Re: AWL functionality messed up?

2009-05-27 Thread Matt Kettler
Linda Walsh wrote: Bowie Bailey wrote: Linda Walsh wrote: I got a really poorly scored piece of spam -- one thing that stood out as weird was report claimed the sender was in my AWL. Any sender who has sent mail to you previously will be in your AWL. This is probably the most

Re: my AWL messed up?

2009-05-27 Thread Matt Kettler
Linda Walsh wrote: To be clear about what is being white listed, would it hurt if the 'brief report for the AWL', instead of : -1.3 AWLAWL: From: address is in the auto white-list it had -1.3 AWLAWL: 'From: 518501.com' addr is in auto white-list So I can see

Re: Problem with check_invalid_ip()

2009-05-29 Thread Matt Kettler
Eric Rodriguez wrote: Hi, I'm having trouble with the check invalid_ip subroutine in the RelayEval.pm. See http://svn.apache.org/viewvc/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/RelayEval.pm?view=logr1=451385pathrev=451385

Re: Problem with check_invalid_ip()

2009-05-29 Thread Matt Kettler
Eric Rodriguez wrote: Hi, I removed the negation ~ , the begin ^ and end $ charaters from the original source: sub check_for_illegal_ip { my ($self, $pms) = @_; foreach my $rcvd ( @{$pms-{relays_untrusted}} ) { # (note this might miss some hits if the Received.pm skips any

Re: tests= SIZE_LIMIT_EXCEEDED ??

2009-06-08 Thread Matt Kettler
Stefan-Michael Guenther wrote: Hi, I just had a closer look at the header of an email which should have been recognized by spamassassin as spam. Waht I found was this: X-SpamScore: 0 tests= SIZE_LIMIT_EXCEEDED I have checked /usr/share/spamassassin/ for a rule which might contain

Re: Unsubscribe

2009-06-12 Thread Matt Kettler
Mike Yrabedra wrote: unsubscribe If you look at the message headers, there's a header explaining where to send unsubscribe messages to (this is the RFC standard header for doing this, so look for it in other mailing lists): List-Unsubscribe: mailto:users-unsubscr...@spamassassin.apache.org

Re: Unsubscribe

2009-06-13 Thread Matt Kettler
Michael Scheidell wrote: Since we saw two of them come in pretty back to back, I suspect a joe job of sometype. those people might not have subscribed. That would be a bit tricky to just be a joe job. This list is confirmed opt-in. i.e.: if you subscribe, an automated bot from ezlm sends you

Re: Custom Rule Sets

2009-06-21 Thread Matt Kettler
rich...@buzzhost.co.uk wrote: Good morning, Looking at the docs I see a 'don't add your customer rules here' warning in reference to the default /usr/share/spamassassin dir. Instead it lists a couple of options including local.cf Is it possible to ask local.cf to include external files/dir

Re: Custom Rule Sets

2009-06-22 Thread Matt Kettler
rich...@buzzhost.co.uk wrote: On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote: rich...@buzzhost.co.uk wrote: Good morning, Looking at the docs I see a 'don't add your customer rules here' warning in reference to the default /usr/share/spamassassin dir. Instead it lists

Re: Custom Rule Sets

2009-06-22 Thread Matt Kettler
rich...@buzzhost.co.uk wrote: On Mon, 2009-06-22 at 07:30 -0400, Matt Kettler wrote: rich...@buzzhost.co.uk wrote: On Mon, 2009-06-22 at 00:26 -0400, Matt Kettler wrote: rich...@buzzhost.co.uk wrote: Good morning, Looking at the docs I see a 'don't add

Re: Unable to update SARE

2009-06-22 Thread Matt Kettler
Frank Bures wrote: Since yesterday, when running sa-update --channelfile /etc/mail/spamassassin/sare-sa-update-channels.txt --gpgkey 856AA88A I get Use of uninitialized value in concatenation (.) or string at /usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/Scalar/Util.pm line 30. An

Re: Use of uninitialized value $dir in scalar chomp at /usr/local/bin/spamd line 2118, GEN103 line 2.

2009-06-22 Thread Matt Kettler
alexus wrote: On Thu, Apr 23, 2009 at 4:08 PM, alexusale...@gmail.com wrote: On Wed, Apr 8, 2009 at 12:50 AM, Matt Kettler mkettler...@verizon.net wrote: alexus wrote: I keep getting this line in my logs everytime there is a spamd calles Apr 8 03:55:15 mx1 spamd[36109

Re: 552 spam score (11.3) exceeded threshold

2009-06-22 Thread Matt Kettler
John Hardin wrote: On Mon, 22 Jun 2009, Pawe�~B T�~Ycza wrote: Yesterday I was trying to send here warning of new www.shopXX.net spam flood. It was short letter with a few URLs to pastebin.com. Unfortunately my messages hasn't arrived at the mailing list. What's up? Do I really look like a

Re: gpg signed spam email ???

2009-06-27 Thread Matt Kettler
RobertH wrote: i was reading at http://www.karan.org/blog/ specifically http://www.karan.org/blog/index.php/2009/06/15/gpg-signed-spam that he recv'd a gpg signed spam email ive never heard of that before yet i havent thought much about it or studied it... Q: is this unheard of, or

Re: gpg signed spam email ???

2009-06-28 Thread Matt Kettler
True, it likely is. But it would also be trivial for the spammer to generate a valid one. Given what we've seen with the image spams in the past (custom generated image for *every* email with random font, size, color, offset, and randomized dots added on), computational power is hardly an

Re: RulesDuJour

2009-06-30 Thread Matt Kettler
Anshul Chauhan wrote: we have to copy KAM.cf to /usr/share/spamassassin only for its integration with spamassassin or something else is to done I'm using spamassassin-3.2.5-1.el4.rf on Centos4.7 Any add-on rules should be placed in the same directory as your local.cf (ie:

Re: perms problems galore

2009-07-03 Thread Matt Kettler
Gene Heskett wrote: Greetings all; I _thought_ I had sa-update running ok, but it seemed that the effectiveness was stagnant, so I found the cron entry that was running as-update discovered a syntax error there, which when I fixed it, disclosed that I had all sorts of perms problems that

Re: perms problems galore

2009-07-03 Thread Matt Kettler
Gene Heskett wrote: Ok, I'll fix that, thanks. That said, why give the saupdate user the ability to add keys at all? Import them as root and only give the saupdate user read access. Basically, since I run myself as root, I was trying to reduce the exposure. All the rest of the

Re: Annoying auto_whitelist

2009-07-04 Thread Matt Kettler
Michelle Konzack wrote: Hello, while I get currently several 1000 shop/meds/pill/gen spams a day and some are going throug my filters, I have to move them to my spamfolder manualy and feed them to sa-learn --spam but this does not work... ...because the Spamer From: is in the

Re: Annoying auto_whitelist

2009-07-04 Thread Matt Kettler
Michelle Konzack wrote: Hello, while I get currently several 1000 shop/meds/pill/gen spams a day and some are going throug my filters, I have to move them to my spamfolder manualy and feed them to sa-learn --spam but this does not work... ...because the Spamer From: is in the

Re: Current Rules Repository

2009-07-08 Thread Matt Kettler
Patrick Sherrill - Coconet wrote: With SARES et al not being updated, where is the best repository for current rules being maintained? The default sa-update channel. .

Re: Never ending spam flood www.viaXX.net?

2009-07-10 Thread Matt Kettler
rich...@buzzhost.co.uk wrote: On Fri, 2009-07-10 at 21:26 +1200, Jason Haar wrote: On 07/10/2009 09:01 PM, Paweł Tęcza wrote: Please see my initial post on Pastebin: http://pastebin.com/f6a83e9fb If it's true that all those domains resolve to just a handful of IP

Re: Never ending spam flood www.viaXX.net?

2009-07-10 Thread Matt Kettler
Steve Freegard wrote: Matt Kettler wrote: rich...@buzzhost.co.uk wrote: On Fri, 2009-07-10 at 21:26 +1200, Jason Haar wrote: On 07/10/2009 09:01 PM, Paweł Tęcza wrote: Please see my initial post on Pastebin: http://pastebin.com/f6a83e9fb

Re: Annoying auto_whitelist

2009-07-10 Thread Matt Kettler
RW wrote: On Fri, 10 Jul 2009 12:33:51 +0200 Matus UHLAR - fantomas uh...@fantomas.sk wrote: On Sat, 04 Jul 2009 08:56:35 -0400 Matt Kettler mkettler...@verizon.net wrote: Please be aware the AWL is NOT whitelist, or a blacklist, and the scores don't really quite work the way

Re: deactivate all checks except specific tests

2009-07-10 Thread Matt Kettler
sebast...@debianfan.de wrote: Hello, i have set up a virtual server for experiments. I want to disable all the spamassassin tests - except one specific rbl - in this topic- the manitu rbl. Is there a parameter for disabling all the tests? There is no option to disable all rules. However,

Re: Opt In Spam

2009-07-16 Thread Matt Kettler
Have you reported the abuse to mailto:habeas@abuse.net, as Neil Schwartzman from Return Path (operators of Habeas) requested last time? Just posting to the sa-users list isn't really going to do very much. If there are pervasive FP problems, it will show up in the mass-checks and we'll drop

Re: Underscores

2009-07-16 Thread Matt Kettler
twofers wrote: How can I pattern match when every word has an underscore after it. Example: This_sentenance_has_an_underscore_after_every_word I'm not really good at Perl pattern matching, but \w and \W see an underscore as a word character, so I'm just not sure what might work. body =~

Re: sa-update errors

2009-07-20 Thread Matt Kettler
MrGibbage wrote: I get errors like this when I run sa-update from cron /usr/local/bin/setlock -n /tmp/cronlock.4051759.53932 sh -c $'/home/skipmorrow/bin/sa-update --gpgkey 6C6191E3 --channel sought.rules.yerp.org' gpg: WARNING: unsafe ownership on homedir

Re: WEb Frontend for SQL Bayes

2009-07-21 Thread Matt Kettler
Luis Daniel Lucio Quiroz wrote: Is there a good frontend that letme to admin SQL Bayes? mysql-admin? What are you looking to do as far as administering bayes? (particularly what would you be doing more than once every 2-3 years)

Re: Spamcheck and how it affects bayes question

2009-07-21 Thread Matt Kettler
Gary Smith wrote: We have a process in place using the perl CPAN module for invoking SA. This is outside of the scope of the normal mail system. Basically we use this to see what scores emails would generate for some statistical stuff. The spam engine this calls is to set use -100 as the

Re: WEb Frontend for SQL Bayes

2009-07-21 Thread Matt Kettler
Luis Daniel Lucio Quiroz wrote: Le mardi 21 juillet 2009 22:11:39, Matt Kettler a écrit : Luis Daniel Lucio Quiroz wrote: Is there a good frontend that letme to admin SQL Bayes? mysql-admin? What are you looking to do as far as administering bayes? (particularly what would

Re: WEb Frontend for SQL Bayes

2009-07-22 Thread Matt Kettler
Benny Pedersen wrote: On Wed, July 22, 2009 04:18, Luis Daniel Lucio Quiroz wrote: Is there a good frontend that letme to admin SQL Bayes? sa-learn That's not exactly a web front-end Benny.

Re: Subject Rules

2009-07-22 Thread Matt Kettler
twofers wrote: I'm writing rules for header Subject and have a rule question. I want a rule that would hit on specific words, no matter what order they were. Would a rule written like this rule below accomplish that? Is the * redundant and not needed? Would a rule written like this

Re: DNSWL

2009-07-24 Thread Matt Kettler
twofers wrote: I get: * -1.0 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low * trust and I read the dnswl.org home page, but I don't understand why this rule would get a -1.0 for a LOW trust rating. It just seems awkward to me, I think LOW trust

Re: How can I view bayes score for individual words?

2009-07-24 Thread Matt Kettler
snowweb wrote: I tried to view the files bayes.toks, bayes.journal, bayes.seen and autowhitelist but they just look jibberish when opened in a unix editor. What's the solution to this? The bayes database stores truncated SHA1 hashes of the words, it is not reversible back to human readable

Re: anchor forgery

2009-07-25 Thread Matt Kettler
mouss wrote: Mike Cardwell a écrit : Just checking through my Spam folder and I came across a message that contained this in the html: censored example, Verizon won't let me send it Yet, there was no mention of this obvious forgery in the spamassassin rules which caught the

Re: Score -71 for VERY spammy message!

2009-07-25 Thread Matt Kettler
snowweb wrote: Terry Carmen wrote: This is the result, X-Spam-Level: X-Spam-Status: No, score=-71.4 required=4.7 tests=HELO_DYNAMIC_IPADDR, HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,

Re: bayes not active although enabled?

2009-07-25 Thread Matt Kettler
snowweb wrote: Sorry, got mixed up. In /etc/mail/spamassassin/local.cf use_bayes 1 Is there anywhere else that I need to switch this on since it does not appear to be doing bayesian testing at all for any messages. check your sa-learn --dump magic SA won't activate bayes until it has

Re: Score -71 for VERY spammy message!

2009-07-26 Thread Matt Kettler
Benny Pedersen wrote: On Sun, July 26, 2009 05:07, snowweb wrote: I can't understand what is going on here! How can it get a score like that? The message contained just an image and a link. add score whitelist_from 0.1 in user_prefs or local.cf restart spamd Um, that's not

Re: whitelist_from questions

2009-07-27 Thread Matt Kettler
MySQL Student wrote: Hi, I'm looking an email that appears to be one of the users from the whitelist, but instead was from: From probesqt...@segunitb1.freeserve.co.uk Mon Jul 27 19:49:19 2009 Why can't a comparison be made between the From: info and the actual sender? Is this because

Re: AutoWhiteList

2009-07-31 Thread Matt Kettler
--[ UxBoD ]-- wrote: Hi, Where can I find sa-awlUtil as it does not appear to be in the download file ? Best Regards, Hmmm, it looks like someone has been editing the wiki in ways that don't match anything in any released or unreleased version of SA. The tool is named

Re: Parallelizing Spam Assassin

2009-07-31 Thread Matt Kettler
rich...@buzzhost.co.uk wrote: On Fri, 2009-07-31 at 09:53 +0100, Justin Mason wrote: On Fri, Jul 31, 2009 at 09:32, rich...@buzzhost.co.ukrich...@buzzhost.co.uk wrote: Imagine what Barracuda Networks could do with that if they did not fill their gay little boxes with hardware

Re: Parallelizing Spam Assassin

2009-07-31 Thread Matt Kettler
rich...@buzzhost.co.uk wrote: email me off list as I've just been banned for upsetting a sponsor LOL Richard, this has nothing to do with Barracuda. They have no influence over my opinions whatsoever. I don't work for Apache or Barracuda, or any company sponsored by either.Neither Apache

Re: Parallelizing Spam Assassin

2009-08-01 Thread Matt Kettler
Um, Linda.. I'm pretty positive Justin is Irish, not American. Linda Walsh wrote: It's an American thing. Things that are normal speech for UK blokes, get Americans all disturbed. Funny, used to be the other way around...but well...times change. Justin Mason wrote: On Fri, Jul 31, 2009

Re: SA-learn (spamassassin)

2009-08-02 Thread Matt Kettler
monolit wrote: Question is logical. When SA learnt new spam/ham so SA have to write new info to the database and I think that database have to increase size. If you have for example *.doc file and you modify it. You add several words - *.doc will be bigger(increase his size). The database

Re: blacklisting a forger; summary; /* end

2009-08-03 Thread Matt Kettler
LuKreme wrote: On 3-Aug-2009, at 10:21, Dennis G German wrote: Content-Type: text/html; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Yes, there IS a problem. What the hell? The message was multipart/alternative. You are more than capable of reading the text/plain

Re: RelayCountry Config

2009-08-06 Thread Matt Kettler
MySQL Student wrote: Hi, I don't know if it makes a difference, but I call it Relay-Countries to match the name of the pseudo-header used in the tests add_header all Relay-Countries _RELAYCOUNTRY_ It doesn't appear to make a difference. I must be doing something else

Re: Scores, razor, and other questions

2009-08-07 Thread Matt Kettler
MySQL Student wrote: Hi, After another day of hacking, I have a handful of general questions that I hoped you could help me to answer. - How can I find the score of a particular rule, without having to use grep? I'm concerned that I might find it at some score, only for it to be redefined

Re: Mailbox for auto learning

2009-08-09 Thread Matt Kettler
Luis Daniel Lucio Quiroz wrote: Hi SAs, Well, after reading this link http://spamassassin.apache.org/full/3.2.x/doc/sa-learn.html I'm still looking for an easy-way to let my mortal users to train our antispam. I was thinking a mailbox such as h...@antispamserver and s...@antispamserver

Re: two different spamassassin outputs

2009-08-09 Thread Matt Kettler
David Banning wrote: With every email for some reason I get two reports from spamassassin. I the headers I get this line; - X-Spam-Status: No, score=2.5 required=5.0 tests=BAYES_00,DEAR_SOMETHING, HTML_MESSAGE,SPF_PASS,URIBL_BLACK,URIBL_OB_SURBL autolearn=no

Re: whitelist_from_rcvd and short circuit

2009-08-13 Thread Matt Kettler
Chris wrote: It appears as though I don't understand how this is supposed to work. I have a file in /etc/mail/spamassassin called my-whitelist.cf. In it I have entries such as: snip whitelist_from_rcvd harley-requ...@the-hed.net the-hed.net snip however, a message from the 2nd

Re: Counting RAZOR2 hits

2009-08-15 Thread Matt Kettler
MySQL Student wrote: Hi, I thought grep -c RAZOR2_CHECK through my mail logs would give me a good approximation of the number of times RAZOR2 was consulted, but that doesn't seem to be the case. There are some mails that don't have it listed in the tests= section. I've also tried the

Re: sa-update.com expired ?

2009-08-16 Thread Matt Kettler
Stefan wrote: Hello list, I just configured sa-update on a server with some sare rule sets. And it couldn't download some sets because the MIRRORED.BY file has an entry with sa- update.com. In this case it was the 70_zmi_german rule set and the MIRRORED.BY file has the following content:

Re: Counting RAZOR2 hits

2009-08-17 Thread Matt Kettler
Karsten Bräckelmann wrote: On Mon, 2009-08-17 at 09:52 +0200, Matus UHLAR wrote: On 15.08.09 14:32, Matt Kettler wrote: That means it was found and was above your min_cf. i.e.: Razor believes it is spam. There's no min_cf gor RAZOR and there's no public hitcount. RAZOR2 has

Re: SA Timeouts

2009-08-19 Thread Matt Kettler
Cory Hawkless wrote: Hi All, Having a problem with my SA setup. I’m using amavisd and Postfix. For some reason I get the following occasionally Aug 19 15:37:20.176 ceg.caznet.com.au /usr/sbin/amavisd[5]: (5-01-6) SA dbg: bayes: database connection established Aug 19

Re: sare channels

2009-08-20 Thread Matt Kettler
Dave wrote: Hello, I'm trying to add additional sa rules and wanted to use the sare channels referenced by the wiki. I'm using sa 3.2.5 and when i atempted to get updates from saupdates.openprotect.com the channel didn't exist. Has it moved? Thanks. Dave. Read the top of the

Re: sare channels

2009-08-20 Thread Matt Kettler
Gary Smith wrote: Read the top of the rulesemporium site: http://www.rulesemporium.com/ SARE rules aren't being updated. Hence, sa-updating them is pointless. Is it still recommended to run the SARE rules? There's nothing wrong with running them if you want.. but using sa-update

Re: Obfuscation Question

2009-08-27 Thread Matt Kettler
Irish Online Help Desk wrote: When I send a test message for my broadcast email I am receiving “0.6 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation” in the spam score. It is a pretty basic email message with a few hyperlinks and a numbered list. Can you explain what may be

Re: SA-learn is it a problem

2009-08-30 Thread Matt Kettler
peperami97 wrote: Hi Whenever I run sa-learn it claims to learn from every message regardless of whether its being run immediately after being run on the same folder. Is this normal or is this a problem ? That would seem to be a problem. It shouldn't relearn from the same message.. are

Re: SA-learn is it a problem

2009-08-30 Thread Matt Kettler
Ben Whyte wrote: By default: ~/.spamassassin/bayes_seen (ie: inside the .spamassassin subdierctory of your home directory) I found it I assume. Its in /home/.spamassassin/spamassassin_seen .spamassassin_seen is not getting updated .spamassasin_toks is getting updated Ben Erm.

Re: SA-learn is it a problem

2009-08-31 Thread Matt Kettler
Ben Whyte wrote: Erm. Did someone mess with the bayes_path setting in your configuration? Also, are you running SA as a user whose home directory is just /home (ie: the user named nobody) The bayes config is pointing to /home/spamd Based on what you've told me so far, it is not. It

Re: some domains in my local.cf file not being tagged

2009-09-02 Thread Matt Kettler
Mark Mahabir wrote: Hi, I have a large number of domains I've blacklisted in my local.cf file e.g. blacklist_from *...@domain.com however spam from some domains gets tagged, whereas others don't. What can I do to improve the situation? Thanks Mark Does the From: header of these

Re: Rule PTR != localhost

2009-09-03 Thread Matt Kettler
Clunk Werclick wrote: Howdie; I'm starting to see plenty of these and they are new to us: zgrep address not listed /var/log/mail.info Sep 3 05:26:59 : warning: 222.252.239.56: address not listed for hostname localhost dig -x 222.252.239.56 ... ;; QUESTION SECTION:

Re: Rule PTR != localhost

2009-09-03 Thread Matt Kettler
Matt Kettler wrote: Clunk Werclick wrote: Howdie; I'm starting to see plenty of these and they are new to us: zgrep address not listed /var/log/mail.info Sep 3 05:26:59 : warning: 222.252.239.56: address not listed for hostname localhost dig -x 222.252.239.56 ... ;; QUESTION

Re: Rule PTR != localhost

2009-09-03 Thread Matt Kettler
Clunk Werclick wrote: On Thu, 2009-09-03 at 05:23 -0400, Matt Kettler wrote: Clunk Werclick wrote: Howdie; I'm starting to see plenty of these and they are new to us: zgrep address not listed /var/log/mail.info Sep 3 05:26:59 : warning: 222.252.239.56: address not listed

Re: some domains in my local.cf file not being tagged

2009-09-03 Thread Matt Kettler
Mark Mahabir wrote: 2009/9/3 Matt Kettler mkettler...@verizon.net: Does the From: header of these messages match *...@domain.com, or are they *...@something.somedomain.com (which wouldn't match)? They're definitely *...@domain.com in the From: header. Does the X-Spam-Status

Re: some domains in my local.cf file not being tagged

2009-09-04 Thread Matt Kettler
d.h...@yournetplus.com wrote: Quoting Matt Kettler mkettler...@verizon.net: Mark Mahabir wrote: 2009/9/3 Matt Kettler mkettler...@verizon.net: Does the From: header of these messages match *...@domain.com, or are they *...@something.somedomain.com (which wouldn't match)? They're

Re: user prefs from sql problem

2009-09-08 Thread Matt Kettler
Karel Beneš wrote: Hi, I am trying to load user preferences from SQL db (mysql). Setup was done according to doc/spamassassin/sql/README.gz, but user preferences are still loaded from files. No error message is raised into log file in debug mode. DB-based bayes and awl works fine. Debian

Re: URL rule creation question

2009-09-10 Thread Matt Kettler
MySQL Student wrote: Hi all, I've seen this pattern in spam quite a bit lately: snip - URI that verizon won't let me send Would it be reasonable to create a rule that looks for this two-char then dot pattern, or is it reasonable that it might appear in a legitimate email too frequently?

Re: URL rule creation question

2009-09-11 Thread Matt Kettler
McDonald, Dan wrote: From: Matt Kettler [mailto:mkettler...@verizon.net] This rule should detect 10 consecutive occurrences. uri L_URI_FUNNYDOTS /(?:\.[a-z,0-9]{2}\.){10} Warning: I wrote this quickly without too much thought. It may have bugs, but I'm short on time at the moment

Re: Does Spam Assassin support additional languages?

2009-09-15 Thread Matt Kettler
Chris Arrendale wrote: I am running version 3.2.4 and interested to know if there are additional language packs for Spam Assassin such as German, Turkish, Chinese, etc.? If they are available, does anybody know where I can download them? There are a few language packs that come with SA.

Re: Re-running SA on an mbox

2009-09-20 Thread Matt Kettler
MySQL Student wrote: Hi, I have an mbox with about a 100 messages in it from a few days ago. The mbox is a combination of spam and ham. What is the best way to run SA through these messages again, so I can catch the ones that have URLs in them that weren't on the blacklist at the time they

Re: Re-running SA on an mbox

2009-09-20 Thread Matt Kettler
MySQL Student wrote: Hi, Do you just want to re-scan the whole mbox and see what rules hit now for research reasons? That's a good start, but I'd like to see if I can break out the ham to train bayes. There's no way to (directly) get SA to modify email that's already in an

Re: Re-running SA on an mbox

2009-09-20 Thread Matt Kettler
Theo Van Dinter wrote: You probably want spamassassin --mbox. :) It won't modify the messages in-place, but you can do something like spamassassin --mbox infile outfile. If you're talking about sa-learn, though, it also knows --mbox. Yes, but he's got mixed spam and nonspam in one mbox.

Re: partial (lazy) scoring? (shortcircuit features)

2009-09-22 Thread Matt Kettler
ArtemGr wrote: I would like to configure Spamassassin to only do certain tests when the required_score is not yet reached. For example, do the usual rule-based and bayesian tests first, and if the score is lower than the required_score, then do the DCC and RAZOR2 tests. Is it possible?

Re: partial (lazy) scoring? (shortcircuit features)

2009-09-24 Thread Matt Kettler
Matus UHLAR - fantomas wrote: Matt Kettler mkettler_sa at verizon.net writes: In theory, a feature could be added to let you do something like this (SA doesn't have this feature, but I'm proposing it could be added): On 22.09.09 11:46, ArtemGr wrote: That would be a nice

Re: 3.3.0 and sa-compile

2009-09-25 Thread Matt Kettler
to...@starbridge.org wrote: Benny Pedersen a écrit : On fre 25 sep 2009 13:38:19 CEST, to...@starbridge.org wrote I've tested with SA 3.2.5 and it's working fine with Rule2XSBody active. I've tried to delete compiled rules and compile again: same result. forget to sa-compile in 3.3 ?

Re: SQL Bayes behavior

2009-09-29 Thread Matt Kettler
pm...@email.it wrote: Hi, I've few question about the behavior of Bayes and SQL. Before the questions, i've followed this tutorial http://www200.pair.com/mecham/spam/debian-spamassassin-sql.html that should be the same thing of this:

Re: New spamhaus list not included

2009-10-04 Thread Matt Kettler
Mike Cardwell wrote: SpamHaus announced a new list a couple of days back - http://www.spamhaus.org/news.lasso?article=646 According to that page it returns results of 127.0.0.3 I just took a quick look at 20_dnsbl_tests.cf and it doesn't seem to include it yet. Currently we have:

Re: SpamAssassin Ruleset Generation

2009-10-06 Thread Matt Kettler
poifgh wrote: I have a question about - understanding how are rulesets generated for spamassassin. For example - consider the rule in 20_drugs.cf : header SUBJECT_DRUG_GAP_C Subject =~ /\bc.{0,2}i.{0,2}a.{0,2}l.{0,2}i.{0,2}s\b/i describe SUBJECT_DRUG_GAP_C Subject contains a

Re: Valid mail from blacklisted dynamic IPs

2009-10-08 Thread Matt Kettler
MySQL Student wrote: Hi, I have a set of users that are authorized to use the mail server via pop-before-smtp, but SA catches the mail they send through the system as spam because they are on blacklisted Verizon or Comcast IPs: X-Spam-Status: Yes, hits=5.4 tag1=-300.0 tag2=5.0 kill=5.0

Re: results in languages other than english

2009-10-08 Thread Matt Kettler
ahattarki wrote: The spamassassin report comes back in English. Is this configurable to return results in languages other than english. Also can a single spamassassin handle returning results in different languages. One user gets the results back in English, while another gets the results

Re: How can i block blank messeage mail

2009-10-22 Thread Matt Kettler
cofe2003 wrote: i find SA will not scan a mail if messeage is blank . so ,i want score all of blank messeages mails is 6.00 how can i do? my SA version is 3.17 thanks That's odd. SA should scan it, unless it is so blank there aren't even any headers. How have you integrated SA into

Re: update does not work correctly?

2009-10-23 Thread Matt Kettler
klop...@gmx.de wrote: Hi, I use Spamassassin 3.2.5 with CentOS On October 20 I startet an update with this commands: sa-update --channel updates.spamassassin.org When I start now the update, the date of the folder and file in /var/lib/spamassassin/3.002005 does not change. It is

Re: New to Spamassassin. Have a few ?s...

2009-11-08 Thread Matt Kettler
Computerflake wrote: I'm looking into a free spam filter that can do the following. Will Spamassassin do these things? 1) Will it filter multiple domains so I can filter for many different companies? Sure. Depending on how you set it up, you can even have per-domain customization of the

Re: About log generation

2009-11-08 Thread Matt Kettler
Jose Luis Marin Perez wrote: Dear friends, There is some configuration of SA to generate different logs and these are for each mail domain? spamd, like most well behaved unix daemons, uses syslog. It doesn't write logfiles directly. The old-school approach to this would be to run several

Re: Development dead

2009-11-11 Thread Matt Kettler
Anatoly Pugachev wrote: On 04.11.2009 / 09:20:16 -0500, Bowie Bailey wrote: polloxx wrote: Hi, Is the spamassassin development dead? On the website there's: 2008-06-12: SpamAssassin 3.2.5 has been released. Not quite. If you look at svn, you'll see this:

Re: Relation bettwen MAIL FROM: and From:

2009-11-12 Thread Matt Kettler
Luis Daniel Lucio Quiroz wrote: Hi All, I'm wondering if some know is this is possible to stop using SA. Look. MAIL FROM and From: are commonly mismatched in legitimate mail. For example, every message that you receive from this list (and every other sanely configured mailing list) will have

Re: Problem with sa-blacklist

2009-11-21 Thread Matt Kettler
Michael Monnerie wrote: I can't reach Bill Stearns, so I try at this list: Dear Bill, I'm using the sa-blacklist.reject for postfix since a long time, but these last days your rsync doesn't work anymore: rsync: failed to connect to rsync.sa-blacklist.stearns.org: Connection timed out

Re: SpamAssassin 3.3

2009-11-22 Thread Matt Kettler
LuKreme wrote: Is there a roadmap for the release of SA 3.3? Probably the best roadmap would be to look at the list of bugs assigned against 3.3.0 https://issues.apache.org/SpamAssassin/buglist.cgi?query_format=advancedbug_status=NEWbug_status=ASSIGNEDbug_status=REOPENEDversion=3.3.0 a

Re: X_Report_Header

2009-11-29 Thread Matt Kettler
Daniel D Jones wrote: Running 3.2.5 under Debian Etch. I'm trying to add the Spamassassin X_Report_Header. Per the website at http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Conf.html report_safe ( 0 | 1 | 2 ) (default: 1) ... If this option is set to 0, incoming spam is

Re: Scoring for DATE_IN_FUTURE_96_XX

2009-12-01 Thread Matt Kettler
Thomas Harold wrote: On 11/30/2009 9:27 PM, Thomas Harold wrote: While looking at the scores in 50_scores.cf, I noticed the following: score DATE_IN_FUTURE_03_06 2.303 0.416 1.461 0.274 score DATE_IN_FUTURE_06_12 3.099 3.099 2.136 1.897 score DATE_IN_FUTURE_12_24 3.300 3.299 3.000 2.189

Re: Clear Database Question

2009-12-04 Thread Matt Kettler
Jason Carson wrote: Hello everyone, Is it necessary to clear the database... sa-learn --clear ...before I run the following to train SpamAssassin's bayesian classifier... sa-learn --spam /home/jason/.maildir/.Spam/cur/ No. That would be ill advised. Running --clear deletes your

Re: Language detection in TextCat

2009-12-06 Thread Matt Kettler
Marc Perkel wrote: I'm wondering if the language detection in TextCat can be improved. Here's the situation. It appears that TextCat was designed to be inclusive. You list the languages you want and it returns many possibilities so as not to trigger unwanted falsely. What I'm doing is

Re: Possible to whitelist *all* incoming emails that contain specific text in the subject line?

2009-12-08 Thread Matt Kettler
nathang wrote: Hi, I'd like to setup an email account in cPanel so that I receive *all* incoming emails that contain a specific word in the subject line. It would be critical that I get 100% of the emails sent to me (that contain a specific word in the subject line), and that none of them

Re: Sharing and merging bayes data?

2009-12-17 Thread Matt Kettler
On 12/17/2009 2:50 AM, Rajkumar S wrote: Hello, I have 2 SA servers running for a single domain. Both were primed with a set of 200 spam and ham messages are are now auto learning. After about a day both have auto learned different numbers of ham and spam mails. Is it possible to merge the

Re: Sharing and merging bayes data?

2009-12-17 Thread Matt Kettler
On 12/17/2009 11:17 AM, RW wrote: If you're using file-based bayes, there's no good way to share updates between one DB and the other. The information needed to make such a merger successful isn't stored, because it is not needed for any reason within SpamAssassin. The database merely

Re: spamassassin or spamd with amavisd-new?

2010-01-05 Thread Matt Kettler
On 1/5/2010 6:09 AM, Angel L. Mateo wrote: Hello, Because FH_DATE_PAST_20XX bug, I have found that when I run spamassassin through amavisd-new (in a postfix server) I need to restart spamassassin and amavisd-new after any change in spamassassin. Debugging this, I found that

Re: ALL_TRUSTED rule no longer working

2010-01-05 Thread Matt Kettler
On 1/5/2010 8:03 PM, Julian Yap wrote: Previously I was running SpamAssassin-3.1.8_1 on FreeBSD. I recently upgraded to 3.2.5_4. It's seems now, I never get any hits on the rule ALL_TRUSTED. Previously it seemed like SA was doing some kind of dynamic evaluation which was working well. -

Re: ALL_TRUSTED rule no longer working

2010-01-06 Thread Matt Kettler
On 1/6/2010 3:43 PM, Julian Yap wrote: On Tue, Jan 5, 2010 at 5:12 PM, Matt Kettler mkettler...@verizon.net mailto:mkettler...@verizon.net wrote: On 1/5/2010 8:03 PM, Julian Yap wrote: Previously I was running SpamAssassin-3.1.8_1 on FreeBSD. I recently upgraded to 3.2.5_4

  1   2   3   4   5   6   7   8   9   10   >