[clue-tech] sa-update

[Mike Staver]

Well, I set up a cron job to run sa-update nightly using this script:

MAILTO=""
0 03 * * * sa-update && service spamassassin restart

That should take care of my rules getting updated very often, which I 
think goes a long way to SA actually catching new spam.  The only way I 
used to get them was by waiting for a new version to be released, then 
I'd upgrade the RPM.  Now I get rule updates whenever they get released, 
which makes me happy. I'm still not able to get SA to work with DCC. 
Here are the relevant parts of my maillog:

dccifd[32315]: 1.3.37 listening to /etc/dcc/dccifd

spamd[32355]: rules: meta test DIGEST_MULTIPLE has undefined dependency 
'DCC_CHECK'

dccifd[32315]: 1.3.37 detected 0 spam, ignored for 0, rejected for 0, 
and discarded for 0 targets among 0 total messages for 0 targets since 
10/05/06 00:00:00

If somebody could help me fix this, I'd be forever grateful. But yes, 
now that I have SA checking more things, it does take longer - but 
that's a price I'm willing to pay for less interruptions during the day 
from spam. Here are some settings from my local.cf file in SA:

rewrite_header Subject [SPAM (_SCORE_)]
report_safe 2
use_razor2 1
use_pyzor 1
trusted_networks 66.185.98.
required_score 4.5
use_bayes 1
loadplugin Mail::SpamAssassin::Plugin::DCC
# DCCifd Options
use_dcc 1
dcc_timeout 10
dcc_home /var/dcc
dcc_path /var/dcc
ok_locales en
score RCVD_IN_MAPS_RBL 2.0
score RCVD_IN_MAPS_DUL 1.0
score RCVD_IN_MAPS_RSS 2.0
score RCVD_IN_MAPS_NML 2.0

With SA 3.1.5, I'm pretty happy with the results.  Since last night, I 
have gotten 75 spam emails - only 2 of which snuck through.  Both of 
those had Razor checks come through, but it wasn't enough to send them 
into my junkmail folder.  Maybe I should raise the razor score - but I 
think I'd rather get DCC to work.

Sean LeBlanc wrote:
> On 10-04 14:56, Mike Staver wrote:
> 
> <snip>
> 
> I'd be interested to know if you found some solutions, and what your various
> settings are. I've been noticing a lot of spam getting past SpamAssassin in
> the past year or so, and I'm getting sick of it. I turned off a lot of
> features since it ran so slow (timing out even, I believe), but maybe I
> should find and turn selected ones back on. I remember at least one that
> checked for deliberate misspellings, but it doesn't seem to work, as spam of
> that sort still gets through.
> 
> 
> 

-- 

                                 -Mike Staver
                                  staver at fimble.com
                                  mstaver at globaltaxnetwork.com

"Those who would give up essential Liberty, to
purchase a little temporary Safety, deserve neither
Liberty nor Safety."

	- Benjamin Franklin