pyzor-users — general discussion of Pyzor and Pyzor-related topics

Re: Pyzor server down?

[Andreas S. <sch...@fa...>]

On Tue, 18 May 2010, at 12:38, Dreas van Donselaar wrote:

> This was an issue on the Pyzor server. ...

Thanks. Now, I can reach public.pyzor.org again.

-- 
-- Andreas

Pyzor server down?

[Andreas S. <sch...@fa...>]

Does anyone know what's going on? I can't reach public.pyzor.org from 
my locations.

$ pyzor ping
public.pyzor.org:24441  TimeoutError:
$ host public.pyzor.org
public.pyzor.org has address 188.40.77.236

-- 
-- Andreas

Re: Facebook False Positives

[Clayton K. <ine...@ru...>]

On 4/28/2010 5:43 PM, Tony Meyer wrote:
> On Fri, Apr 23, 2010 at 4:15 AM, Clayton Keller<ine...@ru...>  wrote:
>> I've been seeing since early this morning legit emails from Facebook
>> being blocked with a subject of "Facebook Contact Email Confirmation".
>>
>> Is it possible to prevent these from being checked or is there a good
>> mechanism to have these expunged to clean out any possible false positives?
>>
>> At the moment, I am unable to get examples to submit back with 'pyzor
>> --whitelist'
>
> Without examples (or just the digests) nothing can be done in pyzor
> itself.  If you can give me an example message (or just the digest)
> then I can look into this more.
>
> Otherwise, you can match these messages in some other way and stop
> them going through pyzor (how to do that depends on what you're doing
> to process mail).
>
> Cheers,
> Tony
>

Thanks.

I'll see if I can get any examples. I had a shortcircuit rule that was 
triggering. So, I've prevented that from triggering if a rule with the 
subject above matched.

Re: Problem with pyzor and Spamassassin (in Postfix)

[Sebastian K. <sko...@lo...>]

thanks for your answer!

is there a good way to check if pyzor is doing what it should via mail 
called from spamassassin (like the GTUBE test for SA)?

Do you have a Message for me that should trigger pyzor?

best regards
Sebastian

Am 29.04.2010 11:05, schrieb Tony Meyer:
>> i tried to test my Spamassassin / Pyzor / Razor Setup with the GTUBE
>> Test (i think everyone knows what this is).
>>      
> Pyzor is a collaborative digest system.  It matches exact (or nearly
> exact) copies of messages.  The GTUBE test is a SA-specific test
> (which some other filters support) to see whether a specific string is
> contained within a message.  Those two systems do not align - there's
> no way to have Pyzor support GTUBE, and I have no plans to try.
>
>    
>> Maybe it is okay that pyzor delivers exit 1 on an none spam mail
>>      
> Not maybe.  It is the expected, documented, behaviour.
>
>    
>> und maybe the parse errors are only because of  the debug mode,
>>      
> I believe that is quite clear.  If you want that changed, you'll have
> to change the SA plug-in, not Pyzor.
>
>    
>> but why is
>> pyzor reporting something when the GTUBE test ist used on console but
>> not if GTUBE test is used via Mail?
>>      
> Because you are not using the same message.  The message you are using
> on the console has the same digest as a reported message.  The message
> you are using in mail does not.  You can use the command line client
> to look at the digests.
>
>    
>> And why do i get an exit 0 from pyzor when i use him on the GTUBE test
>> on console and an exit 1 when he is running over the GTUBE test in an
>> incoming email?
>>      
> Because you're not running Pyzor on the console.  You're running SA.
>
> If you want to investigate Pyzor's behaviour, stop running it through
> SA.  Otherwise what you are really looking at is the behaviour of the
> SA plugin.
>
> Cheers,
> Tony
>
> ------------------------------------------------------------------------------
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users
>    

Re: Problem with pyzor and Spamassassin (in Postfix)

[Tony M. <to...@sp...>]

> i tried to test my Spamassassin / Pyzor / Razor Setup with the GTUBE
> Test (i think everyone knows what this is).

Pyzor is a collaborative digest system.  It matches exact (or nearly
exact) copies of messages.  The GTUBE test is a SA-specific test
(which some other filters support) to see whether a specific string is
contained within a message.  Those two systems do not align - there's
no way to have Pyzor support GTUBE, and I have no plans to try.

> Maybe it is okay that pyzor delivers exit 1 on an none spam mail

Not maybe.  It is the expected, documented, behaviour.

> und maybe the parse errors are only because of  the debug mode,

I believe that is quite clear.  If you want that changed, you'll have
to change the SA plug-in, not Pyzor.

> but why is
> pyzor reporting something when the GTUBE test ist used on console but
> not if GTUBE test is used via Mail?

Because you are not using the same message.  The message you are using
on the console has the same digest as a reported message.  The message
you are using in mail does not.  You can use the command line client
to look at the digests.

> And why do i get an exit 0 from pyzor when i use him on the GTUBE test
> on console and an exit 1 when he is running over the GTUBE test in an
> incoming email?

Because you're not running Pyzor on the console.  You're running SA.

If you want to investigate Pyzor's behaviour, stop running it through
SA.  Otherwise what you are really looking at is the behaviour of the
SA plugin.

Cheers,
Tony

Re: Problem with pyzor and Spamassassin (in Postfix)

[Sebastian K. <sko...@lo...>]

Hi,

my initial Problem was this:

i tried to test my Spamassassin / Pyzor / Razor Setup with the GTUBE 
Test (i think everyone knows what this is).

I first send me the GTUBE Test via Mail which reported me this in the 
summary:

---

1000 GTUBE                  BODY: Generic Test for Unsolicited Bulk Email
  0.0 HTML_MESSAGE           BODY: HTML included in message

---

thats all.

when i run the same test on the console i get this summary:

---
-0.0 NO_RELAYS              Informational: message was not relayed via SMTP
1000 GTUBE                  BODY: Generic Test for Unsolicited Bulk Email
  2.7 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                             [cf: 100]
  0.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
                             above 50%
                             [cf: 100]
  1.8 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
  4.8 PYZOR_CHECK            Listed in Pyzor (http://pyzor.sf.net/)
  0.0 DIGEST_MULTIPLE        Message hits more than one network digest 
check
-0.0 NO_RECEIVED            Informational: message has no Received headers
---

also Razor and Pyzor are reported / checked.

i then saw the exit 1 (also without having debug on in SA/Pyzor) in the 
Mail log and thought that there is something wrong...so i started 
investigating.

Maybe it is okay that pyzor delivers exit 1 on an none spam mail und 
maybe the parse errors are only because of  the debug mode, but why is 
pyzor reporting something when the GTUBE test ist used on console but 
not if GTUBE test is used via Mail?

And why do i get an exit 0 from pyzor when i use him on the GTUBE test 
on console and an exit 1 when he is running over the GTUBE test in an 
incoming email?

spamassassin via eMail => exit 1:

---
Apr 28 15:10:43 mail spamd[19721]: pyzor: opening pipe: /usr/bin/pyzor 
--homedir /var/vmail/.pyzor check < /tmp/.spamassassin19721QlsZUItmp
Apr 28 15:10:43 mail spamd[19760]: util: setuid: ruid=5000 euid=5000
Apr 28 15:10:43 mail spamd[19721]: pyzor: [19760] finished: exit 1
Apr 28 15:10:43 mail spamd[19721]: pyzor: got response: 
public.pyzor.org:24441 (200, 'OK') 0 0
---

spamassassin via Console => exit 0 :

---
Apr 28 15:37:34.368 [26581] dbg: pyzor: opening pipe: /usr/bin/pyzor 
--homedir /var/vmail/.pyzor check < /tmp/.spamassassin26581NSj6S4tmp
Apr 28 15:37:34.374 [26582] dbg: util: setuid: ruid=5000 euid=5000
Apr 28 15:37:34.418 [26581] dbg: pyzor: [26582] finished successfully
Apr 28 15:37:34.418 [26581] dbg: pyzor: got response: 
public.pyzor.org:24441 (200, 'OK') 183 0
---

on both checks i used the same GTUBE test (via Mail in an email and via 
console in a file)

Maybe one of you can explain to me, if this is not wrong.

Best regards
Sebastian

Am 29.04.2010 00:41, schrieb Tony Meyer:
>> pyzor always quits with exit 1.
>>      
> As Andreas said, an exit code of 1 indicates that the message was not
> reported.  That is correct behaviour.
>
>    
>> i then activated the debug mode (-d).
>>      
> I don't believe that the SA plug-in understands the debug output.
> You'd have to check that with the SA folk.
>
> ?What exactly is the problem that you are having (when debug output is
> not enabled)?  Just that you saw an exit code of 1?  Or you had an
> actual problem?
>
> Thanks,
> Tony
>
> ------------------------------------------------------------------------------
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users
>    

Re: Problem with pyzor and Spamassassin (in Postfix)

[Tony M. <to...@sp...>]

> pyzor always quits with exit 1.

As Andreas said, an exit code of 1 indicates that the message was not
reported.  That is correct behaviour.

> i then activated the debug mode (-d).

I don't believe that the SA plug-in understands the debug output.
You'd have to check that with the SA folk.

What exactly is the problem that you are having (when debug output is
not enabled)?  Just that you saw an exit code of 1?  Or you had an
actual problem?

Thanks,
Tony

Re: Facebook False Positives

[Tony M. <to...@sp...>]

On Fri, Apr 23, 2010 at 4:15 AM, Clayton Keller <ine...@ru...> wrote:
> I've been seeing since early this morning legit emails from Facebook
> being blocked with a subject of "Facebook Contact Email Confirmation".
>
> Is it possible to prevent these from being checked or is there a good
> mechanism to have these expunged to clean out any possible false positives?
>
> At the moment, I am unable to get examples to submit back with 'pyzor
> --whitelist'

Without examples (or just the digests) nothing can be done in pyzor
itself.  If you can give me an example message (or just the digest)
then I can look into this more.

Otherwise, you can match these messages in some other way and stop
them going through pyzor (how to do that depends on what you're doing
to process mail).

Cheers,
Tony

Re: Problem with pyzor and Spamassassin (in Postfix)

[Sebastian K. <sko...@lo...>]

i now tried the latest pyzor version but get the same parse erros in the 
maillog

Am 28.04.2010 19:14, schrieb Sebastian Kösters:
> Hi,
>
> i am using pyzor-0.4.0-11.el5 on CentOS 5 with spamassassin-3.3.1-3.
>
> Spamassassin works fine in postfix, but pyzor does not.
>
> maillog:
>
> [...]
> Apr 28 15:10:43 mail spamd[19721]: pyzor: opening pipe: /usr/bin/pyzor
> --homedir /var/vmail/.pyzor check<  /tmp/.spamassassin19721QlsZUItmp
> Apr 28 15:10:43 mail spamd[19760]: util: setuid: ruid=5000 euid=5000
> Apr 28 15:10:43 mail spamd[19721]: pyzor: [19760] finished: exit 1
> Apr 28 15:10:43 mail spamd[19721]: pyzor: got response:
> public.pyzor.org:24441 (200, 'OK') 0 0
> [...]
>
> pyzor always quits with exit 1.
>
> i then activated the debug mode (-d).
>
> maillog:
>
> Apr 28 18:10:23 mail spamd[5754]: pyzor: opening pipe: /usr/bin/pyzor -d
> --homedir /var/vmail/.pyzor check<  /tmp/.spamassassin57546sMuqLtmp
> Apr 28 18:10:23 mail spamd[5819]: util: setuid: ruid=5000 euid=5000
> Apr 28 18:10:23 mail spamd[5754]: pyzor: [5819] finished: exit 1
> Apr 28 18:10:23 mail spamd[5754]: pyzor: got response: sending: 'User:
> anonymous\nTime: 1272471023\nSig:
> 16a37f696e317cfd4dea8323fdf93ba645b4be32\n\nOp: check\nOp-Digest:
> da5fba2e21653a9de1187a39bc0426b898de5c03\nThread: 37970\nPV:
> 2.0\n\n'\nreceived: 'Thread: 37970\nCount: 0\nWL-Count: 0\nCode:
> 200\nDiag: OK\nPV: 2.0\n\n'\npublic.pyzor.org:24441 (200, 'OK') 0 0
> Apr 28 18:10:23 mail spamd[5754]: dns: leaving helper-app run mode
> Apr 28 18:10:23 mail spamd[5754]: pyzor: failure to parse response
> "sending: 'User: anonymous\nTime: 1272471023\nSig:
> 16a37f696e317cfd4dea8323fdf93ba645b4be32\n\nOp: check\nOp-Digest:
> da5fba2e21653a9de1187a39bc0426b898de5c03\nThread: 37970\nPV: 2.0\n\n'"
> Apr 28 18:10:23 mail spamd[5754]: pyzor: failure to parse response
> "received: 'Thread: 37970\nCount: 0\nWL-Count: 0\nCode: 200\nDiag:
> OK\nPV: 2.0\n\n'"
>
>
> this does not help me :-/
>
> When i test spamassassin and pyzor from console everything works fine:
>
>
> su - vmail -c "spamassassin -D<  /var/vmail/sample-spam.txt"
>
>
> Apr 28 15:37:34.368 [26581] dbg: pyzor: opening pipe: /usr/bin/pyzor
> --homedir /var/vmail/.pyzor check<  /tmp/.spamassassin26581NSj6S4tmp
> Apr 28 15:37:34.374 [26582] dbg: util: setuid: ruid=5000 euid=5000
> Apr 28 15:37:34.418 [26581] dbg: pyzor: [26582] finished successfully
> Apr 28 15:37:34.418 [26581] dbg: pyzor: got response:
> public.pyzor.org:24441 (200, 'OK') 183 0
>
> pyzor with debug on:
>
> su - vmail -c "/usr/bin/pyzor -d --homedir /var/vmail/.pyzor check<
> /var/vmail/sample-spam.txt"
>
>
> sending: 'User: anonymous\nTime: 1272474781\nSig:
> f60b585c499d9ac86cd9ecdc29d58c467cf102cc\n\nOp: check\nOp-Digest:
> d152948f7f029b35691afa499c145797558b2fff\nThread: 59481\nPV: 2.0\n\n'
> received: 'Thread: 59481\nCount: 183\nWL-Count: 0\nCode: 200\nDiag:
> OK\nPV: 2.0\n\n'
> public.pyzor.org:24441  (200, 'OK')     183     0
>
>
> my local.cf:
>
> ---
> # These values can be overridden by editing ~/.spamassassin/user_prefs.cf
> # (see spamassassin(1) for details)
>
> # These should be safe assumptions and allow for simple visual sifting
> # without risking lost emails.
>
> required_hits 5
> required_score 2.0
> report_safe 1
> rewrite_header Subject  [***** SPAM _SCORE_ *****]
> add_header all Status _YESNO_, score=_SCORE_ required=_REQD_
> tests=_TESTSSCORES(,)_ _PYZOR_ _RBL_ autolearn=_AUTOLEARN_ version=_VERSION_
>
> # Enable the Bayes system
> use_bayes 1
> use_bayes_rules 1
> bayes_path /var/vmail/.spamassassin/bayes
> # Enable Bayes auto-learning
> bayes_auto_learn 1
>
> # Enable or disable network checks
> skip_rbl_checks 0
>
> use_razor2 1
> razor_config /var/vmail/.razor/razor-agent.conf
> razor_timeout 10
>
> use_pyzor 1
> pyzor_path /usr/bin/pyzor
> pyzor_options --homedir /var/vmail/.pyzor
> pyzor_max 15
> pyzor_timeout 15
>
> #bayes punkte
> score BAYES_00 -6.1
> score BAYES_01 -5.0
> score BAYES_10 -3.5
> score BAYES_20 -2.0
> score BAYES_30 -1.0
> score BAYES_40 -0.3
> score BAYES_44 -0.01
> score BAYES_50 0.01
> score BAYES_56 0.3
> score BAYES_60 1.0
> score BAYES_70 1.6
> score BAYES_80 3.1
> score BAYES_90 5.2
> score BAYES_99 7.2
>
> #razor punkte
> score RAZOR2_CHECK 1.8
> score RAZOR2_CF_RANGE_11_50 0.32
> score RAZOR2_CF_RANGE_51_100 2.7
>
> #pyzor punkte
> score PYZOR_CHECK 4.8
>
> #sonstige punkte
> score SUBJ_ILLEGAL_CHARS 2.6
> score PORN_4 3.7
> score RCVD_IN_RFCI 2.0
> score RCVD_IN_ORBS 1.0
> score RCVD_IN_DSBL 1.0
> score RCVD_IN_SBL 0.5
> score RCVD_IN_VISI 1.0
> score RCVD_IN_RFCI 0.5
> score RCVD_IN_SORBS 0.5
> score X_NJABL_OPEN_PROXY 0.5
> score RCVD_IN_UNCONFIRMED_DSBL 0.2
> score RCVD_IN_BL_SPAMCOP_NET 1.1
> score RCVD_IN_VISI 0.3
> score RCVD_IN_RELAYS_ORDB_ORG 0.3
> score USER_AGENT_MACOE 1.0
> score NIGERIAN_TRANSACTION_1 1.5
> score MICROSOFT_EXECUTABLE 3.100
> score MIME_SUSPECT_NAME 3.100
> score RCVD_IN_BONDEDSENDER -6.0
> score HABEAS_HIL_RBL -6.0
> score X_LIST_UNSUBSCRIBE 0.5
> score EMAIL_ATTRIBUTION -0.5
> score IN_REP_TO -0.5
> score QUOTED_EMAIL_TEXT -0.5
> score REPLY_WITH_QUOTES -0.5
> score HTML_IMAGE_ONLY_02 1.978
> score HTML_IMAGE_ONLY_04 2.087
> score HTML_IMAGE_ONLY_06 1.228
> score HTML_IMAGE_ONLY_08 0.984
> score HTML_IMAGE_ONLY_10 0.843
> score HTML_IMAGE_ONLY_12 0.487
> score EMAIL_ATTRIBUTION -1
> score MSGID_GOOD_EXCHANGE -1
>
> # Reports
> clear_report_template
> report Diese Mail wurde vom SpamAssassin Spam-Filter als Spam erkannt.
> report Sollte diese Nachricht zu Unrecht als Spam markiert worden sein,
> report bitte diese Mail an sp...@do... weiterleiten
> report
> report Vielen Dank!
> report
> report Die Originalnachricht ist dieser E-Mail als Anhang beigefuegt.
> report
> report Content analysis details: (_HITS_ points, _REQD_ required)
> report
> report
> report Zusammenfassug:
> report
> report _SUMMARY_
>
>
> clear_unsafe_report_template
> unsafe_report Diese Nachricht ist nicht komplett in plain text gewesen,
> so dass es
> unsafe_report evtl. gefaehrlich ist, sie zu oeffnen, da die Mail
> moeglicherweise
> unsafe_report einen Virus enthalten koennte Wer sie dennoch anschauen
> moechte, sollte
> unsafe_report dafuer besser einen Editor verwenden!
> ---
>
>
> my master.cf:
>
> ---
>
> smtp      inet  n       -       n       -       -       smtpd
>     -o content_filter=spamassassin
> [....]
> spamassassin unix -     n       n       -       -       pipe
>           user=vmail argv=/usr/bin/spamc -f -e
>           /usr/sbin/sendmail -oi -f ${sender} ${recipient}
> ---
>
> Hope one of you guys can help me.
>
> Best regards
> Sebastian
>
> ------------------------------------------------------------------------------
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users
>    

Re: Problem with pyzor and Spamassassin (in Postfix)

[Sebastian K. <sko...@lo...>]

Hi and thanks,

the test file i used on the console was also the file i used in the mail 
(the body of the testfile).

When i use the testfile on the console => exit 0

When i send the body of the test file via Mail => exit 1 with the parse 
errors.

two different behaviours on the same body?!

best regards
Sebastian

Am 28.04.2010 20:10, schrieb Andreas Schamanek:
> Hi,
>
> On Wed, 28 Apr 2010, at 19:14, Sebastian Koesters wrote:
>
>    
>> Spamassassin works fine in postfix, but pyzor does not.
>>      
> Can't help with Postfix, but
>
>    
>> pyzor always quits with exit 1.
>>      
> this is normal behavior for messages which have not been reported:
>
> $ pyzor check<  spam.eml ; echo $?
> public.pyzor.org:24441  (200, 'OK')     12      0
> 0
> $ pyzor check<  ham.eml ; echo $?
> public.pyzor.org:24441  (200, 'OK')     0       0
> 1
>
> HTH,
>
>    

Re: Problem with pyzor and Spamassassin (in Postfix)

[Andreas S. <sch...@fa...>]

Hi,

On Wed, 28 Apr 2010, at 19:14, Sebastian Koesters wrote:

> Spamassassin works fine in postfix, but pyzor does not.

Can't help with Postfix, but

> pyzor always quits with exit 1.

this is normal behavior for messages which have not been reported:

$ pyzor check < spam.eml ; echo $?
public.pyzor.org:24441  (200, 'OK')     12      0
0
$ pyzor check < ham.eml ; echo $?
public.pyzor.org:24441  (200, 'OK')     0       0
1

HTH,

-- 
-- Andreas

   on Debian Lenny

Problem with pyzor and Spamassassin (in Postfix)

[Sebastian K. <sko...@lo...>]

Hi,

i am using pyzor-0.4.0-11.el5 on CentOS 5 with spamassassin-3.3.1-3.

Spamassassin works fine in postfix, but pyzor does not.

maillog:

[...]
Apr 28 15:10:43 mail spamd[19721]: pyzor: opening pipe: /usr/bin/pyzor 
--homedir /var/vmail/.pyzor check < /tmp/.spamassassin19721QlsZUItmp
Apr 28 15:10:43 mail spamd[19760]: util: setuid: ruid=5000 euid=5000
Apr 28 15:10:43 mail spamd[19721]: pyzor: [19760] finished: exit 1
Apr 28 15:10:43 mail spamd[19721]: pyzor: got response: 
public.pyzor.org:24441 (200, 'OK') 0 0
[...]

pyzor always quits with exit 1.

i then activated the debug mode (-d).

maillog:

Apr 28 18:10:23 mail spamd[5754]: pyzor: opening pipe: /usr/bin/pyzor -d 
--homedir /var/vmail/.pyzor check < /tmp/.spamassassin57546sMuqLtmp
Apr 28 18:10:23 mail spamd[5819]: util: setuid: ruid=5000 euid=5000
Apr 28 18:10:23 mail spamd[5754]: pyzor: [5819] finished: exit 1
Apr 28 18:10:23 mail spamd[5754]: pyzor: got response: sending: 'User: 
anonymous\nTime: 1272471023\nSig: 
16a37f696e317cfd4dea8323fdf93ba645b4be32\n\nOp: check\nOp-Digest: 
da5fba2e21653a9de1187a39bc0426b898de5c03\nThread: 37970\nPV: 
2.0\n\n'\nreceived: 'Thread: 37970\nCount: 0\nWL-Count: 0\nCode: 
200\nDiag: OK\nPV: 2.0\n\n'\npublic.pyzor.org:24441 (200, 'OK') 0 0
Apr 28 18:10:23 mail spamd[5754]: dns: leaving helper-app run mode
Apr 28 18:10:23 mail spamd[5754]: pyzor: failure to parse response 
"sending: 'User: anonymous\nTime: 1272471023\nSig: 
16a37f696e317cfd4dea8323fdf93ba645b4be32\n\nOp: check\nOp-Digest: 
da5fba2e21653a9de1187a39bc0426b898de5c03\nThread: 37970\nPV: 2.0\n\n'"
Apr 28 18:10:23 mail spamd[5754]: pyzor: failure to parse response 
"received: 'Thread: 37970\nCount: 0\nWL-Count: 0\nCode: 200\nDiag: 
OK\nPV: 2.0\n\n'"


this does not help me :-/

When i test spamassassin and pyzor from console everything works fine:


su - vmail -c "spamassassin -D < /var/vmail/sample-spam.txt"


Apr 28 15:37:34.368 [26581] dbg: pyzor: opening pipe: /usr/bin/pyzor 
--homedir /var/vmail/.pyzor check < /tmp/.spamassassin26581NSj6S4tmp
Apr 28 15:37:34.374 [26582] dbg: util: setuid: ruid=5000 euid=5000
Apr 28 15:37:34.418 [26581] dbg: pyzor: [26582] finished successfully
Apr 28 15:37:34.418 [26581] dbg: pyzor: got response: 
public.pyzor.org:24441 (200, 'OK') 183 0

pyzor with debug on:

su - vmail -c "/usr/bin/pyzor -d --homedir /var/vmail/.pyzor check < 
/var/vmail/sample-spam.txt"


sending: 'User: anonymous\nTime: 1272474781\nSig: 
f60b585c499d9ac86cd9ecdc29d58c467cf102cc\n\nOp: check\nOp-Digest: 
d152948f7f029b35691afa499c145797558b2fff\nThread: 59481\nPV: 2.0\n\n'
received: 'Thread: 59481\nCount: 183\nWL-Count: 0\nCode: 200\nDiag: 
OK\nPV: 2.0\n\n'
public.pyzor.org:24441  (200, 'OK')     183     0


my local.cf:

---
# These values can be overridden by editing ~/.spamassassin/user_prefs.cf
# (see spamassassin(1) for details)

# These should be safe assumptions and allow for simple visual sifting
# without risking lost emails.

required_hits 5
required_score 2.0
report_safe 1
rewrite_header Subject  [***** SPAM _SCORE_ *****]
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ 
tests=_TESTSSCORES(,)_ _PYZOR_ _RBL_ autolearn=_AUTOLEARN_ version=_VERSION_

# Enable the Bayes system
use_bayes 1
use_bayes_rules 1
bayes_path /var/vmail/.spamassassin/bayes
# Enable Bayes auto-learning
bayes_auto_learn 1

# Enable or disable network checks
skip_rbl_checks 0

use_razor2 1
razor_config /var/vmail/.razor/razor-agent.conf
razor_timeout 10

use_pyzor 1
pyzor_path /usr/bin/pyzor
pyzor_options --homedir /var/vmail/.pyzor
pyzor_max 15
pyzor_timeout 15

#bayes punkte
score BAYES_00 -6.1
score BAYES_01 -5.0
score BAYES_10 -3.5
score BAYES_20 -2.0
score BAYES_30 -1.0
score BAYES_40 -0.3
score BAYES_44 -0.01
score BAYES_50 0.01
score BAYES_56 0.3
score BAYES_60 1.0
score BAYES_70 1.6
score BAYES_80 3.1
score BAYES_90 5.2
score BAYES_99 7.2

#razor punkte
score RAZOR2_CHECK 1.8
score RAZOR2_CF_RANGE_11_50 0.32
score RAZOR2_CF_RANGE_51_100 2.7

#pyzor punkte
score PYZOR_CHECK 4.8

#sonstige punkte
score SUBJ_ILLEGAL_CHARS 2.6
score PORN_4 3.7
score RCVD_IN_RFCI 2.0
score RCVD_IN_ORBS 1.0
score RCVD_IN_DSBL 1.0
score RCVD_IN_SBL 0.5
score RCVD_IN_VISI 1.0
score RCVD_IN_RFCI 0.5
score RCVD_IN_SORBS 0.5
score X_NJABL_OPEN_PROXY 0.5
score RCVD_IN_UNCONFIRMED_DSBL 0.2
score RCVD_IN_BL_SPAMCOP_NET 1.1
score RCVD_IN_VISI 0.3
score RCVD_IN_RELAYS_ORDB_ORG 0.3
score USER_AGENT_MACOE 1.0
score NIGERIAN_TRANSACTION_1 1.5
score MICROSOFT_EXECUTABLE 3.100
score MIME_SUSPECT_NAME 3.100
score RCVD_IN_BONDEDSENDER -6.0
score HABEAS_HIL_RBL -6.0
score X_LIST_UNSUBSCRIBE 0.5
score EMAIL_ATTRIBUTION -0.5
score IN_REP_TO -0.5
score QUOTED_EMAIL_TEXT -0.5
score REPLY_WITH_QUOTES -0.5
score HTML_IMAGE_ONLY_02 1.978
score HTML_IMAGE_ONLY_04 2.087
score HTML_IMAGE_ONLY_06 1.228
score HTML_IMAGE_ONLY_08 0.984
score HTML_IMAGE_ONLY_10 0.843
score HTML_IMAGE_ONLY_12 0.487
score EMAIL_ATTRIBUTION -1
score MSGID_GOOD_EXCHANGE -1

# Reports
clear_report_template
report Diese Mail wurde vom SpamAssassin Spam-Filter als Spam erkannt.
report Sollte diese Nachricht zu Unrecht als Spam markiert worden sein,
report bitte diese Mail an sp...@do... weiterleiten
report
report Vielen Dank!
report
report Die Originalnachricht ist dieser E-Mail als Anhang beigefuegt.
report
report Content analysis details: (_HITS_ points, _REQD_ required)
report
report
report Zusammenfassug:
report
report _SUMMARY_


clear_unsafe_report_template
unsafe_report Diese Nachricht ist nicht komplett in plain text gewesen, 
so dass es
unsafe_report evtl. gefaehrlich ist, sie zu oeffnen, da die Mail 
moeglicherweise
unsafe_report einen Virus enthalten koennte Wer sie dennoch anschauen 
moechte, sollte
unsafe_report dafuer besser einen Editor verwenden!
---


my master.cf:

---

smtp      inet  n       -       n       -       -       smtpd
   -o content_filter=spamassassin
[....]
spamassassin unix -     n       n       -       -       pipe
         user=vmail argv=/usr/bin/spamc -f -e
         /usr/sbin/sendmail -oi -f ${sender} ${recipient}
---

Hope one of you guys can help me.

Best regards
Sebastian

Facebook False Positives

[Clayton K. <ine...@ru...>]

I've been seeing since early this morning legit emails from Facebook 
being blocked with a subject of "Facebook Contact Email Confirmation".

Is it possible to prevent these from being checked or is there a good 
mechanism to have these expunged to clean out any possible false positives?

At the moment, I am unable to get examples to submit back with 'pyzor 
--whitelist'

dumping pyzord database

[Oguz Y. <ogu...@gm...>]

Hi,

How can I dump the data and number of the occurances of entries to a text file?

Regards,

Re: Unsubscribe

[Ed K. <ed...@es...>]

Check the headers:

List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/pyzor-users>,
         <mailto:pyz...@li...?subject=unsubscribe>

At 01:05 AM Tuesday, 4/6/2010, ara...@gm... wrote -=>

>Unsubscribe
>
>>On Apr 6, 2010 3:42 AM, "Maxim Kostyukov" 
>><<mailto:max...@gm...>max...@gm...> wrote:
>>
>>I am getting this in the logs for each email being processed by Pyzor:
>>
>>Tue Apr  6 11:22:57 2010 [60458] info: pyzor: [60795] error:
>>TERMINATED, signal 15 (000f)
>>
>>Is that normal (and can be ignored) or something indicates Pyzor is
>>failing the checking?
>>
>>SpamAssassin version 3.3.0 running on Perl version 5.8.9, FreeBSD 6.3
>>
>># pyzor ping
>><http://public.pyzor.org:24441>public.pyzor.org:24441  (200, 'OK')
>>
>>Pyzor related configuration in SA:
>>
>>use_pyzor               1
>>pyzor_options --homedir /var/mail/pyzor
>>
>>------------------------------------------------------------------------------
>>Download Intel&#174; Parallel Studio Eval
>>Try the new software tools for yourself. Speed compiling, find bugs
>>proactively, and fine-tune applications for parallel performance.
>>See why Intel Parallel Studio got high marks during beta.
>><http://p.sf.net/sfu/intel-sw-dev>http://p.sf.net/sfu/intel-sw-dev
>>_______________________________________________
>>pyzor-users mailing list
>><mailto:pyz...@li...>pyz...@li...
>>https://lists.sourceforge.net/lists/listinfo/pyzor-users
>------------------------------------------------------------------------------
>Download Intel&#174; Parallel Studio Eval
>Try the new software tools for yourself. Speed compiling, find bugs
>proactively, and fine-tune applications for parallel performance.
>See why Intel Parallel Studio got high marks during beta.
>http://p.sf.net/sfu/intel-sw-dev
>_______________________________________________
>pyzor-users mailing list
>pyz...@li...
>https://lists.sourceforge.net/lists/listinfo/pyzor-users

...........................................................................

Randomly Generated Quote (1555 of 1623):
When work is a pleasure, life is a joy! When work is a duty,
  life is slavery. -Maxim Gorky, author (1868-1936)

Unsubscribe

[<ara...@gm...>]

Unsubscribe

On Apr 6, 2010 3:42 AM, "Maxim Kostyukov" <max...@gm...> wrote:

I am getting this in the logs for each email being processed by Pyzor:

Tue Apr  6 11:22:57 2010 [60458] info: pyzor: [60795] error:
TERMINATED, signal 15 (000f)

Is that normal (and can be ignored) or something indicates Pyzor is
failing the checking?

SpamAssassin version 3.3.0 running on Perl version 5.8.9, FreeBSD 6.3

# pyzor ping
public.pyzor.org:24441  (200, 'OK')

Pyzor related configuration in SA:

use_pyzor               1
pyzor_options --homedir /var/mail/pyzor

------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
pyzor-users mailing list
pyz...@li...
https://lists.sourceforge.net/lists/listinfo/pyzor-users

Unsubscribe

[<ara...@gm...>]

Unsubscribe

On Apr 6, 2010 3:42 AM, "Maxim Kostyukov" <max...@gm...> wrote:

I am getting this in the logs for each email being processed by Pyzor:

Tue Apr  6 11:22:57 2010 [60458] info: pyzor: [60795] error:
TERMINATED, signal 15 (000f)

Is that normal (and can be ignored) or something indicates Pyzor is
failing the checking?

SpamAssassin version 3.3.0 running on Perl version 5.8.9, FreeBSD 6.3

# pyzor ping
public.pyzor.org:24441  (200, 'OK')

Pyzor related configuration in SA:

use_pyzor               1
pyzor_options --homedir /var/mail/pyzor

------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
pyzor-users mailing list
pyz...@li...
https://lists.sourceforge.net/lists/listinfo/pyzor-users

pyzor error TERMINATED signal 15

[Maxim K. <max...@gm...>]

I am getting this in the logs for each email being processed by Pyzor:

Tue Apr  6 11:22:57 2010 [60458] info: pyzor: [60795] error:
TERMINATED, signal 15 (000f)

Is that normal (and can be ignored) or something indicates Pyzor is
failing the checking?

SpamAssassin version 3.3.0 running on Perl version 5.8.9, FreeBSD 6.3

# pyzor ping
public.pyzor.org:24441  (200, 'OK')

Pyzor related configuration in SA:

use_pyzor               1
pyzor_options --homedir /var/mail/pyzor

Re: public.pyzor.org:24441 is down

[Maxim K. <max...@gm...>]

My bad, that is a firewall issue. We allowed both tcp/udp and the
problem went away, pyzor ping is OK.
Now I am getting another issue (terminated signal 15) on each email
being processed by pyzor, but will open a separate thread. Thanks to
all.

On Fri, Apr 2, 2010 at 9:20 PM, Benny Pedersen <me...@ju...> wrote:
> On fre 02 apr 2010 15:03:14 CEST, Maxim Kostyukov wrote
>
>> $ telnet public.pyzor.org 24441
>> Trying 188.40.77.236...
>> telnet: connect to address 188.40.77.236: Connection refused
>> telnet: Unable to connect to remote host
>>
>> $ ping public.pyzor.org
>> PING public.pyzor.org (188.40.77.236): 56 data bytes
>> 64 bytes from 188.40.77.236: icmp_seq=0 ttl=53 time=41.377 ms
>> 64 bytes from 188.40.77.236: icmp_seq=1 ttl=53 time=42.716 ms
>>
>> $ date
>> Fri Apr  2 14:02:39 UTC 2010
>
> is pyzord listning on tcp ?, when i run it here it was just udp :=)
>
>
> --
> xpoint
>
>
> ------------------------------------------------------------------------------
> Download Intel&#174; Parallel Studio Eval
> Try the new software tools for yourself. Speed compiling, find bugs
> proactively, and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users
>

Re: public.pyzor.org:24441 is down

[Benny P. <me...@ju...>]

On fre 02 apr 2010 15:03:14 CEST, Maxim Kostyukov wrote

> $ telnet public.pyzor.org 24441
> Trying 188.40.77.236...
> telnet: connect to address 188.40.77.236: Connection refused
> telnet: Unable to connect to remote host
>
> $ ping public.pyzor.org
> PING public.pyzor.org (188.40.77.236): 56 data bytes
> 64 bytes from 188.40.77.236: icmp_seq=0 ttl=53 time=41.377 ms
> 64 bytes from 188.40.77.236: icmp_seq=1 ttl=53 time=42.716 ms
>
> $ date
> Fri Apr  2 14:02:39 UTC 2010

is pyzord listning on tcp ?, when i run it here it was just udp :=)


-- 
xpoint

Re: public.pyzor.org:24441 is down

[Ed K. <ed...@es...>]

At 06:10 AM Friday, 4/2/2010, you wrote -=>

>On Fri, 2 Apr 2010, at 17:03, Maxim Kostyukov wrote:
>
> > $ telnet public.pyzor.org 24441
> > Trying 188.40.77.236...
> > telnet: connect to address 188.40.77.236: Connection refused
>
>You should use _pyzor ping_ to check:
>
>$ pyzor ping
>public.pyzor.org:24441  (200, 'OK')

Same here:
$ date && pyzor ping
Fri Apr  2 09:03:51 PDT 2010
public.pyzor.org:24441  (200, 'OK')


Ed Kasky
~~~~~~~~~
Randomly Generated Quote (934 of 1230):
Small change can often be found under seat cushions.
                 -- One of Lazarus Long's most penetrating insights

Re: public.pyzor.org:24441 is down

[Andreas S. <sch...@fa...>]

On Fri, 2 Apr 2010, at 17:03, Maxim Kostyukov wrote:

> $ telnet public.pyzor.org 24441
> Trying 188.40.77.236...
> telnet: connect to address 188.40.77.236: Connection refused

You should use _pyzor ping_ to check:

$ pyzor ping
public.pyzor.org:24441  (200, 'OK')

HTH,

-- 
-- Andreas

public.pyzor.org:24441 is down

[Maxim K. <max...@gm...>]

$ telnet public.pyzor.org 24441
Trying 188.40.77.236...
telnet: connect to address 188.40.77.236: Connection refused
telnet: Unable to connect to remote host

$ ping public.pyzor.org
PING public.pyzor.org (188.40.77.236): 56 data bytes
64 bytes from 188.40.77.236: icmp_seq=0 ttl=53 time=41.377 ms
64 bytes from 188.40.77.236: icmp_seq=1 ttl=53 time=42.716 ms

$ date
Fri Apr  2 14:02:39 UTC 2010

Re: pyzor id/account (was: registering)

[Benny P. <me...@ju...>]

On ons 17 mar 2010 11:22:11 CET, Matus UHLAR - fantomas wrote
> are there more pyzor servers?
> I meant pyzor account of course. I was somehow unable tyo find out how to
> report spam to public pyzor server...

http://bugs.gentoo.org/295042
http://bugs.gentoo.org/216374

seems no one had it working to me :(

is server to server digest exhange dropped ?

-- 
xpoint

Re: pyzor id/account (was: registering)

[Matus U. - f. <uh...@fa...>]

> >> I'd like to subscribeget my pyzor ID so I could report spam (and optionally
> >> whitelist FPs) with pyzor system.
> >> First I have to agree with server's admin on my login, that requires finding
> >> admin contact. I wasn't able to find it ;-)
> >> second I have to create a key, protected with the password... why the
> >> password? Is it OK when I won't put any (enter empty one)?

> On Tue 23 Feb 2010 09:24:47 AM CET, Matus UHLAR - fantomas wrote
> > any way to get an account on public pyzor server?

On 23.02.10 23:00, Benny Pedersen wrote:
> is server to server digest protocol dropped ?
> 
> i had pyzord running before, but then came a opdate :(

are there more pyzor servers?
I meant pyzor account of course. I was somehow unable tyo find out how to
report spam to public pyzor server...
-- 
Matus UHLAR - fantomas, uh...@fa... ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"To Boot or not to Boot, that's the question." [WD1270 Caviar]