Mailing List Archive: sa-update

sa-update

mjackson at barking-dog

Nov 29, 2005, 11:24 AM

Post #1 of 61 (11772 views)

Thanks to another thread today, I discovered the sa-update script (which
must be new, or I haven't noticed it in 3+ years of using SA). However, when
I try to run it on two separate boxes, I get debug output similar to this
(when invoked with no command line options other than -D):

[8348] dbg: logger: adding facilities: all
[8348] dbg: logger: logging level is DBG
[8348] dbg: generic: SpamAssassin version 3.1.0
[8348] dbg: config: score set 0 chosen.
[8348] dbg: dns: is Net::DNS::Resolver available? yes
[8348] dbg: dns: Net::DNS version: 0.53
[8348] dbg: dns: name server: 72.3.128.240, family: 2, ipv6: 0
[8348] dbg: generic: sa-update version svn231362
[8348] dbg: generic: using update directory: /etc/mail/spamassassin
[8348] dbg: diag: perl platform: 5.008005 linux
[8348] dbg: diag: module installed: Digest::SHA1, version 2.10
[8348] dbg: diag: module installed: Getopt::Long, version 2.34
[8348] dbg: diag: module installed: LWP::UserAgent, version 2.033
[8348] dbg: diag: module installed: HTTP::Date, version 1.46
[8348] dbg: diag: module installed: Archive::Tar, version 1.26
[8348] dbg: diag: module installed: IO::Zlib, version 1.04
[8348] dbg: diag: module installed: DB_File, version 1.809
[8348] dbg: diag: module installed: HTML::Parser, version 3.46
[8348] dbg: diag: module installed: MIME::Base64, version 3.05
[8348] dbg: diag: module installed: Net::DNS, version 0.53
[8348] dbg: diag: module installed: Net::SMTP, version 2.29
[8348] dbg: diag: module installed: Mail::SPF::Query, version 1.997
[8348] dbg: diag: module installed: IP::Country::Fast, version 309.002
[8348] dbg: diag: module installed: Razor2::Client::Agent, version 2.75
[8348] dbg: diag: module not installed: Net::Ident ('require' failed)
[8348] dbg: diag: module not installed: IO::Socket::INET6 ('require' failed)
[8348] dbg: diag: module not installed: IO::Socket::SSL ('require' failed)
[8348] dbg: diag: module installed: Time::HiRes, version 1.82
[8348] dbg: diag: module installed: DBI, version 1.48
[8348] dbg: channel: attempting channel updates.spamassassin.org
[8348] dbg: channel: update directory
/etc/mail/spamassassin/updates_spamassassin_org
[8348] dbg: channel: channel cf file
/etc/mail/spamassassin/updates_spamassassin_org.cf
[8348] dbg: dns: query failed: 0.1.3.updates.spamassassin.org => NXDOMAIN
[8348] dbg: channel: no updates available, skipping channel
[8348] dbg: diag: updates complete, exiting with code 0

The pertinent error seems to be the NXDOMAIN for
0.1.3.updates.spamassassin.org. Is that normal?

Re: sa-update [ In reply to ]

felicity at apache

Nov 29, 2005, 11:38 AM

Post #2 of 61 (11556 views)

On Tue, Nov 29, 2005 at 11:24:28AM -0800, Mike Jackson wrote:
> Thanks to another thread today, I discovered the sa-update script (which
> must be new, or I haven't noticed it in 3+ years of using SA). However,

It's new with 3.1.

> when I try to run it on two separate boxes, I get debug output similar to
> this (when invoked with no command line options other than -D):
>
> [8348] dbg: dns: query failed: 0.1.3.updates.spamassassin.org => NXDOMAIN
> [8348] dbg: channel: no updates available, skipping channel
> [8348] dbg: diag: updates complete, exiting with code 0
>
> The pertinent error seems to be the NXDOMAIN for
> 0.1.3.updates.spamassassin.org. Is that normal?

It is for now. We have not, as of yet, published any updates via the
default channel, therefore there are no updates available, therefore
NXDOMAIN for the "latest update version" request.

Basically the plan was to make the script available such that when we actually
do updates, it'll be easier for people to do updates since the script will
have been out there for a while.

--
Randomly Generated Tagline:
"see, you field a lot of questions that are unimportant enough to me that
I don't bother to look them up if you're not there to answer them for me."
"excellent. I'm like Clippy."
- Lukas Karlsson and Theo

Re: sa-update [ In reply to ]

maillists at conactive

May 19, 2006, 6:31 AM

Post #3 of 61 (11502 views)

Will Nordmeyer wrote on Fri, 19 May 2006 06:02:56 -0400:

> When I restart spamd, does it look in that directory for the updated rules
> or do I have a step I'm missing to put the rules over into the primary rules
> folder

It seems you have installed sa only for this user? It identified a "local state
dir", it should use it. You can check this by running spamassassin -D --lint
with the same user that spamd runs under.

Kai

--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

Re: sa-update [ In reply to ]

will at willspc

May 19, 2006, 6:56 AM

Post #4 of 61 (11508 views)

Nope, SA is installed systemwide. I have the home foldier for the
install because the systemwide perl has to be kept at perl 5.05 for
Cobalt requirements, so I have an entire little subsystem for
spamassassin that uses Perl 5.8.3.

The spamd daemon runs as root.

Each child process runs as the user in question when it is processing a
message.

OK - I did the --lint and it appears to load the updates dir.

One of my problems with it, though, is that the 10_misc.cf in the
updates dir doesn't have the proper @@CONTACT_ADDRESS@@.

--Will

> Will Nordmeyer wrote on Fri, 19 May 2006 06:02:56 -0400:
>
> > When I restart spamd, does it look in that directory for the
updated rules
> > or do I have a step I'm missing to put the rules over into the
primary rules
> > folder
>
> It seems you have installed sa only for this user? It identified
a "local state
> dir", it should use it. You can check this by running spamassassin -
D --lint
> with the same user that spamd runs under.
>
> Kai
>
> --
> Kai Schätzl, Berlin, Germany
> Get your web at Conactive Internet Services: http://www.conactive.com
>
>
>
>

Re: sa-update [ In reply to ]

maillists at conactive

May 19, 2006, 3:31 PM

Post #5 of 61 (11491 views)

Will Nordmeyer wrote on Fri, 19 May 2006 09:56:21 -0400:

> One of my problems with it, though, is that the 10_misc.cf in the
> updates dir doesn't have the proper @@CONTACT_ADDRESS@@.

I think that's a known problem. This address gets inserted when you "perl
Makefile.PL" and they forgot about it. If you need it you may insert it
yourself. (That may change some checksum, though, I don't know.)

Kai

--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

Re: sa-update [ In reply to ]

felicity at apache

May 19, 2006, 3:44 PM

Post #6 of 61 (11505 views)

On Sat, May 20, 2006 at 12:31:16AM +0200, Kai Schaetzl wrote:
> > One of my problems with it, though, is that the 10_misc.cf in the
> > updates dir doesn't have the proper @@CONTACT_ADDRESS@@.
>
> I think that's a known problem. This address gets inserted when you "perl
> Makefile.PL" and they forgot about it. If you need it you may insert it
> yourself. (That may change some checksum, though, I don't know.)

Put the config line in your /etc/mail/spamassassin/local.cf and that'll take
care of it for now.

--
Randomly Generated Tagline:
Beware of the opinion of someone without any facts.

Re: sa-update [ In reply to ]

felicity at apache

Jul 23, 2006, 1:50 PM

Post #7 of 61 (11461 views)

On Sun, Jul 23, 2006 at 10:44:29PM +0200, Christian Schade wrote:
> > Assuming the updates.spamassassin.org (default) channel ...
>
> Are there any other (usefull) channels beside the default jet?

We have a jet? Cool! :P

I can't speak for anyone else out there, but from the ASF SpamAssassin
project, there's only the one channel available right now.

--
Randomly Generated Tagline:
If Love is grand... Divorce is twenty grand...

RE: Sa-update [ In reply to ]

scheidell at secnap

Apr 6, 2007, 4:36 AM

Post #8 of 61 (11336 views)

> -----Original Message-----
> From: Emre BALCI [mailto:emrebalci@yahoo.com]
> Sent: Friday, April 06, 2007 6:59 AM
> To: users@spamassassin.apache.org
> Subject: Sa-update
>
>
> Hi all
> I am using sa on gentoo when I run sa-update its
> copying rules into /var/lib/spamassassin/version
> I should copy rules form this location to
> /usr/share/spamassassin ?
No, these rules REPLACE the rules in ../share
Copying them might get SA to read some old rules, maybe creating an
inconstancy.

>can I use rules between different versions ?

You would need to add a copy/move/ sa-update/diff script to your
procedures. Probably not a bad idea.
(or, I think you might be able to see the changes via CVS browse to the
sources)

_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(tm).
For Information please see http://www.spammertrap.com
_________________________________________________________________________

Re:sa-update [ In reply to ]

Jul 5, 2007, 4:53 PM

Post #9 of 61 (11221 views)

On Thu, Jul 05, 2007 at 05:01:47PM -0400,
>Install the required modules. They're listed in the INSTALL doc.
Thanks Theo!
I installed all but IO::Zlib via cpan and on IO::Zlib, it gives this error:
t/tied..........ok
t/uncomp1.......FAILED test 5
Failed 1/10 tests, 90.00% okay
t/uncomp2.......FAILED test 5
Failed 1/10 tests, 90.00% okay
Failed Test Stat Wstat Total Fail Failed List of Failed
-------------------------------------------------------------------------------
t/uncomp1.t 10 1 10.00% 5
t/uncomp2.t 10 1 10.00% 5
1 subtest skipped.
Failed 2/10 test scripts, 80.00% okay. 2/123 subtests failed, 98.37% okay.
make: *** [test_dynamic] Error 255
/usr/bin/make test -- NOT OK
Running make install
make test had returned bad status, won't install without force

Chris

Re: Sa-update [ In reply to ]

ihtraum18 at gmail

Jul 25, 2008, 6:06 AM

Post #10 of 61 (10970 views)

I could see the problem:

read on:
http://www.ijs.si/software/amavisd/#faq-spam

amavisd realized that's who manages the upgrade of headers, overwriting any
changes made by spamassassin.

So what I incialmente is that the check is made by spammers by spamassassin
alone, without the amavis as an intermediary.

Desabilitei in / etc / amavis / amavisd.conf the line that makes the check
for spam:

# @ bypass_spam_checks_acl = qw (.);

I do not know if this is the appropriate list, but:

uncomment the above is sufficient for most amavis not call the spamassassin?

I ask this because below that the configuration file, you have several rules
that relate to spamassassin.

[]´s

On Fri, Jul 25, 2008 at 8:58 AM, Eduardo Júnior <ihtraum18@gmail.com> wrote:

>
> Hi,
>
>
> I have just done an update in the rules of my spamassassin with sa-update
>
> He dropped everything to /var/lib/spamassassin/version
>
> He created the directory with several updates_spamassassin_org. Cf
> And a updates_spamassassin_org.cf and updates_spamassassin_org.pre.
>
> Peguei of the includes updates_spamassassin_org.cf and put in
> /etc/spamassassin/local.cf and I made a copy of my *. cf / etc /
> spamassassin to maintain consistently referenced in the path includes.
>
> Executei a /init.d/spamassassin restart to restart.
>
> The question is:
>
> I am making an accurate?
> How to test if these new rules are working properly?
>
>
>
> I´m using:
>
> # spamassassin --version
> SpamAssassin version 3.1.7
> running on Perl version 5.8.8
>
>
>
>
> []´s
>
> --
> Eduardo Júnior
> GNU/Linux user #423272
>
> :wq
>

--
Eduardo Júnior
GNU/Linux user #423272

:wq

RE: Sa-update [ In reply to ]

Bowie_Bailey at BUC

Jul 25, 2008, 6:23 AM

Post #11 of 61 (10962 views)

Eduardo Júnior wrote:
>
> I have just done an update in the rules of my spamassassin with
> sa-update
>
> He dropped everything to /var/lib/spamassassin/version
>
> He created the directory with several updates_spamassassin_org. Cf
> And a updates_spamassassin_org.cf and updates_spamassassin_org.pre.
>
> Peguei of the includes updates_spamassassin_org.cf and put in
> /etc/spamassassin/local.cf and I made a copy of my *. cf / etc /
> spamassassin to maintain consistently referenced in the path
> includes.

I'm not quite sure what you are saying here, but it sounds like you said
that you moved the .cf files from the updates directory to
/etc/spamassassin. Don't do that! :)

sa-update will update the built-in rules for SA (as well as any other
channels you define). These updates will be put under
/var/lib/spamassassin. SpamAssassin will automatically look in that
directory and load the new rules. You don't need to do anything to
them.

Updating SpamAssassin works like this:

1) sa-update
2) restart SpamAssassin

You don't need to do anything else.

--
Bowie

Re: Sa-update [ In reply to ]

maillists at conactive

Jul 25, 2008, 6:31 AM

Post #12 of 61 (10967 views)

Eduardo Júnior wrote on Fri, 25 Jul 2008 08:58:25 -0300:

> Peguei of the includes updates_spamassassin_org.cf and put in
> /etc/spamassassin/local.cf and I made a copy of my *. cf / etc /
> spamassassin to maintain consistently referenced in the path includes.

Not sure what this means. You have to do *nothing* after an sa-update with
the exception of restarting spamd or whatever daemon application you are
using. In case you symlinked some stuff from /etc/mail/spamassassin to
/var/lib/spamassassin or reverse or copied some stuff over: this was
wrong, revert it.

Kai

--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com

Re: Sa-update [ In reply to ]

richard.frovarp at sendit

Jul 25, 2008, 7:17 AM

Post #13 of 61 (10951 views)

Kai Schaetzl wrote:
> Eduardo Júnior wrote on Fri, 25 Jul 2008 08:58:25 -0300:
>
>
>> Peguei of the includes updates_spamassassin_org.cf and put in
>> /etc/spamassassin/local.cf and I made a copy of my *. cf / etc /
>> spamassassin to maintain consistently referenced in the path includes.
>>
>
> Not sure what this means. You have to do *nothing* after an sa-update with
> the exception of restarting spamd or whatever daemon application you are
> using. In case you symlinked some stuff from /etc/mail/spamassassin to
> /var/lib/spamassassin or reverse or copied some stuff over: this was
> wrong, revert it.
>
> Kai
>
>
You may want to run sa-compile if the rules have changed. That is if you
use sa-compile. Then restart whatever is using SA.

Re: Sa-update [ In reply to ]

ihtraum18 at gmail

Jul 25, 2008, 8:04 AM

Post #14 of 61 (10937 views)

At least in my pathhad no sa-compile.

But that's not important now.
I did as recommended by colleagues above, correcting my mistakes and
understanding the operation.
Until had found odd repetition of files.

But when I run sa-update, my list of rules is not updated and can now be
used after restarted?
I must compile the rules updated with sa-compile so they can be used?

any reference

[]´s

On Fri, Jul 25, 2008 at 11:17 AM, Richard Frovarp <
richard.frovarp@sendit.nodak.edu> wrote:

> Kai Schaetzl wrote:
>
>> Eduardo Júnior wrote on Fri, 25 Jul 2008 08:58:25 -0300:
>>
>>
>>
>>> Peguei of the includes updates_spamassassin_org.cf and put in
>>> /etc/spamassassin/local.cf and I made a copy of my *. cf / etc /
>>> spamassassin to maintain consistently referenced in the path includes.
>>>
>>>
>>
>> Not sure what this means. You have to do *nothing* after an sa-update with
>> the exception of restarting spamd or whatever daemon application you are
>> using. In case you symlinked some stuff from /etc/mail/spamassassin to
>> /var/lib/spamassassin or reverse or copied some stuff over: this was wrong,
>> revert it.
>>
>> Kai
>>
>>
>>
> You may want to run sa-compile if the rules have changed. That is if you
> use sa-compile. Then restart whatever is using SA.
>

--
Eduardo Júnior
GNU/Linux user #423272

:wq

Re: Sa-update [ In reply to ]

mouss at netoyen

Jul 25, 2008, 9:06 AM

Post #15 of 61 (10983 views)

Eduardo Júnior wrote:
> At least in my pathhad no sa-compile.
>
> But that's not important now.
> I did as recommended by colleagues above, correcting my mistakes and
> understanding the operation.
> Until had found odd repetition of files.
>
>
> But when I run sa-update, my list of rules is not updated and can now be
> used after restarted?
> I must compile the rules updated with sa-compile so they can be used?
>

there are (mainly) two set of rules:

- your own rules
- public rules

your own rules are those rules that you write yourself. these are not
updated by any SA tool. these are the rule that _you_ decide to
implement. these rules are generally found in $base/etc/spamassassin or
$base/etc/mail/spamassassin/.

the public rules are the ones that all of us have (whether we use
directly, we override, or not). at installation time, they are in an
installation directory ($base/share/spamassassin/). when you use
sa-update, the "original" ones are no more used and your SA will use the
updated ones.

if you use sa-update, the public rules are updated. and optionally, you
can get more rules. all these go to a new directory (generally
$datadir/spamassassin/).

once you update your rules, you can run sa-compile. some people do. some
don't.

RE: Sa-update [ In reply to ]

Bowie_Bailey at BUC

Jul 25, 2008, 9:28 AM

Post #16 of 61 (10960 views)

Eduardo Júnior wrote:
> At least in my pathhad no sa-compile.
>
> But that's not important now.
> I did as recommended by colleagues above, correcting my mistakes and
> understanding the operation.
> Until had found odd repetition of files.
>
>
> But when I run sa-update, my list of rules is not updated and can now
> be used after restarted?
> I must compile the rules updated with sa-compile so they can be used?

By default SpamAssassin does not compile the rules. If you have set it
up to compile the rules, you will need to re-run sa-compile whenever you
update them. If you have not used sa-compile in the past, you do not
need to use it now.

--
Bowie

Re: Sa-update [ In reply to ]

mkettler_sa at verizon

Jul 25, 2008, 4:39 PM

Post #17 of 61 (10942 views)

Eduardo Júnior wrote:
>
> Hi,
>
>
> I have just done an update in the rules of my spamassassin with sa-update
>
> He dropped everything to /var/lib/spamassassin/version
>
> He created the directory with several updates_spamassassin_org. Cf
> And a updates_spamassassin_org.cf <http://updates_spamassassin_org.cf>
> and updates_spamassassin_org.pre.
>
> Peguei of the includes updates_spamassassin_org.cf
> <http://updates_spamassassin_org.cf> and put in
> /etc/spamassassin/local.cf <http://local.cf> and I made a copy of my
> *. cf / etc / spamassassin to maintain consistently referenced in the
> path includes.
No. DO NOT copy the files from where sa-update put them. Just run it,
and leave them where they are. SA will find them where sa-update put them.

The *ONLY* files that should be in /etc/spamassassin are the ones you
put there (ie: local.cf, or any add-on rules that aren't a part of the
standard set).

>
> Executei a /init.d/spamassassin restart to restart.
>
> The question is:
>
> I am making an accurate?
> How to test if these new rules are working properly?
If you want to make sure your SA is detecting the new rule directory
sa-update created:

Look near the top of the output of "spamassassin --lint -D", it should
mention the new directory about a half page down or so.
>
>
>
> I´m using:
>
> # spamassassin --version
> SpamAssassin version 3.1.7
> running on Perl version 5.8.8
You really should consider upgrading versions. sa-update only updates
rules, and there have been no new rules for the 3.1.x family since late
2007. We're on 3.2.5 now.

Re: Sa-update [ In reply to ]

ihtraum18 at gmail

Jul 26, 2008, 6:42 AM

Post #18 of 61 (10934 views)

On Fri, Jul 25, 2008 at 8:39 PM, Matt Kettler <mkettler_sa@verizon.net>wrote:

> Eduardo Júnior wrote:
>
>>
>> Hi,
>>
>>
>> I have just done an update in the rules of my spamassassin with sa-update
>>
>> He dropped everything to /var/lib/spamassassin/version
>>
>> He created the directory with several updates_spamassassin_org. Cf
>> And a updates_spamassassin_org.cf <http://updates_spamassassin_org.cf>
>> and updates_spamassassin_org.pre.
>>
>> Peguei of the includes updates_spamassassin_org.cf <
>> http://updates_spamassassin_org.cf> and put in /etc/spamassassin/local.cf<
>> http://local.cf> and I made a copy of my *. cf / etc / spamassassin to
>> maintain consistently referenced in the path includes.
>>
> No. DO NOT copy the files from where sa-update put them. Just run it, and
> leave them where they are. SA will find them where sa-update put them.
>
> The *ONLY* files that should be in /etc/spamassassin are the ones you put
> there (ie: local.cf, or any add-on rules that aren't a part of the
> standard set).

Ok, but I already did this, correct this, as this before.

>
>
>
>> Executei a /init.d/spamassassin restart to restart.
>>
>> The question is:
>>
>> I am making an accurate?
>> How to test if these new rules are working properly?
>>
> If you want to make sure your SA is detecting the new rule directory
> sa-update created:
>
> Look near the top of the output of "spamassassin --lint -D", it should
> mention the new directory about a half page down or so.

Yes, debugging shows me that information.

>
>>
>>
>> I´m using:
>>
>> # spamassassin --version
>> SpamAssassin version 3.1.7
>> running on Perl version 5.8.8
>>
> You really should consider upgrading versions. sa-update only updates
> rules, and there have been no new rules for the 3.1.x family since late
> 2007. We're on 3.2.5 now.

Unfortunately, it's not possible now, because the server is in production
and can't stop.
But i already proposed an updated.

[]'s

--
Eduardo Júnior
GNU/Linux user #423272

:wq

Re: Sa-update [ In reply to ]

ihtraum18 at gmail

Aug 6, 2008, 6:31 AM

Post #19 of 61 (10884 views)

Continuing with the sa-update

When run sa-update -D, my output has the following excerpt:

[14661] dbg: diag: module not installed: IP:: Country:: Fast ( 'require'
failed)
[14661] dbg: diag: module not installed: Razor2:: Client:: Agent ( 'require'
failed)
[14661] dbg: diag: module not installed: Net:: Ident ( 'require' failed)
[14661] dbg: diag: module not installed: IO:: Socket:: INET6 ( 'require'
failed)
[14661] dbg: diag: module not installed: IO:: Socket:: SSL ( 'require'
failed)

They have some influence in learning?
And how to verify that the recognition of spam in fact improved?

On Sat, Jul 26, 2008 at 10:42 AM, Eduardo Júnior <ihtraum18@gmail.com>wrote:

>
>
> On Fri, Jul 25, 2008 at 8:39 PM, Matt Kettler <mkettler_sa@verizon.net>wrote:
>
>> Eduardo Júnior wrote:
>>
>>>
>>> Hi,
>>>
>>>
>>> I have just done an update in the rules of my spamassassin with sa-update
>>>
>>> He dropped everything to /var/lib/spamassassin/version
>>>
>>> He created the directory with several updates_spamassassin_org. Cf
>>> And a updates_spamassassin_org.cf <http://updates_spamassassin_org.cf>
>>> and updates_spamassassin_org.pre.
>>>
>>> Peguei of the includes updates_spamassassin_org.cf <
>>> http://updates_spamassassin_org.cf> and put in /etc/spamassassin/
>>> local.cf <http://local.cf> and I made a copy of my *. cf / etc /
>>> spamassassin to maintain consistently referenced in the path includes.
>>>
>> No. DO NOT copy the files from where sa-update put them. Just run it, and
>> leave them where they are. SA will find them where sa-update put them.
>>
>> The *ONLY* files that should be in /etc/spamassassin are the ones you put
>> there (ie: local.cf, or any add-on rules that aren't a part of the
>> standard set).
>
>
>
>
> Ok, but I already did this, correct this, as this before.
>
>
>
>>
>>
>>
>>> Executei a /init.d/spamassassin restart to restart.
>>>
>>> The question is:
>>>
>>> I am making an accurate?
>>> How to test if these new rules are working properly?
>>>
>> If you want to make sure your SA is detecting the new rule directory
>> sa-update created:
>>
>> Look near the top of the output of "spamassassin --lint -D", it should
>> mention the new directory about a half page down or so.
>
>
>
> Yes, debugging shows me that information.
>
>
>
>
>>
>>>
>>>
>>> I´m using:
>>>
>>> # spamassassin --version
>>> SpamAssassin version 3.1.7
>>> running on Perl version 5.8.8
>>>
>> You really should consider upgrading versions. sa-update only updates
>> rules, and there have been no new rules for the 3.1.x family since late
>> 2007. We're on 3.2.5 now.
>
>
>
> Unfortunately, it's not possible now, because the server is in production
> and can't stop.
> But i already proposed an updated.
>
>
>
> []'s
>
>
>
> --
> Eduardo Júnior
> GNU/Linux user #423272
>
> :wq
>

--
Eduardo Júnior
GNU/Linux user #423272

:wq

Re: Sa-update [ In reply to ]

mkettler_sa at verizon

Aug 6, 2008, 4:44 PM

Post #20 of 61 (10868 views)

Eduardo Júnior wrote:
>
> Continuing with the sa-update
>
> When run sa-update -D, my output has the following excerpt:
>
> [14661] dbg: diag: module not installed: IP:: Country:: Fast (
> 'require' failed)
> [14661] dbg: diag: module not installed: Razor2:: Client:: Agent (
> 'require' failed)
> [14661] dbg: diag: module not installed: Net:: Ident ( 'require' failed)
> [14661] dbg: diag: module not installed: IO:: Socket:: INET6 (
> 'require' failed)
> [14661] dbg: diag: module not installed: IO:: Socket:: SSL ( 'require'
> failed)
>
>
> They have some influence in learning?
All of those are modules that support optional features.

The IP::Country::Fast can influence learning, by providing additional
token data on what countries the message has been routed through, but
it's hardly critical.

> And how to verify that the recognition of spam in fact improved?
Look for higher BAYES_* rules hitting on spam, and lower ones on nonspam.

Re: sa-update [ In reply to ]

mouss at netoyen

Oct 23, 2008, 4:31 PM

Post #21 of 61 (10620 views)

Jean-Paul Natola a écrit :
> Hi all,
>
> I've been out of the loop for a couple of months do a rollout, so I came back
> to my SA today as I have seen A LOT more spam coming in than normal, I
> upgraded to 3.2.5 today, and ran sa-update but , i dont seem to see any new
> rules, and i;m getting clobbered with spam.
>
>
> Has something cahnged? are the rules still going into
> /usr/local/etc/mail/spamassasin

no these are your custom rules.

sa-update rules go to /var/db/spamassassin/...

>
> I run site wide config
>
> freebsd 6.2

Re: sa-update [ In reply to ]

lcroker at megacable

Oct 23, 2008, 4:38 PM

Post #22 of 61 (10630 views)

I did it today... I have the server in FREBsd and the new rules are
in /var/db/spamassassin/3.002005/updates_spamassassin_org. The
conventional rules are in /usr/local/share/spamassassin.

Maybe you can find any directory named spamassassin to check where
they are.

Regards.

On Thu, 2008-10-23 at 19:18 -0400, Jean-Paul Natola wrote:

> Hi all,
>
> I've been out of the loop for a couple of months do a rollout, so I came back
> to my SA today as I have seen A LOT more spam coming in than normal, I
> upgraded to 3.2.5 today, and ran sa-update but , i dont seem to see any new
> rules, and i;m getting clobbered with spam.
>
>
> Has something cahnged? are the rules still going into
> /usr/local/etc/mail/spamassasin
>
> I run site wide config
>
> freebsd 6.2
>
> TIA
>
> JP
>

Luis Croker
SCSA - SCNA
Administrador de Sistemas
Megacable Comunicaciones
GPG Key1024D/48C1764B
Key fingerprint = E8B6 E84F ECE4 661E 30C7 7208 042D BD09 48C1 764B

RE: sa-update [ In reply to ]

jnatola at familycareintl

Oct 23, 2008, 4:43 PM

Post #23 of 61 (10655 views)

I used to get about 19-15 spam messages in my box per week, now , eve today I
got 11-

and they are hardly hitting any rules, anything new (rbl's etc..) I should
look into?

________________________________

From: Luis Croker [mailto:lcroker@megacable.com.mx]
Sent: Thu 10/23/2008 19:38
To: Jean-Paul Natola
Cc: users@spamassassin.apache.org
Subject: Re: sa-update

I did it today... I have the server in FREBsd and the new rules are in
/var/db/spamassassin/3.002005/updates_spamassassin_org. The conventional
rules are in /usr/local/share/spamassassin.

Maybe you can find any directory named spamassassin to check where they
are.

Regards.

On Thu, 2008-10-23 at 19:18 -0400, Jean-Paul Natola wrote:

Hi all,

I've been out of the loop for a couple of months do a rollout, so I
came back
to my SA today as I have seen A LOT more spam coming in than normal,
I
upgraded to 3.2.5 today, and ran sa-update but , i dont seem to see
any new
rules, and i;m getting clobbered with spam.

Has something cahnged? are the rules still going into
/usr/local/etc/mail/spamassasin

I run site wide config

freebsd 6.2

TIA

JP

Luis Croker
SCSA - SCNA
Administrador de Sistemas
Megacable Comunicaciones <http://www.megacable.com.mx/>
GPG Key1024D/48C1764B <http://pgp.mit.edu/>
Key fingerprint = E8B6 E84F ECE4 661E 30C7 7208 042D BD09 48C1 764B

Re: sa-update [ In reply to ]

Oct 23, 2008, 5:08 PM

Post #24 of 61 (10627 views)

Am 24.10.2008 1:31 Uhr, schrieb mouss:
> Jean-Paul Natola a écrit :
>> Hi all,
>>
>> I've been out of the loop for a couple of months do a rollout, so I came back
>> to my SA today as I have seen A LOT more spam coming in than normal, I
>> upgraded to 3.2.5 today, and ran sa-update but , i dont seem to see any new
>> rules, and i;m getting clobbered with spam.
>>
>>
>> Has something cahnged? are the rules still going into
>> /usr/local/etc/mail/spamassasin
>
> no these are your custom rules.
>
> sa-update rules go to /var/db/spamassassin/...

But on Debian to /var/lib/spamassassin/.. ;)

>
>
>>
>> I run site wide config
>>
>> freebsd 6.2
>
>

--
mit freundlichem Gruss - with kind regard
Jim Knuth
#ICQ 277289867

Bitte keine geschaeftliche Anfragen.
Dies ist mein privater Account!
Please ask no business inquiries.
That is only my private account!

RE: sa-update [ In reply to ]

rdoyle at islandnetworks

Oct 23, 2008, 8:14 PM

Post #25 of 61 (10624 views)

On Thu, 2008-10-23 at 19:43 -0400, Jean-Paul Natola wrote:
> I used to get about 19-15 spam messages in my box per week, now , eve today I
> got 11-
>
> and they are hardly hitting any rules, anything new (rbl's etc..) I should
> look into?
jm_sought rules are useful
http://wiki.apache.org/spamassassin/SoughtRules

Re: sa-update [ In reply to ]

mouss at netoyen

Oct 24, 2008, 12:30 AM

Post #26 of 61 (7181 views)

Jim Knuth a écrit :
> Am 24.10.2008 1:31 Uhr, schrieb mouss:
>> Jean-Paul Natola a écrit :
>>> Hi all,
>>>
>>> I've been out of the loop for a couple of months do a rollout, so I came back
>>> to my SA today as I have seen A LOT more spam coming in than normal, I
>>> upgraded to 3.2.5 today, and ran sa-update but , i dont seem to see any new
>>> rules, and i;m getting clobbered with spam.
>>>
>>>
>>> Has something cahnged? are the rules still going into
>>> /usr/local/etc/mail/spamassasin
>> no these are your custom rules.
>>
>> sa-update rules go to /var/db/spamassassin/...
>
> But on Debian to /var/lib/spamassassin/.. ;)
>

sure, but I doubt he is running Debian on top of freebsd 6.2 with
/usr/local/etc/mail/spamassassin for the "custom" rules directory :)

>>
>>>
>>> I run site wide config
>>>
>>> freebsd 6.2
>>
>
>

Re: sa-update [ In reply to ]

Oct 24, 2008, 2:48 AM

Post #27 of 61 (7155 views)

Am 24.10.2008 9:30 Uhr, schrieb mouss:
> Jim Knuth a écrit :
>> Am 24.10.2008 1:31 Uhr, schrieb mouss:
>>> Jean-Paul Natola a écrit :
>>>> Hi all,
>>>>
>>>> I've been out of the loop for a couple of months do a rollout, so I came back
>>>> to my SA today as I have seen A LOT more spam coming in than normal, I
>>>> upgraded to 3.2.5 today, and ran sa-update but , i dont seem to see any new
>>>> rules, and i;m getting clobbered with spam.
>>>>
>>>>
>>>> Has something cahnged? are the rules still going into
>>>> /usr/local/etc/mail/spamassasin
>>> no these are your custom rules.
>>>
>>> sa-update rules go to /var/db/spamassassin/...
>> But on Debian to /var/lib/spamassassin/.. ;)
>>
>
> sure, but I doubt he is running Debian on top of freebsd 6.2 with

Yes, sorry. I do not seen.

> /usr/local/etc/mail/spamassassin for the "custom" rules directory :)
>
>
>>>>
>>>> I run site wide config
>>>>
>>>> freebsd 6.2
>>
>

--
mit freundlichem Gruss - with kind regard
Jim Knuth
#ICQ 277289867

Bitte keine geschaeftliche Anfragen.
Dies ist mein privater Account!
Please ask no business inquiries.
That is only my private account!

Re: sa-update [ In reply to ]

guenther at rudersport

Apr 21, 2009, 5:31 AM

Post #28 of 61 (6948 views)

On Tue, 2009-04-21 at 10:33 +0430, amir reza rahbaran wrote:
> I ran sa-update and nothing was wrong . After completing its work I
> run "stat /var/lib/spamassassin/3.002004/" and show following results:

Please note that sa-update is silent, unless there are errors --
regardless whether there was an update or not. You can check the exit
code to see if anything has actually been updated.

http://wiki.apache.org/spamassassin/RuleUpdates

> File: `/var/lib/spamassassin/3.002004/'

> Access: 2009-04-21 08:08:36.000000000 +0430
> Modify: 2009-04-16 08:46:46.000000000 +0430
> Change: 2009-04-16 08:46:46.000000000 +0430
>
> The first question is that why Change Date has not changed yet
> (Today`s Date: 2009-04-21) ?

Because there is no update since April 16.

> Second how can I get spamassassin update date ?

The per-channel cf file probably is a good indication about when you
last run sa-update *and* an update actually was available. (It is not
the date of the update being pushed, though.)

$ ls -l /var/lib/spamassassin/3.002005/updates_spamassassin_org.cf

guenther

--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: sa-update [ In reply to ]

guenther at rudersport

Apr 21, 2009, 8:16 AM

Post #29 of 61 (6941 views)

Please keep list-posts on list, please Reply to List.

On Tue, 2009-04-21 at 19:27 +0430, amir reza rahbaran wrote:
> yes, you`re right and the sa-update exit with code 1 and this is the
> result of

Yes, an exit code of 1 means there is no update. It does *not* indicate
any error.

> update report with "/usr/bin/sa-update -D --channelfile /etc/spam_channellist"
[ verbose debug stuff snipped ]
> [3449] dbg: channel: metadata version = 759778
> [3449] dbg: dns: 4.2.3.updates.spamassassin.org => 759778, parsed as 759778
> [3449] dbg: channel: current version is 759778, new version is 759778, skipping channel
> [3449] dbg: diag: updates complete, exiting with code 1
>
> what shall I do?
> thanks in advanced.

Do about what? The above clearly shows what I told you before. There is
no newer update, you are already up-to-date with the latest update
available.

Anyway, since you asked what to do: I suggest carefully re-reading my
previous post and the documentation I referenced.

guenther

[ full-quote snipped as well ]

--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: sa-update [ In reply to ]

amirrezarahbaran at gmail

Apr 21, 2009, 10:24 PM

Post #30 of 61 (6990 views)

Thank you very much Katsten :)

2009/4/21 Karsten BrÃ¤ckelmann <guenther@rudersport.de>

> Please keep list-posts on list, please Reply to List.
>
> On Tue, 2009-04-21 at 19:27 +0430, amir reza rahbaran wrote:
> > yes, you`re right and the sa-update exit with code 1 and this is the
> > result of
>
> Yes, an exit code of 1 means there is no update. It does *not* indicate
> any error.
>
> > update report with "/usr/bin/sa-update -D --channelfile
> /etc/spam_channellist"
> [ verbose debug stuff snipped ]
> > [3449] dbg: channel: metadata version = 759778
> > [3449] dbg: dns: 4.2.3.updates.spamassassin.org => 759778, parsed as
> 759778
> > [3449] dbg: channel: current version is 759778, new version is 759778,
> skipping channel
> > [3449] dbg: diag: updates complete, exiting with code 1
> >
> > what shall I do?
> > thanks in advanced.
>
> Do about what? The above clearly shows what I told you before. There is
> no newer update, you are already up-to-date with the latest update
> available.
>
> Anyway, since you asked what to do: I suggest carefully re-reading my
> previous post and the documentation I referenced.
>
> guenther
>
>
> [ full-quote snipped as well ]
>
> --
> char *t="\10pse\0r\0dtu\0.@ghno
> \x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
> main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8?
> c<<=1:
> (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0;
> }}}
>
>

Re: sa-update [ In reply to ]

amirrezarahbaran at gmail

Apr 22, 2009, 3:40 AM

Post #31 of 61 (6990 views)

hi, I want to set sa-update in a cron job. Do you know how often it takes to
release the updates?

On Wed, Apr 22, 2009 at 9:54 AM, amir reza rahbaran <
amirrezarahbaran@gmail.com> wrote:

> Thank you very much Katsten :)
>
> 2009/4/21 Karsten BrÃ¤ckelmann <guenther@rudersport.de>
>
>> Please keep list-posts on list, please Reply to List.
>>
>>
>> On Tue, 2009-04-21 at 19:27 +0430, amir reza rahbaran wrote:
>> > yes, you`re right and the sa-update exit with code 1 and this is the
>> > result of
>>
>> Yes, an exit code of 1 means there is no update. It does *not* indicate
>> any error.
>>
>> > update report with "/usr/bin/sa-update -D --channelfile
>> /etc/spam_channellist"
>> [ verbose debug stuff snipped ]
>> > [3449] dbg: channel: metadata version = 759778
>> > [3449] dbg: dns: 4.2.3.updates.spamassassin.org => 759778, parsed as
>> 759778
>> > [3449] dbg: channel: current version is 759778, new version is 759778,
>> skipping channel
>> > [3449] dbg: diag: updates complete, exiting with code 1
>> >
>> > what shall I do?
>> > thanks in advanced.
>>
>> Do about what? The above clearly shows what I told you before. There is
>> no newer update, you are already up-to-date with the latest update
>> available.
>>
>> Anyway, since you asked what to do: I suggest carefully re-reading my
>> previous post and the documentation I referenced.
>>
>> guenther
>>
>>
>> [ full-quote snipped as well ]
>>
>> --
>> char *t="\10pse\0r\0dtu\0.@ghno
>> \x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
>> main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8?
>> c<<=1:
>> (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0;
>> }}}
>>
>>
>

Re: sa-update [ In reply to ]

uhlar at fantomas

Apr 22, 2009, 4:24 AM

Post #32 of 61 (7007 views)

On 22.04.09 15:10, amir reza rahbaran wrote:
> hi, I want to set sa-update in a cron job. Do you know how often it takes to
> release the updates?

depends on what. Ordinary rules get updated once per few weeks/months, but
checking daily should not be a problem.

Sought rules are ~uprated every 4 hours. I don't know about other rules,
SARE rules were reported not to be updated at all for some time, checking
daily should not do any harm again imho.

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"Two words: Windows survives." - Craig Mundie, Microsoft senior strategist
"So does syphillis. Good thing we have penicillin." - Matthew Alton

Re: SA-update [ In reply to ]

gtorleif at start

Jan 14, 2010, 6:18 AM

Post #33 of 61 (6553 views)

Sorry. I dont understand what you mean?

Jean-Yves Avenard-2 wrote:
>
> 2010/1/14 brodos <gtorleif@start.no>:
>>
>> Ok. Thanks!
>> Is there any security risks when running SA-update as root?
>
> According to the SA doc: then don't enable user rules.. (they are
> disabled by default)
>
>

--
View this message in context: http://old.nabble.com/SA-update-tp27158542p27161927.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Sa-update [ In reply to ]

Bowie_Bailey at BUC

Mar 19, 2010, 8:36 AM

Post #34 of 61 (6011 views)

Kaleb Hosie wrote:
> I've just finished updating my production server to SpamAssassin 3.3.0 and I immediately ran sa-update to get the latest rule set for SpamAssassin. Is there a way to tell whether sa-update downloaded the latest definitions correctly?
>
> A user has just emailed me with some SPAM that was sent about an hour after I upgraded. I looked at the message and it was a "Casino promotional offer"; I've posted the spam headers below:
>
> X-Spam-Status: No, score=2.2 required=5.0 tests=BAYES_00,HTML_IMAGE_ONLY_28,
> HTML_MESSAGE,RCVD_IN_BRBL_LASTEXT,T_RP_MATCHES_RCVD,URIBL_JP_SURBL
> autolearn=no version=3.3.0
>
> The only configuration I've changed since the install was the "report_safe" and "trusted_networks" option. Is there something else I need to configure to fine tune SA?
>

The main problem is the BAYES_00 rule. Apparently, your bayes db thinks
this email is definitely not spam. Are you sure it is being trained
properly?

Without any bayes hit, this would have scored 4.8. If you can get bayes
to score it as spam, you'll have it.

--
Bowie

RE: Sa-update [ In reply to ]

khosie at spectraaluminum

Mar 19, 2010, 8:58 AM

Post #35 of 61 (5996 views)

Bowie Bailey wrote:
>The main problem is the BAYES_00 rule. Apparently, your bayes db thinks this email is definitely not spam. Are you sure it is being trained properly?
>
>Without any bayes hit, this would have scored 4.8. If you can get bayes to score it as spam, you'll have it.
>
>--
>Bowie

I have to be honest, bayes is oen of the things I'm not too sure with. Would you have a good link that would explain how to properly train it? Or how to work with bayes?

In my environment, postfix passes the message onto the exchange server so once it releases the message, I don't have anything to train bayes with since it's deleted. Thanks again

Kaleb

Re: Sa-update [ In reply to ]

Mark.Martinec+sa at ijs

Mar 19, 2010, 9:38 AM

Post #36 of 61 (6019 views)

On Friday 19 March 2010 16:17:21 Kaleb Hosie wrote:
> Is there a way to tell whether sa-update downloaded the latest definitions
> correctly?

Yes:
sa-update -v

Mark

Re: Sa-update [ In reply to ]

mikael at syska

Mar 19, 2010, 10:26 AM

Post #37 of 61 (6064 views)

Hi,

See this link for a way to train bayes, when using exchange.

mvh

On Fri, Mar 19, 2010 at 4:58 PM, Kaleb Hosie <khosie@spectraaluminum.com> wrote:
> Bowie Bailey wrote:
>>The main problem is the BAYES_00 rule. Apparently, your bayes db thinks this email is definitely not spam. Are you sure it is being trained properly?
>>
>>Without any bayes hit, this would have scored 4.8. If you can get bayes to score it as spam, you'll have it.
>>
>>--
>>Bowie
>
> I have to be honest, bayes is oen of the things I'm not too sure with. Would you have a good link that would explain how to properly train it? Or how to work with bayes?
>
> In my environment, postfix passes the message onto the exchange server so once it releases the message, I don't have anything to train bayes with since it's deleted. Thanks again
>
> Kaleb
>

Re: Sa-update [ In reply to ]

rwmaillists at googlemail

Mar 19, 2010, 2:24 PM

Post #38 of 61 (6011 views)

On Fri, 19 Mar 2010 11:17:21 -0400
Kaleb Hosie <khosie@spectraaluminum.com> wrote:

> The only configuration I've changed since the install was the
> "report_safe" and "trusted_networks" option. Is there something else
> I need to configure to fine tune SA?

You need to set internal_networks.

You can set only internal_networks if you like, but otherwise set both
and include the internal in trusted.

RE: Sa-update [ In reply to ]

martin at gregorie

Mar 20, 2010, 6:25 AM

Post #39 of 61 (6061 views)

On Fri, 2010-03-19 at 11:58 -0400, Kaleb Hosie wrote:

> In my environment, postfix passes the message onto the exchange server
> so once it releases the message, I don't have anything to train bayes
> with since it's deleted.
>
Add an 'always_bcc' directive to your Postfix configuration to grab a
copy of all mail passing through it and send it to a capture mailbox.
Use a procmail recipe to classify mail arriving in the capture mailbox
as ham, spam or indeterminate and file it appropriately for input to
sa_learn.

Martin

RE: Sa-update [ In reply to ]

khosie at spectraaluminum

Mar 22, 2010, 8:33 AM

Post #40 of 61 (5890 views)

>> In my environment, postfix passes the message onto the exchange server
>> so once it releases the message, I don't have anything to train bayes
>> with since it's deleted.
>>
>Add an 'always_bcc' directive to your Postfix configuration to grab a copy of all mail passing through it and send it to a capture mailbox.
>Use a procmail recipe to classify mail arriving in the capture mailbox as ham, spam or indeterminate and file it appropriately for input to sa_learn.
>
>Martin

That is perfect! I've done that and it saves the mail locallly. The only problem is that when I open the file for the users mailbox, it makes all of the email as one large text file with one email after the next. Is that normal?

I wouldn't have to go through it and separate each mail would I?

Kaleb

Re: sa-update [ In reply to ]

joea at j4computers

Mar 27, 2012, 3:08 AM

Post #41 of 61 (4614 views)

>>> On 3/26/2012 at 10:48 PM, Jeremy McSpadden <jeremy@fluxlabs.net> wrote:
> Sa-update should reload SA, therefore reloading rules. What error are you
> getting ?
>
>
> --
> Jeremy McSpadden

Running "/usr/sbin/spamassassin reload" produces

"warn: archive-iterator: unable to open reload: No such file or directory"

This is SUSE SLES10, there is no "/etc/init.d/spamassassin" (the example sited in docs), which is why I attempted the above.

Re: sa-update [ In reply to ]

rwmaillists at googlemail

Mar 27, 2012, 4:09 AM

Post #42 of 61 (4607 views)

On Tue, 27 Mar 2012 06:08:02 -0400
joea@j4computers.com wrote:

> >>> On 3/26/2012 at 10:48 PM, Jeremy McSpadden <jeremy@fluxlabs.net>
> >>> wrote:
> > Sa-update should reload SA, therefore reloading rules. What error
> > are you getting ?
> >
> >
> > --
> > Jeremy McSpadden
>
> Running "/usr/sbin/spamassassin reload" produces
>
> "warn: archive-iterator: unable to open reload: No such file or
> directory"
>
> This is SUSE SLES10, there is no "/etc/init.d/spamassassin" (the
> example sited in docs), which is why I attempted the above.

Just restart spamd or send it SIGHUP (which is, I presume, what reload
does).

Re: sa-update [ In reply to ]

Mar 27, 2012, 11:47 AM

Post #43 of 61 (4613 views)

27.3.2012 13:08, joea@j4computers.com kirjoitti:
>>>> On 3/26/2012 at 10:48 PM, Jeremy McSpadden <jeremy@fluxlabs.net> wrote:
>> Sa-update should reload SA, therefore reloading rules. What error are you
>> getting ?
>>
>>
>> --
>> Jeremy McSpadden
>
> Running "/usr/sbin/spamassassin reload" produces
>
> "warn: archive-iterator: unable to open reload: No such file or directory"
>
> This is SUSE SLES10, there is no "/etc/init.d/spamassassin" (the example sited in docs), which is why I attempted the above.
>

It may be named differently, maybe /etc/init.d/spamd

However running spamassassin is no help. It is not spamd.

Re: sa-update [ In reply to ]

martin at gregorie

Mar 27, 2012, 12:19 PM

Post #44 of 61 (4610 views)

On Tue, 2012-03-27 at 21:47 +0300, Jari Fredriksson wrote:
> 27.3.2012 13:08, joea@j4computers.com kirjoitti:
> >>>> On 3/26/2012 at 10:48 PM, Jeremy McSpadden <jeremy@fluxlabs.net> wrote:
> >> Sa-update should reload SA, therefore reloading rules. What error are you
> >> getting ?
> >>
> >>
> >> --
> >> Jeremy McSpadden
> >
> > Running "/usr/sbin/spamassassin reload" produces
> >
> > "warn: archive-iterator: unable to open reload: No such file or directory"
> >
> > This is SUSE SLES10, there is no "/etc/init.d/spamassassin" (the example sited in docs), which is why I attempted the above.
> >
>
> It may be named differently, maybe /etc/init.d/spamd
>
> However running spamassassin is no help. It is not spamd.
>
Fedora 14 and earlier, which use the Sys V init service management
system, called the spamd daemon management
script /etc/init.d/spamassassin so its a reasonable guess that
equivalent RHEL releases as well as other RedHat related distros will do
the same.

Since Fedora 15 RH has changed over to using the systemd service
management system and the relevant command is now

systemctl start|stop|restart|status spamassassin.service

though SA itself is, of course, still /usr/bin/spamassassin as always.

Martin

Re: sa-update [ In reply to ]

jhardin at impsec

Apr 5, 2014, 9:14 AM

Post #45 of 61 (3742 views)

On Sat, 5 Apr 2014, Amir Reza Rahbaran wrote:

> I want to know how long it takes custom signatures updated by sa-update.

Daily, if the corpora are sufficient for masscheck scoring to run.

At the moment the masscheck corpus is ham-starved. There's not quite
enough ham available for reliable scores to be generated and published.

Once again, participation as a mass-checker, especially if you can provide
a non-English ham corpus, is solicited. If you have access to thousands of
reliably-categorized messages and can set up a box to run SpamAssassin to
scan them to test the performance of the base rules, please consider
becoming a masscheck contributor. The content of private messages is not
exposed by this process, only the rule hits are public.

If you can do this, see the wiki for the process and contact Kevin McGrail
for upload credentials. Thanks!

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The difference is that Unix has had thirty years of technical
types demanding basic functionality of it. And the Macintosh has
had fifteen years of interface fascist users shaping its progress.
Windows has the hairpin turns of the Microsoft marketing machine
and that's all. -- Red Drag Diva
-----------------------------------------------------------------------
8 days until Thomas Jefferson's 271st Birthday

Re: sa-update [ In reply to ]

davew at hireahit

Apr 6, 2014, 5:08 PM

Post #46 of 61 (3739 views)

On 2014-04-05 09:14, John Hardin wrote:
> On Sat, 5 Apr 2014, Amir Reza Rahbaran wrote:
>
>> I want to know how long it takes custom signatures updated by sa-update.
>
> Daily, if the corpora are sufficient for masscheck scoring to run.
>
> At the moment the masscheck corpus is ham-starved. There's not quite
> enough ham available for reliable scores to be generated and published.
>
> Once again, participation as a mass-checker, especially if you can
> provide a non-English ham corpus, is solicited. If you have access to
> thousands of reliably-categorized messages and can set up a box to run
> SpamAssassin to scan them to test the performance of the base rules,
> please consider becoming a masscheck contributor. The content of
> private messages is not exposed by this process, only the rule hits
> are public.
>
> If you can do this, see the wiki for the process and contact Kevin
> McGrail for upload credentials. Thanks!

I've been idly debating figuring out how to contribute, but having read
the wiki articles, I have a few questions:

Is older ham useful? It specifically mentions that older spam isn't
useful, and why, but I'm thinking older ham is probably useful since old
mail clients and legitimately sent mail never dies. But I could filter
based on date.

Is mail "Sent" folder mail of any use? I suspect not, since there's not
necessarily a Received header yet (although there might be, it depends
on how the user sent the message), so direct-to-MX and similar rules
will skew.

Is a ham-only corpus submission useful? Our ham is well cleaned, but we
don't archive spam on an ongoing basis, and users primarily just delete
spam. But most of our users archive ham and retain it, so depending on
what the results look like, it might be useful data source.

--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren

Re: sa-update [ In reply to ]

jhardin at impsec

Apr 6, 2014, 5:21 PM

Post #47 of 61 (3738 views)

On Sun, 6 Apr 2014, Dave Warren wrote:

> On 2014-04-05 09:14, John Hardin wrote:
>> On Sat, 5 Apr 2014, Amir Reza Rahbaran wrote:
>>
>> > I want to know how long it takes custom signatures updated by sa-update.
>>
>> Daily, if the corpora are sufficient for masscheck scoring to run.
>>
>> At the moment the masscheck corpus is ham-starved. There's not quite
>> enough ham available for reliable scores to be generated and published.
>>
>> Once again, participation as a mass-checker, especially if you can provide
>> a non-English ham corpus, is solicited. If you have access to thousands of
>> reliably-categorized messages and can set up a box to run SpamAssassin to
>> scan them to test the performance of the base rules, please consider
>> becoming a masscheck contributor. The content of private messages is not
>> exposed by this process, only the rule hits are public.
>>
>> If you can do this, see the wiki for the process and contact Kevin McGrail
>> for upload credentials. Thanks!
>
> I've been idly debating figuring out how to contribute, but having read the
> wiki articles, I have a few questions:
>
> Is older ham useful? It specifically mentions that older spam isn't useful,
> and why, but I'm thinking older ham is probably useful since old mail clients
> and legitimately sent mail never dies. But I could filter based on date.

There's some debate about that. :)

I personally agree with you. Others disagree.

> Is mail "Sent" folder mail of any use? I suspect not, since there's not
> necessarily a Received header yet (although there might be, it depends on how
> the user sent the message), so direct-to-MX and similar rules will skew.
>
> Is a ham-only corpus submission useful? Our ham is well cleaned, but we don't
> archive spam on an ongoing basis, and users primarily just delete spam. But
> most of our users archive ham and retain it, so depending on what the results
> look like, it might be useful data source.

Yes, ham-only masscheck submissions would be very welcome.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Men by their constitutions are naturally divided in to two parties:
1. Those who fear and distrust the people and wish to draw all
powers from them into the hands of the higher classes. 2. Those who
identify themselves with the people, have confidence in them,
cherish and consider them as the most honest and safe, although not
the most wise, depository of the public interests.
-- Thomas Jefferson
-----------------------------------------------------------------------
7 days until Thomas Jefferson's 271st Birthday

Re: sa-update [ In reply to ]

jdebert at garlic

Apr 6, 2014, 8:25 PM

Post #48 of 61 (3723 views)

On Sat, 5 Apr 2014 09:14:56 -0700 (PDT)
John Hardin <jhardin@impsec.org> wrote:

> On Sat, 5 Apr 2014, Amir Reza Rahbaran wrote:
>
> > I want to know how long it takes custom signatures updated by
> > sa-update.
>
> Daily, if the corpora are sufficient for masscheck scoring to run.
>
> At the moment the masscheck corpus is ham-starved. There's not quite
> enough ham available for reliable scores to be generated and
> published.

This explains why SA is not catching any spam here? After updating
to updates 1584283 and then 1585021, all spam is being passed. Nothing
else was done. No other changes made.

jd

Re: sa-update [ In reply to ]

davew at hireahit

Apr 7, 2014, 12:17 AM

Post #49 of 61 (3742 views)

On 2014-04-06 17:21, John Hardin wrote:
> On Sun, 6 Apr 2014, Dave Warren wrote:
>
>> Is older ham useful? It specifically mentions that older spam isn't
>> useful, and why, but I'm thinking older ham is probably useful since
>> old mail clients and legitimately sent mail never dies. But I could
>> filter based on date.
>
> There's some debate about that. :)
>
> I personally agree with you. Others disagree.

I've been giving it some thought and I think that perhaps limiting it to
the last few months will make it easier to get a sane set of
TRUSTED_NETWORKS and INTERNAL_NETWORKS; I've got mail going back to
~2002 but no real recollection of how things were set up or named prior
to 2007 or so.

Initially I'll limit it to mail within the last couple of months, but
perhaps expand that up to 24-36 months for non-spam and 6 months for
spam, is that sane/reasonable?

> Yes, ham-only masscheck submissions would be very welcome.

Perfect, glad to hear it. At this point I've built a dedicated box to
run the masscheck scripts, so now it's just a matter of putting together
a corpus and doing some sanity checking and testing.

My current thought is to take user-fed spam and non-spam folders and
place copies of messages into a staging path which will then be reviewed
before being added to the corpus for learning. Hopefully I'll be ready
to go live within a day or two.

--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren

Re: sa-update [ In reply to ]

KMcGrail at PCCC

Apr 7, 2014, 4:51 AM

Post #50 of 61 (3745 views)

On 4/7/2014 3:17 AM, Dave Warren wrote:
> On 2014-04-06 17:21, John Hardin wrote:
>> On Sun, 6 Apr 2014, Dave Warren wrote:
>>
>>> Is older ham useful? It specifically mentions that older spam isn't
>>> useful, and why, but I'm thinking older ham is probably useful since
>>> old mail clients and legitimately sent mail never dies. But I could
>>> filter based on date.
>>
>> There's some debate about that. :)
>>
>> I personally agree with you. Others disagree.
>
> I've been giving it some thought and I think that perhaps limiting it
> to the last few months will make it easier to get a sane set of
> TRUSTED_NETWORKS and INTERNAL_NETWORKS; I've got mail going back to
> ~2002 but no real recollection of how things were set up or named
> prior to 2007 or so.
>
> Initially I'll limit it to mail within the last couple of months, but
> perhaps expand that up to 24-36 months for non-spam and 6 months for
> spam, is that sane/reasonable?
I think 3 years makes a lot of sense for reasons I'd rather not discuss
on-list for fear the spammers will learn more than I will be able to
usefully convey.

Regards,
KAM

Re: sa-update [ In reply to ]

jhardin at impsec

Apr 7, 2014, 7:49 AM

Post #51 of 61 (1219 views)

On Mon, 7 Apr 2014, Dave Warren wrote:

> On 2014-04-06 17:21, John Hardin wrote:
>> On Sun, 6 Apr 2014, Dave Warren wrote:
>>
>> > Is older ham useful? It specifically mentions that older spam isn't
>> > useful, and why, but I'm thinking older ham is probably useful since old
>> > mail clients and legitimately sent mail never dies. But I could filter
>> > based on date.
>>
>> There's some debate about that. :)
>>
>> I personally agree with you. Others disagree.
>
> I've been giving it some thought and I think that perhaps limiting it to the
> last few months will make it easier to get a sane set of TRUSTED_NETWORKS and
> INTERNAL_NETWORKS; I've got mail going back to
> ~ 2002 but no real recollection of how things were set up or named prior
> to 2007 or so.
>
> Initially I'll limit it to mail within the last couple of months, but perhaps
> expand that up to 24-36 months for non-spam and 6 months for spam, is that
> sane/reasonable?

Sure.

>> Yes, ham-only masscheck submissions would be very welcome.
>
> Perfect, glad to hear it. At this point I've built a dedicated box to run the
> masscheck scripts, so now it's just a matter of putting together a corpus and
> doing some sanity checking and testing.
>
> My current thought is to take user-fed spam and non-spam folders and place
> copies of messages into a staging path which will then be reviewed before
> being added to the corpus for learning. Hopefully I'll be ready to go live
> within a day or two.

Thanks for your participation!

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...every time I sit down in front of a Windows machine I feel as
if the computer is just a place for the manufacturers to put their
advertising. -- fwadling on Y! SCOX
-----------------------------------------------------------------------
6 days until Thomas Jefferson's 271st Birthday

Re: sa-update [ In reply to ]

davew at hireahit

Apr 7, 2014, 10:56 AM

Post #52 of 61 (1227 views)

On 2014-04-06 20:25, jdebert wrote:
> On Sat, 5 Apr 2014 09:14:56 -0700 (PDT)
> John Hardin <jhardin@impsec.org> wrote:
>
>> On Sat, 5 Apr 2014, Amir Reza Rahbaran wrote:
>>
>>> I want to know how long it takes custom signatures updated by
>>> sa-update.
>> Daily, if the corpora are sufficient for masscheck scoring to run.
>>
>> At the moment the masscheck corpus is ham-starved. There's not quite
>> enough ham available for reliable scores to be generated and
>> published.
> This explains why SA is not catching any spam here? After updating
> to updates 1584283 and then 1585021, all spam is being passed. Nothing
> else was done. No other changes made.

No -- This issue just means that rule updates may not get created, but
the last valid set of rules will still available to sa-update.

--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren

Re: sa-update [ In reply to ]

jhardin at impsec

Apr 7, 2014, 10:57 AM

Post #53 of 61 (1236 views)

On Sun, 6 Apr 2014, jdebert wrote:

> On Sat, 5 Apr 2014 09:14:56 -0700 (PDT)
> John Hardin <jhardin@impsec.org> wrote:
>
>> On Sat, 5 Apr 2014, Amir Reza Rahbaran wrote:
>>
>>> I want to know how long it takes custom signatures updated by
>>> sa-update.
>>
>> Daily, if the corpora are sufficient for masscheck scoring to run.
>>
>> At the moment the masscheck corpus is ham-starved. There's not quite
>> enough ham available for reliable scores to be generated and
>> published.
>
> This explains why SA is not catching any spam here? After updating
> to updates 1584283 and then 1585021, all spam is being passed. Nothing
> else was done. No other changes made.

I was mistaken, the ham corpus has actually been over the threshold for
several days now. Apologies.

If your install is not catching *any* spam then there's something else
going on. Are there any headers in FNs indicating that SA is scanning the
message at all? Are there any error messages in the logs indicating
problems attempting to run SA? Is the spamd daemon running?

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
But if there is no such inalienable right [to self defense], the
entire nature of the social contract is changed. Each manâ€™s worth
is measured solely by his utility to the state, and as such the
value of his life rides a roller coaster not unlike the stock
market: dependent not only upon the preferences of the party in
power but upon the whims of its political leaders and the
permanent bureaucratic class. -- Mike McDaniel
-----------------------------------------------------------------------
6 days until Thomas Jefferson's 271st Birthday

Re: sa-update [ In reply to ]

thomas-lists at nybeta

Apr 7, 2014, 2:22 PM

Post #54 of 61 (1229 views)

On 4/6/2014 11:25 PM, jdebert wrote:
>
> This explains why SA is not catching any spam here? After updating
> to updates 1584283 and then 1585021, all spam is being passed. Nothing
> else was done. No other changes made.
>

Our setup is still catching spam, but the performance has definitely
trended downward in the last week or two. A lot more stuff is getting
through to the inbox then before.

My guess is that the spammers have changed their tactics, again, and are
now ahead of the various block lists.

Re: sa-update [ In reply to ]

jdebert at garlic

Apr 8, 2014, 11:00 AM

Post #55 of 61 (1232 views)

On Mon, 07 Apr 2014 17:22:37 -0400
Thomas Harold <thomas-lists@nybeta.com> wrote:

> On 4/6/2014 11:25 PM, jdebert wrote:
> >
> > This explains why SA is not catching any spam here? After updating
> > to updates 1584283 and then 1585021, all spam is being passed.
> > Nothing else was done. No other changes made.
> >
>
> Our setup is still catching spam, but the performance has definitely
> trended downward in the last week or two. A lot more stuff is getting
> through to the inbox then before.
>
> My guess is that the spammers have changed their tactics, again, and
> are now ahead of the various block lists.
>

After another update, it started catching spam but most was still
getting past. After a second update, it has been catching most spam.

jd

Re: sa-update [ In reply to ]

jhardin at impsec

Aug 19, 2014, 1:06 PM

Post #56 of 61 (1076 views)

On Tue, 19 Aug 2014, Scott Lewis wrote:

> Our sa-update's have not found fresh updates for a couple of weeks now.
> Does anyone know anything about this or are experiencing the same thing?
> It does not look like they are erring out.

Masscheck corpus starvation, possibly due to timing issues. We're *almost*
up to the lower limits needed to publish a rules update.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
You know things are bad when Pravda says we [the USA] have gone
too far to the left. -- Joe Huffman
-----------------------------------------------------------------------
5 days until the 1935th anniversary of the destruction of Pompeii

RE: sa-update [ In reply to ]

Kevin_Miller at ci

Aug 21, 2014, 12:25 PM

Post #57 of 61 (1068 views)

How's this coming? I'm still showing July 28 as the last update. (Not complaining - I appreciate all you guys do!)

...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: (907) 586-0242, Fax: (907) 586-4500
Registered Linux User No: 307357

-----Original Message-----
From: John Hardin [mailto:jhardin@impsec.org]
Sent: Tuesday, August 19, 2014 12:06 PM
To: users@spamassassin.apache.org
Subject: Re: sa-update

On Tue, 19 Aug 2014, Scott Lewis wrote:

> Our sa-update's have not found fresh updates for a couple of weeks now.
> Does anyone know anything about this or are experiencing the same thing?
> It does not look like they are erring out.

Masscheck corpus starvation, possibly due to timing issues. We're *almost* up to the lower limits needed to publish a rules update.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
You know things are bad when Pravda says we [the USA] have gone
too far to the left. -- Joe Huffman
-----------------------------------------------------------------------
5 days until the 1935th anniversary of the destruction of Pompeii

Re: sa-update [ In reply to ]

axb.lists at gmail

Aug 21, 2014, 12:56 PM

Post #58 of 61 (1082 views)

On 08/21/2014 09:25 PM, Kevin Miller wrote:
> How's this coming? I'm still showing July 28 as the last update.
> (Not complaining - I appreciate all you guys do!)

unless there's a new wave of starved masscheckers update should be
published this weekend.
Of couse, the project could always use more masscheck contributers

Details about masschecks are in the SA Wiki

RE: sa-update [ In reply to ]

jhardin at impsec

Aug 21, 2014, 1:40 PM

Post #59 of 61 (1068 views)

On Thu, 21 Aug 2014, Kevin Miller wrote:

> How's this coming? I'm still showing July 28 as the last update. (Not
> complaining - I appreciate all you guys do!)

From the latest run:

On 8/20/2014 10:25 PM, UpdatesD Cron wrote:
> Exit Status 9 is not zero for do-nightly-rescore-example.

HAM: 208428 (150000 required)
SPAM: 127817 (150000 required)

Soooo close!

> From: John Hardin [mailto:jhardin@impsec.org]
>
> On Tue, 19 Aug 2014, Scott Lewis wrote:
>
>> Our sa-update's have not found fresh updates for a couple of weeks now.
>
> Masscheck corpus starvation, possibly due to timing issues. We're
> *almost* up to the lower limits needed to publish a rules update.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Judicial Activism (n): interpreting the Constitution to grant the
government powers that are popularly felt to be "needed" but that
are not explicitly provided for therein (common definition);
interpreting the Constitution as it is written (Brady definition)
-----------------------------------------------------------------------
3 days until the 1935th anniversary of the destruction of Pompeii

Re: sa-update [ In reply to ]

sausers-20150205 at billmail

Mar 17, 2023, 8:03 AM

Post #60 of 61 (317 views)

On 2023-03-17 at 05:11:30 UTC-0400 (Fri, 17 Mar 2023 10:11:30 +0100)
SA list <lists+spamassassin-users@nospam.webmeneer.net>
is rumored to have said:

> Hello,
>
> I didn't get an update since 5 March (1908044).

Correct. We've had a problem with RuleQA, in that we have not had enough
spam in the masscheck submissions to run the rescoring properly. I'm not
sure whose submissions have dried up...

The existing list of active rules and their scores is fine for now and
won't likely be problematic in the near to mid term. Obviously we hope
to resolve the underlying lack of data and to resume proper QA ASAP.

--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire

Re: sa-update [ In reply to ]

users at spamassassin

Mar 22, 2023, 5:32 PM

Post #61 of 61 (317 views)

On 17 Mar 2023, at 16:03, Bill Cole wrote:

> Correct. We've had a problem with RuleQA, in that we have not had
> enough spam in the masscheck submissions to run the rescoring
> properly. I'm not sure whose submissions have dried up...
>
> The existing list of active rules and their scores is fine for now and
> won't likely be problematic in the near to mid term. Obviously we hope
> to resolve the underlying lack of data and to resume proper QA ASAP.

Thanks Bill for letting us know what’s going on!

cheers,

--
matt [at] lv223.org
GPG key ID: 7D91A8CA