OT: Re: Can spammer 'force' a timeout ?

[Daniel Gercke]

I´ve try to get it run serveral hours... Nothing. Everytime i get an 
error when i lint the rules. Here is the error:

Failed to compile URI SpamAssassin tests, skipping:     0.48491
(syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule 
SPAMCOP_URI_RBL, line 1, near "eval:"   0.00023
syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule BE_URI_RBL, 
line 1, near "eval:"    0.00022
)

and here the Rule:

uri       SPAMCOP_URI_RBL 
eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2')
describe  BE_URI_RBL  URI's domain appears in spamcop database at 
sc.surbl.org
tflags    BE_URI_RBL  net

score     BE_URI_RBL  3.0

uri       BE_URI_RBL eval:check_spamcop_uri_rbl('be.surbl.org','127.0.0.2')
describe  BE_URI_RBL  URI's domain appears in BigEvil
tflags    BE_URI_RBL  net

score     BE_URI_RBL  3.0

anyone seen before? any idea?

Daniel Gercke

programmierung . system managements


Martin Hepworth schrieb:
> Marcal
> 
> the bigevil rule set is really nasty on CPU. I'd change it to use the
> www.surbl.org varient instead (see web site for how-to).
> 
> -- 
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
> 
> 
> Marcel Burggraeve wrote:
> 
>> Since a couple of weeks a lot of spam keeps getting through and when I
>> examine them most of them have the following in the headers :
>> X-Plusine-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)
>>
>> I'm not using RBL checklists, our mailscanner is not really busy and 
>> lots of
>> them come in during the night when the system is almost doing nothing.
>> We're running HP-UX 11.i, the latest mailscanner, latest spamassassin and
>> I'm using big evil and a medicine rule from the rulesemporium.
>>
>> Could there be some kind of trick to force spamassassin into a timed out
>> situation ?
>>
>> Best regards,
>>
>> Marcel Burggraeve
>> Plusine
>> The Netherlands
>>
>> -------------------------- MailScanner list ----------------------
>> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
>> Before posting, please see the Most Asked Questions at
>> http://www.mailscanner.biz/maq/     and the archives at
>> http://www.jiscmail.ac.uk/lists/mailscanner.html
>>
> 
> **********************************************************************
> 
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
> 
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
> 
> **********************************************************************
> 
> -------------------------- MailScanner list ----------------------
> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
> Before posting, please see the Most Asked Questions at
> http://www.mailscanner.biz/maq/     and the archives at
> http://www.jiscmail.ac.uk/lists/mailscanner.html
> 
> 


--
haus neuer medien GmbH . agentur fuer neuen antrieb
.
Tel 03834 8313 0 . Fax 8313 13 . info at hnm.de . www.hnm.de
Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
AG Stralsund HRB 5089 . Geschaeftsfuehrer Daniel Scheibner
.
-- 
[Diese Nachricht gilt als frei von Viren und gefaehrlichen Dateianhaengen.
Schutz vor Viren und Spam von haus neuer medien. Bei Fragen oder Interesse Kontakt ueber mailscanner at hnm.de oder 03834 83130.]

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html