You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Valery V. Bobrov" <vb...@uvttk.ru> on 2005/05/14 14:35:37 UTC
more spam with SpamAssassin version 3.0.2
Hello!
I upgraded to SpamAssassin version 3.0.2 from 2.64 and I noticed the amount
of spam messages has been increased!
What sort of problem?
Yours faithfully,
Valery
Re: more spam with SpamAssassin version 3.0.2
Posted by "Valery V.Bobrov" <vb...@uvttk.ru>.
Thank you for your help
I mean:
> - more undetected spam messages?
> do you mean that 3.0.2 detects fewer spam messages than 2.6.4?
Yes
And what shoul I do with this version?
>
> if you want help with a spamassassin problem, i think you need to be more
> precise ...
Yes, right you are.
Besr regards,
Valery
>
> regards,
>
> wolfgang
>
Re: more spam with SpamAssassin version 3.0.2
Posted by wolfgang <me...@gmx.net>.
In an older episode (Saturday 14 May 2005 14:35), Valery V. Bobrov wrote:
> I upgraded to SpamAssassin version 3.0.2 from 2.64 and I noticed the amount
> of spam messages has been increased!
do you mean there are
- more detected spam messages?
- more undetected spam messages?
- more of both?
do you mean that 3.0.2 detects fewer spam messages than 2.6.4?
if you want help with a spamassassin problem, i think you need to be more
precise ...
regards,
wolfgang
Re: more spam with SpamAssassin version 3.0.2
Posted by wolfgang <me...@gmx.net>.
In an older episode (Saturday 14 May 2005 18:41), Matt Kettler wrote:
> wolfgang wrote:
> > In an older episode (Saturday 14 May 2005 17:53), Matt Kettler wrote:
> >
> >>3.0.3 fixes some scoring issues in 3.0.2 and a few important
> >>bugs that 3.0.2 suffers from in terms of accuracy (mostly URI parsing for
> >>URIBLs).
> >
> >
> > after installing debian's SA 3.0.3 yesterday, I noticed that it lacks the
> > patches mentioned on
http://bugzilla.spamassassin.org/show_bug.cgi?id=4111
http://bugzilla.spamassassin.org/show_bug.cgi?id=4298
> Thanks for the heads up on tht one wolfgang.
my pleasure.
>
> Distro ports are such a mixed blessing.
agreed, but the sources from
http://apache.easy-webs.de/spamassassin/source/Mail-SpamAssassin-3.0.3.tar.bz2
lack those patches too - so that is not debian specific.
regards,
wolfgang
Re: more spam with SpamAssassin version 3.0.2
Posted by Matt Kettler <mk...@evi-inc.com>.
wolfgang wrote:
> In an older episode (Saturday 14 May 2005 17:53), Matt Kettler wrote:
>
>>3.0.3 fixes some scoring issues in 3.0.2 and a few important
>>bugs that 3.0.2 suffers from in terms of accuracy (mostly URI parsing for
>>URIBLs).
>
>
> after installing debian's SA 3.0.3 yesterday, I noticed that it lacks the
> patches mentioned on
Thanks for the heads up on tht one wolfgang.
Distro ports are such a mixed blessing. They're really good in that they
maintain consistency with the default OS paths for things, keep the package
dependency trees sane, etc. But they're also a bit evil because package
maintainers, being merely human, inevitably screw up sometimes.
Things like missing init.pre, putting the default.cf files in
/etc/mail/spamassassin instead of /usr/share, mixing up files from different
versions, are all mistakes that have been seen in different ports on this list.
It's a good thing you keep an eye on your distro packages. That really helps
mitigate the drawbacks of ports while taking advantage of their benefits.
Re: more spam with SpamAssassin version 3.0.2
Posted by wolfgang <me...@gmx.net>.
In an older episode (Saturday 14 May 2005 17:53), Matt Kettler wrote:
> 3.0.3 fixes some scoring issues in 3.0.2 and a few important
> bugs that 3.0.2 suffers from in terms of accuracy (mostly URI parsing for
> URIBLs).
after installing debian's SA 3.0.3 yesterday, I noticed that it lacks the
patches mentioned on
http://bugzilla.spamassassin.org/show_bug.cgi?id=4111
http://bugzilla.spamassassin.org/show_bug.cgi?id=4298
also, I suggest to add
urirhssub URIBL_JP_SURBL multi.surbl.org. A 64
body URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL')
describe URIBL_JP_SURBL Has URI in JP at http://www.surbl.org/lists.html
tflags URIBL_JP_SURBL net
score URIBL_JP_SURBL 3.0
and
urirhssub URIBL_BLACK multi.uribl.com. A 2
body URIBL_BLACK eval:check_uridnsbl('URIBL_BLACK')
describe URIBL_BLACK Contains an URL listed in the URIBL blacklist
tflags URIBL_BLACK net
score URIBL_BLACK 1.0
to you config.
regards,
wolfgang
Re: more spam with SpamAssassin version 3.0.2
Posted by Matt Kettler <mk...@evi-inc.com>.
Valery V. Bobrov wrote:
> Hello!
>
> I upgraded to SpamAssassin version 3.0.2 from 2.64 and I noticed the amount
> of spam messages has been increased!
>
>
> What sort of problem?
>
> Yours faithfully,
> Valery
>
Others have given a lot of good things to check for. However, one more thing to
check for.
Check to see if any of your spam is matching the rule named ALL_TRUSTED. If it
is, you must manually declare a trusted_networks because the auto-detection
algorithm is getting confused.
See:
http://wiki.apache.org/spamassassin/TrustPath
(Note: The trust path problem exists in SA 2.6x as well, it's just less
noticeable. Usually in 2.6x the only side effect is FP's on dialup RBLs like
SORBS_DUL.)
Also, I'd consider grabbing the bayes rule scores from SA 3.0.3, or just upgrade
to 3.0.3 outright. 3.0.3 fixes some scoring issues in 3.0.2 and a few important
bugs that 3.0.2 suffers from in terms of accuracy (mostly URI parsing for URIBLs).
If you're reluctant to go to 3.0.3, the adjusted scores from 3.0.3's
50_scores.cf are as follows:
score BAYES_60 0 0 3.515 1.0
score BAYES_80 0 0 3.608 2.0
score BAYES_95 0 0 3.514 3.0
score BAYES_99 0 0 4.070 3.5
score SPF_FAIL 0 0.001 0 0.875
Re: more spam with SpamAssassin version 3.0.2
Posted by Jon Trulson <jo...@radscan.com>.
On Sat, 14 May 2005 nigel@blue-canoe.net wrote:
> I don't think 3.0.2 is worse, just that there's more spam around
> lately. If I take my own stats, SA is catching a slightly higher
> percentage of spam in the last month to 6 weeks. The RBL's I use
> frontline are catching more too.
>
>> From January 05 to March 05 Spam accounted for around 60% of all email
> in. between March and now that has risen to a shade over 65%.
>
> I do notice some stuff gets through SA, but I figure spammers can play
> with SA as easily as the rest of us, and consequently can find ways to
> get round it. Fortunately, not many seem that determined.
>
One of the things I did when I first upgraded to the 3.x series
was to increase the BAYES_99 score to the pre 3.x value of 5.4. Almost
all of the 'st-0-ck' spam is cought by BAYES_99 only on our systems.
This helped alot. Bayes is also doing a good job with the German
political onslaught we've been seeing today :)
> HTH
>
> Nigel
>
> On Sat, 14 May 2005 16:35:37 +0400, "Valery V. Bobrov" <vb...@uvttk.ru>
> wrote:
>
>> Hello!
>>
>> I upgraded to SpamAssassin version 3.0.2 from 2.64 and I noticed the amount
>> of spam messages has been increased!
>>
>>
>> What sort of problem?
>>
>> Yours faithfully,
>> Valery
>>
>
--
Jon Trulson mailto:jon@radscan.com
ID: 1A9A2B09, FP: C23F328A721264E7 B6188192EC733962
PGP keys at http://radscan.com/~jon/PGPKeys.txt
#include <std/disclaimer.h>
"I am Nomad." -Nomad
Re: more spam with SpamAssassin version 3.0.2
Posted by ni...@blue-canoe.net.
I don't think 3.0.2 is worse, just that there's more spam around
lately. If I take my own stats, SA is catching a slightly higher
percentage of spam in the last month to 6 weeks. The RBL's I use
frontline are catching more too.
From January 05 to March 05 Spam accounted for around 60% of all email
in. between March and now that has risen to a shade over 65%.
I do notice some stuff gets through SA, but I figure spammers can play
with SA as easily as the rest of us, and consequently can find ways to
get round it. Fortunately, not many seem that determined.
HTH
Nigel
On Sat, 14 May 2005 16:35:37 +0400, "Valery V. Bobrov" <vb...@uvttk.ru>
wrote:
>Hello!
>
>I upgraded to SpamAssassin version 3.0.2 from 2.64 and I noticed the amount
>of spam messages has been increased!
>
>
>What sort of problem?
>
>Yours faithfully,
> Valery
>
RE: more spam with SpamAssassin version 3.0.2
Posted by martin smith <ma...@ntlworld.com>.
M>-----Original Message-----
M>From: Valery V. Bobrov [mailto:vb@uvttk.ru]
M>Sent: 14 May 2005 13:36
M>To: users@spamassassin.apache.org
M>Subject: more spam with SpamAssassin version 3.0.2
M>
M>Hello!
M>
M>I upgraded to SpamAssassin version 3.0.2 from 2.64 and I
M>noticed the amount of spam messages has been increased!
M>
M>
M>What sort of problem?
M>
M>Yours faithfully,
M> Valery
Look at the INSTALL file to find the system requirements such as perl,
Net::DNS and other module versions, then do a spamassassin --lint -D it
will tell you more details what is failing. Chances are its not doing
network tests because of Net:DNS which will lower the spam score
significantly.
Martin