Mailing List Archive: SpamAssassin: devel

Rule updates are too old

1 2 3 4

View All

Index | Next | Previous | View Threaded

darxus at chaosreigns

Jun 17, 2012, 9:00 AM

Post #1 of 85 (1259 views)
Permalink

Rule updates are too old

SpamAssassin version 3.3.0 has not had a rule update since 2012-06-16.
SpamAssassin version 3.3.1 has not had a rule update since 2012-06-16.
SpamAssassin version 3.3.2 has not had a rule update since 2012-06-16.

darxus at chaosreigns

Jun 23, 2012, 9:00 AM

Post #2 of 85 (1210 views)
Permalink

Rule updates are too old [In reply to]

darxus at chaosreigns

Jun 24, 2012, 9:00 AM

Post #3 of 85 (1203 views)
Permalink

Rule updates are too old [In reply to]

darxus at chaosreigns

Jun 25, 2012, 9:00 AM

Post #4 of 85 (1201 views)
Permalink

Rule updates are too old [In reply to]

darxus at chaosreigns

Jun 25, 2012, 9:53 AM

Post #5 of 85 (1197 views)
Permalink

Re: Rule updates are too old [In reply to]

On 06/25, darxus [at] chaosreigns wrote:
> SpamAssassin version 3.3.0 has not had a rule update since 2012-06-22.

The problem for a while was insufficient spam corpora. As of the update
this past weekend, spam corpora is fine, but ham corpora dropped below the
threshold. We had 119,126 out of a needed 150,000. It looks like this is
due to losing ham-net-llanga in the last week, which had 93,322 hams a week
ago. I just emailed llanga offlist.

Missing ham-net-llanga - last seen 20120616.
Missing ham-net-zmi - last seen 20120609.
Missing ham-net-wt-jp1 - last seen 20120331.
Missing ham-net-wt-en3 - last seen 20120331.
Missing ham-net-wt-en1 - last seen 20120331.
Missing ham-net-axb-ned-spam - last seen 20120331.
Missing ham-net-axb-phish - last seen 20120317.
Missing ham-net-axb-ned-phish - last seen 20120317.
Missing ham-net-axb-ham - last seen 20120317.
Missing ham-net-axb-fraud-feeds - last seen 20120317.
Missing ham-net-axb-fraud-autofilter - last seen 20120317.
Missing ham-net-wt-homeone - last seen 20120303.
Missing ham-net-wt-hamtrap - last seen 20120303.
Missing ham-net-wt-en2-flh - last seen 20120303.
Missing ham-net-wt-ackbar - last seen 20120303.
Missing ham-net-darxus-trap - last seen 20120204.
Missing ham-net-axb-brasil - last seen 20120204.
Missing ham-net-kgolding - last seen 20111015.
Missing ham-net-dos - last seen 20111015.
Missing ham-net-nbebout - last seen 20110528.
Missing ham-net-jm - last seen 20110401.
Missing ham-net-wt-hamtrap-en - last seen 20110129.
Missing ham-net-bb-zmi - last seen 20110115.
Missing ham-net-bb-trec_enron - last seen 20110115.
Missing ham-net-bb-kmcgrail - last seen 20110115.
Missing ham-net-bb-fredt - last seen 20110115.
Missing ham-net-bb-doc - last seen 20110115.

--
"My definition of a free society is a society where it is safe to be
unpopular." - Adlai E. Stevenson Jr.
http://www.ChaosReigns.com

p at state-of-mind

Jun 25, 2012, 9:59 AM

Post #6 of 85 (1204 views)
Permalink

Re: Rule updates are too old [In reply to]

* darxus [at] chaosreigns <darxus [at] chaosreigns>:
> On 06/25, darxus [at] chaosreigns wrote:
> > SpamAssassin version 3.3.0 has not had a rule update since 2012-06-22.
>
> The problem for a while was insufficient spam corpora. As of the update
> this past weekend, spam corpora is fine, but ham corpora dropped below the
> threshold. We had 119,126 out of a needed 150,000. It looks like this is
> due to losing ham-net-llanga in the last week, which had 93,322 hams a week
> ago. I just emailed llanga offlist.

I didn't follow this for a while. Has the security problem been addressed? Has
the corpus been reopened for new contributors?

p [at] ric

--
state of mind ()

http://www.state-of-mind.de

Franziskanerstraße 15 Telefon +49 89 3090 4664
81669 München Telefax +49 89 3090 4666

Amtsgericht München Partnerschaftsregister PR 563

darxus at chaosreigns

Jun 25, 2012, 10:41 AM

Post #7 of 85 (1197 views)
Permalink

Re: Rule updates are too old [In reply to]

On 06/25, darxus [at] chaosreigns wrote:
> due to losing ham-net-llanga in the last week, which had 93,322 hams a week
> ago. I just emailed llanga offlist.

Got a good reply back from llanga, something did happen on his end, and:

> I'm confident it data will be back shortly.

--
"Will I ever learn? I hope not, I'm having too much fun."
- Brent "Minime" Avis, motorcycle.com
http://www.ChaosReigns.com

darxus at chaosreigns

Jun 25, 2012, 10:49 AM

Post #8 of 85 (1206 views)
Permalink

Re: Rule updates are too old [In reply to]

On 06/25, Patrick Ben Koetter wrote:
> I didn't follow this for a while. Has the security problem been addressed? Has
> the corpus been reopened for new contributors?

No change. Bug 6694 is still preventing addition of masscheck
contributors. I continue to feel that it should just be closed as a
non-issue and new contributors should be allowed. It seems we have one
PMC vote in favor of that (Kevin McGrail), and I think policy requires
two more PMC votes to do that.

Do we have two other PMC members around to vote on that? Anybody actually
object?

( https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6694 )

--
"If you want to make an apple pie from scratch, you must first create
the universe." - Carl Sagan
http://www.ChaosReigns.com

KMcGrail at PCCC

Jun 25, 2012, 10:56 AM

Post #9 of 85 (1195 views)
Permalink

Re: Rule updates are too old [In reply to]

On 6/25/2012 1:49 PM, darxus [at] chaosreigns wrote:
> On 06/25, Patrick Ben Koetter wrote:
>> I didn't follow this for a while. Has the security problem been addressed? Has
>> the corpus been reopened for new contributors?
> No change. Bug 6694 is still preventing addition of masscheck
> contributors. I continue to feel that it should just be closed as a
> non-issue and new contributors should be allowed. It seems we have one
> PMC vote in favor of that (Kevin McGrail), and I think policy requires
> two more PMC votes to do that.
>
> Do we have two other PMC members around to vote on that? Anybody actually
> object?
>
> ( https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6694 )
>
I have lazy consensus on it. I just need to get a release candidate
done. As of yesterday, I now have the passphrase for the signing key!
Woot!

Regards,
AKM

darxus at chaosreigns

Jun 25, 2012, 12:24 PM

Post #10 of 85 (1211 views)
Permalink

Re: Rule updates are too old [In reply to]

On 06/25, Kevin A. McGrail wrote:
> >( https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6694 )
> >
> I have lazy consensus on it. I just need to get a release candidate
> done. As of yesterday, I now have the passphrase for the signing
> key! Woot!

Cool, can you mention that in a comment to the bug? Can the bug be closed?

--
"Speed is a metaphor for freedom."
http://www.ChaosReigns.com

KMcGrail at PCCC

Jun 25, 2012, 1:01 PM

Post #11 of 85 (1200 views)
Permalink

Re: Rule updates are too old [In reply to]

On 6/25/2012 3:24 PM, darxus [at] chaosreigns wrote:
> On 06/25, Kevin A. McGrail wrote:
>>> ( https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6694 )
>>>
>> I have lazy consensus on it. I just need to get a release candidate
>> done. As of yesterday, I now have the passphrase for the signing
>> key! Woot!
> Cool, can you mention that in a comment to the bug? Can the bug be closed?
>
The bug can't be closed because it still exists but we have a framework
to allow more masscheck helpers and will continue to grow it.

darxus at chaosreigns

Jun 26, 2012, 9:00 AM

Post #12 of 85 (1182 views)
Permalink

Rule updates are too old [In reply to]

darxus at chaosreigns

Jun 27, 2012, 9:00 AM

Post #13 of 85 (1179 views)
Permalink

Rule updates are too old [In reply to]

darxus at chaosreigns

Jun 27, 2012, 12:02 PM

Post #14 of 85 (1177 views)
Permalink

Rule updates are too old [In reply to]

SpamAssassin version 3.3.0 has not had a rule update since 2012-06-22.
SpamAssassin version 3.3.1 has not had a rule update since 2012-06-22.
SpamAssassin version 3.3.2 has not had a rule update since 2012-06-22.

20120627: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120627
20120627: Spam: 59326, Ham: 109540
20120623: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120623
20120623: Spam: 246602, Ham: 119126

darxus at chaosreigns

Jun 27, 2012, 12:07 PM

Post #15 of 85 (1174 views)
Permalink

Re: Rule updates are too old [In reply to]

On 06/27, darxus [at] chaosreigns wrote:
> SpamAssassin version 3.3.0 has not had a rule update since 2012-06-22.
> SpamAssassin version 3.3.1 has not had a rule update since 2012-06-22.
> SpamAssassin version 3.3.2 has not had a rule update since 2012-06-22.
>
> 20120627: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120627
> 20120627: Spam: 59326, Ham: 109540
> 20120623: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120623
> 20120623: Spam: 246602, Ham: 119126

Added the requested threshold checking. These are two separate alerts.
The rule update check is is based on DNS records, and the threshold checks
are based on http://ruleqa.spamassassin.org/ . If either one failes, it'll
send an email. If the update check fails, but the threshold checks don't
fail, it'll still include the ham / spam counts. If the threshold check
fails, but the update check doesn't, it won't mention the last dates of
updates.

When run on a Saturday, it'll only do one threshold check. When run any
other day, it'll check thresholds for the current day, and the last
Saturday / net / weekly run, because I believe score generation requires
both of them to be above the ham and spam thresholds.

--
"theres a lot more to life than chicks
none of it matters but theres a lot of it"
- LeRoy, #motorcycles, #EFNet, 7/18/06
http://www.ChaosReigns.com

KMcGrail at PCCC

Jun 27, 2012, 12:12 PM

Post #16 of 85 (1171 views)
Permalink

Re: Rule updates are too old [In reply to]

Thanks. This is a good time to mention that if you have a good feed for
Ham or Spam and don't want the trouble of setting up your own Masscheck,
Alex Broens, one of our committers, has the hardware to grind through it
all and has offered to set things up. I highly recommend it knowing the
data is safe and will benefit lots of anti-spam endeavors.

Regards,
KAM

On 6/27/2012 3:07 PM, darxus [at] chaosreigns wrote:
> On 06/27, darxus [at] chaosreigns wrote:
>> SpamAssassin version 3.3.0 has not had a rule update since 2012-06-22.
>> SpamAssassin version 3.3.1 has not had a rule update since 2012-06-22.
>> SpamAssassin version 3.3.2 has not had a rule update since 2012-06-22.
>>
>> 20120627: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120627
>> 20120627: Spam: 59326, Ham: 109540
>> 20120623: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120623
>> 20120623: Spam: 246602, Ham: 119126
> Added the requested threshold checking. These are two separate alerts.
> The rule update check is is based on DNS records, and the threshold checks
> are based on http://ruleqa.spamassassin.org/ . If either one failes, it'll
> send an email. If the update check fails, but the threshold checks don't
> fail, it'll still include the ham / spam counts. If the threshold check
> fails, but the update check doesn't, it won't mention the last dates of
> updates.
>
> When run on a Saturday, it'll only do one threshold check. When run any
> other day, it'll check thresholds for the current day, and the last
> Saturday / net / weekly run, because I believe score generation requires
> both of them to be above the ham and spam thresholds.
>

--
*Kevin A. McGrail*
President

Peregrine Computer Consultants Corporation
3927 Old Lee Highway, Suite 102-C
Fairfax, VA 22030-2422

http://www.pccc.com/

703-359-9700 x50 / 800-823-8402 (Toll-Free)
703-359-8451 (fax)
KMcGrail [at] PCCC <mailto:kmcgrail [at] pccc>

Attachments:

pccc_logo.gif (10.2 KB)

darxus at chaosreigns

Jun 28, 2012, 9:00 AM

Post #17 of 85 (1177 views)
Permalink

Rule updates are too old [In reply to]

20120628: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120628
20120628: Spam: 254563, Ham: 109625
20120623: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120623
20120623: Spam: 246602, Ham: 119126

darxus at chaosreigns

Jun 28, 2012, 9:12 AM

Post #18 of 85 (1172 views)
Permalink

Re: Rule updates are too old [In reply to]

On 06/28, darxus [at] chaosreigns wrote:
> 20120628: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120628
> 20120628: Spam: 254563, Ham: 109625
> 20120623: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120623
> 20120623: Spam: 246602, Ham: 119126
>

Fascinating. There was an update today while both today and last
Saturday's updates were below the ham threshold. Anyone care to guess how
that happened, so I can perhaps improve my alerting?

Ah, yesterday's data is above the thresholds. And it makes sense for it to
use yesterday's data instead of today's. Does that mean it doesn't
actually depend on the last Saturday / net / run?

--
"Speed is a metaphor for freedom."
http://www.ChaosReigns.com

KMcGrail at PCCC

Jun 28, 2012, 11:12 AM

Post #19 of 85 (1160 views)
Permalink

Re: Rule updates are too old [In reply to]

On 6/28/2012 12:12 PM, darxus [at] chaosreigns wrote:
> On 06/28, darxus [at] chaosreigns wrote:
>> 20120628: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120628
>> 20120628: Spam: 254563, Ham: 109625
>> 20120623: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120623
>> 20120623: Spam: 246602, Ham: 119126
>>
> Fascinating. There was an update today while both today and last
> Saturday's updates were below the ham threshold. Anyone care to guess how
> that happened, so I can perhaps improve my alerting?
>
> Ah, yesterday's data is above the thresholds. And it makes sense for it to
> use yesterday's data instead of today's. Does that mean it doesn't
> actually depend on the last Saturday / net / run?
Good question. I've been afraid to poke it too much for fear of
breaking things and have only made changes to keep things running.

Though Warren and I talked about moving this all to a more modern
CentOS/RHEL box which will force us to figure things out a bit ;-)

Regards,
KAM

darxus at chaosreigns

Jun 28, 2012, 11:33 AM

Post #20 of 85 (1176 views)
Permalink

Re: Rule updates are too old [In reply to]

On 06/28, Kevin A. McGrail wrote:
> >Ah, yesterday's data is above the thresholds. And it makes sense for it to
> >use yesterday's data instead of today's. Does that mean it doesn't
> >actually depend on the last Saturday / net / run?
> Good question. I've been afraid to poke it too much for fear of
> breaking things and have only made changes to keep things running.

Okay, I modified it to use the previous day's counts instead of the current
day's. Still interested in other suggestions.

--
"Begin at the beginning and go on till you come to the end; then stop."
- Lewis Carrol, Alice in Wonderland
http://www.ChaosReigns.com

darxus at chaosreigns

Jun 29, 2012, 9:00 AM

Post #21 of 85 (1170 views)
Permalink

Rule updates are too old [In reply to]

20120628: Spam: 260144, Ham: 219123
20120623: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120623
20120623: Spam: 246602, Ham: 119126

jarif at iki

Jun 29, 2012, 11:28 AM

Post #22 of 85 (1176 views)
Permalink

Re: Rule updates are too old [In reply to]

On Fri, June 29, 2012 19:00, darxus [at] chaosreigns wrote:
> 20120628: Spam: 260144, Ham: 219123
> 20120623: Spam or ham is below threshold of 150,000:
> http://ruleqa.spamassassin.org/?daterev=20120623
> 20120623: Spam: 246602, Ham: 119126
>

:)

darxus at chaosreigns

Jun 30, 2012, 9:06 AM

Post #23 of 85 (1166 views)
Permalink

Rule updates are too old [In reply to]

20120629: Spam: 260720, Ham: 219330
20120623: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120623
20120623: Spam: 246602, Ham: 119126

darxus at chaosreigns

Jun 30, 2012, 9:29 AM

Post #24 of 85 (1166 views)
Permalink

Re: Rule updates are too old [In reply to]

On 06/30, darxus [at] chaosreigns wrote:
> 20120629: Spam: 260720, Ham: 219330

Woo.

> 20120623: Spam or ham is below threshold of 150,000: http://ruleqa.spamassassin.org/?daterev=20120623
> 20120623: Spam: 246602, Ham: 119126

Removed this threshold test for the last Saturday / net run, since it
doesn't appear to be relevant.

--
"It is better to die on your feet than to live on your knees."
- Emiliano Zapata, Mexican Revolution Leader
http://www.ChaosReigns.com

darxus at chaosreigns

Jun 30, 2012, 9:30 AM

Post #25 of 85 (1166 views)
Permalink

Rule updates are too old [In reply to]

SpamAssassin version 3.3.0 has not had a rule update since 2012-06-30.
SpamAssassin version 3.3.1 has not had a rule update since 2012-06-30.
SpamAssassin version 3.3.2 has not had a rule update since 2012-06-30.

20120629: Spam: 260720, Ham: 219330

1 2 3 4

View All

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads