.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.42) .\" .\" Standard preamble: .\" ======================================================================== .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' . ds C` . ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is >0, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .\" .\" Avoid warning from groff about undefined register 'F'. .de IX .. .nr rF 0 .if \n(.g .if rF .nr rF 1 .if (\n(rF:(\n(.g==0)) \{\ . if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{\ . nr % 0 . nr F 2 . \} . \} .\} .rr rF .\" ======================================================================== .\" .IX Title "sa-heatu 1" .TH sa-heatu 1 "2022-10-13" "sa-heatu" "User Commands" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH "NAME" sa\-heatu \- Spamasassin Heuristic Email Address Tracker Utility .SH "SYNOPSIS" .IX Header "SYNOPSIS" .Vb 1 \& sa\-heatu [options] [dbfile [timestamp\-file]] .Ve .SH "DESCRIPTION" .IX Header "DESCRIPTION" Check or clean a SpamAssassin auto-whitelist (\s-1AWL\s0) database file. .PP The Auto-WhiteList (\s-1AWL\s0) feature in Spamassassing tracks scores from messages previously received and adjusts the message score, either by boosting messages from senders who send ham or penalizing senders who have sent spam previously. This not only treats some senders as if they were whitelisted but also treats spammers as if they were blacklisted. To enable \s-1AWL\s0 in spamassassin, read dcoumentation: .PP .Vb 1 \& perldoc Mail::SpamAssassin::Conf .Ve .PP This is an enhanced version of the original \s-1AWL\s0 tool. The \s-1AWL\s0 database can be examined and pruned; single email entries can be removed. This is useful when a spammer sends one or more ham messages before sending spam. .PP Without special options, the program generates a summary of the database (see \s-1FILES\s0): .PP .Vb 1 \& $ sa\-heatu \-D \-n /var/spool/spamassassin/auto\-whitelist \& \& 0 entries removed. \& 0 entries would be expired. \& 0 timestamps would be added. \& 0 timestamps would be updated. \& \& 308 entries input. \& 308 entries output = input \- expired \- removed. .Ve .PP With option \fB\-\-verbose\fR it generates output: .PP .Vb 1 \& AVG TOTSCORE COUNT EMAIL IPBASE .Ve .PP \&\fI\s-1AVG\s0\fR is the average score; \fI\s-1TOTSCORE\s0\fR is the total score of all mails seen so far; \fI\s-1COUNT\s0\fR is the number of messages seen from that sender; \fI\s-1EMAIL\s0\fR is the sender's email address, and \fI\s-1IPBASE\s0\fR is the \&\fB\s-1AWL\s0 base \s-1IP\s0 address\fR. .PP \&\fI\s-1AWL\s0 base \s-1IP\s0 address\fR is a way to identify the sender's \s-1IP\s0 address they frequently send from, in an approximate way, but remaining hard for spammers to spoof. The algorithm is as follows: .PP .Vb 2 \& \- Take the last Received header that contains a public IP address; \& namely one which is not in private, unrouted IP space. \& \& \- Chop off the last two octets, assuming that the user may be in \& an ISP\*(Aqs dynamic address pool. .Ve .PP Negative values indicate senders of ham: .PP .Vb 5 \& average total count \& 6.8 6.8 1 support@midphase.com 72.26 \& \-8.1 \-16.2 2 users\-return\-@spamassassin.apache.org 98.109 \& 1.4 15.9 11 partners@us.cyberoam.com 38.105 \& 13.9 13.9 1 obdg@borgard.com 89.185 .Ve .SH "OPTIONS" .IX Header "OPTIONS" .IP "\fB\-D, \-\-DONTupdatetimestamps\fR" 4 .IX Item "-D, --DONTupdatetimestamps" No timestamps processing is done. Alias for \fB\-\-noTimestamps\fR. .IP "\fB\-e, \-\-expireOlderThan \s-1NUMBER\s0\fR" 4 .IX Item "-e, --expireOlderThan NUMBER" Expire entries older than \s-1NUMBER\s0 of days. .IP "\fB\-f, \-\-firstTimes\fR" 4 .IX Item "-f, --firstTimes" Use this for the first run to avoid reading timestamps. .IP "\fB\-h, \-\-help\fR" 4 .IX Item "-h, --help" Display short help. .IP "\fB\-n, \-\-noTimestamps\fR" 4 .IX Item "-n, --noTimestamps" No timestamps processing. .IP "\fB\-p, \-\-prune \s-1NUMBER\s0\fR" 4 .IX Item "-p, --prune NUMBER" Clean out infrequently-used \s-1AWL\s0 entries. The \fI\s-1NUMBER\s0\fR can be used to select the threshold at which entries are kept or deleted. Value 1 means that entries seen once are deleted. .IP "\fB\-q, \-\-quiet\fR" 4 .IX Item "-q, --quiet" Be quiet. .IP "\fB\-r, \-\-remove \s-1EMAIL\s0\fR" 4 .IX Item "-r, --remove EMAIL" Remove \s-1EMAIL\s0 from database. .IP "\fB\-s, \-\-showUpdates\fR" 4 .IX Item "-s, --showUpdates" Output entries updated or added or removed, in addition to the summary. .IP "\fB\-v, \-\-verbose\fR" 4 .IX Item "-v, --verbose" Display more information. Note that this may display lot of information from the database. .SH "EXAMPLES" .IX Header "EXAMPLES" To see valid senders: .PP .Vb 1 \& sa\-heatu \-\-verbose \-D | sort \-n | head \-n 20 .Ve .PP To see top spammers: .PP .Vb 1 \& sa\-heatu \-\-verbose \-D | sort \-n | tail \-n 20 .Ve .PP To display single record: .PP .Vb 1 \& sa\-heatu \-\-verbose \-n | grep \-i foo@example.com .Ve .PP To remove of \fIfoo@example.com\fR entry: .PP .Vb 1 \& $ sa\-heatu \-n \-\-remove foo@example.com \& \& Using $HOME/.spamassassin/auto\-whitelist \& \& average total count found \& 34.5 34.5 1 foo@example.com 41.202 \& \& 1 deleted. \& 259 keys with 1 entry. \& 658 keys with 2 entries. \& 1675 entries. .Ve .PP To shrink the database considerably by removing entries that only have one hit: .PP .Vb 1 \& sa\-heatu \-\-prune .Ve .PP Average total count email address ip network address last time updated: Note: the date and time stamp is the time sa-heatu was run, not the time the email was received: .PP .Vb 1 \& sa\-heatu \-\-verbose \-D | sort \-n | head \-5 .Ve .SH "ENVIRONMENT" .IX Header "ENVIRONMENT" None. .SH "FILES" .IX Header "FILES" .ie n .IP "$HOME/.spamassassin" 4 .el .IP "\f(CW$HOME\fR/.spamassassin" 4 .IX Item "$HOME/.spamassassin" The default working directory of program where \fIdbfile\fR etc. are expected. .Sp If \fIdbfile\fR is not given the \f(CW\*(C`$HOME/.spamassassin/auto\-whitelist\*(C'\fR is used. See also option \fBauto_whitelist_path\fR in Spamassasin Perl module \&\fIMail::SpamAssassin::Plugin::AWL\fR which typically points to \&\f(CW\*(C`/var/spool/spamassassin/auto\-whitelist\*(C'\fR. .SH "SEE ALSO" .IX Header "SEE ALSO" \&\fBspamassassin\fR\|(1) \&\fBMail::SpamAssassin::Plugin::AWL\fR\|(3p) .SH "STANDARDS" .IX Header "STANDARDS" http://wiki.apache.org/spamassassin/AutoWhitelist .SH "AVAILABILITY" .IX Header "AVAILABILITY" See \s-1STANDARDS\s0 for download link. .PP The original version this program is based on is at http://svn.apache.org/repos/asf/spamassassin/branches/3.2/tools/check_whitelist .SH "AUTHORS" .IX Header "AUTHORS" Program was written by Dennis G German .PP This manual page was written by Jari Aalto . Released under license \s-1GNU GPL\s0 version 2 or (at your option) any later version. For more information about license, visit .