Spam being ignored +/-

Use this forum if you have installed hMailServer and want to ask a question related to a production release of hMailServer. Before posting, please read the troubleshooting guide. A large part of all reported issues are already described in detail here.
Post Reply
Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Spam being ignored +/-

Post by Furball Zen » 2020-12-11 01:57

Ok, so running the latest version cause the version i was on for a while started allowing a shit ton of spam through, almost like it started ignoring SpamAssassin (or SA wasnt working right). So the past few days ive been editing my rules, adding new one and have been getting progressively pissed.

So, the last email i got SA shows this:

Code: Select all

Dec 10 18:42:36.387 [-1740] info: spamd: result: Y 6 - BAYES_00,FORGED_SPF_HELO,FSL_BULK_SIG,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,LOTS_OF_MONEY,MIME_HTML_ONLY,MIME_QP_LONG_LINE,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,SPF_HELO_PASS,URIBL_BLACK,URIBL_DBL_SPAM scantime=2.1,size=5473,user=(unknown),uid=0,required_score=5.0,rhost=botr-mail,raddr=127.0.0.1,rport=60169,mid=<mtnJ3LwTkDYlz2nOUSH3stAkuQdbQLpUHIAEd7RsMu4.7TeicWk-ZEcMw0h4OzEdow@regardwelfare.co>,bayes=0.000000,autolearn=no autolearn_force=no
I have hM set to delete at 4, mark at 3. So why is it delivering the mail instead of deleting it? I have changed nothing in the settings for years, just in the last 2-3 weeks its almost like someone can see my rules and is crafting their spam to circumvent it.

User avatar
jimimaseye
Moderator
Moderator
Posts: 8917
Joined: 2011-09-08 17:48

Re: Spam being ignored +/-

Post by jimimaseye » 2020-12-11 02:10

5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-11 02:15

Furball Zen wrote:
2020-12-11 01:57
just in the last 2-3 weeks its almost like someone can see my rules and is crafting their spam to circumvent it.
So you have noticed that too ?? :wink:
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-11 04:27

jimimaseye wrote:
2020-12-11 02:10
run this and post the results: https://www.hmailserver.com/forum/viewt ... 20&t=30914
I just love your non answers...

Code: Select all

2020-12-10   Hmailserver: 5.6.7-B2425

DOMAINS

   "Domain1.com" - ajxxxxx.net                    Enabled: True

SIGNATURE         LIMITS                       DKIM               ADVANCED
  Enabled: False   Max size:                0   Enabled: False     Catchall: postmaster@Domain1.com
                   Max message size:        0                      Plus addressing: False
                   Max size of accounts:    0                    
                                                                   Greylisting:     False

   "Domain2.com" - bixxxxxxxxxxxxxxxxxx.com       Enabled: True

SIGNATURE         LIMITS                       DKIM               ADVANCED
  Enabled: False   Max size:                0   Enabled: False   
                   Max message size:        0                      Plus addressing: False
                   Max size of accounts:    0                    
                                                                   Greylisting:     False

   "Domain3.com" - bixxxxxxxxxxxxxxxxxxxxxx.com   Enabled: True

SIGNATURE         LIMITS                       DKIM               ADVANCED
  Enabled: False   Max size:                0   Enabled: False   
                   Max message size:        0                      Plus addressing: False
                   Max size of accounts:    0                    
                                                                   Greylisting:     False

   "Domain4.com" - boxxxxxxxx.com                 Enabled: True

SIGNATURE         LIMITS                       DKIM               ADVANCED
  Enabled: False   Max size:                0   Enabled: False     Catchall: postmaster@Domain4.com
                   Max message size:        0                      Plus addressing: False
                   Max size of accounts:    0                    
                                                                   Greylisting:      True

   "Domain5.com" - dixxxxxxxx.inxx                Enabled: True

SIGNATURE         LIMITS                       DKIM               ADVANCED
  Enabled: False   Max size:                0   Enabled: False   
                   Max message size:        0                      Plus addressing: False
                   Max size of accounts:    0                    
                                                                   Greylisting:     False

   "Domain6.com" - fuxxxxxxxx.clxx                Enabled: True

SIGNATURE         LIMITS                       DKIM               ADVANCED
  Enabled: False   Max size:                0   Enabled: False   
                   Max message size:        0                      Plus addressing: False
                   Max size of accounts:    0                    
                                                                   Greylisting:     False

   "Domain7.com" - pcxxxxx.us                     Enabled: True

SIGNATURE         LIMITS                       DKIM               ADVANCED
  Enabled: False   Max size:                0   Enabled: False   
                   Max message size:        0                      Plus addressing: False
                   Max size of accounts:    0                    
                                                                   Greylisting:     False

   "Domain8.com" - xoxxxxxxxxxx.net               Enabled: True

SIGNATURE         LIMITS                       DKIM               ADVANCED
  Enabled: False   Max size:                0   Enabled: False   
                   Max message size:        0                      Plus addressing: False
                   Max size of accounts:    0                    
                                                                   Greylisting:     False
-----------------------------------------------------------------------------------------------

IP RANGES

IP: 192.188.88.1 - 192.188.88.255     Priority: 20     Name: Auto-ban: web

  Allow connections                         Other
     SMTP:  False                              Antispam :  False
     POP3:  False                              Antivirus:  False
     IMAP:  False                              SSL/TLS:    False


IP: 31.192.241.0 - 31.192.241.255     Priority: 20     Name: Britain

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 78.128.63.0 - 78.128.63.255     Priority: 20     Name: Bulgaria

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 142.54.170.100 - 142.54.170.100     Priority: 20     Name: car-apayment.cn

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 69.162.65.115 - 69.162.65.122     Priority: 20     Name: Dallas

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 69.94.143.0 - 69.94.143.255     Priority: 20     Name: Kyrgyzstan

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 188.214.30.114 - 188.214.30.120     Priority: 20     Name: Romania

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 191.96.249.0 - 191.96.249.255     Priority: 20     Name: Russia

  Allow connections                         Other
     SMTP:  False                              Antispam :  False
     POP3:  False                              Antivirus:  False
     IMAP:  False                              SSL/TLS:    False


IP: 69.162.65.0 - 69.162.65.255     Priority: 20     Name: Spammer

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 91.200.12.1 - 91.200.12.255     Priority: 20     Name: Spammer 1

  Allow connections                         Other
     SMTP:  False                              Antispam :  False
     POP3:  False                              Antivirus:  False
     IMAP:  False                              SSL/TLS:    False


IP: 185.36.81.0 - 185.36.81.255     Priority: 20     Name: Tele Asia

  Allow connections                         Other
     SMTP:  False                              Antispam :  False
     POP3:  False                              Antivirus:  False
     IMAP:  False                              SSL/TLS:    False


IP: 192.168.1.1 - 192.168.1.90     Priority: 15     Name: My computer

  Allow connections                         Other
     SMTP:   True                              Antispam :   True
     POP3:   True                              Antivirus:   True
     IMAP:   True                              SSL/TLS:    False

  Allow Deliveries from                     Require Authentication from
     Local To Local       -  True              Local To Local       - False
     Local To External    -  True              Local To External    -  True
     External To Local    -  True              External To Local    - False
     External To External - False           


IP: 64.8.71.14 - 64.8.71.14     Priority: 15     Name: smtp.fuse.net

  Allow connections                         Other
     SMTP:   True                              Antispam :   True
     POP3:   True                              Antivirus:   True
     IMAP:   True                              SSL/TLS:    False

  Allow Deliveries from                     Require Authentication from
     Local To Local       -  True              Local To Local       - False
     Local To External    -  True              Local To External    - False
     External To Local    -  True              External To Local    - False
     External To External - False           


IP: 67.219.250.148 - 67.219.250.148     Priority: 10     Name: ?

  Allow connections                         Other
     SMTP:  False                              Antispam :  False
     POP3:  False                              Antivirus:  False
     IMAP:  False                              SSL/TLS:    False


IP: 0.0.0.0 - 255.255.255.255     Priority: 10     Name: Internet

  Allow connections                         Other
     SMTP:   True                              Antispam :   True
     POP3:   True                              Antivirus:   True
     IMAP:   True                              SSL/TLS:    False

  Allow Deliveries from                     Require Authentication from
     Local To Local       -  True              Local To Local       -  True
     Local To External    -  True              Local To External    -  True
     External To Local    -  True              External To Local    - False
     External To External - False           


   !!  Warning:  DEFAULT DOMAIN is SET  !! - "Domain4.com"
------------------------------------------------------
AUTOBANNED Local Addresses:
    No entries

-----------------------------------------------------------------------------------------------

AUTOBAN
  Autoban Enabled: True       Max invalid logon attempts:      2
                              Minutes Before Reset:           30  (0.50 hours, 0.02 days)
                              Minutes to Autoban:         525600  (8,760.00 hours, 365.00 days)

There is a total of 2166 auto-ban IP ranges.
-----------------------------------------------------------------------------------------------

INCOMING RELAYS
   No entries
-----------------------------------------------------------------------------------------------

MIRRORING         Disabled
-----------------------------------------------------------------------------------------------

PROTOCOLS

SMTP
GENERAL             DELIVERY                  RFC COMPLIANCE            ADVANCED
No. Connections:  0  No Retries:  4 Mins: 60   Plain Text:         True  Bind: 192.168.1.13
                     Host: EXTERNAL.TLD        Empty sender:       True  Batch recipients:   100
Max Msg Size:50000000  Relay:-                   Incorrect endings:  True  Use STARTTLS:     False
                      EXTERNAL.TLD  (ok)       Disc. on invalid:   True  Delivered-To hdr:  True
                     Port:  25                 Max number commands: 100  Loop limit:           5
                     Req Auth: True *User Entered*                       Recipient hosts:     15
                     Con. Sec.: None
  Routes:
     No routes defined.

POP3
  No. Connections: 0

IMAP
 GENERAL                   PUBLIC FOLDERS                    ADVANCED
  No. Connections:   0      Public folder name: #Public       IMAP sort:  True
                                                              IMAP Quota: True
                                                              IMAP Idle:  True
                                                              IMAP ACL:   True
                                                              Delim: "\"
-----------------------------------------------------------------------------------------------

ANTISPAM

GENERAL                              SPAM TESTS              Score   SPAMASSASSIN
  Spam Mark:                  3       Use SPF:            True - 3    Use Spamassassin:    True
  Add X-HmailServer-Spam:     True    Check HELO host:    True - 2    Hostname:       localhost
  Add X-HmailServer-Reason:   True    Check MX records:   True - 2    Port:                 783
  Add X-HmailServer-Subject:  True    Verify DKIM:       False        Use SA score:        True
              Subject Text: "[SPAM]"
  Spam delete threshold: 4         Maximum message size: 1024

DNSBL ENTRIES:
                  zen.spamhaus.org      Score: 4     Result: 127.0.0.*
                    bl.spamcop.net      Score: 4     Result: 127.0.0.*
            dnsbl-1.uceprotect.net      Score: 3     Result: 127.0.0.*
            dnsbl-2.uceprotect.net      Score: 3     Result: 127.0.0.*
            dnsbl-3.uceprotect.net      Score: 3     Result: 127.0.0.*
                   dnsbl.njabl.org      Score: 1     Result: 127.0.0.*
                  psbl.surriel.com      Score: 1     Result: 127.0.0.*
                virbl.dnsbl.bit.nl      Score: 1     Result: 127.0.0.*
            b.barracudacentral.org      Score: 2     Result: 127.0.0.*
                    bl.nszones.com      Score: 3     Result: 127.0.0.*

SURBL ENTRIES:
                    bl.nszones.com      Score: 4

GREYLISTING:
  Greylisting:   True       Defer mins: 5       Days Unused: 1      Days Used: 60
                            Bypass SPF: False    Bypass A/MX: True

Greylist WHITELIST ENTRIES:
   No entries

Greylist DOMAINS enabled:
           Domain4.com

WHITELISTING
              0.0.0.0            to    255.255.255.255              *[@t]steidenlaw[dot]com
              0.0.0.0            to    255.255.255.255              *historicvehicle[dot]org
              0.0.0.0            to    255.255.255.255              *[@t]*taxslayer[dot]com
              0.0.0.0            to    255.255.255.255              elikapekas123[@t]aol[dot]com
              0.0.0.0            to    255.255.255.255              webmaster[@t]xoxideforums[dot]com
              0.0.0.0            to    255.255.255.255              %[@t]pof[dot]com
              0.0.0.0            to    255.255.255.255              jalenterp[@t]aol[dot]com
              0.0.0.0            to    255.255.255.255              *[@t]kicker[dot]com
              0.0.0.0            to    255.255.255.255              *[@t]usajobs[dot]gov
              0.0.0.0            to    255.255.255.255              *[@t]craigslist[dot]org
              0.0.0.0            to    255.255.255.255              *[@t]*shapeways[dot]com
              0.0.0.0            to    255.255.255.255              *[@t]ebay[dot]com
              0.0.0.0            to    255.255.255.255              *[@t]irs[dot]gov
              184.106.178.220    to    184.106.178.220              webadmin[@t]ajallen[dot]net
              195.78.94.34       to    195.78.94.34                 forumadmin[@t]bit-tech[dot]net
-----------------------------------------------------------------------------------------------

ANTIVIRUS

GENERAL:
  When found - Delete Attachments.

  Max Message Size: 0
     CLAM AV:   False
     CLAMWIN:   False
     CUSTOMAV:  True       Executable: C:\Program Files\Windows Defender\MsMpEng.exe
                           ReturnValue: 5


  Block Attachments: False
-----------------------------------------------------------------------------------------------

SSL CERTIFICATES
   No entries
-----------------------------------------------------------------------------------------------

SSL/TLS
             SSL 3.0 :   True
             TLS 1.0 :   True
             TLS 1.1 :   True
             TLS 1.2 :   True                Verify Remote SSL/TLS Certs:   True
SslCipherList  :

ECDHE-RSA-AES128-GCM-SHA256     - ECDHE-ECDSA-AES128-GCM-SHA256   - ECDHE-RSA-AES256-GCM-SHA384     
ECDHE-ECDSA-AES256-GCM-SHA384   - DHE-RSA-AES128-GCM-SHA256       - DHE-DSS-AES128-GCM-SHA256       
kEDH+AESGCM                     - ECDHE-RSA-AES128-SHA256         - ECDHE-ECDSA-AES128-SHA256       
ECDHE-RSA-AES128-SHA            - ECDHE-ECDSA-AES128-SHA          - ECDHE-RSA-AES256-SHA384         
ECDHE-ECDSA-AES256-SHA384       - ECDHE-RSA-AES256-SHA            - ECDHE-ECDSA-AES256-SHA          
DHE-RSA-AES128-SHA256           - DHE-RSA-AES128-SHA              - DHE-DSS-AES128-SHA256           
DHE-RSA-AES256-SHA256           - DHE-DSS-AES256-SHA              - DHE-RSA-AES256-SHA              
AES128-GCM-SHA256               - AES256-GCM-SHA384               - ECDHE-RSA-RC4-SHA               
ECDHE-ECDSA-RC4-SHA             - AES128                          - AES256                          
RC4-SHA                         - HIGH                            - !aNULL                          
!eNULL                          - !EXPORT                         - !DES                            
!3DES                           - !MD5                            - !PSK;                           
-----------------------------------------------------------------------------------------------

TCPIP PORTS                                         Connection Sec
               192.168.1.13    / 25    / SMTP   -   None                
               192.168.1.13    / 110   / POP3   -   None                
               192.168.1.13    / 143   / IMAP   -   None                
-----------------------------------------------------------------------------------------------

LOGGING      Logging Enabled: True

  Paths:-
    Current:  C:\Program Files\hMailServer\Logs\hmailserver_2020-12-10.log
    Error:    C:\Program Files\hMailServer\Logs\ERROR_hmailserver_2020-12-10.log - !! ERRORS PRESENT !!
    Event:    C:\Program Files\hMailServer\Logs\hmailserver_events.log - Not present
    Awstats:  C:\Program Files\hMailServer\Logs\hmailserver_awstats.log
                        APPLICATION -    True
                        SMTP        -    True
                        POP3        -      .
                        IMAP        -      .
                        TCPIP       -      .
                        DEBUG       -      .
                        AWSTATS     -      .
-----------------------------------------------------------------------------------------------

SYSTEM TESTS

Database type: MSSQL Compact

IPv6 support is available in operating system.

Backup directory C:\Documents and Settings\A.J. Allen\Desktop is writable.

Relative message paths are stored in the database for all messages.

-----------------------------------------------------------------------------------------------

HMAILSERVER.INI

[Directories]
Program folder:  C:\Program Files\hMailServer\
Database folder: C:\Program Files\hMailServer\Database
Data folder:     C:\Program Files\hMailServer\Data
Log folder:      C:\Program Files\hMailServer\Logs
Temp folder:     C:\Program Files\hMailServer\Temp
Event folder:    C:\Program Files\hMailServer\Events

[Database]
Type=              MSSQLCE
Username=           
PasswordEncryption=1
Port=              0
Server=             
Internal=          1
-----------------------------------------------------------------------------------------------

[/size]Generated by HMSSettingsDiagnostics v1.88, Hmailserver Forum.

User avatar
mattg
Moderator
Moderator
Posts: 21268
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: Spam being ignored +/-

Post by mattg » 2020-12-11 09:08

What does this file contain?
C:\Program Files\hMailServer\Logs\ERROR_hmailserver_2020-12-10.log
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

User avatar
jimimaseye
Moderator
Moderator
Posts: 8917
Joined: 2011-09-08 17:48

Re: Spam being ignored +/-

Post by jimimaseye » 2020-12-11 10:22

Furball Zen wrote:
2020-12-11 04:27
jimimaseye wrote:
2020-12-11 02:10
run this and post the results: https://www.hmailserver.com/forum/viewt ... 20&t=30914
I just love your non answers...
Yeah, sorry, its the only thing I can do nowadays since breaking my crystal ball! (I see you are still on the attack).

For reference: it's investigation. Analysis. Gathering of evidence. Once done we can determine the cause (hopefully). By the way, next time, please use the latest version of the diagnostic script as it has since had bug fixes and additional features which may be pertinent to uncovering your problems.
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-11 14:20

Furball Zen wrote:
2020-12-11 01:57
I have hM set to delete at 4, mark at 3. So why is it delivering the mail instead of deleting it? I have changed nothing in the settings for years, just in the last 2-3 weeks its almost like someone can see my rules and is crafting their spam to circumvent it.
That's extremely low. I thought my settings were low. That's inviting a lot of false positives.

Everyone's mail environment is different, of course. When I was going through the same issue a long time ago I tried a whole bunches of different settings for SA and failed miserably. What I found was that the default SA settings are actually the best. With small caveats.

There are a few things you can do to enhance the default settings.

* Use bayes. Train Bayes. Love Bayes. Bayes will love you back. https://hmailserver.com/forum/viewtopic ... 20&t=26866
* Use ClamAV with sanesecurity + phishing heuristics. This will trap a bunch of stuff SA does not do on its own. https://hmailserver.com/forum/viewtopic ... 21&t=26829

Then there are things you can do to block spammers before they even get a chance to spam.

* Use scripting to block common spammer telltales. Here's an excellent place to start: https://hmailserver.com/forum/viewtopic ... 21&t=33566
* Block connections from spammer countries using GeoIP: https://hmailserver.com/forum/viewtopic.php?f=9&t=34496
* There is a dynamic black/white list script that works great. In the event all of the above don't work, this is a great backstop: https://hmailserver.com/forum/viewtopic ... 20&t=33602

There is a ton of info on this site that can help you live a spam free lifestyle.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-11 15:12

Also, KAM.cf adds a bunch of good rules to SpamAssassin.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-11 16:17

mattg wrote:
2020-12-11 09:08
What does this file contain?
C:\Program Files\hMailServer\Logs\ERROR_hmailserver_2020-12-10.log
The only errors i ever get is it complaining it cant talk to SA, im guessing based on the amount of traffic, cause it only complains once in a while, never more than once a day. The previous error log was on Dec 4th, so that kinda gives you the infrequency of it.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-11 16:23

jimimaseye wrote:
2020-12-11 10:22
Furball Zen wrote:
2020-12-11 04:27
jimimaseye wrote:
2020-12-11 02:10
run this and post the results: https://www.hmailserver.com/forum/viewt ... 20&t=30914
I just love your non answers...
Yeah, sorry, its the only thing I can do nowadays since breaking my crystal ball! (I see you are still on the attack).

For reference: it's investigation. Analysis. Gathering of evidence. Once done we can determine the cause (hopefully). By the way, next time, please use the latest version of the diagnostic script as it has since had bug fixes and additional features which may be pertinent to uncovering your problems.
Im not on the attack, you need to hone your CS skills, youre pretty much a jerk to me every time i post. At least MattG tries to help with his product. I submitted a specific issue with evidence and you, like always, just say "run this and post", just like almost 3 years ago when i said nothing changed on my end, turns out the ISP changed something and i had to add a rule to be able to send, it wasnt anything to do with hM. If you dont have the time to volunteer on this site, then dont, but dont be a jerk to people.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-11 16:31

palinka wrote:
2020-12-11 14:20
Furball Zen wrote:
2020-12-11 01:57
I have hM set to delete at 4, mark at 3. So why is it delivering the mail instead of deleting it? I have changed nothing in the settings for years, just in the last 2-3 weeks its almost like someone can see my rules and is crafting their spam to circumvent it.
That's extremely low. I thought my settings were low. That's inviting a lot of false positives.

Everyone's mail environment is different, of course. When I was going through the same issue a long time ago I tried a whole bunches of different settings for SA and failed miserably. What I found was that the default SA settings are actually the best. With small caveats.

There are a few things you can do to enhance the default settings.

* Use bayes. Train Bayes. Love Bayes. Bayes will love you back. https://hmailserver.com/forum/viewtopic ... 20&t=26866
* Use ClamAV with sanesecurity + phishing heuristics. This will trap a bunch of stuff SA does not do on its own. https://hmailserver.com/forum/viewtopic ... 21&t=26829

Then there are things you can do to block spammers before they even get a chance to spam.

* Use scripting to block common spammer telltales. Here's an excellent place to start: https://hmailserver.com/forum/viewtopic ... 21&t=33566
* Block connections from spammer countries using GeoIP: https://hmailserver.com/forum/viewtopic.php?f=9&t=34496
* There is a dynamic black/white list script that works great. In the event all of the above don't work, this is a great backstop: https://hmailserver.com/forum/viewtopic ... 20&t=33602

There is a ton of info on this site that can help you live a spam free lifestyle.
Yea, ive trained bayes in the past, but now it doesnt seem to do anything at all, it wont read the samples like it used to. Thats when i made sure i was on the most recent hM to see if that was the issue but it wasnt. I went to JAM to update SA, but their recent version is ONLY for 64bit and my machine isnt, so im wondering if that has something to do with it.

The last email to go through SpamD shows a score of 11 and it was finally deleted, but i still woke up to well over 20 spam emails just over night.

Since ive never had to mess with them, where do the scripts get stored? Im kinda doing a country blocking by IP address already on some countries, but communicate with people all over the world so i cant just lock it down to a handful of allowed.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-11 16:46

Furball Zen wrote:
2020-12-11 16:31
Since ive never had to mess with them, where do the scripts get stored? Im kinda doing a country blocking by IP address already on some countries, but communicate with people all over the world so i cant just lock it down to a handful of allowed.
hmailserver triggers are placed in /events/eventhandlers.vbs

Outside scripts you can put wherever you want.

GeoIP is very useful. I block most countries, but short-circuit geoip by checking public whitelists: https://www.hmailserver.com/forum/viewt ... p?p=216802

Short circuiting should only be used for edge cases because you don't want to have false positives there. Therefore, keep your country-block-list to ones you rarely receive ham on.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-11 16:52

Furball Zen wrote:
2020-12-11 16:23
Im not on the attack, you need to hone your CS skills, youre pretty much a jerk to me every time i post. At least MattG tries to help with his product.
Nobody "owns" hmailserver. Its open source and free. And neither Matt nor Jimi are developers of it (me either). There is no "CS", only a bunch of dudes that like using it and help other people out in their spare time - therefore there is no need to hone CS or any other skills. Well, maybe scripting skills, which you will find in spades here if you look around. The good news is that nearly anything you want to do with hmailserver has already been written up. All it takes is looking around or asking a question. :D

Nobody gets paid here. Not even the guy that wrote it, although there is a donation link on the homepage if you want to send him some beer money.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-11 16:59

Furball Zen wrote:
2020-12-11 04:27

Code: Select all

2020-12-10   Hmailserver: 5.6.7-B2425
IP RANGES

IP: 192.188.88.1 - 192.188.88.255     Priority: 20     Name: Auto-ban: web

  Allow connections                         Other
     SMTP:  False                              Antispam :  False
     POP3:  False                              Antivirus:  False
     IMAP:  False                              SSL/TLS:    False


IP: 31.192.241.0 - 31.192.241.255     Priority: 20     Name: Britain

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 78.128.63.0 - 78.128.63.255     Priority: 20     Name: Bulgaria

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 142.54.170.100 - 142.54.170.100     Priority: 20     Name: car-apayment.cn

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 69.162.65.115 - 69.162.65.122     Priority: 20     Name: Dallas

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 69.94.143.0 - 69.94.143.255     Priority: 20     Name: Kyrgyzstan

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 188.214.30.114 - 188.214.30.120     Priority: 20     Name: Romania

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 191.96.249.0 - 191.96.249.255     Priority: 20     Name: Russia

  Allow connections                         Other
     SMTP:  False                              Antispam :  False
     POP3:  False                              Antivirus:  False
     IMAP:  False                              SSL/TLS:    False


IP: 69.162.65.0 - 69.162.65.255     Priority: 20     Name: Spammer

  Allow connections                         Other
     SMTP:  False                              Antispam :   True
     POP3:  False                              Antivirus:   True
     IMAP:  False                              SSL/TLS:     True


IP: 91.200.12.1 - 91.200.12.255     Priority: 20     Name: Spammer 1

  Allow connections                         Other
     SMTP:  False                              Antispam :  False
     POP3:  False                              Antivirus:  False
     IMAP:  False                              SSL/TLS:    False


IP: 185.36.81.0 - 185.36.81.255     Priority: 20     Name: Tele Asia

  Allow connections                         Other
     SMTP:  False                              Antispam :  False
     POP3:  False                              Antivirus:  False
     IMAP:  False                              SSL/TLS:    False


IP: 67.219.250.148 - 67.219.250.148     Priority: 10     Name: ?

  Allow connections                         Other
     SMTP:  False                              Antispam :  False
     POP3:  False                              Antivirus:  False
     IMAP:  False                              SSL/TLS:    False


By the way, if you implement the dynamic black/white list, you can get rid of all these IP ranges.

If you're really serious about blasting spam, you can give my firewall ban a whack also: https://github.com/palinkas-jo-reggelt/ ... rewall-Ban

My github page has a few other hmailserver tricks as well.

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-11 17:12

Furball Zen wrote:
2020-12-11 16:31
Yea, ive trained bayes in the past, but now it doesnt seem to do anything at all, it wont read the samples like it used to. Thats when i made sure i was on the most recent hM to see if that was the issue but it wasnt. I went to JAM to update SA, but their recent version is ONLY for 64bit and my machine isnt, so im wondering if that has something to do with it.

The last email to go through SpamD shows a score of 11 and it was finally deleted, but i still woke up to well over 20 spam emails just over night.

Since ive never had to mess with them, where do the scripts get stored? Im kinda doing a country blocking by IP address already on some countries, but communicate with people all over the world so i cant just lock it down to a handful of allowed.
I run hMailServer 5.6.8 B2505.32 (custom version) on Windows 2003 Server R2 with Spamassassin 3.4.0 (JAM version) and ClamAV (clamd daemon devel-clamav-0.99.2-20-g224f73461 (OS: win32, ARCH: i386, CPU: i386))

... I also have a Windows Server 2019 Essentials with the same 5.6.8 version and the latest Spamassassin and ClamAV (If I remember correctly :oops: )

I have had no major changes in amount of SPAM. My "updatechannels.txt" only contain "updates.spamassassin.org".

I did have issues with SA using LWP for updating a while ago ... https://www.hmailserver.com/forum/viewtopic.php?t=33043 ... and had to switch to CURL.

Anyways, what does your SpamAssassin (run & update) logs tell you?
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

User avatar
RvdH
Senior user
Senior user
Posts: 1218
Joined: 2008-06-27 14:42
Location: Netherlands

Re: Spam being ignored +/-

Post by RvdH » 2020-12-11 17:25

Furball Zen wrote:
2020-12-11 01:57
Ok, so running the latest version cause the version i was on for a while started allowing a shit ton of spam through, almost like it started ignoring SpamAssassin (or SA wasnt working right). So the past few days ive been editing my rules, adding new one and have been getting progressively pissed.

So, the last email i got SA shows this:

Code: Select all

Dec 10 18:42:36.387 [-1740] info: spamd: result: Y 6 - BAYES_00,FORGED_SPF_HELO,FSL_BULK_SIG,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,LOTS_OF_MONEY,MIME_HTML_ONLY,MIME_QP_LONG_LINE,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,SPF_HELO_PASS,URIBL_BLACK,URIBL_DBL_SPAM scantime=2.1,size=5473,user=(unknown),uid=0,required_score=5.0,rhost=botr-mail,raddr=127.0.0.1,rport=60169,mid=<mtnJ3LwTkDYlz2nOUSH3stAkuQdbQLpUHIAEd7RsMu4.7TeicWk-ZEcMw0h4OzEdow@regardwelfare.co>,bayes=0.000000,autolearn=no autolearn_force=no
I have hM set to delete at 4, mark at 3. So why is it delivering the mail instead of deleting it? I have changed nothing in the settings for years, just in the last 2-3 weeks its almost like someone can see my rules and is crafting their spam to circumvent it.
check your hmailserver error logs, do you have errors like below on date/time a message marked (by SA) as spam comes through?
There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 2.
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-11 17:35

RvdH wrote:
2020-12-11 17:25
Furball Zen wrote:
2020-12-11 01:57
Ok, so running the latest version cause the version i was on for a while started allowing a shit ton of spam through, almost like it started ignoring SpamAssassin (or SA wasnt working right). So the past few days ive been editing my rules, adding new one and have been getting progressively pissed.

So, the last email i got SA shows this:

Code: Select all

Dec 10 18:42:36.387 [-1740] info: spamd: result: Y 6 - BAYES_00,FORGED_SPF_HELO,FSL_BULK_SIG,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,LOTS_OF_MONEY,MIME_HTML_ONLY,MIME_QP_LONG_LINE,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,SPF_HELO_PASS,URIBL_BLACK,URIBL_DBL_SPAM scantime=2.1,size=5473,user=(unknown),uid=0,required_score=5.0,rhost=botr-mail,raddr=127.0.0.1,rport=60169,mid=<mtnJ3LwTkDYlz2nOUSH3stAkuQdbQLpUHIAEd7RsMu4.7TeicWk-ZEcMw0h4OzEdow@regardwelfare.co>,bayes=0.000000,autolearn=no autolearn_force=no
I have hM set to delete at 4, mark at 3. So why is it delivering the mail instead of deleting it? I have changed nothing in the settings for years, just in the last 2-3 weeks its almost like someone can see my rules and is crafting their spam to circumvent it.
check your hmailserver error logs, do you have errors like below on date/time a message marked (by SA) as spam comes through?
There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 2.
I get those too... Usually only affect a single mail. 99.99% of the time it is SpamAssassin taking too long to report back.
I changed my W2K3 Server Windows settings "Performance Options" in controlpanel to "Processor scheduling = Background" and "Memory usage = Programs" and that seems to have changed something. Not had a Spamassassin outtake in a week now.
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-11 19:59

SorenR wrote:
2020-12-11 17:35
I get those too... Usually only affect a single mail. 99.99% of the time it is SpamAssassin taking too long to report back.
I changed my W2K3 Server Windows settings "Performance Options" in controlpanel to "Processor scheduling = Background" and "Memory usage = Programs" and that seems to have changed something. Not had a Spamassassin outtake in a week now.
What did I say before? When in doubt just ask Soren? Didn't even have to ask this time. :lol:

Performance Options exists in windows 10 in Control Panel > System and Security > System > Advanced System Settings > Advanced > Performance.

I could not find "Memory Usage" as an option, though.

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-11 22:39

Create a folder on C: and name it ".{ED7BA470-8E54-465E-825C-99712043E01C}" without the quotes... :mrgreen:

If it exists it's in there somewhere.
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-12 01:49


User avatar
jim.bus
Senior user
Senior user
Posts: 630
Joined: 2011-05-28 11:49
Location: US

Re: Spam being ignored +/-

Post by jim.bus » 2020-12-12 06:36

palinka wrote:
2020-12-11 19:59
SorenR wrote:
2020-12-11 17:35
I get those too... Usually only affect a single mail. 99.99% of the time it is SpamAssassin taking too long to report back.
I changed my W2K3 Server Windows settings "Performance Options" in controlpanel to "Processor scheduling = Background" and "Memory usage = Programs" and that seems to have changed something. Not had a Spamassassin outtake in a week now.
What did I say before? When in doubt just ask Soren? Didn't even have to ask this time. :lol:

Performance Options exists in windows 10 in Control Panel > System and Security > System > Advanced System Settings > Advanced > Performance.

I could not find "Memory Usage" as an option, though.
It is not entirely clear but the 'memory usage' Windows 10 may be referring to could be under Advanced>Settings>Adjust for best performance. When you select this option all the options checked disappear which probably would be using a lot of memory if those options were checked. There is also Virtual Memory but that is a separate reference distinct from the reference to Memory Usage.

User avatar
mattg
Moderator
Moderator
Posts: 21268
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: Spam being ignored +/-

Post by mattg » 2020-12-13 00:39

Furball Zen wrote:
2020-12-11 16:17
mattg wrote:
2020-12-11 09:08
What does this file contain?
C:\Program Files\hMailServer\Logs\ERROR_hmailserver_2020-12-10.log
The only errors i ever get is it complaining it cant talk to SA, im guessing based on the amount of traffic, cause it only complains once in a while, never more than once a day. The previous error log was on Dec 4th, so that kinda gives you the infrequency of it.
Is SpamAssassin on the same machine?
Do you use a local DNS?
Did you actually check that log file?

I SpamAssassin score ALL emails (by setting the 'required_score' variable to -500.0 in my .cf file) , and check to see if the 'X-Spam-Header' is present, and then if not, I add a 'default Spam Assassin Score.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-13 01:18

palinka wrote:
2020-12-11 16:46
Furball Zen wrote:
2020-12-11 16:31
Since ive never had to mess with them, where do the scripts get stored? Im kinda doing a country blocking by IP address already on some countries, but communicate with people all over the world so i cant just lock it down to a handful of allowed.
hmailserver triggers are placed in /events/eventhandlers.vbs

Outside scripts you can put wherever you want.

GeoIP is very useful. I block most countries, but short-circuit geoip by checking public whitelists: https://www.hmailserver.com/forum/viewt ... p?p=216802

Short circuiting should only be used for edge cases because you don't want to have false positives there. Therefore, keep your country-block-list to ones you rarely receive ham on.
When i asked where they go, i presumed hM needs a way to reference them, im not that familiar with the deeper workings of hM to be sure. So if you could maybe be a little more specific id really appreciate it :) BTW im just using Win 10 1506 cause its the last version i can use that allows perma disable of Updates that arent forced on you after a while, in other words, MS doesnt have that backdoor to turn them back on.
palinka wrote:
2020-12-11 16:52
Furball Zen wrote:
2020-12-11 16:23
Im not on the attack, you need to hone your CS skills, youre pretty much a jerk to me every time i post. At least MattG tries to help with his product.
Nobody "owns" hmailserver. Its open source and free. And neither Matt nor Jimi are developers of it (me either). There is no "CS", only a bunch of dudes that like using it and help other people out in their spare time - therefore there is no need to hone CS or any other skills. Well, maybe scripting skills, which you will find in spades here if you look around. The good news is that nearly anything you want to do with hmailserver has already been written up. All it takes is looking around or asking a question. :D

Nobody gets paid here. Not even the guy that wrote it, although there is a donation link on the homepage if you want to send him some beer money.
I know no one gets paid, but im the level of user, that i craft my questions very specifically cause i dont need to know basic things like how to figure out file hierarchy, so its very, i guess, annoying when the answer is "run this since im apparently ignoring your carefully crafted question" when im looking for more of a direct answer or at least a probing response for clarity if my question is fuzzy to the user.

Like i mentioned about the last time i posted 2.5 years ago, my ISP had apparently implemented another level of difficulty to the process and i had to allow a wildly odd IP address to communicate with hM and running the script didnt reveal anything wrong, i just simply figured it out on my own, but felt i wasted my time posting here. I never posted the solution for others to find as a result of his 'rudeness'.
mattg wrote:
2020-12-13 00:39
Furball Zen wrote:
2020-12-11 16:17
mattg wrote:
2020-12-11 09:08
What does this file contain?
C:\Program Files\hMailServer\Logs\ERROR_hmailserver_2020-12-10.log
The only errors i ever get is it complaining it cant talk to SA, im guessing based on the amount of traffic, cause it only complains once in a while, never more than once a day. The previous error log was on Dec 4th, so that kinda gives you the infrequency of it.
Is SpamAssassin on the same machine?
Do you use a local DNS?
Did you actually check that log file?
The machine only handles hM and SA, so yes same machine.
No DNS, just default localhost.
mattg wrote:
2020-12-13 00:39
I SpamAssassin score ALL emails (by setting the 'required_score' variable to -500.0 in my .cf file) , and check to see if the 'X-Spam-Header' is present, and then if not, I add a 'default Spam Assassin Score.
Not sure how to force that?

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-13 01:25

SorenR wrote:
2020-12-11 17:35
RvdH wrote:
2020-12-11 17:25
Furball Zen wrote:
2020-12-11 01:57
Ok, so running the latest version cause the version i was on for a while started allowing a shit ton of spam through, almost like it started ignoring SpamAssassin (or SA wasnt working right). So the past few days ive been editing my rules, adding new one and have been getting progressively pissed.

So, the last email i got SA shows this:

Code: Select all

Dec 10 18:42:36.387 [-1740] info: spamd: result: Y 6 - BAYES_00,FORGED_SPF_HELO,FSL_BULK_SIG,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,LOTS_OF_MONEY,MIME_HTML_ONLY,MIME_QP_LONG_LINE,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,SPF_HELO_PASS,URIBL_BLACK,URIBL_DBL_SPAM scantime=2.1,size=5473,user=(unknown),uid=0,required_score=5.0,rhost=botr-mail,raddr=127.0.0.1,rport=60169,mid=<mtnJ3LwTkDYlz2nOUSH3stAkuQdbQLpUHIAEd7RsMu4.7TeicWk-ZEcMw0h4OzEdow@regardwelfare.co>,bayes=0.000000,autolearn=no autolearn_force=no
I have hM set to delete at 4, mark at 3. So why is it delivering the mail instead of deleting it? I have changed nothing in the settings for years, just in the last 2-3 weeks its almost like someone can see my rules and is crafting their spam to circumvent it.
check your hmailserver error logs, do you have errors like below on date/time a message marked (by SA) as spam comes through?
There was a communication error with SpamAssassin. hMailServer tried to retrieve data from SpamAssassin but the connection to SpamAssassin was lost. The WinSock error code is 2.
I get those too... Usually only affect a single mail. 99.99% of the time it is SpamAssassin taking too long to report back.
I changed my W2K3 Server Windows settings "Performance Options" in controlpanel to "Processor scheduling = Background" and "Memory usage = Programs" and that seems to have changed something. Not had a Spamassassin outtake in a week now.
I tried setting spamd.exe to HIGH on the proc since my Win 10 version is Home and doesnt have Performance Options anywhere i can find.

User avatar
mattg
Moderator
Moderator
Posts: 21268
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: Spam being ignored +/-

Post by mattg » 2020-12-13 01:44

Furball Zen wrote:
2020-12-13 01:18
mattg wrote:
2020-12-13 00:39

Is SpamAssassin on the same machine?
Do you use a local DNS?
Did you actually check that log file?
The machine only handles hM and SA, so yes same machine.
No DNS, just default localhost.
A local DNS server will improve your search speed immensely

Furball Zen wrote:
2020-12-13 01:18
I know no one gets paid, but im the level of user, that i craft my questions very specifically cause i dont need to know basic things like how to figure out file hierarchy, so its very, i guess, annoying when the answer is "run this since im apparently ignoring your carefully crafted question" when im looking for more of a direct answer or at least a probing response for clarity if my question is fuzzy to the user.
For the record, I think that jimimaseye's response was entirely appropriate, and to be entirely honest, the only question that I can see in your initial post this thread, is
Furball Zen wrote:
2020-12-11 01:57
So why is it delivering the mail instead of deleting it?
I'm not sure that qualifies as a 'carefully crafted question'. I'm also not sure how we tell 'what level of user' you are without searching your back posts.

After reviewing your settings, and checking your log file (which you still haven't confirmed is only SA connection issues), my best guess is that SpamAssassin timed out (or was unavailable) and I'm trying to suggest ways to limit that.

Please don't be rude to jimimaseye.
Their response was timely and appropriate
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-13 03:42

Furball Zen wrote:
2020-12-13 01:18
When i asked where they go, i presumed hM needs a way to reference them, im not that familiar with the deeper workings of hM to be sure. So if you could maybe be a little more specific id really appreciate it :)
That's basically as specific as it gets. I posted a bunch of links that I thought were relevant to your question. You need to read them probably at least twice before attempting to implement them. I'm not saying that because I think you're dumb - it's just that there are many changes throughout the threads that are improvements and to understand what they are requires careful reading. One of the issues with a board like this is that those of us that are not moderators cannot modify the OP to update any scripts to the latest version of whatever script is being discussed. You post, then you have a very limited time to edit your post, then after that you have to simply post again if you have changes. Often those "re-posts" leave out stuff that was already discussed or was already working.
BTW im just using Win 10 1506 cause its the last version i can use that allows perma disable of Updates that arent forced on you after a while, in other words, MS doesnt have that backdoor to turn them back on.
I wouldn't do that. As much as I distrust MS, at least they are working on security flaws. So far, no MS updates have put my environment in jeopardy.
when the answer is "run this since im apparently ignoring your carefully crafted question"
That is simply a means to give us a broad spectrum of information, which often cuts through the noise. You have to understand - many users come here with a question to what they think is the problem and it turns out to be something else completely. How could anyone know? Many users don't have a clue. I'm not saying that's the case with you, but understand the perspective of those of us trying to help. So many come here and don't have a clue.
Like i mentioned about the last time i posted 2.5 years ago, my ISP had apparently implemented another level of difficulty to the process and i had to allow a wildly odd IP address to communicate with hM and running the script didnt reveal anything wrong, i just simply figured it out on my own, but felt i wasted my time posting here. I never posted the solution for others to find as a result of his 'rudeness'.
See above. In that case, it was obviously something in your environment. Something difficult to perceive without actually knowing your environment.

The diagnostic script isn't perfect - it does not reveal all issues - but it does reveal a lot and is very helpful in diagnosing issues. That's why its asked for in 90% of threads.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-13 05:58

mattg wrote:
2020-12-13 01:44
Furball Zen wrote:
2020-12-13 01:18
mattg wrote:
2020-12-13 00:39

Is SpamAssassin on the same machine?
Do you use a local DNS?
Did you actually check that log file?
The machine only handles hM and SA, so yes same machine.
No DNS, just default localhost.
A local DNS server will improve your search speed immensely
Not sure what you mean be searching? Where do i plug that into hM?
mattg wrote:
2020-12-13 01:44
After reviewing your settings, and checking your log file (which you still haven't confirmed is only SA connection issues), my best guess is that SpamAssassin timed out (or was unavailable) and I'm trying to suggest ways to limit that.
Yes i did, in Post #9, maybe i was a little general vs specific in saying "yes, it was a winsock 2 error". Those are the ONLY errors i ever see, so i didnt think i needed to be too specific, especially when it sounded like you guessed the contents of the log.
palinka wrote:
2020-12-13 03:42
Furball Zen wrote:
2020-12-13 01:18
When i asked where they go, i presumed hM needs a way to reference them, im not that familiar with the deeper workings of hM to be sure. So if you could maybe be a little more specific id really appreciate it :)
That's basically as specific as it gets. I posted a bunch of links that I thought were relevant to your question. You need to read them probably at least twice before attempting to implement them. I'm not saying that because I think you're dumb - it's just that there are many changes throughout the threads that are improvements and to understand what they are requires careful reading. One of the issues with a board like this is that those of us that are not moderators cannot modify the OP to update any scripts to the latest version of whatever script is being discussed. You post, then you have a very limited time to edit your post, then after that you have to simply post again if you have changes. Often those "re-posts" leave out stuff that was already discussed or was already working.
Furball Zen wrote:
2020-12-13 01:18
BTW im just using Win 10 1506 cause its the last version i can use that allows perma disable of Updates that arent forced on you after a while, in other words, MS doesnt have that backdoor to turn them back on.
I wouldn't do that. As much as I distrust MS, at least they are working on security flaws. So far, no MS updates have put my environment in jeopardy.
I understand the point to that, but the machine cant handle much more and ONLY runs hM and SA and is other wise blocked from the internet. I cant and dont want to upgrade it, theres a reason i have separate email and web servers.
when the answer is "run this since im apparently ignoring your carefully crafted question"
That is simply a means to give us a broad spectrum of information, which often cuts through the noise. You have to understand - many users come here with a question to what they think is the problem and it turns out to be something else completely. How could anyone know? Many users don't have a clue. I'm not saying that's the case with you, but understand the perspective of those of us trying to help. So many come here and don't have a clue.
Like i mentioned about the last time i posted 2.5 years ago, my ISP had apparently implemented another level of difficulty to the process and i had to allow a wildly odd IP address to communicate with hM and running the script didnt reveal anything wrong, i just simply figured it out on my own, but felt i wasted my time posting here. I never posted the solution for others to find as a result of his 'rudeness'.
See above. In that case, it was obviously something in your environment. Something difficult to perceive without actually knowing your environment.

The diagnostic script isn't perfect - it does not reveal all issues - but it does reveal a lot and is very helpful in diagnosing issues. That's why its asked for in 90% of threads.
Well, you also have to take into consideration others when they post, i gave more than enough info in my question to warrant SOME direct answer, or so i thought. "If A doesnt = B then why is C happening when C shouldnt happen unless A = B?" Either way, im looking at your script suggestions, and no i didnt take offense to the 'read twice' bit, i understood your context. Mainly i feel SOMETHING is wrong somewhere since i cant train bayes anymore and i went from maybe 2-3 spam per day on ALL my accounts, to like 30-40 PER ACCOUNT per day.

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-13 13:31

If you are done ranting here are your goals for today...

1) Matt asked about the DNS primarely on speed but secondly because some of the RBL lists do NOT like you using a public DNS. If you are not using a public DNS proceed directly to #2

2) What is the status of Spamassassin? Logs etc.?

3) If you can't train Bayes it is NOT a hMailserver issue.

4) If you are worried about the winsock error try logging the number of mails you get via a script in Eventhandlers.vbs. You can place the scritplet under "OnDeliverMessage" and have it print a line in the event log for every mail NOT containing a Spamassassin header.
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-13 21:18

SorenR wrote:
2020-12-13 13:31
If you are done ranting here are your goals for today...

1) Matt asked about the DNS primarely on speed but secondly because some of the RBL lists do NOT like you using a public DNS. If you are not using a public DNS proceed directly to #2

2) What is the status of Spamassassin? Logs etc.?

3) If you can't train Bayes it is NOT a hMailserver issue.

4) If you are worried about the winsock error try logging the number of mails you get via a script in Eventhandlers.vbs. You can place the scritplet under "OnDeliverMessage" and have it print a line in the event log for every mail NOT containing a Spamassassin header.
I wasnt ranting? Somehow when i searched for SA last night, i got the German JAM site and also the latest 32bit version (3.4.2.40), installed it and have only gotten one spam so far since. I think that and setting the proc priority on spamd.exe higher made a difference.I checked the logs and its denying left and right again.

Technically my original question still wasnt answered, as to why hM was ignoring the SA score and not deleting the email, so i still think thats an hM issue. But since it seems sorted for now, ill digress.

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-13 21:58

Furball Zen wrote:
2020-12-13 21:18
SorenR wrote:
2020-12-13 13:31
If you are done ranting here are your goals for today...

1) Matt asked about the DNS primarely on speed but secondly because some of the RBL lists do NOT like you using a public DNS. If you are not using a public DNS proceed directly to #2

2) What is the status of Spamassassin? Logs etc.?

3) If you can't train Bayes it is NOT a hMailserver issue.

4) If you are worried about the winsock error try logging the number of mails you get via a script in Eventhandlers.vbs. You can place the scritplet under "OnDeliverMessage" and have it print a line in the event log for every mail NOT containing a Spamassassin header.
I wasnt ranting? Somehow when i searched for SA last night, i got the German JAM site and also the latest 32bit version (3.4.2.40), installed it and have only gotten one spam so far since. I think that and setting the proc priority on spamd.exe higher made a difference.I checked the logs and its denying left and right again.

Technically my original question still wasnt answered, as to why hM was ignoring the SA score and not deleting the email, so i still think thats an hM issue. But since it seems sorted for now, ill digress.
That's the attitude that make me regret involving myself into other peoples problems. Technicly the issue is resolved but the cause was not found.
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

User avatar
mattg
Moderator
Moderator
Posts: 21268
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: Spam being ignored +/-

Post by mattg » 2020-12-13 22:27

Furball Zen wrote:
2020-12-13 05:58
mattg wrote:
2020-12-13 01:44
After reviewing your settings, and checking your log file (which you still haven't confirmed is only SA connection issues), my best guess is that SpamAssassin timed out (or was unavailable) and I'm trying to suggest ways to limit that.
Yes i did, in Post #9, maybe i was a little general vs specific in saying "yes, it was a winsock 2 error". Those are the ONLY errors i ever see, so i didnt think i needed to be too specific, especially when it sounded like you guessed the contents of the log.
For the life of me I can't see where you say what was ACTUALLY in the logs

You say what is usually in the logs
Furball Zen wrote:
2020-12-11 16:17
mattg wrote:
2020-12-11 09:08
What does this file contain?
C:\Program Files\hMailServer\Logs\ERROR_hmailserver_2020-12-10.log
The only errors i ever get is it complaining it cant talk to SA, im guessing based on the amount of traffic, cause it only complains once in a while, never more than once a day. The previous error log was on Dec 4th, so that kinda gives you the infrequency of it.
Furball Zen wrote:
2020-12-13 21:18
my original question still wasnt answered, as to why hM was ignoring the SA score and not deleting the email, so i still think thats an hM issue.
Quite a few of us have stated that we think that the issue is that SPamassassin deosn't respond in a timely manner, and we offered ways to speed up SpamAssassin, which seems to have fixed your issue

How were we unhelpful?
Where is there an unanswered question?
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-13 22:54

mattg wrote:
2020-12-13 22:27
1. You say what is usually in the logs
2. How were we unhelpful?
3. Where is there an unanswered question?
1. Yea, meaning when i do look at them, thats all i see. I left room for other errors i havent seen, guess its my way of being as truthful as possible while allowing for something i didnt see/know.
2. I didnt say you werent helpful?
3. In my first post, "I have hM set to delete at 4, mark at 3. So why is it delivering the mail instead of deleting it?", cause the spamd copy showed the score was 6.
SorenR wrote:
2020-12-13 21:58

That's the attitude that make me regret involving myself into other peoples problems. Technicly the issue is resolved but the cause was not found.
Oh, i didnt mean it that way, i appreciate your time.

I had to manually add an IP range to block a spammer. It took SA three emails to start blocking them. The first one had a score of 1, second one 6.7 and let through and the 3rd a score of 10 and deleted/ignored. Is this normal behavior? They all came from diff IPs in a range 50.3.203.10-50.3.203.13 but with the same domain name.

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-13 23:31

Furball Zen wrote:
2020-12-13 22:54

Oh, i didnt mean it that way, i appreciate your time.

I had to manually add an IP range to block a spammer. It took SA three emails to start blocking them. The first one had a score of 1, second one 6.7 and let through and the 3rd a score of 10 and deleted/ignored. Is this normal behavior? They all came from diff IPs in a range 50.3.203.10-50.3.203.13 but with the same domain name.
There are different ways to "train your dragon".

Bayes is by default set up to maintain training "on-the-fly" once it received it's initial training from 200+ SPAM/HAM mails.

Once trained it will look at content and combine it with DNS lookups and DNSRBL/SURBL lists. Everytime it "thinks" a sender is a spammer or something new is detected it will raise the score. SPF, DKIM and DMARC if detected will lower the score if valid so look at it as a scoreboard with two columns; the good side and the bad side.. Once all rules have finished (unless you use shortcircuit) the two columns are added up. That is the score reported to hMailServer.

I rate SPAM as > 3 both in SpamAssassin and in hMailServer. Score > 10000 will delete (in reality I don't delete mails based on score).
Emails scored 3 < X =<7 is moved to SPAM folder & copied to my SPAM account.
Emails scored X > 7 is ONLY(!) copied to SPAM account
Every day at 23:00 SpamAssassin extract all mail from the last week from all INBOX'es and all SPAM folders and use it for training. That way people can change rating of an email by moving it from INBOX to SPAM folder or visa versa.

https://www.hmailserver.com/forum/viewt ... 20&t=26866
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-14 06:15

SorenR wrote:
2020-12-13 23:31
Furball Zen wrote:
2020-12-13 22:54

Oh, i didnt mean it that way, i appreciate your time.

I had to manually add an IP range to block a spammer. It took SA three emails to start blocking them. The first one had a score of 1, second one 6.7 and let through and the 3rd a score of 10 and deleted/ignored. Is this normal behavior? They all came from diff IPs in a range 50.3.203.10-50.3.203.13 but with the same domain name.
There are different ways to "train your dragon".

Bayes is by default set up to maintain training "on-the-fly" once it received it's initial training from 200+ SPAM/HAM mails.

Once trained it will look at content and combine it with DNS lookups and DNSRBL/SURBL lists. Everytime it "thinks" a sender is a spammer or something new is detected it will raise the score. SPF, DKIM and DMARC if detected will lower the score if valid so look at it as a scoreboard with two columns; the good side and the bad side.. Once all rules have finished (unless you use shortcircuit) the two columns are added up. That is the score reported to hMailServer.

I rate SPAM as > 3 both in SpamAssassin and in hMailServer. Score > 10000 will delete (in reality I don't delete mails based on score).
Emails scored 3 < X =<7 is moved to SPAM folder & copied to my SPAM account.
Emails scored X > 7 is ONLY(!) copied to SPAM account
Every day at 23:00 SpamAssassin extract all mail from the last week from all INBOX'es and all SPAM folders and use it for training. That way people can change rating of an email by moving it from INBOX to SPAM folder or visa versa.

https://www.hmailserver.com/forum/viewt ... 20&t=26866
Ill look at that later, ive been using the Spam folder to train, but all it does now is just read them and learn from (0) files. Annoying...
Furball Zen wrote:
2020-12-13 22:54

I had to manually add an IP range to block a spammer. It took SA three emails to start blocking them. The first one had a score of 1, second one 6.7 and let through and the 3rd a score of 10 and deleted/ignored. Is this normal behavior? They all came from diff IPs in a range 50.3.203.10-50.3.203.13 but with the same domain name.
The effer came back till he found an IP he could connect with all the way up to 50.3.203.45, so i added that to the range... wtf...

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-14 14:46

Furball Zen wrote:
2020-12-13 22:54

I had to manually add an IP range to block a spammer. It took SA three emails to start blocking them. The first one had a score of 1, second one 6.7 and let through and the 3rd a score of 10 and deleted/ignored. Is this normal behavior? They all came from diff IPs in a range 50.3.203.10-50.3.203.13 but with the same domain name.

The effer came back till he found an IP he could connect with all the way up to 50.3.203.45, so i added that to the range... wtf...
You deffo have a problem with your SpamAssassin...

http://multirbl.valli.org/lookup/50.3.203.45.html

Listed on 31 blacklists :shock:

New hMailServer DNSBL's:

zen.spamhaus.org
127.0.0.2
"Blocked SnowShoe SPAM"
score = 1,000,000,000

ubl.unsubscore.com
127.0.0.2
"Blocked LashBack SPAM"
score = 1,000,000,000
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-14 18:40

SorenR wrote:
2020-12-14 14:46
Furball Zen wrote:
2020-12-13 22:54

I had to manually add an IP range to block a spammer. It took SA three emails to start blocking them. The first one had a score of 1, second one 6.7 and let through and the 3rd a score of 10 and deleted/ignored. Is this normal behavior? They all came from diff IPs in a range 50.3.203.10-50.3.203.13 but with the same domain name.

The effer came back till he found an IP he could connect with all the way up to 50.3.203.45, so i added that to the range... wtf...
You deffo have a problem with your SpamAssassin...

http://multirbl.valli.org/lookup/50.3.203.45.html

Listed on 31 blacklists :shock:

New hMailServer DNSBL's:

zen.spamhaus.org
127.0.0.2
"Blocked SnowShoe SPAM"
score = 1,000,000,000

ubl.unsubscore.com
127.0.0.2
"Blocked LashBack SPAM"
score = 1,000,000,000
Well, yea lol. Think i should do a reinstall for a refresh? The previous install was running for 11ish years?

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-14 19:49

I still have a laptop with Windows XP that I installed in 2006... I am not sure I could recreate it today with the programs and configurations I need on it... It was my development platform up until 2 years ago.

If you end up with the same problem after two weeks then you have gained nothing be reinstalling.

What is your SpamAssassin logfile saying...

https://cwiki.apache.org/confluence/dis ... HowToDebug

https://cwiki.apache.org/confluence/dis ... ugChannels

https://cwiki.apache.org/confluence/dis ... NotWorking
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-14 21:07

SorenR wrote:
2020-12-14 19:49
I still have a laptop with Windows XP that I installed in 2006... I am not sure I could recreate it today with the programs and configurations I need on it... It was my development platform up until 2 years ago.

If you end up with the same problem after two weeks then you have gained nothing be reinstalling.

What is your SpamAssassin logfile saying...

https://cwiki.apache.org/confluence/dis ... HowToDebug

https://cwiki.apache.org/confluence/dis ... ugChannels

https://cwiki.apache.org/confluence/dis ... NotWorking
Not sure, where is it located? im on Windows, not linux.

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-15 01:27

Furball Zen wrote:
2020-12-14 21:07
SorenR wrote:
2020-12-14 19:49
I still have a laptop with Windows XP that I installed in 2006... I am not sure I could recreate it today with the programs and configurations I need on it... It was my development platform up until 2 years ago.

If you end up with the same problem after two weeks then you have gained nothing be reinstalling.

What is your SpamAssassin logfile saying...

https://cwiki.apache.org/confluence/dis ... HowToDebug

https://cwiki.apache.org/confluence/dis ... ugChannels

https://cwiki.apache.org/confluence/dis ... NotWorking
Not sure, where is it located? im on Windows, not linux.
I use Windoze too...

log would be in e.g. C:\SpamAssassin\logs or something to that effect, you may have to look in "Program Files (x86)" ...
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-15 02:41

I think spamd.log location gets set as a parameter when you install the service. I imagine if you don't set it, then it logs to event log. That's just speculation, though.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-15 04:45

SorenR wrote:
2020-12-15 01:27

I use Windoze too...

log would be in e.g. C:\SpamAssassin\logs or something to that effect, you may have to look in "Program Files (x86)" ...
palinka wrote:
2020-12-15 02:41
I think spamd.log location gets set as a parameter when you install the service. I imagine if you don't set it, then it logs to event log. That's just speculation, though.
Yea i looked all over and couldnt find anything, im guessing i didnt set it up way back when cause there wasnt an option when i did the updated version yesterday.

Ive decided to look at some updated hardware and i can get a huge upgrade for about $38 and end up with a Core i5 up from an Atom 320. Not that i need that much horsepower for hM and SA, but for the price.... meh. Maybe ill look unto running Linux on it instead.

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-15 05:43

Furball Zen wrote:
2020-12-15 04:45
SorenR wrote:
2020-12-15 01:27

I use Windoze too...

log would be in e.g. C:\SpamAssassin\logs or something to that effect, you may have to look in "Program Files (x86)" ...
palinka wrote:
2020-12-15 02:41
I think spamd.log location gets set as a parameter when you install the service. I imagine if you don't set it, then it logs to event log. That's just speculation, though.
Yea i looked all over and couldnt find anything, im guessing i didnt set it up way back when cause there wasnt an option when i did the updated version yesterday.

Ive decided to look at some updated hardware and i can get a huge upgrade for about $38 and end up with a Core i5 up from an Atom 320. Not that i need that much horsepower for hM and SA, but for the price.... meh. Maybe ill look unto running Linux on it instead.
My two hMailServers...
- 2003 Server R2 is an Intel Core 2 Duo E6550 @ 2.33GHz with 2GB RAM and a 1GB LAN. 500GB SATA. Headless. Installed 2007.
- 2019 Server Essentials is an Intel Core 2 Duo E8400 @ 3GHz with 6GB RAM and a 1GB LAN. 500GB SATA. Headless. Installed 2020.

Old machines that were made redundant a long time ago. I believe I still have parts lying around to build 2 or 3 systems. My son is a gamer and I recommission all his old gear if it still runs... I believe I have a motherboard with a AMD Ryzen 5 4-core thingy coming my way soon.

We recently cloned his 1GB SATA to a 1GB SSD. From "ample time to go to kitchen and brew a cup of instant coffee" to 25 second boot time on a "restart" - remember this is a gamer so all sorts of online crap has to be loaded - and under 10 seconds just turning it on.

Flavor of the month is "Cyberpunk 2077" with all graphics at top settings displayed on one standard'ish flat panel and one 144HZ 21" curved panel.
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

User avatar
jim.bus
Senior user
Senior user
Posts: 630
Joined: 2011-05-28 11:49
Location: US

Re: Spam being ignored +/-

Post by jim.bus » 2020-12-15 08:33

SorenR wrote:
2020-12-15 05:43

Old machines that were made redundant a long time ago. I believe I still have parts lying around to build 2 or 3 systems. My son is a gamer and I recommission all his old gear if it still runs... I believe I have a motherboard with a AMD Ryzen 5 4-core thingy coming my way soon.

We recently cloned his 1GB SATA to a 1GB SSD. From "ample time to go to kitchen and brew a cup of instant coffee" to 25 second boot time on a "restart" - remember this is a gamer so all sorts of online crap has to be loaded - and under 10 seconds just turning it on.

Flavor of the month is "Cyberpunk 2077" with all graphics at top settings displayed on one standard'ish flat panel and one 144HZ 21" curved panel.
Well as long as we are all bragging about our hardware, I'll brag about mine which is running my hMailServer, MySQL, And SPAMAssassin, Microsoft 365, etc. My system is the same type of components a gamer might use. I built it this way because the system would have the power to do anything I would ever likely want to run on it.

i7 3960X 6 Core 12 Threads CPU at 3.3 GHz to 3.9 GHz Turbo Boost and 32 GB RAM, 256 GB SSD System Drive and a 2 TB and 4 TB Hard Drive for Data Storage.

Needless to say I run everything on this machine. I do not worry about running virus scans at the same time as anything else running. I've had the computer (custom build) since 2012.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-15 13:56

¯\_ (ツ)_/¯ I only buy refurbished. And only after catastrophic hardware failure. I replaced my server a couple of years ago after a solid 10 year run. Then last month I rebuilt it after a drive failure.

I got a nice workstation from work thanks to covid because my old laptop didn't have the juice for video conferencing. I always thought the desk you put it on is far more important than the beeper bopper booper on the desk. On my luxurious desk that I made with my own hands, there are no wires whatsoever. :D

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-15 15:59

SorenR wrote:
2020-12-15 05:43
Furball Zen wrote:
2020-12-15 04:45
SorenR wrote:
2020-12-15 01:27

I use Windoze too...

log would be in e.g. C:\SpamAssassin\logs or something to that effect, you may have to look in "Program Files (x86)" ...
palinka wrote:
2020-12-15 02:41
I think spamd.log location gets set as a parameter when you install the service. I imagine if you don't set it, then it logs to event log. That's just speculation, though.
Yea i looked all over and couldnt find anything, im guessing i didnt set it up way back when cause there wasnt an option when i did the updated version yesterday.

Ive decided to look at some updated hardware and i can get a huge upgrade for about $38 and end up with a Core i5 up from an Atom 320. Not that i need that much horsepower for hM and SA, but for the price.... meh. Maybe ill look unto running Linux on it instead.
My two hMailServers...
- 2003 Server R2 is an Intel Core 2 Duo E6550 @ 2.33GHz with 2GB RAM and a 1GB LAN. 500GB SATA. Headless. Installed 2007.
- 2019 Server Essentials is an Intel Core 2 Duo E8400 @ 3GHz with 6GB RAM and a 1GB LAN. 500GB SATA. Headless. Installed 2020.

Old machines that were made redundant a long time ago. I believe I still have parts lying around to build 2 or 3 systems. My son is a gamer and I recommission all his old gear if it still runs... I believe I have a motherboard with a AMD Ryzen 5 4-core thingy coming my way soon.

We recently cloned his 1GB SATA to a 1GB SSD. From "ample time to go to kitchen and brew a cup of instant coffee" to 25 second boot time on a "restart" - remember this is a gamer so all sorts of online crap has to be loaded - and under 10 seconds just turning it on.

Flavor of the month is "Cyberpunk 2077" with all graphics at top settings displayed on one standard'ish flat panel and one 144HZ 21" curved panel.
Yea, ive built my own PCs since 1996, but this is just a Dell Optiplex 160 i got off eBay to run headless. It doesnt reboot on its own after a power failure, so as long as i remember that, its not been an issue. My main PC is a workhorse though, AMD FX6100, AMD 6990, 16GB of Corsair DDR3 all water cooled. Yea its almost 7 years old, but still kills anything i throw at it. My web/media server is just an AMD FM1 system i threw together and run it headless as well.

On topic update, only got two spam over night, one was targeted so i dont really count that. I had to recheck the proc settings on spamd.exe since the update and set it back to HIGH, no errors since the 10th either. I also set a Task to run saupdate.bat every night at 3am. I was only running that manually once in a while.
palinka wrote:
2020-12-15 13:56
¯\_ (ツ)_/¯ I only buy refurbished. And only after catastrophic hardware failure. I replaced my server a couple of years ago after a solid 10 year run. Then last month I rebuilt it after a drive failure.

I got a nice workstation from work thanks to covid because my old laptop didn't have the juice for video conferencing. I always thought the desk you put it on is far more important than the beeper bopper booper on the desk. On my luxurious desk that I made with my own hands, there are no wires whatsoever. :D
I dont normally upgrade till then either, but i knew this was a borderline spec machine when i got it over 8 years ago and like i said, $38 is easy to justify for what id consider going from an NX-2 to NCC-1701 ;)

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-15 16:17

Furball Zen wrote:
2020-12-15 15:59
It doesnt reboot on its own after a power failure
If you use an APC UPS, there is a great piece of software called APCUPSD that gives you lots more options than the windows battery handling. I even scripted mine to notify the utility in the event of an outage.

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-15 17:02

palinka wrote:
2020-12-15 16:17
Furball Zen wrote:
2020-12-15 15:59
It doesnt reboot on its own after a power failure
If you use an APC UPS, there is a great piece of software called APCUPSD that gives you lots more options than the windows battery handling. I even scripted mine to notify the utility in the event of an outage.
I have a HP T1500 protecting my servers/NAS'es, my 4G router and my main GB switch (with POE ports) where my WiFi AP's are connected to...

So... I opted not to protect my 200/200 fiber router since local gear is powered from same power grid as me (I have 3P+N 400V AC 63A coming in).

It's going to be a cold day in Hell before I loose connectivity :mrgreen:
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-15 17:21

SorenR wrote:
2020-12-15 17:02
So... I opted not to protect my 200/200 fiber router since local gear is powered from same power grid as me (I have 3P+N 400V AC 63A coming in).
Here the fiber switchgear all has backup power. Zero downtime. Say whatever you want about Verizon, but they are most definitely an engineering focused company. In the 8 years I've had Verizon fiber, there was only one downtime, which was early on a Sunday morning, so I believe it was likely scheduled maintenance.

In case you don't know, Verizon is a telco that offers fiber optic, tv, phone and wireless. Once they came to us (my company as landlord in downtown manhattan) and told us they wanted to put a 911 cell tower on the building. Don't ask me what is the difference between a regular cell tower and a 911 cell tower. I have no idea. But their engineers chose the spot for engineering reasons. "Can you ask the building across the street?" NO! THIS IS THE SPOT WE CHOSE BECAUSE IT MAXIMIZES BLAH BLAH BLAH! Nobody's crazy about cell towers on the building, but it was an excellent long term lease with a credit tenant that effectively took zero space away from any other lease in the building. Free money, more or less.

My entire network + server is on one 650W UPS, including the fiber optic switch outside. I get about 20-25 minutes server runtime on battery from that (being the biggest load) and then another half hour or so after the server goes into hibernation before the battery poops out from the network load. I have another UPS at my desk for 2 computers + ancillary stuff including a clock that is a pain to reset after an outage. :D

User avatar
SorenR
Senior user
Senior user
Posts: 4198
Joined: 2006-08-21 15:38
Location: Denmark

Re: Spam being ignored +/-

Post by SorenR » 2020-12-15 21:14

Furball Zen wrote:
2020-12-15 15:59
Ive decided to look at some updated hardware and i can get a huge upgrade for about $38 and end up with a Core i5 up from an Atom 320. Not that i need that much horsepower for hM and SA, but for the price.... meh. Maybe ill look unto running Linux on it instead.
The server I have with Windows 2019 Server Essentials I also installed the Linux Subsystem on... It's running Ubuntu and the plan is to run SpamAssassin and ClamAV off of the Linux system. I probably have to upgrade memory from 6GB but that's OK.
SørenR.

Algorithm (noun.)
Word used by programmers when they do not want to explain what they did.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-15 22:03

palinka wrote:
2020-12-15 16:17
Furball Zen wrote:
2020-12-15 15:59
It doesnt reboot on its own after a power failure
If you use an APC UPS, there is a great piece of software called APCUPSD that gives you lots more options than the windows battery handling. I even scripted mine to notify the utility in the event of an outage.
No, just the BIOS restart on power loss setting thing, it ignores it lol.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-15 23:08

Had to block another ramping IP spammer. Sigh.

User avatar
mattg
Moderator
Moderator
Posts: 21268
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: Spam being ignored +/-

Post by mattg » 2020-12-17 10:56

Try the spamassassin support
It certainly seems like your SpamAssassin isn't optimal
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-17 22:23

mattg wrote:
2020-12-17 10:56
Try the spamassassin support
It certainly seems like your SpamAssassin isn't optimal
Something is odd, or its very specifically crafted spam lol.

User avatar
mattg
Moderator
Moderator
Posts: 21268
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: Spam being ignored +/-

Post by mattg » 2020-12-18 00:13

Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2020-12-31 18:55

Well, after working through blocking some IP ranges, it seems most (99%+) was coming from 185.234.1.1 to 185.249.255.255. Once i blocked those, the rest of the spam started being handled by the blacklists. So, maybe i was getting hammered so hard that SA or hM couldnt keep up checking them all? Almost 24 hours with no delivered spam.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2020-12-31 19:19

Furball Zen wrote:
2020-12-31 18:55
Almost 24 hours with no delivered spam.
Don't you love the spam free lifestyle? I know I do.

Furball Zen
Normal user
Normal user
Posts: 121
Joined: 2009-04-23 00:42

Re: Spam being ignored +/-

Post by Furball Zen » 2021-01-04 22:26

palinka wrote:
2020-12-31 19:19
Furball Zen wrote:
2020-12-31 18:55
Almost 24 hours with no delivered spam.
Don't you love the spam free lifestyle? I know I do.
I was mostly busy all weekend and didnt check till last night, i got a total of 5 spam since last Thursday, so i think i can deal with that for now lol. It does seem that blocking that last IP range allowed SA to keep up with checking the RBL's and such cause its blocking a LOT more than it ever did.

palinka
Senior user
Senior user
Posts: 2475
Joined: 2017-09-12 17:57

Re: Spam being ignored +/-

Post by palinka » 2021-01-05 05:16

Furball Zen wrote:
2021-01-04 22:26
palinka wrote:
2020-12-31 19:19
Furball Zen wrote:
2020-12-31 18:55
Almost 24 hours with no delivered spam.
Don't you love the spam free lifestyle? I know I do.
I was mostly busy all weekend and didnt check till last night, i got a total of 5 spam since last Thursday, so i think i can deal with that for now lol. It does seem that blocking that last IP range allowed SA to keep up with checking the RBL's and such cause its blocking a LOT more than it ever did.
👍

Post Reply