You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by ge...@alphaworks.co.uk on 2010/01/13 12:59:11 UTC
SA not picking up rules from /var/lib/spamassassin/
I'm using SA 3.2.5 and sa-update but SA doesn't seem to be picking rules
up from /var/lib/spamassassin/
The rules are present:
> -bash-3.2$ ls -Rl1h /var/lib/spamassassin/
> /var/lib/spamassassin/:
> total 4.0K
> drwxr-xr-x 3 root root 4.0K Jan 2 04:40 3.002005
>
> /var/lib/spamassassin/3.002005:
> total 8.0K
> drwxr-xr-x 2 root root 4.0K Jan 6 07:05 updates_spamassassin_org
> -rw-r--r-- 1 root root 2.4K Jan 2 04:40 updates_spamassassin_org.cf
>
> /var/lib/spamassassin/3.002005/updates_spamassassin_org:
> total 1.4M
> -rw-r--r-- 1 root root 5.6K Jan 2 04:40 10_default_prefs.cf
> -rw-r--r-- 1 root root 7.4K Jan 2 04:40 20_advance_fee.cf
> -rw-r--r-- 1 root root 6.7K Jan 2 04:40 20_body_tests.cf
> -rw-r--r-- 1 root root 1.9K Jan 2 04:40 20_compensate.cf
> -rw-r--r-- 1 root root 14K Jan 2 04:40 20_dnsbl_tests.cf
> -rw-r--r-- 1 root root 15K Jan 2 04:40 20_drugs.cf
> -rw-r--r-- 1 root root 11K Jan 2 04:40 20_dynrdns.cf
> -rw-r--r-- 1 root root 8.1K Jan 2 04:40 20_fake_helo_tests.cf
> -rw-r--r-- 1 root root 25K Jan 2 04:40 20_head_tests.cf
> -rw-r--r-- 1 root root 11K Jan 2 04:40 20_html_tests.cf
> -rw-r--r-- 1 root root 5.2K Jan 2 04:40 20_imageinfo.cf
> -rw-r--r-- 1 root root 3.3K Jan 2 04:40 20_meta_tests.cf
> -rw-r--r-- 1 root root 2.5K Jan 2 04:40 20_net_tests.cf
> -rw-r--r-- 1 root root 8.0K Jan 2 04:40 20_phrases.cf
> -rw-r--r-- 1 root root 2.1K Jan 2 04:40 20_porn.cf
> -rw-r--r-- 1 root root 16K Jan 2 04:40 20_ratware.cf
> -rw-r--r-- 1 root root 5.4K Jan 2 04:40 20_uri_tests.cf
> -rw-r--r-- 1 root root 19K Jan 2 04:40 20_vbounce.cf
> -rw-r--r-- 1 root root 2.6K Jan 2 04:40 23_bayes.cf
> -rw-r--r-- 1 root root 1.6K Jan 2 04:40 25_accessdb.cf
> -rw-r--r-- 1 root root 1.6K Jan 2 04:40 25_antivirus.cf
> -rw-r--r-- 1 root root 1.6K Jan 2 04:40 25_asn.cf
> -rw-r--r-- 1 root root 1.3K Jan 2 04:40 25_dcc.cf
> -rw-r--r-- 1 root root 2.2K Jan 2 04:40 25_dkim.cf
> -rw-r--r-- 1 root root 2.1K Jan 2 04:40 25_domainkeys.cf
> -rw-r--r-- 1 root root 2.9K Jan 2 04:40 25_hashcash.cf
> -rw-r--r-- 1 root root 1.3K Jan 2 04:40 25_pyzor.cf
> -rw-r--r-- 1 root root 3.4K Jan 2 04:40 25_razor2.cf
> -rw-r--r-- 1 root root 7.5K Jan 2 04:40 25_replace.cf
> -rw-r--r-- 1 root root 2.9K Jan 2 04:40 25_spf.cf
> -rw-r--r-- 1 root root 1.8K Jan 2 04:40 25_textcat.cf
> -rw-r--r-- 1 root root 7.5K Jan 2 04:40 25_uribl.cf
> -rw-r--r-- 1 root root 29K Jan 2 04:40 30_text_de.cf
> -rw-r--r-- 1 root root 22K Jan 2 04:40 30_text_fr.cf
> -rw-r--r-- 1 root root 1.9K Jan 2 04:40 30_text_it.cf
> -rw-r--r-- 1 root root 23K Jan 2 04:40 30_text_nl.cf
> -rw-r--r-- 1 root root 19K Jan 2 04:40 30_text_pl.cf
> -rw-r--r-- 1 root root 3.3K Jan 2 04:40 30_text_pt_br.cf
> -rw-r--r-- 1 root root 46K Jan 2 04:40 50_scores.cf
> -rw-r--r-- 1 root root 1.3K Jan 2 04:40 60_awl.cf
> -rw-r--r-- 1 root root 2.8K Jan 2 04:40 60_shortcircuit.cf
> -rw-r--r-- 1 root root 4.9K Jan 2 04:40 60_whitelist.cf
> -rw-r--r-- 1 root root 2.5K Jan 2 04:40 60_whitelist_dk.cf
> -rw-r--r-- 1 root root 2.6K Jan 2 04:40 60_whitelist_dkim.cf
> -rw-r--r-- 1 root root 3.6K Jan 2 04:40 60_whitelist_spf.cf
> -rw-r--r-- 1 root root 1.9K Jan 2 04:40 60_whitelist_subject.cf
> -rw-r--r-- 1 root root 53K May 21 2007 70_sare_adult.cf
> -rw-r--r-- 1 root root 45K Dec 27 2005 70_sare_genlsubj0.cf
> -rw-r--r-- 1 root root 376K Oct 27 2008 70_sare_header.cf
> -rw-r--r-- 1 root root 8.0K May 21 2006 70_sare_header_eng.cf
> -rw-r--r-- 1 root root 28K Jun 4 2006 70_sare_html0.cf
> -rw-r--r-- 1 root root 3.1K Jun 4 2006 70_sare_html_eng.cf
> -rw-r--r-- 1 root root 51K Jun 4 2007 70_sare_obfu0.cf
> -rw-r--r-- 1 root root 13K Dec 27 2005 70_sare_oem.cf
> -rw-r--r-- 1 root root 18K Dec 12 2005 70_sare_random.cf
> -rw-r--r-- 1 root root 96K May 28 2006 70_sare_specific.cf
> -rw-r--r-- 1 root root 62K Jan 1 07:00 70_sare_stocks.cf
> -rw-r--r-- 1 root root 25K Nov 12 2005 70_sare_unsub.cf
> -rw-r--r-- 1 root root 95K Jan 2 04:40 72_active.cf
> -rw-r--r-- 1 root root 831 Jan 2 04:40 72_removed.cf
> -rw-r--r-- 1 root root 13K May 21 2007 72_sare_bml_post25x.cf
> -rw-r--r-- 1 root root 16K May 16 2006 72_sare_redirect_post3.0.0.cf
> -rw-r--r-- 1 root root 1.4K Jan 2 04:40 72_scores.cf
> -rw-r--r-- 1 root root 5.2K Jan 2 04:40 80_additional.cf
> -rw-r--r-- 1 root root 10K Jun 2 2005 99_sare_fraud_post25x.cf
> -rw-r--r-- 1 root root 187 Jan 2 04:40 MIRRORED.BY
> -bash-3.2$
Can anyone advise what the problem might be and what diagnosis I can
perform?
Thanks,
Geoff
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by ge...@alphaworks.co.uk.
On 13/01/2010 13:46, Jason Bertoch wrote:
> geoff.spamassassin3@alphaworks.co.uk wrote:
>> I'm using SA 3.2.5 and sa-update but SA doesn't seem to be picking
>> rules up from /var/lib/spamassassin/
>>
>> Can anyone advise what the problem might be and what diagnosis I can
>> perform?
>>
>
> The output of 'spamassassin --lint -D' might shed some light.
I was a little ahead of you there, I noticed that only the default rules
from /var/lib/spamassassin/3.002005/updates_spamassassin_org were being
loaded; the SAREs rules were not. I then realised this was because the
SAREs rules were not included in
/var/lib/spamassassin/3.002005/updates_spamassassin_org.cf which makes
sense as the SAREs rules would not be published via the
updates.spamassassin.org channel. It seems that the person who set this
up has manually put the SAREs rules in the
/var/lib/spamassassin/3.002005/updates_spamassassin_org directory
without realising how it all worked. I've now added the
saupdates.openprotect.com channel which contains recommended SAREs rules
and all is working!
Thanks,
Geoff
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by Benny Pedersen <me...@junc.org>.
On Wed 13 Jan 2010 04:11:45 PM CET, Geoff Soper wrote
> I'll certainly add sought.rules.yerp.org and
> 90_2tld.cf.sare.sa-update.dostech.net to updates.spamassassin.org as
> suggested by Jason.
delete all files in the 3.2.5 sa update dir, use sa-update again
so all sa-update rules gets loaded, problem you see it mostly that
openprotect did not delete the old rules in the sa-update dir, if you
want to use them move them to /etc/maail/spamassassin
never touch sa-update files otherwise, if you find thay dont work
delete the sa-update dir and redo a new sa-update to get latest rules
from the channel(s) again
but life continues as seen on http://www.rulesemporium.com/ :)
--
xpoint http://www.unicom.com/pw/reply-to-harmful.html
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by Jason Bertoch <ja...@i6ix.com>.
Geoff Soper wrote:
>
> OK, I'm slightly confused as to what the advice is here. Is there
> consensus on SAREs? Should I still use them (via the channel list
> described at http://wiki.apache.org/spamassassin/SareChannels ) or is it
> better not to use them? I get the impression that there is consensus on
> the OpenProtect channel being a bad thing.
>
> I'll certainly add sought.rules.yerp.org and
> 90_2tld.cf.sare.sa-update.dostech.net to updates.spamassassin.org as
> suggested by Jason.
>
I don't believe the general consensus is that SARE rules are *bad*, they
are just outdated or already incorporated, and may cause unnecessary
additional overhead or false positives. Your best bet is to look at the
rule list [1], note the last modified date, and see if any of them might
still apply to your spam. You can always add rules, adjust the scores,
and see what happens but I think most people don't use them anymore.
[1] http://rulesemporium.com/rules/?C=M;O=A
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by "Shaun T. Erickson" <st...@gmail.com>.
On Wed, Jan 13, 2010 at 10:11 AM, Geoff Soper
<ge...@alphaworks.co.uk> wrote:
>
> OK, I'm slightly confused as to what the advice is here. Is there consensus
> on SAREs? Should I still use them (via the channel list described at
> http://wiki.apache.org/spamassassin/SareChannels ) or is it better not to
> use them? I get the impression that there is consensus on the OpenProtect
> channel being a bad thing.
I have been using the list here, with good results. Of the two groups
of rules he lists, I regularly update the first group and only updated
the second group once (just to get them - they aren't updated any
more, so no point in pulling them regularly):
http://khopesh.com/wiki/Anti-spam
--
-ste
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by Geoff Soper <ge...@alphaworks.co.uk>.
On 13/01/2010 15:03, Benny Pedersen wrote:
> On Wed 13 Jan 2010 02:53:13 PM CET, Geoff Soper wrote
>
>> saupdates.openprotect.com channel which contains recommended SAREs
>> rules and all is working!
>
> outdated sare rules is not recommended, and openprotect do care ? :)
>
> if you update sare rules via sa-update it would work, if you do some
> other bad things you are on your own
>
OK, I'm slightly confused as to what the advice is here. Is there
consensus on SAREs? Should I still use them (via the channel list
described at http://wiki.apache.org/spamassassin/SareChannels ) or is it
better not to use them? I get the impression that there is consensus on
the OpenProtect channel being a bad thing.
I'll certainly add sought.rules.yerp.org and
90_2tld.cf.sare.sa-update.dostech.net to updates.spamassassin.org as
suggested by Jason.
Thanks,
Geoff
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by Benny Pedersen <me...@junc.org>.
On Wed 13 Jan 2010 02:53:13 PM CET, Geoff Soper wrote
> saupdates.openprotect.com channel which contains recommended SAREs
> rules and all is working!
outdated sare rules is not recommended, and openprotect do care ? :)
if you update sare rules via sa-update it would work, if you do some
other bad things you are on your own
--
xpoint http://www.unicom.com/pw/reply-to-harmful.html
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by Jason Bertoch <ja...@i6ix.com>.
geoff.spamassassin3@alphaworks.co.uk wrote:
> Thanks for that, can you point me in the direction of some info on the
> 90_2tld.cf.sare.sa-update.dostech.net channel? I found
> http://taint.org/2007/08/15/004348a.html in relation to
> sought.rules.yerp.org
>
Info is included in the file itself:
# util_rb_2tld 2tld-1.tld 2tld-2.tld ...
# This option allows the addition of new 2nd-level TLDs (2TLD) to
# the RegistrarBoundaries code. Updates to the list usually happen
# when new versions of SpamAssassin are released, but sometimes
# it's necessary to add in new 2TLDs faster than a release can
# occur. 2TLDs include things like co.uk, fed.us, etc.
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by ge...@alphaworks.co.uk.
Thanks for that, can you point me in the direction of some info on the
90_2tld.cf.sare.sa-update.dostech.net channel? I found
http://taint.org/2007/08/15/004348a.html in relation to
sought.rules.yerp.org
Thanks,
Geoff
On 13/01/2010 14:35, Jason Bertoch wrote:
> Jason Bertoch wrote:
>> geoff.spamassassin3@alphaworks.co.uk wrote:
>>> On 13/01/2010 14:02, Shaun T. Erickson wrote:
>>>> On Wed, Jan 13, 2010 at 8:53 AM, Geoff Soper
>>>> <ge...@alphaworks.co.uk> wrote:
>>>>
>>>>> I've now added the saupdates.openprotect.com
>>>>> channel which contains recommended SAREs rules and all is working!
>>>> I thought I read that no one should be using openprotect as it's
>>>> hoplessly out of date. ??
>>>
>>> Ah, is there a better way to get SARE rules? I note the the SARE
>>> site says they are no longer published but I'm not sure if that just
>>> relates to that site's action of collating them or whether it means
>>> all the authors no longer publish their rules.
>>>
>>
>> No, that's the best way to get SARE rules. However, most are either
>> outdated or already incorporated into SA. My update channels
>> currently include:
>>
>> updates.spamassassin.org
>> sought.rules.yerp.org
>> 90_2tld.cf.sare.sa-update.dostech.net
>>
>
> Apologies, I was confusing openprotect with dostech. It's my
> understanding that the dostech servers are most appropriate for SARE
> rules.
>
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by Jason Bertoch <ja...@i6ix.com>.
Jason Bertoch wrote:
> geoff.spamassassin3@alphaworks.co.uk wrote:
>> On 13/01/2010 14:02, Shaun T. Erickson wrote:
>>> On Wed, Jan 13, 2010 at 8:53 AM, Geoff Soper
>>> <ge...@alphaworks.co.uk> wrote:
>>>
>>>> I've now added the saupdates.openprotect.com
>>>> channel which contains recommended SAREs rules and all is working!
>>>>
>>> I thought I read that no one should be using openprotect as it's
>>> hoplessly out of date. ??
>>>
>>
>> Ah, is there a better way to get SARE rules? I note the the SARE site
>> says they are no longer published but I'm not sure if that just
>> relates to that site's action of collating them or whether it means
>> all the authors no longer publish their rules.
>>
>
> No, that's the best way to get SARE rules. However, most are either
> outdated or already incorporated into SA. My update channels currently
> include:
>
> updates.spamassassin.org
> sought.rules.yerp.org
> 90_2tld.cf.sare.sa-update.dostech.net
>
Apologies, I was confusing openprotect with dostech. It's my
understanding that the dostech servers are most appropriate for SARE rules.
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by Jason Bertoch <ja...@i6ix.com>.
geoff.spamassassin3@alphaworks.co.uk wrote:
> On 13/01/2010 14:02, Shaun T. Erickson wrote:
>> On Wed, Jan 13, 2010 at 8:53 AM, Geoff Soper
>> <ge...@alphaworks.co.uk> wrote:
>>
>>> I've now added the saupdates.openprotect.com
>>> channel which contains recommended SAREs rules and all is working!
>>>
>> I thought I read that no one should be using openprotect as it's
>> hoplessly out of date. ??
>>
>
> Ah, is there a better way to get SARE rules? I note the the SARE site
> says they are no longer published but I'm not sure if that just relates
> to that site's action of collating them or whether it means all the
> authors no longer publish their rules.
>
No, that's the best way to get SARE rules. However, most are either
outdated or already incorporated into SA. My update channels currently
include:
updates.spamassassin.org
sought.rules.yerp.org
90_2tld.cf.sare.sa-update.dostech.net
/Jason
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by ge...@alphaworks.co.uk.
On 13/01/2010 14:02, Shaun T. Erickson wrote:
> On Wed, Jan 13, 2010 at 8:53 AM, Geoff Soper
> <ge...@alphaworks.co.uk> wrote:
>
>> I've now added the saupdates.openprotect.com
>> channel which contains recommended SAREs rules and all is working!
>>
> I thought I read that no one should be using openprotect as it's
> hoplessly out of date. ??
>
Ah, is there a better way to get SARE rules? I note the the SARE site
says they are no longer published but I'm not sure if that just relates
to that site's action of collating them or whether it means all the
authors no longer publish their rules.
Thanks,
Geoff
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by "Shaun T. Erickson" <st...@gmail.com>.
On Wed, Jan 13, 2010 at 8:53 AM, Geoff Soper
<ge...@alphaworks.co.uk> wrote:
> I've now added the saupdates.openprotect.com
> channel which contains recommended SAREs rules and all is working!
I thought I read that no one should be using openprotect as it's
hoplessly out of date. ??
--
-ste
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by Geoff Soper <ge...@alphaworks.co.uk>.
On 13/01/2010 13:46, Jason Bertoch wrote:
> geoff.spamassassin3@alphaworks.co.uk wrote:
>> I'm using SA 3.2.5 and sa-update but SA doesn't seem to be picking
>> rules up from /var/lib/spamassassin/
>>
>> Can anyone advise what the problem might be and what diagnosis I can
>> perform?
>>
>
> The output of 'spamassassin --lint -D' might shed some light.
I was a little ahead of you there, I noticed that only the default rules
from /var/lib/spamassassin/3.002005/updates_spamassassin_org were being
loaded; the SAREs rules were not. I then realised this was because the
SAREs rules were not included in
/var/lib/spamassassin/3.002005/updates_spamassassin_org.cf which makes
sense as the SAREs rules would not be published via the
updates.spamassassin.org channel. It seems that the person who set this
up has manually put the SAREs rules in the
/var/lib/spamassassin/3.002005/updates_spamassassin_org directory
without realising how it all worked. I've now added the
saupdates.openprotect.com channel which contains recommended SAREs rules
and all is working!
Thanks,
Geoff
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by Jason Bertoch <ja...@i6ix.com>.
geoff.spamassassin3@alphaworks.co.uk wrote:
> I'm using SA 3.2.5 and sa-update but SA doesn't seem to be picking rules
> up from /var/lib/spamassassin/
>
> Can anyone advise what the problem might be and what diagnosis I can
> perform?
>
The output of 'spamassassin --lint -D' might shed some light.
Re: SA not picking up rules from /var/lib/spamassassin/
Posted by Kai Schaetzl <ma...@conactive.com>.
Geoff.spamassassin3@alphaworks.co.uk wrote on Wed, 13 Jan 2010 11:59:11
+0000:
> I'm using SA 3.2.5 and sa-update but SA doesn't seem to be picking rules
> up from /var/lib/spamassassin/
Well, you listed a lot, but not any proof for what you think it *seems* not
to do.
Kai
--
Get your web at Conactive Internet Services: http://www.conactive.com