Subject: Re: Trust (in numbers) - msg#00051

Previous Message by Date: click to view message preview

Re: What does Razor classify as SPAM?

On Fri, Mar 28, 2003 at 12:21:13PM -0500, Thomas A. Moulton wrote: > I got an email from a yahoo.com mailing list that was human generated. > > How can I find out how this was called SPAM? > Based on other mailing list traffic I'm seeing classified by razor as spam, a significant number of razor users are subscribing to mailing lists and arranging to auto-report all list traffic as spam immediately upon its arrival. Razor-users itself has been subject to this from time to time. As there has been much traffic on razor-users on this topic yielding heat in excess of light, and no general solution, I suggest you add the following to your .procmailrc PRIOR to the recipe which invokes razor: :0 * ^(X-list: |\ List-ID: |\ Sender: owner-|\ X-BeenThere: |\ Delivered-To: mailing list * |\ X-(Mailing-)?List: <|\ X-Loop: )\/[-A-Za-z0-9_+]+ $DEFAULT -- ----------------------------------------------------------------- Dan Wilder <dan@xxxxxxx> Technical Manager SSC, Inc. P.O. Box 55549 Phone: 206-782-8808 Seattle, WA 98155-0549 URL http://www.linuxjournal.com/ ----------------------------------------------------------------- ------------------------------------------------------- This SF.net email is sponsored by: The Definitive IT and Networking Event. Be There! NetWorld+Interop Las Vegas 2003 -- Register today! http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en

Next Message by Date: click to view message preview

Extreme load with razor2 and spamassassin

> From: Christian Stigen Larsen <csl@xxxxxxxxxxxxx> > To: razor-users@xxxxxxxxxxxxxxxxxxxxx > Subject: [Razor-users] Extreme load with razor2 and spamassassin > [...] > Things worked fine, but the introduction of Razor on our mailserver seemed to > impose quite a noticeable load to the system. I have encountered high loads on my system, and running 'top' revealed a bunch of spamassassin processes crunching away. I don't believe the problem is at all related to razor, since I run razor before spamassassin, and spamassassin is configured to skip the razor check. Yet the system load is due to spamassassin processes queuing up waiting for system resources. This is despite using the compiled spamc/spamd version of spamassassin. If you're not using spamd instead of the spamassassin perl script, you might give that a try. My system is a lowly P200 MMX. It doesn't sound as though your system ought to be having such problems unless it's running out of RAM. -- john@xxxxxxxxx John Stimson http://www.idsfa.net/~john/ HMC Physics '94 ------------------------------------------------------- This SF.net email is sponsored by: The Definitive IT and Networking Event. Be There! NetWorld+Interop Las Vegas 2003 -- Register today! http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en

Previous Message by Thread: click to view message preview

Trust (in numbers)

I have reported 45 genuine spams since 31 January (all the rest were already catalogued) but (for example) one reported yesterday still comes up uncatalogued. razor-report -H on this spam gives (if this is a help) 1 e1: 9CuGGoHlZ9MWsqNo4A5UKXS8l8YA 1.0 e2: IO6PU_U_Ct3Ll2Hah8PYtJUEc5QA 1.0 e3: W5KOgC7AmZULRlgavActRnA5SawtwEOayIhJC_bBcdIA 1.0 e4: jWd9SndiZUDthVD2DOAAC_rouMMA, ep4: 7542-10 1.1 e2: Cp0cLrP-0mUuRH2zakyOVODh8OcA 1.1 e3: vvgbGKjIVRro5KELeB2N-R5LKcjpcIs3iB1XAHSZbDsA 1.1 e4: YBklVZw9QfLgV-kHE2_YeClCwl8A, ep4: 7542-10 Obviously it can't be included here but further clues are From: "Jane" <jjizc@xxxxxxxxxxxx> and Subject: just as good, less expensive The documentation says that your level of trust increases with the number of correctly catalogued or revoked spams -- is there still a long way to go? ------------------------------------------------------- This SF.net email is sponsored by: The Definitive IT and Networking Event. Be There! NetWorld+Interop Las Vegas 2003 -- Register today! http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en

Next Message by Thread: click to view message preview

Re: Trust (in numbers)

Thank you for your reply. Running razor-check -d gives a lot of interesting text! This spam (about a generic version of a medicine (?) with a name beginning with V) has been processed by SpamAssassin 2.50 and the original message is in a MIME part. Passing the whole email through razor-check gives the result "not spam". Extracting the original spam from the MIME part and passing it through razor-check gives the result "is known spam". Well, the surrounding text of the whole email as received must have changed the signature, but there have been emails which have not been processed by SpamAssassin (one offering diplomas) which are clearly spam but which are said _not_ to be spam. This one (the diploma one) has two extra headers due to POPing it from the ISP and delivering it locally but, otherwise, the text is much the same as everybody else gets -- the To: header has four addresses on it which presumably change during the spammer's run. Even removing these two local headers doesn't change the decision that it is not spam. Obviously, the SpamAssassin processed ones must be unprocessed before checking and, if necessary, reporting but should anything be done about the other ones before checking/reporting? P.S. Which exactly are the CF values in the output? >>>>> On Fri, 28 Mar 2003 14:20:56 -0500, Matt Kettler <mkettler@xxxxxxxxxxx> said: Matt> Have you tried running the email in question through razor-check Matt> -d to look at some of the debug output to see what the CF values Matt> are for the individual mime parts? >> At 04:05 PM 3/28/2003 +0000, Chris Martin wrote: I have reported 45 >> genuine spams since 31 January (all the rest were already >> catalogued) but (for example) one reported yesterday still comes up >> uncatalogued. ------------------------------------------------------- This SF.net email is sponsored by: The Definitive IT and Networking Event. Be There! NetWorld+Interop Las Vegas 2003 -- Register today! http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en