gmane.mail.spam.spamassassin.general

sa-learn expire not working. Keeps complaining about delta atime

rtsit — 2012-05-26T04:04:42

I've got bayes running on a per-user database.  When I run:

sa-learn -D -u SOMEUSER --force-expire

It goes through and tries to expire. It decides it wants to remove 34399
tokens, but it can't do it due to an invalid delta atime. I'm confused.

This particular user has the following values in the bayes_vars MySQL table:
spam_count: 1440
ham_count: 652
token_count: 146899

Since it's over the threshold of 112500 I figured that it would expire the
extra tokens. 

INSTEAD, it complains about delta not having a good atime.

I'm watching this MySQL DB getting bigger and bigger, and expecting it's
eventually going to grow exponentially large unless the expire functions
work.

I'm currently at 227 megs for the .MYD file and 428 megs for the .MYI file.

The last time I had an issue, the database was in excess of 4 gigs.

Here's the debug output. If someone can give me a hint on how to give a
proper delta atime, I'd be really thankful.

May 25 20:55:12.219 [8792] dbg: bayes: using username: SOMEUSER< at >example.com
May 25 20:55:12.219 [8792] dbg: bayes: learner_new: got
store=Mail::SpamAssassin::BayesStore::MySQL=HASH(0x8055549c0)
May 25 20:55:12.220 [8792] dbg: plugin:
Mail::SpamAssassin::Plugin::Bayes=HASH(0x80488a7b0) implements
'learner_is_scan_available', priority 0
May 25 20:55:12.400 [8792] dbg: bayes: database connection established
May 25 20:55:12.401 [8792] dbg: bayes: found bayes db version 3
May 25 20:55:12.403 [8792] dbg: bayes: Using userid: 80
May 25 20:55:12.405 [8792] dbg: config: score set 3 chosen.
May 25 20:55:12.406 [8792] dbg: sa-learn: spamtest initialized
May 25 20:55:12.406 [8792] dbg: learn: initializing learner
May 25 20:55:12.407 [8792] dbg: plugin:
Mail::SpamAssassin::Plugin::Bayes=HASH(0x80488a7b0) implements
'learner_sync', priority 0
May 25 20:55:12.408 [8792] dbg: bayes: bayes journal sync starting
May 25 20:55:12.408 [8792] dbg: bayes: bayes journal sync completed
May 25 20:55:12.409 [8792] dbg: plugin:
Mail::SpamAssassin::Plugin::Bayes=HASH(0x80488a7b0) implements
'learner_expire_old_training', priority 0
May 25 20:55:12.410 [8792] dbg: bayes: expiry starting
May 25 20:55:12.432 [8792] dbg: bayes: expiry check keep size, 0.75 * max:
112500
May 25 20:55:12.433 [8792] dbg: bayes: token count: 146899, final goal
reduction size: 34399
May 25 20:55:12.433 [8792] dbg: bayes: first pass? current: 1338004512,
Last: 1337967033, atime: 0, count: 0, newdelta: 0, ratio: 0, period: 43200
May 25 20:55:12.434 [8792] dbg: bayes: can't use estimation method for
expiry, unexpected result, calculating optimal atime delta (first pass)
May 25 20:55:12.434 [8792] dbg: bayes: expiry max exponent: 9
May 25 20:55:13.466 [8792] dbg: bayes: atime token reduction
May 25 20:55:13.466 [8792] dbg: bayes: ======== ===============
May 25 20:55:13.467 [8792] dbg: bayes: 43200 127066
May 25 20:55:13.467 [8792] dbg: bayes: 86400 119617
May 25 20:55:13.467 [8792] dbg: bayes: 172800 99251
May 25 20:55:13.468 [8792] dbg: bayes: 345600 71996
May 25 20:55:13.468 [8792] dbg: bayes: 691200 37284
May 25 20:55:13.468 [8792] dbg: bayes: 1382400 0
May 25 20:55:13.468 [8792] dbg: bayes: 2764800 0
May 25 20:55:13.469 [8792] dbg: bayes: 5529600 0
May 25 20:55:13.469 [8792] dbg: bayes: 11059200 0
May 25 20:55:13.469 [8792] dbg: bayes: 22118400 0
May 25 20:55:13.470 [8792] dbg: bayes: couldn't find a good delta atime,
need more token difference, skipping expire
May 25 20:55:13.472 [8792] dbg: bayes: expiry completed
May 25 20:55:13.473 [8792] dbg: plugin:
Mail::SpamAssassin::Plugin::Bayes=HASH(0x80488a7b0) implements
'learner_close', priority 0


:confused:

X-Spam-Checker-Version doesn't reflect what sa-update we are at

2012-05-25T21:26:45

Isn't it bad that X-Spam-Checker-Version doesn't report what sa-update
we are up to so far, and that there is no additional other variable that
we can toggle on in reports to do that.

syswrite() to parent failed:

Andy Jezierski — 2012-05-24T15:28:18

Just installed a new instance of spamassassin to offload some of the spam 
processing from our main server. Occaisionally the following message will 
appear and I'll have to restart spamd in order to get things going again.

syswrite() to parent failed: Broken pipe at 
/usr/local/lib/perl5/site_perl/5.14.2/Mail/SpamAssassin/SpamdForkScaling.pm 
line 579.

FreeBSD 8.2
perl 5.14.2_2
SA 3.3.2_6

Any ideas?

Thanks
Andy

Suddenly getting lots of false positives.

Jeremy Morton — 2012-05-24T09:14:11

I've gotten a lot of false positives coming into my inbox lately, and 
the principle reason for most of them seems to be that they are matching 
the following rule:
-4.0 RCVD_IN_DNSWL_MED      RBL: Sender listed at http://www.dnswl.org/, 
medium trust

I'm not sure why they're matching this rule, so I thought I'd ask you 
guys to see whether you could figure it out.  Here's a sample message 
that made it through my spam filter, which is definitely spam (note that 
I have it configured to attach X-Spam-Report to every message so I can 
see why it was NOT marked as spam):

==================================================
 From - Wed May 23 10:53:41 2012
X-Account-Key: account2
X-UIDL: UID308596-1160697276
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys: 

Return-path: <niw9< at >etisbew.com>
Envelope-to: bugzilla< at >game-point.net
Delivery-date: Wed, 23 May 2012 10:37:58 +0100
Received: from [59.94.13.26]
by ip.game-point.net with esmtp (Exim 4.69)
(envelope-from <niw9< at >etisbew.com>)
id 1SX80z-0005qn-7r
for bugzilla< at >game-point.net; Wed, 23 May 2012 10:37:58 +0100
Received: from apache by etisbew.com with local (Exim 4.63)
(envelope-from <splashedoo6< at >realliving.com>)
id A10PD7-HLT0O1-68
for bugzilla< at >game-point.net; Wed, 23 May 2012 15:07:55 +0530
To: bugzilla< at >game-point.net
Subject: Good afternoon,
Date: Wed, 23 May 2012 15:07:55 +0530
From: "Stella Cotton" <niw9< at >etisbew.com>
Message-ID: <74FC52565ECB52BB625FD430CB8D155D< at >etisbew.com>
X-Priority: 3
X-Mailer: PHPMailer 5.1 (phpmailer.sourceforge.net)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="------------03070800307080108050505"
X-Spam-Status: No, score=0.7
X-Spam-Score: 7
X-Spam-Bar: /
X-Spam-Flag: NO
X-Spam-Report: Spam detection software, running on the system 
"ip.game-point.net", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
the administrator of that system for details.
Content preview:  It is what a man needs to overcome the most delicate 
problem.
Your power and strength of your porksword will please her! Make your body
as strong as your spirit is!Click It is what a man needs to overcome the
most delicate problem. Your power and strength of your porksword will 
please
her! Make your body as strong as your spirit is! [...]
Content analysis details:   (0.7 points, 3.0 required)
pts rule name              description
---- ---------------------- 
--------------------------------------------------
1.5 URIBL_WS_SURBL         Contains an URL listed in the WS SURBL blocklist
[URIs: bestinternetdancer.com]
1.5 URIBL_JP_SURBL         Contains an URL listed in the JP SURBL blocklist
[URIs: bestinternetdancer.com]
-4.0 RCVD_IN_DNSWL_MED      RBL: Sender listed at 
http://www.dnswl.org/, medium
trust
[59.94.13.26 listed in list.dnswl.org]
0.9 RCVD_IN_SORBS_DUL      RBL: SORBS: sent directly from dynamic IP 
address
[59.94.13.26 listed in dnsbl.sorbs.net]
0.6 SPF_SOFTFAIL           SPF: sender does not match SPF record (softfail)
0.2 BAYES_60               BODY: Bayesian spam probability is 60 to 80%
[score: 0.6609]
0.0 HTML_MESSAGE           BODY: HTML included in message

This is a multi-part message in MIME format.
--------------03070800307080108050505
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="iso-8859-2"

It is what a man needs to overcome the most delicate problem. Your power 
and strength of your porksword will please her! Make your body as strong 
as your spirit is!Click

--------------03070800307080108050505
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="us-ascii"

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1250">
<STYLE></STYLE>
</HEAD>
<BODY>
<div style="width:600px;">
<div style="background: none repeat scroll 0 0 #FDF3F0; border-top: 3px 
solid #E7431D; padding: 25px;">
<div style="font-size: 180%;">

<em>It is what a man needs to overcome the most delicate problem. 
<br>Your power and strength of your porksword will please her! <br>Make 
your body as strong as your spirit is!</em>
</div>
</div>
<div id="nav" style="background: none repeat scroll 0 0 #4D4D4F; 
font-size: 90%; line-height: 40px;">
<a style="color: #FFFFFF; padding: 12px 25px;" 
href="http://pijqasos.bestinternetdancer.com/page.html?Wsl7zrBeopsqjfqBjDy27csllzE">Click</a> 

</div>
</div>
</BODY></HTML>
--------------03070800307080108050505--
==================================================


Any ideas why the sender would be in the dnswl with medium trust?  I did 
recently change my machine's hostname to ip.game-point.net.

Documentation for: bayes_auto_learn ?

corpus.defero — 2012-05-22T07:53:39

I can't seem to find any documentation on bayes_auto_learn, in
particular how it works / where it creates the db / how it sources
spam/ham.

Is there a link anyone knows of that gives some detail on it?

New SpamAssassin Project Chair

Kevin A. McGrail — 2012-05-20T19:34:07

Good Afternoon Everyone,

I am both humbled and honored to report that I have accepted the 
nomination of the SpamAssassin PMC to serve as the new project chair.  
On April 18th, the Board of Directors for the Apache Software Foundation 
accepted the nomination and appointed me to the position.

Unfortunately and for very good reasons, our previous chair, Daryl C. W. 
O'Shea is no longer unavailable to help the project.  I hope all can 
join me in thanking Daryl for his service to the project.  And while he 
will be sorely missed, for privacy reasons, I can only tell you that he 
is urgently needed elsewhere.  But I'm certain he needs and would 
appreciate all the good karma we can send his way.

Over the past few weeks, I've been working to get up to speed on my 
duties.  Luckily, I attended the ASF BarCamp DC conference yesterday.  
Not only was it a great conference with great people that taught me a 
few things but several of the attendees were very helpful in helping me 
overcome a few hurdles.   Many thanks to Nick Burch, Greg Stein, 
Christopher Guest, and Tim Williams for their help!

I'll be working hard to shepherd the 3.4.0 release as soon as possible 
and look forward to helping the project.

Regards,
Kevin A. McGrail aka KAM

(unknown)

Jose Sanchez — 2012-05-18T23:55:41

<p>Online Business Opportunity for you<br><a href="http://www.selbsthilfe.narod.ru/newsjournal/96AlanRichardson/">http://www.selbsthilfe.narod.ru/newsjournal/96AlanRichardson/</a></p>

FILL_THIS_FORM_LONG usage

dhanushka ranasinghe — 2012-05-18T14:20:40

Hi.....

What sort of spams are block by the FILL_THIS_FORM_LONG   rule


Thank You

log sender IP

Chris Hunt — 2012-05-17T23:35:02

I'm hoping to track scores by sender IP.  Do any gurus know how I can
get the original sender's IP address into this log line?

May 17 04:08:19 mail01 spamd[20409]: spamd: result: . 2 -
AWL,BAYES_50,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_02,HTML_MESSAGE,SPF_HELO_PASS,URIBL_WS_SURBL
scantime=0.9,size=9109,user=happydog< at >willapabay.org,uid=105,required_score=5.0,rhost=mail01-01.reachone.com,raddr=127.0.0.1,rport=36534,mid=<16780360.84780< at >patriotupdate.com>,bayes=0.500889,autolearn=no

Please note that since it's a Postfix milter, the spamd daemon sees
[remoteaddr] as 127.0.0.1:

May 17 16:27:38 mail1spamd[2187]: spamd: [...] [127.0.0.1] for
drsmooth< at >olynet.com:104 in 2.2 seconds, 2373 bytes.

I'm hoping custom spamassassin plugin is not the answer :)

TIA,
Chris

__DRUG_MUSCLE1 false-positives

David F. Skoll — 2012-05-17T15:18:17

Hi,

We have a Swedish customer who is seeing lots of DRUG_MUSCLE FP's.  It
turns out that __DRUG_MUSCLE1 is triggering on the common Swedish
phrase "som är".

I looked at the regex and it seems that Perl treats är as having a
word boundary in the \b sense between the "ä" and the "r"

Maybe rewrite as follows (untested):

body __DRUGS_MUSCLE1        /(?:\b|\s)[_\W]{0,3}s[_\W]{0,3}[o0\xF2-\xF6][_\W]{0,3}m[_\W]{0,3}[a4\xE0-\xE6< at >][_\W]{0,3}(?!\w)/i

Regards,

David.

regex needed for http link

Joseph Acquisto — 2012-05-16T21:05:23

I have been unsuccessful creating a rule to detect and weight http links in message body, such as this one below:

http://boguslink.ru 

The ones I have created get "hits" when tested on the command line, but don't seem to work in local.cf.  Maybe that's the wrong place?

SpamAssassin have many fails on my ubuntu 12.04

Damien Guillaume — 2012-05-15T18:14:40

Hi All,

I post on this list because since several days I've problems with my SpamAssassin. 
He crash several times in 1 day. I need just to make /etc/init.d/spamassassin start and it work again.

In Debug, I've that on the last 10 lines before the crash:
Tue May 15 19:30:00 2012 [18645] dbg: prefork: sysread(17) not ready, wait max 300 secs
Tue May 15 19:30:01 2012 [18647] dbg: timing: total 4731 ms - load_scoreonly_sql: 139 (2.9%), signal_user_changed: 30 (0.6%), parse: 19 (0.4%), extract_message_metadata: 106 (2.2%), get_uri_detail_list: 12 (0.3%), tests_pri_-1000: 13 (0.3%), tests_pri_-950: 2 (0.0%), tests_pri_-900: 3 (0.1%), tests_pri_-400: 94 (2.0%), check_bayes: 83 (1.7%), tests_pri_0: 2896 (61.2%), check_dkim_signature: 2 (0.0%), check_dkim_adsp: 68 (1.4%), check_spf: 102 (2.2%), poll_dns_idle: 83 (1.8%), check_razor2: 673 (14.2%), check_pyzor: 0.10 (0.0%), tests_pri_500: 9 (0.2%), rewrite_mail: 3 (0.1%), copy_config: 1378 (29.1%)
Tue May 15 19:30:01 2012 [18647] dbg: prefork: sysread(18) not ready, wait max 300 secs
Tue May 15 19:30:01 2012 [18466] dbg: timing: total 2397 ms - load_scoreonly_sql: 1.99 (0.1%), signal_user_changed: 2 (0.1%), parse: 1.43 (0.1%), extract_message_metadata: 150 (6.3%), get_uri_detail_list: 16 (0.7%), tests_pri_-1000: 58 (2.4%), tests_pri_-950: 1.57 (0.1%), tests_pri_-900: 15 (0.6%), tests_pri_-400: 96 (4.0%), check_bayes: 73 (3.0%), tests_pri_0: 742 (31.0%), check_dkim_signature: 0.83 (0.0%), check_dkim_adsp: 47 (2.0%), check_spf: 63 (2.6%), poll_dns_idle: 55 (2.3%), check_razor2: 410 (17.1%), check_pyzor: 0.06 (0.0%), tests_pri_500: 14 (0.6%), learn: 280 (11.7%), rewrite_mail: 5 (0.2%), copy_config: 966 (40.3%)
Tue May 15 19:30:01 2012 [18466] dbg: prefork: sysread(8) not ready, wait max 300 secs
Tue May 15 19:30:36 2012 [18647] dbg: prefork: parent closed, exiting
Tue May 15 19:30:36 2012 [18645] dbg: prefork: parent closed, exiting
Tue May 15 19:30:36 2012 [18600] dbg: prefork: parent closed, exiting
Tue May 15 19:30:36 2012 [18466] dbg: prefork: parent closed, exiting
Tue May 15 19:30:36 2012 [16335] dbg: prefork: parent closed, exiting

That's my /etc/default/spamassassin:
ENABLED=1
SAHOME="/var/log/spamassassin/"
OPTIONS="-D -u vmail --sql-config --nouser-config --daemonize --max-children=15 --create-prefs --setuid-with-sql --helper-home-dir=${SAHOME} --syslog=${SAHOME}spamd.log"
PIDFILE="/var/run/spamd.pid"
CRON=0

I've try to reduce the max-children of 10 or 5 but the Spamassasin crash same if I've 15 or more ...

Have any people in the same situation ? Or have you a idea what's I can check ?
SpamAssassin version 3.3.2
  running on Perl version 5.14.2

That's is my "transport" with postfix:
spamassassin    unix            -               n               n               -               -               pipe
                flags=Rq user=vmail argv=/usr/bin/spamc -u ${user}< at >${nexthop} -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

That's is my local.cf
ok_locales              all
rbl_timeout     4
dns_available   yes
time_limit      300
use_bayes               1
bayes_auto_learn              1
use_bayes_rules 1
bayes_path      /home/.spamassassin/bayes
bayes_file_mode 0770
bayes_auto_expire       1
bayes_journal_max_size  150000000
bayes_expiry_max_db_size        200000000
ifplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold
bayes_auto_learn_threshold_nonspam      0.1
bayes_auto_learn_threshold_spam 12.0
endif # Mail::SpamAssassin::Plugin::AutoLearnThreshold
skip_rbl_checks         0
use_razor2              1
razor_config    /etc/razor/razor-agent.conf
razor_timeout   10
use_pyzor               0
pyzor_path      /usr/bin/pyzor
pyzor_max       3
pyzor_timeout   10
required_score           5.0
report_safe             0
rewrite_header  Subject *SPAM*
score BAYES_00 -6.1
score BAYES_01 -5.0
score BAYES_10 -3.5
score BAYES_20 -2.0
score BAYES_30 -1.0
score BAYES_40 -0.3
score BAYES_44 -0.01
score BAYES_50 0.01
score BAYES_56 0.3
score BAYES_60 1.0
score BAYES_70 1.6
score BAYES_80 3.1
score BAYES_90 5.2
score BAYES_99 7.2
score RAZOR2_CHECK 1.8
score RAZOR2_CF_RANGE_11_50 0.32
score RAZOR2_CF_RANGE_51_100 2.7
score PYZOR_CHECK 4.8
user_scores_dsn                  DBI:mysql:spamassassin:localhost
user_scores_sql_password         *****
user_scores_sql_username         spamassassin
user_scores_sql_custom_query     SELECT preference, value FROM userpref WHERE username = _USERNAME_ OR username = '$GLOBAL' OR username = CONCAT('%',_DOMAIN_) ORDER BY username ASC

Thank,
Damien

Debug messages in test-mode report

Brent Gardner — 2012-05-15T18:07:00

Upgrading from v3.2.5 to v3.3.2 on 32-bit CentOS v5.8 with Perl v5.8.8 
on a test machine before deploying to the production servers.

Doing some tests, lint shows no errors.  I run something like 
'spamassassin -D -t < message.txt 2>&1' and sometimes I see debug 
messages in the test-mode report, as in this example: 
http://pastebin.com/jUH1YXvq

Should I be worried about this?  All other messages produced by -D seem 
to indicate proper or expected operation.  Never saw this behavior with 
v3.2.5


Thanks.


Brent Gardner

how decode tokens's column

Jacopo Fabiani — 2012-05-11T13:34:51

Hi,
I am Jacopo Fabiani, a Computer Science student of Pisa.
I'm trying to get spam/ham tokens stored in Department's spamassasin
database which should be useful to create a query classifier.
I got a dump of database with the command sa-learn --backup but I have some
problem to encode the token's column.
Below you can see what I get:
v    3    db_version # this must be the first line!!!
v    142549    num_spam
v    66900    num_nonspam
t    29875    17211    1335967225    2dd27dc5f9
t    1573    2752    1335249870    c0614089c0

I think the last column should contain the token. First, I tried to convert
from hex to ascii but I didn't solve the problem.

Then I looked inside the code of backup_database() function inside
Mail::SpamAssassin::BayesStore::BDB and I found that tokens are encoded
with unpack function:

my $encoded = unpack("H*", $token);

So, after I looked inside restore_database() function, I tried to do the
inverse process using the pack function but it does not solve the problem:

$token = pack("H*",$encoded);

print $token; <-- it prints a non-sense value

also I tried to use sha1 function:

$token = substr(sha1($encoded), -5);
print $token; <-- it prints a non-sense value

My question is: where do I get wrong? Is there a way to decode encoded
token that I got with sa-learn --backup command?

Best Regards,
Jacopo.

KB_FAKED_THE_BAT

Mike Grau — 2012-05-03T17:02:04

Hello all,

Just an FYI ...

The meta rule in 72_active.cf "KB_FAKED_THE_BAT" is getting circumvented
here because the meta rule component

 header   __KB_DATE_CONTAINS_TAB  Date:raw =~ /^\t

is being evaded by spam that now has a space character before the tab:

# grep Date: HEADERS | od -a
0000000   D   a   t   e   :  sp  ht   T   h   u   ,  sp   3  sp   M   a
0000020   y  sp   2   0   1   2  sp   1   6   :   5   3   :   5   9  sp
0000040   +   0   7   0   0  nl
0000046vi H*

This has been Russian language spam (charset koi8-r) with various
flavors of X-Mailer: The Bat!

new twist on BitLy

Chip M. — 2012-05-03T06:26:04

There's a new campaign using "bitly.com", instead of "bit.ly".

Other characteristics are:
1. empty plain text Part, followed by a quoted-printable HTML Part
2. very long HTML Title
3. large Style section, with random text (Bayes salad like)
4. current Subject is "FW: your arrest record"

I expect the Subject to change, soon.

I had a few "hunh" moments trying to figure out why my system 
wasn't extracting the shortener parameter, and why NONE of 
my shortener code was kicking in, then had the "doh!" moment.
Figured I'd try to save someone else that headache. :)

As soon as I realized that "bitly.com" is (apparently) a 
legit alias for the terser "bit.ly", I naively jumped to the 
theory that I could probably kill all of those, because who 
(other than spammers) would be thick enough to use a 
longer URL as a shortener.

I've had plenty of naive "obvious" solutions foiled by Pakled
senders, so loaded up six months of my most diverse corpus.

Found two spam, and two ham.

Fortunately, the two ham were both political mailing lists,
which explains the twittery, and reinforces my prejudice that 
it's ok to score this domain heavily, as long as one has a 
good quarantine and FP pipeline.

I'll check some more corpora this weekend, and report back if
there's any non-trivial ham using this domain.
- "Chip"

I think spamasasin doesnt actualize spam list

Pruebito — 2012-05-02T14:34:23

I have problems sending mail since 7 days. I have tested the headers and hav
this result:

 pts rule name              description
---- ----------------------
--------------------------------------------------
 0.0 URIBL_RED              Contains an URL listed in the URIBL redlist
                            [URIs: posicionamientowebbuscadores.es]
 0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
blocked.
                            See
                           
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                             for more information.
                            [URIs: posicionamientowebbuscadores.es]
 0.4 URIBL_GREY             Contains an URL listed in the URIBL greylist
                            [URIs: posicionamientowebbuscadores.es]
 0.6 URIBL_PH_SURBL         Contains an URL listed in the PH SURBL blocklist
                            [URIs: posicionamientowebbuscadores.es]
 1.6 URIBL_WS_SURBL         Contains an URL listed in the WS SURBL blocklist
                            [URIs: posicionamientowebbuscadores.es]
 4.5 URIBL_AB_SURBL         Contains an URL listed in the AB SURBL blocklist
                            [URIs: posicionamientowebbuscadores.es]
 1.2 URIBL_JP_SURBL         Contains an URL listed in the JP SURBL blocklist
                            [URIs: posicionamientowebbuscadores.es]
 0.1 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL blocklist
                            [URIs: posicionamientowebbuscadores.es]

If I go to SURBL list they says my domain is not the list.

spamassasin is actualizing this list?

FS_REPLICA rule

dhanushka ranasinghe — 2012-05-02T12:00:14

hi guys ...

Do you now whats the purpose of this rule, and what sort of spams are
blocking by this mail...few legitimate mails block by this rule

##{ FS_REPLICA
header   FS_REPLICA             Subject =~ /replica/i^M
describe FS_REPLICA             Subject says "replica"^M
##} FS_REPLICA



Thank You
Dhanushka

STOX_REPLY_TYPE_WITHOUT_QUOTES

corpus.defero — 2012-04-27T13:28:21

I'm seeing this rule: STOX_REPLY_TYPE_WITHOUT_QUOTES
Catching on legitimate mail.

It's a meta rule and right enough it catches this line:

Content-Type: text/plain; format=flowed; charset="iso-8859-1";
reply-type=original

AND does NOT match either:

__HS_SUBJ_RE_FW Subject =~ /^(?i:re|fw):/
or
rawbody __HS_QUOTE /^> 

SCORING.
 0.2 STOX_REPLY_TYPE        STOX_REPLY_TYPE
 1.9 STOX_REPLY_TYPE_WITHOUT_QUOTES STOX_REPLY_TYPE_WITHOUT_QUOTES

As legitimate mail, it's picking up just over 2 points for this - and
I'm wondering what the sender is possibly doing wrong here?

Global and per-user bayesian databases

Robert Wysocki — 2012-04-27T10:57:33

Hi,

Our old environment used per-user bayesian databases, but now we've
decided to use one that is site-wide.

The thing is that some users managed to train their bayes filters quite
well and we don't want to loose it.

So is it possible to configure spamassassin to use both global and
per-user bayesian databases?

Or is it possible to import one database to another _without_
overwriting the second one?

Regards,

Sweet spamassassin server hardware

Marc Perkel — 2012-04-25T15:52:23

Just bought this at NewEgg and it's making a great SA server. Using a 
desktop Asus motherboard, 8 core AMD processor < at > 3.6 ghz per core - and 
32 gigs of ram. And you can get all that for $600.

Pretty amazing!