pyzor-users — general discussion of Pyzor and Pyzor-related topics

Re: R: Reporting

[John E H. <jh...@ti...>]

Giampaolo Tomassoni wrote at 17:07 +0200 on Oct 27, 2006:
 > sending: 'User: anonymous\nTime: 1161961427\nSig: 7806f09ca3653b2628b937d763f30c4508ed3c91\n\nOp: check\nOp-Digest: 950ccddf245b3c36f83ea13cf6c0e586f10211ee\nThread: 61994\nPV: 2.0\n\n'
 > received: 'Thread: 61994\nCount: 1\nWL-Count: 0\nCode: 200\nDiag: OK\nPV: 2.0\n\n'
 > 82.94.255.100:24441     (200, 'OK')     1       0
 > 
 > And this is the spamassassin result:
 > 
 > Content analysis details:   (5.9 points, 5.0 required)
 > 
 >  pts rule name              description
 > ---- ---------------------- --------------------------------------------------
 >  0.6 REPLY_TO_EMPTY         Reply-To: is empty
 >  0.1 HTML_50_60             BODY: Message is 50% to 60% HTML
 >  1.9 HTML_IMAGE_ONLY_12     BODY: HTML: images with 800-1200 bytes of words
 >  0.0 HTML_MESSAGE           BODY: HTML included in message
 >  0.0 BAYES_50               BODY: Bayesian spam probability is 40 to 60%
 >                             [score: 0.5000]
 >  0.0 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 >  2.2 DCC_CHECK              Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
 >  1.1 HTML_MIME_NO_HTML_TAG  HTML-only message, but there is no HTML tag
 > 
 > I'm shure to have reported this message (through spamassassin -r).
 > 
 > I have 'use_pyzor 1' in local.cf. Do I need anything there to enable reporting?
 > 
 > Maybe such a setting there got missing, somehow.

The default threshold for hitting the SA PYZOR_CHECK rule is 5 pyzor
reports.  As the 'pyzor check' output you included above shows, that
message has had only 1 report (maybe only your report).

And just because you reported a spam with spamassassin -r doesn't mean
it was reported successfully.  You can hit pyzor server timeouts when
you are reporting just as you can when checking.  Add -D when
doing the spamassassin report to see what's happening.

R: Reporting

[Giampaolo T. <Gia...@To...>]

> Giampaolo Tomassoni wrote at 15:09 +0200 on Oct 27, 2006:
>  > Dears,
>  >=20
>  > some weeks ago, reporting a spam through spamassassin to pyzor=20
> worked fine: a further test on the very same message would have=20
> show the PYZOR score in it.
>  >=20
>  > Recently this doesn't happen anymore: I report a spam and a=20
> further check on it doesn't show any PYZOR score.
>  >=20
>  > Did something changed or it's just a problem on my side?
>  >=20
>  > Now and then, I'm reporting anonymously. Do I have to=20
> register, somehow? How?
>  >=20
>  > I'm using the 82.94.255.100:24441 server.
>=20
> Maybe you are hitting a timeout.
> What happens when you do 'pyzor -d check < your_email'?

sending: 'User: anonymous\nTime: 1161961427\nSig: =
7806f09ca3653b2628b937d763f30c4508ed3c91\n\nOp: check\nOp-Digest: =
950ccddf245b3c36f83ea13cf6c0e586f10211ee\nThread: 61994\nPV: 2.0\n\n'
received: 'Thread: 61994\nCount: 1\nWL-Count: 0\nCode: 200\nDiag: =
OK\nPV: 2.0\n\n'
82.94.255.100:24441     (200, 'OK')     1       0

And this is the spamassassin result:

Content analysis details:   (5.9 points, 5.0 required)

 pts rule name              description
---- ---------------------- =
--------------------------------------------------
 0.6 REPLY_TO_EMPTY         Reply-To: is empty
 0.1 HTML_50_60             BODY: Message is 50% to 60% HTML
 1.9 HTML_IMAGE_ONLY_12     BODY: HTML: images with 800-1200 bytes of =
words
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.0 BAYES_50               BODY: Bayesian spam probability is 40 to 60%
                            [score: 0.5000]
 0.0 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 2.2 DCC_CHECK              Listed in DCC =
(http://rhyolite.com/anti-spam/dcc/)
 1.1 HTML_MIME_NO_HTML_TAG  HTML-only message, but there is no HTML tag

I'm shure to have reported this message (through spamassassin -r).

I have 'use_pyzor 1' in local.cf. Do I need anything there to enable =
reporting?

Maybe such a setting there got missing, somehow.

Thanks,

-----------------------------------
Giampaolo Tomassoni - IT Consultant
Piazza VIII Aprile 1948, 4
I-53044 Chiusi (SI) - Italy
Ph: +39-0578-21100

MAI inviare una e-mail a:
NEVER send an e-mail to:
 rai...@to...

Re: Reporting

[John E H. <jh...@ti...>]

Giampaolo Tomassoni wrote at 15:09 +0200 on Oct 27, 2006:
 > Dears,
 > 
 > some weeks ago, reporting a spam through spamassassin to pyzor worked fine: a further test on the very same message would have show the PYZOR score in it.
 > 
 > Recently this doesn't happen anymore: I report a spam and a further check on it doesn't show any PYZOR score.
 > 
 > Did something changed or it's just a problem on my side?
 > 
 > Now and then, I'm reporting anonymously. Do I have to register, somehow? How?
 > 
 > I'm using the 82.94.255.100:24441 server.

Maybe you are hitting a timeout.
What happens when you do 'pyzor -d check < your_email'?

Reporting

[Giampaolo T. <Gia...@To...>]

Dears,

some weeks ago, reporting a spam through spamassassin to pyzor worked =
fine: a further test on the very same message would have show the PYZOR =
score in it.

Recently this doesn't happen anymore: I report a spam and a further =
check on it doesn't show any PYZOR score.

Did something changed or it's just a problem on my side?

Now and then, I'm reporting anonymously. Do I have to register, somehow? =
How?

I'm using the 82.94.255.100:24441 server.

Regards,

-----------------------------------
Giampaolo Tomassoni - IT Consultant
Piazza VIII Aprile 1948, 4
I-53044 Chiusi (SI) - Italy
Ph: +39-0578-21100

MAI inviare una e-mail a:
NEVER send an e-mail to:
 rai...@to...

Re: Planned pyzor server move..

[Olivier N. <on...@cs...>]

 > To clarify: I am referring to the server on 82.94.255.100
 > 
 > On Tue, 2006-10-24 at 02:55 +0200, Milton Cyrus wrote:
 > > Hi Guy's/galls (if any) ;)
 > > 
 > > 
 > > I am planning to move the current Pyzir DB to a now IP/Server . The  
 > > current server desperately needs the other cpu cycles to carry its  
 > > other services. So in an attempt to do this in a scheduled way PLs  
 > > provide me with a maintenance window that works for all.
 > > Preferable in the coming 2 weeks...

Thanks for offering the service.

I think there is no preferable time for maintenance, email come all
the time, so...

Go and do the changewhen you are ready, we will follow you.

Bests,

Olivier

Re: Server out?

[John E H. <jh...@ti...>]

Marc G. Fournier wrote at 17:34 -0300 on Oct 24, 2006:
 > 'k, just curious here, but is there any sync'age between these two
 > servers?  Or are you risking reporting exclusively to one, and
 > checking against the other? :(

I don't think so.  As I understand, Milton just put up a second
independent server since the other "official" one kept timing out.
The code to do any such syncing is vaporware as far as I know.

That said, I currently report to both and check both (and pick the max
score).


 > One thought I had when I saw this patch was somehow extending the
 > Pyzor server(s) to broadcast reports between each other, but that
 > woudl require someone with Python abilities to do ... basically,
 > when I report to 82.94.255.100, it then has its own internal list
 > of servers that it reports to ... the communication would have to
 > be done in such a way that those servers then don't go out an
 > *re-broadcast' it again, but that should just be a matter of using
 > the servers own internal server list to know that the report came
 > *from* another server instead of from a client ...
 > 
 > Thoughts?  I'd be willing to put up a well connected server to act
 > as one leg of this if someone had the skills to design/develop such
 > an extension ...

There's been some discussion over the years about updating pyzor to
overcome problems such as these (in addition to making the server side
more robust, other improvements include revoking, trust, and others
that I can't think of at the moment).  But currently pyzor is not
razor (although it may have originally been intended to be that).

Re: Server out?

[Marc G. F. <sc...@hu...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



- --On Tuesday, October 24, 2006 12:45:13 -0600 John E Hein <jh...@ti...> 
wrote:

> Ring, John C wrote at 13:03 -0400 on Oct 24, 2006:
>  > I'm seeing the UPD packets going out to 66.250.40.33, but I'm not seeing
>  > any replies reaching us.  I can ping the server, however.
>  >
>  > Running pyzor version 0.4.0.  A sample run:
>  >
>  > # pyzor -d check < sample-nonspam.txt
>  > calculated digest: 08e7eb05ffb2518788344d88b3b5baa0d23869fa
>  > sending: 'User: anonymous\nTime: 1161709316\nSig:
>  > 01b23a5a63413759666f8d34d02ea6e327878ab0\n\nOp: check\nOp-Digest:
>  > 08e7eb05ffb2518788344d88b3b5baa0d23869fa\nThread: 53149\nPV: 2.0\n\n'
>  > 66.250.40.33:24441      TimeoutError:
>  >
>  > and I see:
>  >
>  > 12:59:22.483447 192.168.5.9.44836 > clapton.quatro.com.pyzor: udp 165
>  > (DF)
>  >
>  > on the firewall's external interface, but no reply packet is ever
>  > received.
>
> I have two servers in my pyzor servers file (see a patch from an
> earlier email to this list for running SpamAssassin with multiple
> pyzor servers).

'k, just curious here, but is there any sync'age between these two servers?  Or 
are you risking reporting exclusively to one, and checking against the other? :(

One thought I had when I saw this patch was somehow extending the Pyzor 
server(s) to broadcast reports between each other, but that woudl require 
someone with Python abilities to do ... basically, when I report to 
82.94.255.100, it then has its own internal list of servers that it reports to 
... the communication would have to be done in such a way that those servers 
then don't go out an *re-broadcast' it again, but that should just be a matter 
of using the servers own internal server list to know that the report came 
*from* another server instead of from a client ...

Thoughts?  I'd be willing to put up a well connected server to act as one leg 
of this if someone had the skills to design/develop such an extension ...


- ----
Marc G. Fournier           Hub.Org Networking Services (http://www.hub.org)
Email . sc...@hu...                              MSN . sc...@hu...
Yahoo . yscrappy               Skype: hub.org        ICQ . 7615664
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (FreeBSD)

iD8DBQFFPnjp4QvfyHIvDvMRAn64AJ0YW+WEp/h9CU4RCgYpEUl98c5YAQCgjdsI
EzY4JiMn3wPSJpTQg5cXUu0=
=K3Ls
-----END PGP SIGNATURE-----

RE: Server out?

[Ring, J. C <jc...@sw...>]

>From: John E Hein [jh...@ti...]
>I have two servers in my pyzor servers file (see a patch from an
earlier email to this list for
>running SpamAssassin with multiple pyzor servers).
>
>82.94.255.100:24441     (200, 'OK')
>66.250.40.33:24441      (200, 'OK')
>
>Yes, 66.* mostly times out these days.  82.* mostly works.  However, it
may be loaded less
>than 66.*.  It definitely appears to be more loaded recently than
earlier this year when
>Milton unveiled it...

Ok, thanks!

Unfortunately, even using this new server, when I added the pyzor check
back to our SpamAssassin configuration, the CPU jumped from between
25%-60% utilization with no backlog to a constant 75% usage, and a
back-log started :(  So I've disabled the pyzor check again.

--=20
John C. Ring, Jr.=20
jc...@sw...=20
Network Engineer
Union Switch & Signal Inc.

"If men were angels, no government would be necessary. If angels were to
govern men, neither external nor internal controls on government would
be necessary." -- James Madison

Re: Server out?

[John E H. <jh...@ti...>]

Ring, John C wrote at 13:03 -0400 on Oct 24, 2006:
 > I'm seeing the UPD packets going out to 66.250.40.33, but I'm not seeing
 > any replies reaching us.  I can ping the server, however.
 > 
 > Running pyzor version 0.4.0.  A sample run:
 > 
 > # pyzor -d check < sample-nonspam.txt
 > calculated digest: 08e7eb05ffb2518788344d88b3b5baa0d23869fa
 > sending: 'User: anonymous\nTime: 1161709316\nSig:
 > 01b23a5a63413759666f8d34d02ea6e327878ab0\n\nOp: check\nOp-Digest:
 > 08e7eb05ffb2518788344d88b3b5baa0d23869fa\nThread: 53149\nPV: 2.0\n\n'
 > 66.250.40.33:24441      TimeoutError:
 > 
 > and I see:
 > 
 > 12:59:22.483447 192.168.5.9.44836 > clapton.quatro.com.pyzor: udp 165
 > (DF)
 > 
 > on the firewall's external interface, but no reply packet is ever
 > received.

I have two servers in my pyzor servers file (see a patch from an
earlier email to this list for running SpamAssassin with multiple
pyzor servers).

82.94.255.100:24441     (200, 'OK')
66.250.40.33:24441      (200, 'OK')

Yes, 66.* mostly times out these days.  82.* mostly works.  However,
it may be loaded less than 66.*.  It definitely appears to be more
loaded recently than earlier this year when Milton unveiled it...
http://www.i-block.com/php/stats.php?host=&span=yearly&refresh=300


pyzor ping ; pyzor ping
82.94.255.100:24441     (200, 'OK')
66.250.40.33:24441      (200, 'OK')
82.94.255.100:24441     (200, 'OK')
66.250.40.33:24441      TimeoutError: 

[patch] multiple pyzor servers for SpamAssassin

[John E H. <jh...@ti...>]

Below is a patch against the pyzor plugin in SpamAssassin 3.1.6 It
loops over the responses from 'pyzor check' and picks the max.

Thanks to Milton's server and this patch, SA is using pyzor
effectively again to contribute to the spam score.

If you do put more than one server in ~/.pyzor/servers, you should
also either lengthen the SA timeout (pyzor_timeout) from the default
5... or shorten the default pyzor timeout of 5.

I did the latter:

% cat ~/.pyzor/servers
82.94.255.100:24441
66.250.40.33:24441

% cat ~/.pyzor/config
[client]
ServersFile = servers
Timeout = 3

So when 66.* times out (which it does a lot as many people on this
list have observed), it won't cause SA to invalidate other legit
responses from other servers by making SA time out waiting for the
slow server.


This patch has some extra debug in it and was intentionally not
re-indented in order to highlight just the substantive changes.
If it goes into SA,

- fix it to conform to the right indent/coding style and be less hacky

- possibly consider a different algorithm than "pick the max count
  from all responding servers"

- change the default plugin timeout to be a bit more than the default
  pyzor timeout.


--- lib/Mail/SpamAssassin/Plugin/Pyzor.pm.orig	Fri Sep 29 07:06:39 2006
+++ lib/Mail/SpamAssassin/Plugin/Pyzor.pm	Tue Oct 24 11:32:30 2006
@@ -229,7 +229,10 @@
   my ($self, $permsgstatus, $fulltext) = @_;
   my @response;
   my $pyzor_count;
+  my $pyzor_respcount;
   my $pyzor_whitelisted;
+  my $i;
+  my $sz;
   my $timeout = $self->{main}->{conf}->{pyzor_timeout};
 
   $pyzor_count = 0;
@@ -302,16 +305,29 @@
     return 0;
   }
 
+  $pyzor_respcount = 0;
+  $sz = @response;
+  for ($i = 0; $i < $sz; $i++) {
+    dbg("pyzor: response $i: \"$response[$i]\", respcnt: $pyzor_respcount, count: $pyzor_count, resp sz: $sz");
   # this regexp is intended to be a little bit forgiving
-  if ($response[0] =~ /^\S+\t.*?\t(\d+)\t(\d+)\s*$/) {
+  if ($response[$i] =~ /^\S+\t.*?\t(\d+)\t(\d+)\s*$/) {
     $pyzor_whitelisted = $2+0;
     if ($pyzor_whitelisted == 0) {
-      $pyzor_count = $1+0;
+      # Pick max count from all server responses
+      if ($pyzor_count < $1+0) {
+        $pyzor_count = $1+0;
+      }
+      $pyzor_respcount++;
     }
+    dbg("pyzor: response $i,2: \"$response[$i]\", respcnt: $pyzor_respcount, count: $pyzor_count");
   }
   else {
     # warn on failures to parse
-    dbg("pyzor: failure to parse response \"$response[0]\"");
+    dbg("pyzor: failure to parse response \"$response[$i]\"");
+  }
+  }
+  if ($pyzor_respcount > 0) {
+    dbg("pyzor: final count: $pyzor_count");
   }
 
   if ($pyzor_whitelisted) {

Server out?

[Ring, J. C <jc...@sw...>]

I'm seeing the UPD packets going out to 66.250.40.33, but I'm not seeing
any replies reaching us.  I can ping the server, however.

Running pyzor version 0.4.0.  A sample run:

# pyzor -d check < sample-nonspam.txt
calculated digest: 08e7eb05ffb2518788344d88b3b5baa0d23869fa
sending: 'User: anonymous\nTime: 1161709316\nSig:
01b23a5a63413759666f8d34d02ea6e327878ab0\n\nOp: check\nOp-Digest:
08e7eb05ffb2518788344d88b3b5baa0d23869fa\nThread: 53149\nPV: 2.0\n\n'
66.250.40.33:24441      TimeoutError:

and I see:

12:59:22.483447 192.168.5.9.44836 > clapton.quatro.com.pyzor: udp 165
(DF)

on the firewall's external interface, but no reply packet is ever
received.

--=20
John C. Ring, Jr.=20
jc...@sw...=20
Network Engineer
Union Switch & Signal Inc.

"If men were angels, no government would be necessary. If angels were to
govern men, neither external nor internal controls on government would
be necessary." -- James Madison

Re: Planned pyzor server move..

[John E H. <jh...@ti...>]

MIlton Cyrus wrote at 09:38 +0200 on Oct 24, 2006:
 > To clarify: I am referring to the server on 82.94.255.100
 > 
 > On Tue, 2006-10-24 at 02:55 +0200, Milton Cyrus wrote:
 > > Hi Guy's/galls (if any) ;)
 > > 
 > > 
 > > I am planning to move the current Pyzir DB to a now IP/Server . The  
 > > current server desperately needs the other cpu cycles to carry its  
 > > other services. So in an attempt to do this in a scheduled way PLs  
 > > provide me with a maintenance window that works for all.
 > > Preferable in the coming 2 weeks...

I doubt that there is any time in the next two weeks that is worse or
better for anyone here.  So I'd say that you should do what you need
to do when it's best for you.

Do you want people to remove 82.94.255.100 from the .pyzor/servers file
temporarily while you do the move?

And I'd like to say thanks again for putting up a second server.

p.s. I have a patch for spamassassin that allows it to work better
with two or more servers.  I'll send it out in a separate email.

Re: Planned pyzor server move..

[MIlton C. <cy...@i-...>]

To clarify: I am referring to the server on 82.94.255.100

On Tue, 2006-10-24 at 02:55 +0200, Milton Cyrus wrote:
> Hi Guy's/galls (if any) ;)
> 
> 
> I am planning to move the current Pyzir DB to a now IP/Server . The  
> current server desperately needs the other cpu cycles to carry its  
> other services. So in an attempt to do this in a scheduled way PLs  
> provide me with a maintenance window that works for all.
> Preferable in the coming 2 weeks...
> 
> 
> Milt.
> 
> 
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users

Planned pyzor server move..

[Milton C. <mi...@i-...>]

Hi Guy's/galls (if any) ;)


I am planning to move the current Pyzir DB to a now IP/Server . The  
current server desperately needs the other cpu cycles to carry its  
other services. So in an attempt to do this in a scheduled way PLs  
provide me with a maintenance window that works for all.
Preferable in the coming 2 weeks...


Milt.

Re: Is Pyzor alive

[Chris <cpo...@ea...>]

On Thursday 21 September 2006 10:43 pm, Olivier Nicole wrote:
> Hi,
>
> I recently procceed to a major update on my email server, on th
> occasion I updated SA and so I looked in more detail to the subsystems
> it uses.
>
> I found out that most of the time pyzor is timing out.
>
> I could install a local pyzor server, but I have definitely not enough
> traffic to collect any usefull data. Is there a way to have a
> distributed database for pyzor?
>
> Best regards,
>
> Olivier
>
Olivier, try using this address:

82.94.255.100:24441

Milton Cyrus set this one up back in March and I've been using it ever=20
sense. Just remember that if you run "pyzor discover" you'll have to=20
re-enter it in your Pyzor server list. I've had no problems at all using=20
this server.

HTH

=2D-=20
Chris

Is Pyzor alive

[Olivier N. <on...@cs...>]

Hi,

I recently procceed to a major update on my email server, on th
occasion I updated SA and so I looked in more detail to the subsystems
it uses.

I found out that most of the time pyzor is timing out.

I could install a local pyzor server, but I have definitely not enough
traffic to collect any usefull data. Is there a way to have a
distributed database for pyzor?

Best regards,

Olivier

Re: Pyzor Alive?

[Ian S. <ia...@pa...>]

On September 11, 2006 10:51 pm, Chris wrote:
> On Monday 11 September 2006 7:10 pm, Ian Scott wrote:
> > I've just installed pyzor - and after much googling, discovered that the
> > pyzor server IP does not work - but that someone else is hosting the da=
ta
> > at 82.94.255.100:24441
> >
> > That was fun, trying to find that information! :)
> >
> > So I'm wondering, how effective is Pyzor at this time? Is it being
> > regularly updated?  To whom should I submit spam emails to, if anyone?
> >
> > I noticed that the list archives show very little activity recently, as
> > well.
> >
> > Ian Scott
>
> Ian, I've been running Pyzor w/SA for a couple of years now, I've been
> using the server you've mentioned since it was put up. My system is a
> small, single user home system.  My stats for pyzor on yesterdays spam is
> below:
>
>
> TOP SPAM RULES FIRED
> ------------------------------------------------------------
> RANK=C2=A0=C2=A0=C2=A0=C2=A0RULE NAME =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0COUNT %OFRULE=
S %OFMAIL
> %OFSPAM =C2=A0%OFHAM
> ------------------------------------------------------------
>
> 17=C2=A0=C2=A0=C2=A0=C2=A0PYZOR_CHECK =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 40=C2=A0=C2=
=A0=C2=A0 =C2=A01.76=C2=A0=C2=A0 31.75=C2=A0=C2=A0 36.36=C2=A0=C2=A0
> =C2=A00.00
>
> Thats from 110 spam emails.

Thanks Chris.  I'm actually using it with S/A and Amavisd-new.  What are yo=
u=20
using to parse log files to get that information, for one thing?

Secondly... since installing both Pyzor and Razor2, my spam is now virtuall=
y=20
zero!  Amazing!

But the odd one that gets through.. can I submit them somehow to Pyzor?

Re: Pyzor Alive?

[Chris <cpo...@ea...>]

On Monday 11 September 2006 7:10 pm, Ian Scott wrote:
> I've just installed pyzor - and after much googling, discovered that the
> pyzor server IP does not work - but that someone else is hosting the data
> at 82.94.255.100:24441
>
> That was fun, trying to find that information! :)
>
> So I'm wondering, how effective is Pyzor at this time? Is it being
> regularly updated?  To whom should I submit spam emails to, if anyone?
>
> I noticed that the list archives show very little activity recently, as
> well.
>
> Ian Scott

Ian, I've been running Pyzor w/SA for a couple of years now, I've been usin=
g=20
the server you've mentioned since it was put up. My system is a small,=20
single user home system.  My stats for pyzor on yesterdays spam is below:


TOP SPAM RULES FIRED
=2D-----------------------------------------------------------
RANK=A0=A0=A0=A0RULE NAME =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0=A0=A0=A0=A0=A0=A0=
=A0COUNT %OFRULES %OFMAIL=20
%OFSPAM =A0%OFHAM
=2D-----------------------------------------------------------

17=A0=A0=A0=A0PYZOR_CHECK =A0 =A0 =A0 =A0 =A0 =A0 =A0=A0=A0=A0=A0=A0=A0=A0 =
=A0 40=A0=A0=A0 =A01.76=A0=A0 31.75=A0=A0 36.36=A0=A0 =A00.00

Thats from 110 spam emails.

=2D-=20
Chris

Pyzor Alive?

[Ian S. <ia...@pa...>]

I've just installed pyzor - and after much googling, discovered that the py=
zor=20
server IP does not work - but that someone else is hosting the data at=20
82.94.255.100:24441

That was fun, trying to find that information! :)

So I'm wondering, how effective is Pyzor at this time? Is it being regularl=
y=20
updated?  To whom should I submit spam emails to, if anyone?

I noticed that the list archives show very little activity recently, as wel=
l.

Ian Scott

RE: ping

[Ugo B. <ug...@ca...>]

pyz...@li... <> wrote:
>=20
> Just sending a ping to the list to check if we're still alive.
> after looking at the stats and the load on the machine('s) I can
> conclude that:=20
>=20
>   	1. pyzor still adds value at least to my filtering .
> 	2. we need to get someone working on either getting
> this  in Perl
> 	so that more people can contribute. Am first to get
> work done in
> this regard.
> 	3. we need to get the database transparent and  as
> distributed as
> possible asap.
>=20
> re. point 3 I will make a copy of the DB available via http (.tgz) on
> an hourly bases starting 2morrow. this means still there will still
> be a central point to report but the "check" load will be distributed.

Isn't 1 hour delay "too long" when we're talking about spam?

>=20
> If there are people on the list from NL. give me a call and lets
> organize.. else post to the list..

Depending of the needed ressources, I could host a copy of the DB.

Regards,

Ugo

Re: ping

[Milton C. <mi...@i-...>]

Felt I needed to provide just a little but more justification to the  
filtering results</>
http://www.i-block.com/php/lifetime.php?host=&span=daily&refresh=300
Milt.

On 16-aug-2006, at 0:11, Milton Cyrus wrote:

> Just sending a ping to the list to check if we're still alive.
> after looking at the stats and the load on the machine('s) I can
> conclude that:
>
>   	1. pyzor still adds value at least to my filtering .
> 	2. we need to get someone working on either getting this  in Perl
> 	so that more people can contribute. Am first to get work done in
> this regard.
> 	3. we need to get the database transparent and  as distributed as
> possible asap.
>
> re. point 3 I will make a copy of the DB available via http (.tgz) on
> an hourly bases starting 2morrow. this means still there will still
> be a central point to report but the "check" load will be distributed.
>
> If there are people on the list from NL. give me a call and lets
> organize..
> else post to the list..
>
> best
> Milton Cyrus
>
>
>
> ---------------------------------------------------------------------- 
> ---
> Using Tomcat but need to do more? Need to support web services,  
> security?
> Get stuff done quickly with pre-integrated technology to make your  
> job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache  
> Geronimo
> http://sel.as-us.falkag.net/sel? 
> cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users

ping

[Milton C. <mi...@i-...>]

Just sending a ping to the list to check if we're still alive.
after looking at the stats and the load on the machine('s) I can  
conclude that:

  	1. pyzor still adds value at least to my filtering .
	2. we need to get someone working on either getting this  in Perl
	so that more people can contribute. Am first to get work done in  
this regard.
	3. we need to get the database transparent and  as distributed as  
possible asap.

re. point 3 I will make a copy of the DB available via http (.tgz) on  
an hourly bases starting 2morrow. this means still there will still  
be a central point to report but the "check" load will be distributed.

If there are people on the list from NL. give me a call and lets  
organize..
else post to the list..

best
Milton Cyrus

Re: Pyzor Usage statistics for 82.94.255.100

[MIlton C. <cy...@i-...>]

sorry.. should be ..
http://www.i-block.com/php/stats.php?host=&span=daily&refresh=300

Milt.


On Thu, 2006-07-06 at 14:49 +0200, MIlton Cyrus wrote:
> Hi,
> 
> On Tue, 2006-06-27 at 02:17 -0400, pyz...@nr... wrote:
> 
> > As far as Milton's server goes I've never needed to use it. Has he posted
> > anything to indicated that it is overloaded by clients?
> > (Milton Cyrus <mi...@i-...> 82.94.255.100:24441)
> 
> http://www.i-block.com/php/stats.php
> 
> shows current and past statistics.. ... "I was wondering where the
> system-load came from :-) "
> 
> 
> best,
> Milton
> 
> 
> 
> 
> 
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users

Pyzor Usage statistics for 82.94.255.100

[MIlton C. <cy...@i-...>]

Hi,

On Tue, 2006-06-27 at 02:17 -0400, pyz...@nr... wrote:

> As far as Milton's server goes I've never needed to use it. Has he posted
> anything to indicated that it is overloaded by clients?
> (Milton Cyrus <mi...@i-...> 82.94.255.100:24441)

http://www.i-block.com/php/stats.php

shows current and past statistics.. ... "I was wondering where the
system-load came from :-) "


best,
Milton

Re: Checking IPs against Pyzor

[<pyz...@nr...>]

Pyzor isn't IP based. It is based on a hash of a particular email =
message.
Perhaps the guy is confused with some other service. Get the message =
headers
and see what is really going on.
-Sean


On Tue, 4 Jul 2006 13:31:48 +0000 (UTC), you wrote:

>How can one check whether an IP is listed in Pyzor's database? One of my=
=20
>clients is complaining that his IP is being blocked from sending mail to=
=20
>certain hosts because it's listed in Pyzor even though he's not sending=20
>spam. Also, is it possible to remove an IP from Pyzor if it was wrongly=20
>added?
>
>Thanks in advance for the help!
>
>
>- Robert
>
>Using Tomcat but need to do more? Need to support web services, =
security?
>Get stuff done quickly with pre-integrated technology to make your job =
easier
>Download IBM WebSphere Application Server v.1.0.1 based on Apache =
Geronimo
>http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D=
121642
>_______________________________________________
>pyzor-users mailing list
>pyz...@li...
>https://lists.sourceforge.net/lists/listinfo/pyzor-users