MS % rate of catch

[Randal, Phil]

On my linux box, rules_du_jour is hacked as follows:

1: Trusted Rulesets:

  TRUSTED_RULESETS="BIGEVIL TRIPWIRE ANTIDRUG EVILNUMBERS RANDOMVAL
BOGUSVIRUS MRWIGGLY";

2: SA_DIR

  SA_DIR="/etc/mail/spamassassin";

3: email settings (as you wish)

4: SA_LINT

  SA_LINT="spamassassin --lint -p
/etc/MailScanner/spam.assassin.prefs.conf";

4: SA_RESTART

  SA_RESTART="/etc/init.d/MailScanner reload";

Cheers,

Phil
----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Derek Winkler
> Sent: 06 April 2004 15:43
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: MS % rate of catch
>
> If it's called rules_du_jour.txt that's most likely because
> you downloaded it with Windows.
>
> It should be just "rules_du_jour".
>
> I good location to put it is /usr/local/bin.
>
> You don't use spamd when using MailScannner.
>
> Change this command to the command used to restart
> MailScanner, possibly /etc/init.d/MailScanner restart. I just
> set mine to "true" and just do the regular MailScanner
> restart, by default every 4 hours I believe, configurable in
> MailScanner.conf.
>
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > Behalf Of Billy A. Pumphrey
> > Sent: Tuesday, April 06, 2004 10:39 AM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: MS % rate of catch
> >
> >
> > Awesome,
> > I am configuring it now having a little trouble.  A lot of
> my newbness
> > is again because I don't use Linux that often, and will
> hopefully soon
> > be familiar with it.
> >
> > Will you tell me this:
> >
> > It doesn't state where to put the rules_du_jour.txt file.  I could
> > assume the spamassassin rules directory or possibly this line "The
> > crontab line above runs /root/bin/rules_du_jour"
> >
> > Also on the spamd restart process.  I can't get the command
> to work.
> > I think it would be ="/etc/rc.d/init.d/spamassassin restart" but it
> > doesn't work when I type it out, and the direcoties exists in that
> > path except for the spamassassin directory.
> >
> > Thank you
> > Billy Pumphrey
> > -----Original Message-----
> > From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> > Behalf Of Derek Winkler
> > Sent: Tuesday, April 06, 2004 9:21 AM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: MS % rate of catch
> >
> > It does some other ones but for some reason doesn't mention them up
> > top.
> >
> > Look at the arrays for further rules.
> >
> > I get a lot of hits on BLACKLIST_URI. I also use RANDOMVAL and
> > BOGUSVIRUS.
> >
> > We only use BOGUSVIRUS because the support calls from
> users, "I got an
> > email that says I have a virus. What should I do?", get
> very tiresome.
> >
> > Keep in mind that the use of more and more custom rulesets
> increases
> > memory usage of each MailScanner process.
> >
> > > -----Original Message-----
> > > From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > > Behalf Of Billy A. Pumphrey
> > > Sent: Tuesday, April 06, 2004 10:19 AM
> > > To: MAILSCANNER at JISCMAIL.AC.UK
> > > Subject: Re: MS % rate of catch
> > >
> > >
> > > Good information.  On the rulesdujour script, I see that it only
> > > updates "BIGEVIL TRIPWIRE ANTIDRUG EVILNUMBERS" <-- those.  What
> > > about the rest?
> > >
> > > -----Original Message-----
> > > From: MailScanner mailing list
> > [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> > > Behalf Of Martin Hepworth
> > > Sent: Tuesday, April 06, 2004 3:05 AM
> > > To: MAILSCANNER at JISCMAIL.AC.UK
> > > Subject: Re: MS % rate of catch
> > >
> > > Billy
> > > check out the rules emporiam (www.rulesemporiam.com) and
> the Custom
> > > Rules sets
> > (http://wiki.apache.org/spamassassin/CustomRulesets). This
> > > will increase your hit rate quite a bit.
> > >
> > > You'll need to add these rules into
> /etc/mail/spamassassin and then
> > > restart MailScanner. Make sure the rule files are world readable.
> > >
> > > It's also very worthwhile training the bayes DB - there's
> plenty on
> > > the spamassassin web site about this.
> > >
> > > Also worth watching the SA users email list for
> new/updates to the
> > > rules and possibly using the rulesdujour script to automatically
> > > pull down updates. The spammers are constantly finding
> new ways of
> > > getting around SA so it's almost a requirement to keep up
> to date on
> > > these.
> > >
> > > --
> > > Martin Hepworth
> > > Snr Systems Administrator
> > > Solid State Logic
> > > Tel: +44 (0)1865 842300
> > >
> > >
> > > Billy A. Pumphrey wrote:
> > > > Does this seem a little off or about right?
> > > >
> > > > Out of 110 spam messages, this is what MS did:
> > > >
> > > > 38 passed through as NOT spam
> > > > 72 passed through as spam
> > > >
> > > > That is about a 65% rate.
> > > >
> > > > Here are my spamassassin score levels:
> > > > Required SpamAssassin Score = 6
> > > > High SpamAssassin Score = 7.2
> > > >
> > > > Or is that about right?  I did have the required score on
> > > 5, but I put
> > > > it on 6.
> > > >
> > > > Thank you
> > > > Billy Pumphrey
> > >
> > >
> >
> **********************************************************************
> > >
> > > This email and any files transmitted with it are confidential and
> > > intended solely for the use of the individual or entity
> to whom they
> > > are addressed. If you have received this email in error
> > please notify
> > > the system manager.
> > >
> > > This footnote confirms that this email message has been swept for
> > > the presence of computer viruses and is believed to be clean.
> > >
> > >
> >
> **********************************************************************
> > >
> >
>