After upgrade the SA to 3.3.1, Mail scanning stop working partially
After upgrade the SpamAssassin Server version to 3.3.1, my mail scanning stop working partially. Below is the test.cf file for checking whether SA working as per the given score. [r...@spd SPECS]# cd /etc/mail/spamassassin/ [r...@spd spamassassin]# cat test.cf body LOCAL_DEMONSTRATION_RULE /test123/ score LOCAL_DEMONSTRATION_RULE 5 describe LOCAL_DEMONSTRATION_RULE This is a simple test rule Below is the setting for local.cf rewrite_header Subject SPAM report_safe 1 required_score 5.0 use_bayes 1 bayes_auto_learn 1 endif # Mail::SpamAssassin::Plugin::Shortcircuit Let me explain in details. When I set the required score to 5.0, mail scanning is not working properly. When I send the mail with "test123" with required score 5, SA not consider it spam but when I set the required score to 4, SA consider it spam the same mail. I have check the same with many other test. It seems that SA take the score 4 to consider the mail as a SPAM and rewrite the subject with *SPAM*** Below is the log @40004c71e02720670564 tcpserver: status: 1/100 @40004c71e02720b8462c tcpserver: pid 4698 from 192.168.10.70 @40004c71e02720cb1a7c tcpserver: ok 4698 spd:192.168.30.195:25 :192.168.10.70::61253 @40004c71e027385ebf7c CHKUSER accepted sender: from remote rcpt <> : sender accepted @40004c71e02739b381dc CHKUSER accepted rcpt: from remote rcpt : found existing recipient @40004c71e02739b94a54 policy_check: local s...@test.com -> local d...@test.com (AUTHENTICATED SENDER) @40004c71e02739bf3dc4 policy_check: policy allows transmission @40004c71e02d1471a28c simscan:[4698]:CLEAN (-1.00/12.00):5.3640s:test123:192.168.10.70:s...@test.com:d...@test.com @40004c71e02f35bee364 tcpserver: end 4698 status 0 @40004c71e02f35bf0e5c tcpserver: status: 0/100
Re: Whitelist question
On 8/21/2010 1:27 AM, Henrik K wrote: On Sat, Aug 21, 2010 at 08:16:58AM +0300, Henrik K wrote: You need to use _envelope_ sender (e.g. Return-Path), not From. Never mind, I was confusing it with spf and read the docs.. For clarity: assuming your MTA inserts a Return-Path: header, or adds a clause to the Received header about the envelope sender, whitelist_from_rcvd will match against it, in addition to the From: header, and several other "from-like" headers. (however Resent-From should take priority if present..)
RE: A lot of Recent Spam is Uncaught by SpamAssassin
> > Since they score 0.8, they wouldn't be learnt as ham with the default > > bayes_auto_learn_threshold_nonspam value. So, probably at least this > > setting had been overridden somewhere in your SA conf... > > Probably not. 0.8 is the score for BAYES_50, which isn't counted in the > autolearning score. That leaves a score of 0.0 which is below the > default threshold of 0.1 Ah, right: I forgot Bayes score is not counted for autolearning purposes. Sorry Shlomi about that.
Re: A lot of Recent Spam is Uncaught by SpamAssassin
On Sun, 22 Aug 2010 11:55:43 +0200 "Giampaolo Tomassoni" wrote: > > I cannot find any special setting for autolearn (either > > bayes_auto_learn_threshold_nonspam or > > bayes_auto_learn_threshold_spam ) in either > > /etc/mail/spamassassin/local.cf or > > ~/.spamassassin/user_prefs . It probably means they are the default > > which is > > 0.1 and 12.0 respectively which seems reasonable enough. > > In your set, these are the scores of your ham-learnt messages: > > 1282213227.7828.1nhON:2,S0.8 > 1282213227.7828.AHPct:2,S0.8 > 1282213227.7828.CQy9k:2,S0.8 > 1282213227.7828.VLBN5:2,S -2.0 > 1282213227.7828.zvzWO:2,S0.8 > > Since they score 0.8, they wouldn't be learnt as ham with the default > bayes_auto_learn_threshold_nonspam value. So, probably at least this > setting had been overridden somewhere in your SA conf... Probably not. 0.8 is the score for BAYES_50, which isn't counted in the autolearning score. That leaves a score of 0.0 which is below the default threshold of 0.1
Re: A lot of Recent Spam is Uncaught by SpamAssassin
On Sun, Aug 22, 2010 at 11:40:43AM +0300, Shlomi Fish wrote: >I cannot find any special setting for autolearn (either >bayes_auto_learn_threshold_nonspam or >bayes_auto_learn_threshold_spam ) in either /etc/mail/spamassassin/local.cf or >~/.spamassassin/user_prefs . It probably means they are the default which is >0.1 and 12.0 respectively which seems reasonable enough. I've seen quite a few spams scoring zero (or even negative, rarely though) points on my personal server, so I decided to lower autolearn threshold for ham to -0.5 points. -- Jacek Politowski
RE: A lot of Recent Spam is Uncaught by SpamAssassin
> I cannot find any special setting for autolearn (either > bayes_auto_learn_threshold_nonspam or > bayes_auto_learn_threshold_spam ) in either > /etc/mail/spamassassin/local.cf or > ~/.spamassassin/user_prefs . It probably means they are the default > which is > 0.1 and 12.0 respectively which seems reasonable enough. In your set, these are the scores of your ham-learnt messages: 1282213227.7828.1nhON:2,S0.8 1282213227.7828.AHPct:2,S0.8 1282213227.7828.CQy9k:2,S0.8 1282213227.7828.VLBN5:2,S -2.0 1282213227.7828.zvzWO:2,S0.8 Since they score 0.8, they wouldn't be learnt as ham with the default bayes_auto_learn_threshold_nonspam value. So, probably at least this setting had been overridden somewhere in your SA conf... Also, since most of the above messages hit BAYES_50, I would say you have network tests disabled in your setup. If this is the case, I would suggest to either: 1) enable and appropriately configure network test, because they may help SA to better classify your messages; 2) revise the default auto-learn threshold. Most of the SA user base nowadays uses network test, which means that the default auto-learn thresholds may reflect the wider spam-to-ham score spread this case yields. Also note 1282213227.7828.VLBN5:2,S : is it really spam? Revise you ham corpora: isn't there any spam? > I'll try to retrain the Bayesian filter. > > Regards, > > Shlomi Fish > > -- > - > Shlomi Fish http://www.shlomifish.org/ > Understand what Open Source is - http://shlom.in/oss-fs > > God considered inflicting XSLT as the tenth plague of Egypt, but then > decided against it because he thought it would be too evil. > > Please reply to list if it's a mailing list post - > http://shlom.in/reply .
Re: A lot of Recent Spam is Uncaught by SpamAssassin
On Saturday 21 August 2010 14:43:33 Giampaolo Tomassoni wrote: > > Hi all, > > > > Recently I've noticed that a lot of spam that I am getting is not > > caught by > > SpamAssassin, despite the fact that it is very similar to other spam I > > got and > > that I marked as spam using the Bayesian training. I've placed a sample > > of > > some of the recent messagess I got here: > > > > http://www.shlomifish.org/sa-uncaught-spam/ > > > > A lot of it is "I want to have a relationship with you, please contact > > me so I > > can send you my picture, etc.". > > > > I've also noticed that the latest version of SpamAssassin, 3.3.1, was > > released > > on 20-March-2010, which is quite a long time ago: > > > > http://freshmeat.net/projects/spamassassin/ > > > > Is there a new release planned soon? > > I don't believe a new SA release would be of any help. > > Most of the message in your set hit BAYES_99 on my system. > > The X-Spam-Status of some of the messages in your set, reports that you > enabled the autolearning facility, and that it has Learnt the message as > ham. This may be the why you have so low Bayes hits. > > I would suggest to revise the Bayes autolearn thresholds in you SA setup. > I cannot find any special setting for autolearn (either bayes_auto_learn_threshold_nonspam or bayes_auto_learn_threshold_spam ) in either /etc/mail/spamassassin/local.cf or ~/.spamassassin/user_prefs . It probably means they are the default which is 0.1 and 12.0 respectively which seems reasonable enough. I'll try to retrain the Bayesian filter. Regards, Shlomi Fish -- - Shlomi Fish http://www.shlomifish.org/ Understand what Open Source is - http://shlom.in/oss-fs God considered inflicting XSLT as the tenth plague of Egypt, but then decided against it because he thought it would be too evil. Please reply to list if it's a mailing list post - http://shlom.in/reply .
Re: A lot of Recent Spam is Uncaught by SpamAssassin
On Saturday 21 August 2010 18:39:41 John Hardin wrote: > On Sat, 21 Aug 2010, Giampaolo Tomassoni wrote: > > The X-Spam-Status of some of the messages in your set, reports that you > > enabled the autolearning facility, and that it has Learnt the message as > > ham. This may be the why you have so low Bayes hits. > > > > I would suggest to revise the Bayes autolearn thresholds in you SA setup. > OK, I will. > ...and, as your bayes database is now polluted, wipe the database and > retrain properly from scratch. > OK, thanks. > You _did_ retain your manual training corpora, right? :) Yes, I did. :-). Regards, Shlomi Fish -- - Shlomi Fish http://www.shlomifish.org/ What does "Zionism" mean? - http://shlom.in/def-zionism God considered inflicting XSLT as the tenth plague of Egypt, but then decided against it because he thought it would be too evil. Please reply to list if it's a mailing list post - http://shlom.in/reply .
