OT: Re: Can spammer 'force' a timeout ?

[Martin Hepworth]

Deniel

I presume you've compiled and installed the patch????


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Daniel Gercke wrote:
> I´ve try to get it run serveral hours... Nothing. Everytime i get an 
> error when i lint the rules. Here is the error:
> 
> Failed to compile URI SpamAssassin tests, skipping:     0.48491
> (syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule 
> SPAMCOP_URI_RBL, line 1, near "eval:"   0.00023
> syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule BE_URI_RBL, 
> line 1, near "eval:"    0.00022
> )
> 
> and here the Rule:
> 
> uri       SPAMCOP_URI_RBL 
> eval:check_spamcop_uri_rbl('sc.surbl.org','127.0.0.2')
> describe  BE_URI_RBL  URI's domain appears in spamcop database at 
> sc.surbl.org
> tflags    BE_URI_RBL  net
> 
> score     BE_URI_RBL  3.0
> 
> uri       BE_URI_RBL eval:check_spamcop_uri_rbl('be.surbl.org','127.0.0.2')
> describe  BE_URI_RBL  URI's domain appears in BigEvil
> tflags    BE_URI_RBL  net
> 
> score     BE_URI_RBL  3.0
> 
> anyone seen before? any idea?
> 
> Daniel Gercke
> 
> programmierung . system managements
> 
> 
> Martin Hepworth schrieb:
> 
>> Marcal
>>
>> the bigevil rule set is really nasty on CPU. I'd change it to use the
>> www.surbl.org varient instead (see web site for how-to).
>>
>> -- 
>> Martin Hepworth
>> Snr Systems Administrator
>> Solid State Logic
>> Tel: +44 (0)1865 842300
>>
>>
>> Marcel Burggraeve wrote:
>>
>>> Since a couple of weeks a lot of spam keeps getting through and when I
>>> examine them most of them have the following in the headers :
>>> X-Plusine-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)
>>>
>>> I'm not using RBL checklists, our mailscanner is not really busy and 
>>> lots of
>>> them come in during the night when the system is almost doing nothing.
>>> We're running HP-UX 11.i, the latest mailscanner, latest spamassassin 
>>> and
>>> I'm using big evil and a medicine rule from the rulesemporium.
>>>
>>> Could there be some kind of trick to force spamassassin into a timed out
>>> situation ?
>>>
>>> Best regards,
>>>
>>> Marcel Burggraeve
>>> Plusine
>>> The Netherlands
>>>
>>> -------------------------- MailScanner list ----------------------
>>> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
>>> Before posting, please see the Most Asked Questions at
>>> http://www.mailscanner.biz/maq/     and the archives at
>>> http://www.jiscmail.ac.uk/lists/mailscanner.html
>>>
>>
>> **********************************************************************
>>
>> This email and any files transmitted with it are confidential and
>> intended solely for the use of the individual or entity to whom they
>> are addressed. If you have received this email in error please notify
>> the system manager.
>>
>> This footnote confirms that this email message has been swept
>> for the presence of computer viruses and is believed to be clean.
>>
>> **********************************************************************
>>
>> -------------------------- MailScanner list ----------------------
>> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
>> Before posting, please see the Most Asked Questions at
>> http://www.mailscanner.biz/maq/     and the archives at
>> http://www.jiscmail.ac.uk/lists/mailscanner.html
>>
>>
> 
> 
> -- 
> haus neuer medien GmbH . agentur fuer neuen antrieb
> .
> Tel 03834 8313 0 . Fax 8313 13 . info at hnm.de . www.hnm.de
> Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
> AG Stralsund HRB 5089 . Geschaeftsfuehrer Daniel Scheibner
> .

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html