You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by LuKreme <kr...@kreme.com> on 2013/11/08 21:11:41 UTC
RP_MATCHES_RCVD
Some spam has been matching the rule RP_MATCHES_RCVD which is worth -2.8 points. I wanted to look at this rule, so I went to /usr/local/etc/mail/spamassassin and gripped for the name, but no hits.
Where's the rule defined? I thought there was a rules folder, but the only one I can find it one in the source for SA 3.0 (`locate 10_misc.cf`).
# find /usr/local -name "*cf" | grep -v postfix
/usr/local/etc/mail/spamassassin/local.cf
/usr/local/etc/mail/spamassassin/whitelist.cf
#
/usr/local/share/spamassassin contains a template, a txt file of the public key., and a file named languages, no rules.
/usr/share/spamassassin does not exist
SpamAssasin version is 3.3.2
--
He was Igor, son of Igor, nephew of several Igors, brother of Igors and
cousin of more Igors than he could remember without checking up in his
diary. Igors did not change a winning formula. {Footnote: Especially if
it was green, and bubbled.}
Re: RP_MATCHES_RCVD
Posted by LuKreme <kr...@kreme.com>.
On 08 Nov 2013, at 13:53 , Kris Deugau <kd...@vianet.ca> wrote:
> It's also been scored down in more recent rule updates; as of a few
> minutes ago it looks like it's *way* down:
>
> score RP_MATCHES_RCVD -1.501 -0.001 -1.501 -0.001
I saw that after I ran sa-update, which was shortly after I posted.
I've set it to -0.1 for now.
--
Every absurdity has a champion to defend it.
Re: RP_MATCHES_RCVD
Posted by Benny Pedersen <me...@junc.eu>.
Thomas Harold skrev den 2014-04-17 19:01:
> (Hopefully next month I can help out with the mass-check.)
should it not be like
meta RP_UNLISTED_HAM (!RP_MATCHES_RCVD)
if it should score as spam ?
if just scores are changed, then its another problem imho
Re: RP_MATCHES_RCVD
Posted by Thomas Harold <th...@nybeta.com>.
On 4/17/2014 9:14 AM, Kevin A. McGrail wrote:
>
>> it's not corrected, that's the point...
>>
> The scoring occurs from automatic corpus checks. The best way to help
> the rule score better is to help with masscheck.
>
It's not really a good indicator of spam/ham here either. A moderate
amount of spam is being marked as ham due to that rule's weight.
This rule was discussed back in Oct/Nov 2013, after which the rule was
manually set to -0.001. And it stayed that way until at least Feb 28th
of this year. Then during the first few weeks of March 2014, someone
converted it to a T_ rule before re-releasing it.
(Hopefully next month I can help out with the mass-check.)
Re: RP_MATCHES_RCVD
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 4/17/2014 10:21 AM, Matus UHLAR - fantomas wrote:
>>> it's not corrected, that's the point...
>
> On 17.04.14 09:14, Kevin A. McGrail wrote:
>> The scoring occurs from automatic corpus checks. The best way to
>> help the rule score better is to help with masscheck.
>
> and still SA people tune some scores manually.
>
>> Looking at
>> http://ruleqa.spamassassin.org/?daterev=20140416-r1587834-n&rule=RP_MATCHES_RCVD&srcpath=&g=Change
>> there does appear to be a hamminess to the rule and it justifies a
>> negative score. A score of -1.05 seems appropriate to me.
>
> Not to me. The whole fact that @gmail.com spam comming from gmail.com
> servers does not mean it's not spam, only because millions of
> @gmail.com ham
> comming from gmail.com are ham...
>
> this logic is braindead to me
Then you will likely have to use manual tuning.
regards,
KAM
Re: RP_MATCHES_RCVD
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>>it's not corrected, that's the point...
On 17.04.14 09:14, Kevin A. McGrail wrote:
>The scoring occurs from automatic corpus checks. The best way to
>help the rule score better is to help with masscheck.
and still SA people tune some scores manually.
>Looking at http://ruleqa.spamassassin.org/?daterev=20140416-r1587834-n&rule=RP_MATCHES_RCVD&srcpath=&g=Change
>there does appear to be a hamminess to the rule and it justifies a
>negative score. A score of -1.05 seems appropriate to me.
Not to me. The whole fact that @gmail.com spam comming from gmail.com
servers does not mean it's not spam, only because millions of @gmail.com ham
comming from gmail.com are ham...
this logic is braindead to me
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
- Holmes, what kind of school did you study to be a detective?
- Elementary, Watson. -- Daffy Duck & Porky Pig
Re: RP_MATCHES_RCVD
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
> it's not corrected, that's the point...
>
The scoring occurs from automatic corpus checks. The best way to help
the rule score better is to help with masscheck.
Looking at
http://ruleqa.spamassassin.org/?daterev=20140416-r1587834-n&rule=RP_MATCHES_RCVD&srcpath=&g=Change
there does appear to be a hamminess to the rule and it justifies a
negative score. A score of -1.05 seems appropriate to me.
Regards,
KAM
Re: RP_MATCHES_RCVD
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>Thomas Harold skrev den 2014-04-15 05:49:
>>Mar 24th - RP_MATCHES_RCVD = -0.535
>>Mar 27th - RP_MATCHES_RCVD = -0.371
>>Apr 7th - RP_MATCHES_RCVD = -0.271
>>Apr 14th - RP_MATCHES_RCVD = -0.989
>>
>>Running 3.3.1 on CentOS 6 (from the @updates channel). Running
>>"sa-update" daily.
On 15.04.14 07:18, Benny Pedersen wrote:
>what is the problem ?, the scores is adjusted by public corpus, so
>if there is score that is not correct its a sign of missing ham/spam
>to correct it
the problem with this rule is (and was) that it often pushes score under the
spam threshold. It was complained here more times IIRC.
I have complained about this too, and I still have in my cf:
/etc/spamassassin/local.cf:score RP_MATCHES_RCVD 0
This rule is imho just something that should not be used as a whole.
No complaints against metas for now.
>other then that spamassassin does not just counts on one rule, so
>even if that rule seems incorrect hitting then it corrected by other
>rules
it's not corrected, that's the point...
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Posli tento mail 100 svojim znamim - nech vidia aky si idiot
Send this email to 100 your friends - let them see what an idiot you are
Re: RP_MATCHES_RCVD
Posted by Benny Pedersen <me...@junc.eu>.
Thomas Harold skrev den 2014-04-15 05:49:
> (during first few weeks of March it was showing as T_RP_MATCHES_RCVD,
> -0.01)
note rules that begins with T_ is corpus testing rules, also why it
score just 0.01 here
> Mar 24th - RP_MATCHES_RCVD = -0.535
> Mar 27th - RP_MATCHES_RCVD = -0.371
> Apr 7th - RP_MATCHES_RCVD = -0.271
> Apr 14th - RP_MATCHES_RCVD = -0.989
>
> Running 3.3.1 on CentOS 6 (from the @updates channel). Running
> "sa-update" daily.
what is the problem ?, the scores is adjusted by public corpus, so if
there is score that is not correct its a sign of missing ham/spam to
correct it
other then that spamassassin does not just counts on one rule, so even
if that rule seems incorrect hitting then it corrected by other rules
Re: RP_MATCHES_RCVD
Posted by Thomas Harold <th...@nybeta.com>.
On 11/8/2013 4:38 PM, John Hardin wrote:
> On Fri, 8 Nov 2013, Kris Deugau wrote:
>
>> LuKreme wrote:
>>> Some spam has been matching the rule RP_MATCHES_RCVD which is worth
>>> -2.8 points. I wanted to look at this rule, so I went to
>>> /usr/local/etc/mail/spamassassin and gripped for the name, but no hits.
>>
>> There was a thread on this rule not too long ago; check the list
>> archives
>
> Yeah, I thought we'd killed that in favor of a subrule. I guess we never
> actually pulled the trigger on that change... Mark?
>
It seems to be back, and the value is changing from week to week.
Feb 28th - RP_MATCHES_RCVD = -0.001
(during first few weeks of March it was showing as T_RP_MATCHES_RCVD, -0.01)
Mar 24th - RP_MATCHES_RCVD = -0.535
Mar 27th - RP_MATCHES_RCVD = -0.371
Apr 7th - RP_MATCHES_RCVD = -0.271
Apr 14th - RP_MATCHES_RCVD = -0.989
Running 3.3.1 on CentOS 6 (from the @updates channel). Running
"sa-update" daily.
Re: RP_MATCHES_RCVD
Posted by John Hardin <jh...@impsec.org>.
On Fri, 8 Nov 2013, Kris Deugau wrote:
> LuKreme wrote:
>> Some spam has been matching the rule RP_MATCHES_RCVD which is worth
>> -2.8 points. I wanted to look at this rule, so I went to
>> /usr/local/etc/mail/spamassassin and gripped for the name, but no hits.
>
> There was a thread on this rule not too long ago; check the list
> archives
Yeah, I thought we'd killed that in favor of a subrule. I guess we never
actually pulled the trigger on that change... Mark?
> and in the meantime score it down or disable it completely. A
> fair bit of spam hits this here. :(
I'd score it as -0.001 (advisory), as there may still be other meta rules
using it rather than the unscored subrule so you don't want to completely
disable it.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
From the Liberty perspective, it doesn't matter if it's a
jackboot or a Birkenstock smashing your face. -- Robb Allen
-----------------------------------------------------------------------
3 days until Veterans Day
Re: RP_MATCHES_RCVD
Posted by LuKreme <kr...@kreme.com>.
On 08 Nov 2013, at 13:53 , Kris Deugau <kd...@vianet.ca> wrote:
> SA is installed from package, this looks something like
> /var/lib/spamassassin.
Ah, /var/db/spamassassin
I would never have found them. thanks!
--
Everything you read on the Internet is false -- Glenn Fleishman
Re: RP_MATCHES_RCVD
Posted by Kris Deugau <kd...@vianet.ca>.
LuKreme wrote:
> Some spam has been matching the rule RP_MATCHES_RCVD which is worth -2.8 points. I wanted to look at this rule, so I went to /usr/local/etc/mail/spamassassin and gripped for the name, but no hits.
There was a thread on this rule not too long ago; check the list
archives and in the meantime score it down or disable it completely. A
fair bit of spam hits this here. :(
It's also been scored down in more recent rule updates; as of a few
minutes ago it looks like it's *way* down:
score RP_MATCHES_RCVD -1.501 -0.001 -1.501 -0.001
Run sa-update regularly to get rule and score updates.
> # find /usr/local -name "*cf" | grep -v postfix
> /usr/local/etc/mail/spamassassin/local.cf
> /usr/local/etc/mail/spamassassin/whitelist.cf
> #
SA stock rules haven't been shipped in the tarball for quite a while,
and IIRC most packages don't include them any more either. They're
downloaded by sa-update. "spamassassin -D --lint 2>&1 |grep
LOCAL_STATE" should show the path they're under. On most systems where
SA is installed from package, this looks something like
/var/lib/spamassassin.
-kgd