http://blog.gmane.org/gmane.mail.spam.spamassassin.general hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137381 <pre> I've got bayes running on a per-user database. When I run: sa-learn -D -u SOMEUSER --force-expire It goes through and tries to expire. It decides it wants to remove 34399 tokens, but it can't do it due to an invalid delta atime. I'm confused. This particular user has the following values in the bayes_vars MySQL table: spam_count: 1440 ham_count: 652 token_count: 146899 Since it's over the threshold of 112500 I figured that it would expire the extra tokens. INSTEAD, it complains about delta not having a good atime. I'm watching this MySQL DB getting bigger and bigger, and expecting it's eventually going to grow exponentially large unless the expire functions work. I'm currently at 227 megs for the .MYD file and 428 megs for the .MYI file. The last time I had an issue, the database was in excess of 4 gigs. Here's the debug output. If someone can give me a hint on how to give a proper delta atime, I'd be really thankful. May 25 20:55:12.219 [8792] dbg: bayes: using username: SOMEUSER&lt; at &gt;example.com Ma</pre> rtsit 2012-05-26T04:04:42 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137379 <pre>Isn't it bad that X-Spam-Checker-Version doesn't report what sa-update we are up to so far, and that there is no additional other variable that we can toggle on in reports to do that. </pre> jidanni< at >jidanni.org 2012-05-25T21:26:45 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137376 <pre>Just installed a new instance of spamassassin to offload some of the spam processing from our main server. Occaisionally the following message will appear and I'll have to restart spamd in order to get things going again. syswrite() to parent failed: Broken pipe at /usr/local/lib/perl5/site_perl/5.14.2/Mail/SpamAssassin/SpamdForkScaling.pm line 579. FreeBSD 8.2 perl 5.14.2_2 SA 3.3.2_6 Any ideas? Thanks Andy</pre> Andy Jezierski 2012-05-24T15:28:18 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137353 <pre>I've gotten a lot of false positives coming into my inbox lately, and the principle reason for most of them seems to be that they are matching the following rule: -4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium trust I'm not sure why they're matching this rule, so I thought I'd ask you guys to see whether you could figure it out. Here's a sample message that made it through my spam filter, which is definitely spam (note that I have it configured to attach X-Spam-Report to every message so I can see why it was NOT marked as spam): ================================================== From - Wed May 23 10:53:41 2012 X-Account-Key: account2 X-UIDL: UID308596-1160697276 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-path: &lt;niw9&lt; at &gt;etisbew.com&gt; Envelope-to: bugzilla&lt; at &gt;game-point.net Delivery-date: Wed, 23 May 2012 10:37:58 +0100 Received: from [59.94.13.26] by ip.game-point.net with esmtp (Exim 4.69) (envelope-from &lt;niw9&lt; at &gt;etisbew.com&gt;) id 1SX80z-00</pre> Jeremy Morton 2012-05-24T09:14:11 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137351 <pre>I can't seem to find any documentation on bayes_auto_learn, in particular how it works / where it creates the db / how it sources spam/ham. Is there a link anyone knows of that gives some detail on it? </pre> corpus.defero 2012-05-22T07:53:39 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137349 <pre>Good Afternoon Everyone, I am both humbled and honored to report that I have accepted the nomination of the SpamAssassin PMC to serve as the new project chair. On April 18th, the Board of Directors for the Apache Software Foundation accepted the nomination and appointed me to the position. Unfortunately and for very good reasons, our previous chair, Daryl C. W. O'Shea is no longer unavailable to help the project. I hope all can join me in thanking Daryl for his service to the project. And while he will be sorely missed, for privacy reasons, I can only tell you that he is urgently needed elsewhere. But I'm certain he needs and would appreciate all the good karma we can send his way. Over the past few weeks, I've been working to get up to speed on my duties. Luckily, I attended the ASF BarCamp DC conference yesterday. Not only was it a great conference with great people that taught me a few things but several of the attendees were very helpful in helping me overcome a few hurdles. Many t</pre> Kevin A. McGrail 2012-05-20T19:34:07 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137347 <pre>&lt;p&gt;Online Business Opportunity for you&lt;br&gt;&lt;a href="http://www.selbsthilfe.narod.ru/newsjournal/96AlanRichardson/"&gt;http://www.selbsthilfe.narod.ru/newsjournal/96AlanRichardson/&lt;/a&gt;&lt;/p&gt; </pre> Jose Sanchez 2012-05-18T23:55:41 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137344 <pre>Hi..... What sort of spams are block by the FILL_THIS_FORM_LONG rule Thank You </pre> dhanushka ranasinghe 2012-05-18T14:20:40 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137339 <pre>I'm hoping to track scores by sender IP. Do any gurus know how I can get the original sender's IP address into this log line? May 17 04:08:19 mail01 spamd[20409]: spamd: result: . 2 - AWL,BAYES_50,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_02,HTML_MESSAGE,SPF_HELO_PASS,URIBL_WS_SURBL scantime=0.9,size=9109,user=happydog&lt; at &gt;willapabay.org,uid=105,required_score=5.0,rhost=mail01-01.reachone.com,raddr=127.0.0.1,rport=36534,mid=&lt;16780360.84780&lt; at &gt;patriotupdate.com&gt;,bayes=0.500889,autolearn=no Please note that since it's a Postfix milter, the spamd daemon sees [remoteaddr] as 127.0.0.1: May 17 16:27:38 mail1spamd[2187]: spamd: [...] [127.0.0.1] for drsmooth&lt; at &gt;olynet.com:104 in 2.2 seconds, 2373 bytes. I'm hoping custom spamassassin plugin is not the answer :) TIA, Chris </pre> Chris Hunt 2012-05-17T23:35:02 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137330 <pre>Hi, We have a Swedish customer who is seeing lots of DRUG_MUSCLE FP's. It turns out that __DRUG_MUSCLE1 is triggering on the common Swedish phrase "som är". I looked at the regex and it seems that Perl treats är as having a word boundary in the \b sense between the "ä" and the "r" Maybe rewrite as follows (untested): body __DRUGS_MUSCLE1 /(?:\b|\s)[_\W]{0,3}s[_\W]{0,3}[o0\xF2-\xF6][_\W]{0,3}m[_\W]{0,3}[a4\xE0-\xE6&lt; at &gt;][_\W]{0,3}(?!\w)/i Regards, David. </pre> David F. Skoll 2012-05-17T15:18:17 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137322 <pre>I have been unsuccessful creating a rule to detect and weight http links in message body, such as this one below: http://boguslink.ru The ones I have created get "hits" when tested on the command line, but don't seem to work in local.cf. Maybe that's the wrong place? </pre> Joseph Acquisto 2012-05-16T21:05:23 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137321 <pre>Hi All, I post on this list because since several days I've problems with my SpamAssassin. He crash several times in 1 day. I need just to make /etc/init.d/spamassassin start and it work again. In Debug, I've that on the last 10 lines before the crash: Tue May 15 19:30:00 2012 [18645] dbg: prefork: sysread(17) not ready, wait max 300 secs Tue May 15 19:30:01 2012 [18647] dbg: timing: total 4731 ms - load_scoreonly_sql: 139 (2.9%), signal_user_changed: 30 (0.6%), parse: 19 (0.4%), extract_message_metadata: 106 (2.2%), get_uri_detail_list: 12 (0.3%), tests_pri_-1000: 13 (0.3%), tests_pri_-950: 2 (0.0%), tests_pri_-900: 3 (0.1%), tests_pri_-400: 94 (2.0%), check_bayes: 83 (1.7%), tests_pri_0: 2896 (61.2%), check_dkim_signature: 2 (0.0%), check_dkim_adsp: 68 (1.4%), check_spf: 102 (2.2%), poll_dns_idle: 83 (1.8%), check_razor2: 673 (14.2%), check_pyzor: 0.10 (0.0%), tests_pri_500: 9 (0.2%), rewrite_mail: 3 (0.1%), copy_config: 1378 (29.1%) Tue May 15 19:30:01 2012 [18647] dbg: prefork: sysread(18) not ready, </pre> Damien Guillaume 2012-05-15T18:14:40 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137320 <pre>Upgrading from v3.2.5 to v3.3.2 on 32-bit CentOS v5.8 with Perl v5.8.8 on a test machine before deploying to the production servers. Doing some tests, lint shows no errors. I run something like 'spamassassin -D -t &lt; message.txt 2&gt;&amp;1' and sometimes I see debug messages in the test-mode report, as in this example: http://pastebin.com/jUH1YXvq Should I be worried about this? All other messages produced by -D seem to indicate proper or expected operation. Never saw this behavior with v3.2.5 Thanks. Brent Gardner </pre> Brent Gardner 2012-05-15T18:07:00 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137315 <pre>Hi, I am Jacopo Fabiani, a Computer Science student of Pisa. I'm trying to get spam/ham tokens stored in Department's spamassasin database which should be useful to create a query classifier. I got a dump of database with the command sa-learn --backup but I have some problem to encode the token's column. Below you can see what I get: v 3 db_version # this must be the first line!!! v 142549 num_spam v 66900 num_nonspam t 29875 17211 1335967225 2dd27dc5f9 t 1573 2752 1335249870 c0614089c0 I think the last column should contain the token. First, I tried to convert from hex to ascii but I didn't solve the problem. Then I looked inside the code of backup_database() function inside Mail::SpamAssassin::BayesStore::BDB and I found that tokens are encoded with unpack function: my $encoded = unpack("H*", $token); So, after I looked inside restore_database() function, I tried to do the inverse process using the pack function but it does not solve the problem: $token = pack</pre> Jacopo Fabiani 2012-05-11T13:34:51 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137313 <pre>Hello all, Just an FYI ... The meta rule in 72_active.cf "KB_FAKED_THE_BAT" is getting circumvented here because the meta rule component header __KB_DATE_CONTAINS_TAB Date:raw =~ /^\t is being evaded by spam that now has a space character before the tab: # grep Date: HEADERS | od -a 0000000 D a t e : sp ht T h u , sp 3 sp M a 0000020 y sp 2 0 1 2 sp 1 6 : 5 3 : 5 9 sp 0000040 + 0 7 0 0 nl 0000046vi H* This has been Russian language spam (charset koi8-r) with various flavors of X-Mailer: The Bat! </pre> Mike Grau 2012-05-03T17:02:04 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137312 <pre>There's a new campaign using "bitly.com", instead of "bit.ly". Other characteristics are: 1. empty plain text Part, followed by a quoted-printable HTML Part 2. very long HTML Title 3. large Style section, with random text (Bayes salad like) 4. current Subject is "FW: your arrest record" I expect the Subject to change, soon. I had a few "hunh" moments trying to figure out why my system wasn't extracting the shortener parameter, and why NONE of my shortener code was kicking in, then had the "doh!" moment. Figured I'd try to save someone else that headache. :) As soon as I realized that "bitly.com" is (apparently) a legit alias for the terser "bit.ly", I naively jumped to the theory that I could probably kill all of those, because who (other than spammers) would be thick enough to use a longer URL as a shortener. I've had plenty of naive "obvious" solutions foiled by Pakled senders, so loaded up six months of my most diverse corpus. Found two spam, and two ham. Fortunately, the two ham were both po</pre> Chip M. 2012-05-03T06:26:04 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137309 <pre> I have problems sending mail since 7 days. I have tested the headers and hav this result: pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_RED Contains an URL listed in the URIBL redlist [URIs: posicionamientowebbuscadores.es] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: posicionamientowebbuscadores.es] 0.4 URIBL_GREY Contains an URL listed in the URIBL greylist [URIs: posicionamientowebbuscadores.es] 0.6 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist [URIs: posicionamientowebbuscadores.es] 1.6 URIBL_WS_SURBL Contains an URL listed in the WS SU</pre> Pruebito 2012-05-02T14:34:23 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137307 <pre>hi guys ... Do you now whats the purpose of this rule, and what sort of spams are blocking by this mail...few legitimate mails block by this rule ##{ FS_REPLICA header FS_REPLICA Subject =~ /replica/i^M describe FS_REPLICA Subject says "replica"^M ##} FS_REPLICA Thank You Dhanushka </pre> dhanushka ranasinghe 2012-05-02T12:00:14 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137302 <pre>I'm seeing this rule: STOX_REPLY_TYPE_WITHOUT_QUOTES Catching on legitimate mail. It's a meta rule and right enough it catches this line: Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original AND does NOT match either: __HS_SUBJ_RE_FW Subject =~ /^(?i:re|fw):/ or rawbody __HS_QUOTE /^&gt; SCORING. 0.2 STOX_REPLY_TYPE STOX_REPLY_TYPE 1.9 STOX_REPLY_TYPE_WITHOUT_QUOTES STOX_REPLY_TYPE_WITHOUT_QUOTES As legitimate mail, it's picking up just over 2 points for this - and I'm wondering what the sender is possibly doing wrong here? </pre> corpus.defero 2012-04-27T13:28:21 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137299 <pre>Hi, Our old environment used per-user bayesian databases, but now we've decided to use one that is site-wide. The thing is that some users managed to train their bayes filters quite well and we don't want to loose it. So is it possible to configure spamassassin to use both global and per-user bayesian databases? Or is it possible to import one database to another _without_ overwriting the second one? Regards, </pre> Robert Wysocki 2012-04-27T10:57:33 http://comments.gmane.org/gmane.mail.spam.spamassassin.general/137293 <pre>Just bought this at NewEgg and it's making a great SA server. Using a desktop Asus motherboard, 8 core AMD processor &lt; at &gt; 3.6 ghz per core - and 32 gigs of ram. And you can get all that for $600. Pretty amazing! </pre> Marc Perkel 2012-04-25T15:52:23 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.mail.spam.spamassassin.general