Re: Uncatched spam and rules weith modification..

2005-05-12 Thread Frederic Goudal

Robert Menschel [EMAIL PROTECTED]
 Cc: SPAMassassin Users users@spamassassin.apache.org
 Date: Wed, 11 May 2005 19:07:50 PDT
 Subject: Re: Uncatched spam and rules weith modification..

Hello Frederic,

FG X-spam-status: No, hits=5.312 tagged_above=-999 required=6.31 
tests=BAYES_99,
FG  RCVD_HELO_IP_MISMATCH, RCVD_NUMERIC_HELO
that does score high enough to be classified as spam, but you or your
administrator have raised the required score from 5.0 to 6.31.

It is what is put in Amavisd config.  I will maybe lower it a bit.



If your Bayes database is reliable and stable, bump the score for
BAYES_99.  

In fact I forgot to uprgrade to SA 3.0.3 which bumbs bayes a lot.
But from my own mail it seems that bayes_99 never hits a false positive.


Or look into adopting some of SARE's rules files, at
http://www.rulesemporium.com (or other custom files available via the
wiki).

I have most of sare rules, but I have not seen a set for stock ads..

THanks for the advice

f.g.




Uncatched spam and rules weith modification..

2005-05-11 Thread Frederic Goudal


Hello,

For the last weeks I have received a lot of spam concerning stock alerts and 
different investissments.
Their bayes score is 99, but they don't score enough to be classified as spam. 
I use rules_du_jour and the standard spamassassin set
with SURBL...
This spam does not trigger a lot of rules typicaly I have that kind of result :

X-spam-status: No, hits=5.312 tagged_above=-999 required=6.31 tests=BAYES_99,
 RCVD_HELO_IP_MISMATCH, RCVD_NUMERIC_HELO

X-spam-status: No, hits=4.171 tagged_above=-999 required=6.31 tests=BAYES_99,
 MIME_BASE64_TEXT, RCVD_IN_SORBS_DUL

X-spam-status: No, hits=3.873 tagged_above=-999 required=6.31 tests=BAYES_99,
 RCVD_IN_SORBS_DUL



I'm using a global bayes_db which seems to work quite well  : my users are not
complaining about too much spam or too much false positive (btw my own email
address recieve much more spam than other people as it has been public for 15
years now).

What I wonder is what to do ?

Increasing the bayes_99 score ?
Decreasing the 6.31 spam level ?
Try to create new rules ?

FiLH