the old files back and restarted spamd again. I did a find for spamd and here is my results: [EMAIL PROTECTED] /]# find ./ -name spamd find: ./proc/9832/fd: No such file or directory ./etc/rc.d/init.d/spamd

Re: Messages Not detected as Spam

2006-04-26 Thread Jim Maul
Paul Wetter wrote: Ok, I added what you said. I think things may be back on the up and in operation. Some spam however is still not detected, which brings me to my next question. I have one other question about razor checks. They do not appear to be working. If I do a manual check (with

Re: Permission errors

2006-04-25 Thread Jim Maul
Igor Chudov wrote: Doing some housecleaning... I am running spamd as root, at which point it reverts to 'nobody'. It then proceeds to complain, understandably, that it does not have permission to write to users' directories. Apr 24 23:56:57 manifold spamd[21442]: spamd: still running as

  1   2   3   >