Christo
Newbie
 Offline
Posts: 3
|
 |
« Reply #240 on: March 28, 2008, 02:32:15 PM » |
|
Follow up questions:
RE: 2. When you say "It will not create it for a given account until spam is received at that account." does this apply to the primary account domain only , or to all of the add-on domains also ?! Because I have received plenty of spam on the add-on domain, and it has not created the spam folder in there. Neither has it made one in the primary domain account..
3. Yes, let's get it working on my add-on domain, I will help test. I'll send you a pm here.
EDIT: pm not possible?!... I will email you.
|
|
|
|
« Last Edit: March 28, 2008, 02:35:25 PM by Christo »
|
Logged
|
|
|
|
|
w98
|
|
« Reply #241 on: March 28, 2008, 02:49:04 PM » |
|
Hi Christo, If it's not labeling or flagging spam for your add-on domain(s) then you should contact LP support. Usually looking at the raw source of the Email will show headers like this: X-Spam-Status: Yes, score=14.9
X-Spam-Score: 149
X-Spam-Bar: ++++++++++++++
X-Spam-Report: Spam detection software, running on the system "janus.lunarpages.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: No text version was provided Email template Click here to
get enrolled for your Medical Billing Degree! We hope you enjoyed receiving
this email, but if you no longer wish to receive our emails please press
here. or please write to us at: 770 E Main Street #259 Lehi, UT 84043 [...]
Content analysis details: (14.9 points, 3.5 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
1.0 FH_XMAIL_RND_833 Special X-Mailer Version
-0.0 SPF_PASS SPF: sender matches SPF record
2.7 URI_UNSUBSCRIBE URI: URI contains suspicious unsubscribe link
2.9 URI_L_PHP URI: URI_L_PHP
1.5 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
0.1 HTML_COMMENT_SAVED_URL BODY: HTML message is a saved web page
0.4 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
1.4 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
1.5 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: wetherwarnings.com]
-0.9 AWL AWL: From: address is in the auto white-list
X-Spam-Flag: YES Ian |
|
|
|
|
Logged
|
|
|
|
Christo
Newbie
Offline
Posts: 3
|
|
« Reply #242 on: March 28, 2008, 03:05:08 PM » |
|
What a difference, you are getting a ton of info in your headers.
In comparison, all I am getting is these three headers:
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on grafias.lunarpages.com
X-Spam-Level: **
X-Spam-Status: No, score=3.0 required=5.0 tests=BAYES_60,URIBL_BLACK autolearn=no version=3.2.3
Another strange thing is, I NEVER see any emails greater than my 5.0 threshold. I am assuming that they get diverted or deleted.... But I never set it up that way !!
|
|
|
|
|
Logged
|
|
|
|
|
w98
|
|
« Reply #243 on: March 28, 2008, 03:07:49 PM » |
|
Once you run my script you'll see how many spam/ham messages that SpamAssassin has seen since you modified your user_prefs file to use your own bayesian database. Once it's seen 200 spam and ham come in (aside from training) it'll kick into overdrive. In the meantime, training SA on what you consider spam/ham will be that much more beneficial once the magic 200 numbers have been reached.
|
|
|
|
|
Logged
|
|
|
|
paris2
Newbie
Offline
Posts: 1
|
|
« Reply #244 on: April 27, 2008, 12:24:08 AM » |
|
Can someone help me with this error?
ERROR MESSAGE:
syntax error at tpix-sa-trainer.cgi line 91, near "$check_user_Inbox_for_ham "
BEGIN not safe after errors--compilation aborted at tpix-sa-trainer.cgi line 189.
RELEVANT LINES (I think) FROM SA-TRAINER:
#####
# if you want to scan your users' Inbox folders instead of a separate 'ham'
# folder, set the following line to "Y".
# If you are using the global Email address or $global_hambox variables
# listed above, then THIS variable MUST remain set to "N" -- you cannot scan
# both your user's Inboxes *and* a global Email account/folder for ham.
# Enabling this variable and setting it to 'N' will search for a folder called
# 'ham' within each user account. MOST USERS WILL SET THIS TO "N"
$check_user_Inbox_for_ham = "N" ;
# if the above variable is set to "N", you can enter a mailbox name here to
# scan for non-spam messages; we recomment users create a folder called "ham"
# but you can set that here to some other name
#$user_hambox = "ham" ;
Thanks.
|
|
|
|
|
Logged
|
|
|
|
|
w98
|
|
« Reply #245 on: April 27, 2008, 10:03:02 AM » |
|
Perl isn't always that smart when defining errors. I'm guessing the error is actually on line 81 with the $global_hambox variable.
If you like, you can Email a copy of your script to me and I'll check it out. Go to the 'contact me' page at iandouglas.com for my Email addresses.
|
|
|
|
|
Logged
|
|
|
|
Monte
Newbie
Offline
Posts: 5
|
|
« Reply #246 on: June 23, 2008, 07:43:10 AM » |
|
LP support directed me to this thread after a long, continuing battle with excessive spam. I've set up SA trainer as indicated in the top post of this thread and in the text files within the trainer script archive. But... SA seems perfectly content to learn and do nothing with it's new knowledge. According to the script statisitcs at the bottom of the page after it's run, SA has tokens learned from ....
Number of HAM messages scanned over time: 1973
Number of SPAM messages scanned over time: 30617
... yet several of my users still receive 10-30 spam a day. My own account has received a dozen since midnight, none of which have any of the SA header info I expected to see.
Since the majority of my users don't bother to use IMAP or webmail so they can move spam to a scannable folder, I've had to rely on a few stalwarts who have been diligently forwarding spam to a 'spambox' account I set up. I log into that, move the spam to a scannable folder and run the SA trainer. The trainer indicates it has learned new 'tokens' from the scan, and I delete the messages to get ready for the next batch on which to run the trainer. The trainer does work for the few users who have set up a spam folder and move spam messages there manually.
The 'globalham' account is correctly scanned each time as well, with tokens learned at each run. Though traffic there is (as expected) much lower than on the 'spambox' account.
Anyway, let me go back to page 11 and start reading through it all and see if I messed something up. The frustration level with all the spam is exceedingly high...
|
|
|
|
« Last Edit: June 23, 2008, 07:56:49 AM by Monte »
|
Logged
|
|
|
|
Monte
Newbie
Offline
Posts: 5
|
|
« Reply #247 on: June 23, 2008, 08:36:23 AM » |
|
... It's also worth noting that in cases where the spam scoring stops and you get *flooded* with spam -- please do keep moving those spam messages into your 'spam' folders and keep training on them -- SpamAssassin will continue to learn from these messages so when the spam scoring *does* get restarted by LP support, your SpamAssassin databases will be that much better at scoring spam. That is precisely what appears to be happening for my domain (Felicitas server)... Users report a major influx of spam; I re-activate my long and ugly trouble ticket with support; they re-start SA and all is well. For a couple days. Then the flood starts again. The most recent 'round' began around March 25, 2008 and hasn't improved since then. Considering the constant flow of spam recently, I'll need to get LP support to jump-start SA on my domain again. At least the trainer script will have provided SA with a ton of new info. But the underlying problem is still there: Why the heck is the SA service going inactive such a short time after each re-start? And is there something that 'we' -the account holders at LP- can do about it? |
|
|
|
|
Logged
|
|
|
|
|
w98
|
|
« Reply #248 on: June 23, 2008, 12:28:17 PM » |
|
My $0.02:
SpamAssassin will usually skip scanning large messages ... if I recall, the default is 250kb -- anything larger is not scanned as spam.
If LP has their mail subsystem set up in such a way that if SpamAssassin doesn't respond within a preset amount of time, it skips the scanning process, *AND* a spammer has sent a flood of 249kb messages as spam, that it causes a temporary denial-of-service attack, letting smaller spam messages through.
It's possible, in theory.
It's also theoretically possible that spammers have been rotating their spam tokens according to SpamAssassin's expiration feature -- that is, spam you trained on 4 months ago are now having their tokens expire from your bayesian database, and now the spammers are sending similar messages again which will slip through until you retrain...
Remember, spammers know just as much about SpamAssassin (if not more) than we do -- it's their "business".
As LP customers, I'd encourage everyone to be supportive of the LP admins, be nice about it, but if you do see an increase in spam, simply send in a single support ticket asking them to monitor the systems, that you're getting a lot of 'extra' spam lately.
|
|
|
|
|
Logged
|
|
|
|
Monte
Newbie
Offline
Posts: 5
|
|
« Reply #249 on: June 23, 2008, 03:46:40 PM » |
|
Just looked through the latest batch of spam received today, and not a single one is over 26 Kb. Hmm...
... going back through the last 300+ spam messages received on my account alone (that's going back only as far as May 2nd), not a single one is over 26 kb. That being the case, I don't think it's a size issue with grossly large spam messages bogging down the servers. At least not where my own account is concerned.
I'll admit to having become grumpy with the LP support staff, for which I do apologize. It's not the LP staff sending all this crud through... they just get to deal with both the resource drain and the irate customers. Some days the job probably doesn't pay well enough, I'm sure.
I'm still interested in finding out why the SA service needs to be re-started on the server fairly often (about every three weeks if not more often). SA actually works pretty well when it's running, and even better with the training script in place.
Which reminds me, I need to have them re-start SA on my domain/Felicitas server.
|
|
|
|
|
Logged
|
|
|
|
|
w98
|
|
« Reply #250 on: June 23, 2008, 03:55:17 PM » |
|
I can't speak to why they'd need to restart the service unless there's a resource leak of some sort. If it's uniformly happening every 3 weeks, they should recognize a pattern.
Good luck LP admins!
|
|
|
|
|
Logged
|
|
|
|
ollythebuilder
Trekkie
Offline
Posts: 18
|
|
« Reply #251 on: July 01, 2008, 06:25:50 PM » |
|
Hi everyone, and thanks for this great script Ian.
One thing, I've got a few addon domains with LP, and have set up email accounts all to forward to my regular email address...and am training SA from that catch-all. Is this a good or bad way to deal with addon domains? I have noticed I can specify addons in the cgi script, but is that really necessary when I have a catch-all?
Many thanks.
|
|
|
|
|
Logged
|
|
|
|
|
w98
|
|
« Reply #252 on: July 01, 2008, 09:07:45 PM » |
|
Since all of your accounts will share the same bayesian database, if the forwarding alias places the message in your catch-all mailbox still showing the original To: recipient, it will be just fine.
|
|
|
|
|
Logged
|
|
|
|
ollythebuilder
Trekkie
Offline
Posts: 18
|
|
« Reply #253 on: July 03, 2008, 02:32:11 AM » |
|
many thanks again Ian.
|
|
|
|
|
Logged
|
|
|
|
|
Dilber MC Theme by HarzeM