auto_learn with 3.1.0
How do I configure 3.1.0 to do autolearn? I had the following 3 lines in my local.cf file with my previous version: auto_learn1 auto_learn_threshold_spam7.5 auto_learn_threshold_nospam0.0 After I upgraded to 3.1.0, and then called my daily running of the rules_du_jour update script, I see that a spamassassin --lint command failed because of these three lines. So I disabled the three lines for now, as having current rules_du_jour rules makes a lot less spam than having auto_learn activated. Is there a way that I can turn autolearn on in 3.1.0? -- Jeff Ramsey MIS Administrator Tubafor Mill, Inc.
Bayes is letting too much spam through
When spam gets through to my inbox, it almost always would have been marked spam, and then I see BAYES_00. By my count, without the BAYES_00 flag, SA would have blocked the message. Should I turn BAYESIAN filters off, or am I doing something wrong? I cannot imagine why anyone would turn BAYESIAN filters on if this is the result, so I must be doing something wrong. -- Jeff Ramsey MIS Administrator Tubafor Mill, Inc. signature.asc Description: This is a digitally signed message part
Re: Bayes is letting too much spam through
Per the advice of Loren, I have started my bayes db over. And so far so good. SA is working like I wanted it to. I have another question about my learnspam script. Here is the script: START SCRIPT #!/bin/sh # learnspam v0.34 HAMBOX=~/evolution/local/HamLearn/mbox SPAMBOX=~/evolution/local/SpamLearn/mbox [EMAIL PROTECTED] TMPHDIR=~/tmp/ham TMPSDIR=~/tmp/spam VERBOSE=1 echo Synchronizing $HAMBOX and $SPAMBOX to $SERVER rsync --partial --progress -z -e ssh $HAMBOX $SERVER:$TMPHDIR rsync --partial --progress -z -e ssh $SPAMBOX $SERVER:$TMPSDIR ssh $SERVER echo ; echo 'Learning ham...' ; echo ; sa-learn --ham --showdots --mbox $TMPHDIR ; echo 'Unlearning bad ham...' ; echo ; sa-learn --ham --forget --showdots --mbox $TMPSDIR ; echo 'Learning spam...' ; echo ; sa-learn --spam --showdots --mbox $TMPSDIR ; echo 'Removing spam senders from AWL...' ; echo ; spamassassin -R --mbox $TMPSDIR - END SCRIPT -- I run this script via a cron event a couple of times per day, and I move ham to the ham mbox and spam to the spam mbox via Novell Evolution. Do I have the sa-learn --forget line correct? Do I need it there at all? I placed it there because I wanted to make sure that all the junkmail not getting marked spam was not only being learned as spam, but unlearned as ham, just in case it was auto-learned as ham. -- Jeff Ramsey MIS Administrator Tubafor Mill, Inc. signature.asc Description: This is a digitally signed message part
Re: Bayes is letting too much spam through
On Thu, 2004-12-23 at 04:17, Michael Parker wrote: On Wed, Dec 22, 2004 at 07:47:35PM +, Jeff Ramsey wrote: ssh $SERVER echo ; echo 'Learning ham...' ; echo ; sa-learn --ham --showdots --mbox $TMPHDIR ; Ok echo 'Unlearning bad ham...' ; echo ; sa-learn --ham --forget --showdots --mbox $TMPSDIR ; Ok, unless you consider the next line echo 'Learning spam...' ; echo ; sa-learn --spam --showdots --mbox $TMPSDIR ; Ok, but really if you are gonna do this then you don't need the --forget, bayes will do the right thing. I removed the unlearn line. I was not sure if bayes would do the right thing. echo 'Removing spam senders from AWL...' ; echo ; spamassassin -R --mbox $TMPSDIR You realize that AWL also serves as a blacklist right? I guess you could remove it all, but I wouldn't recommend it. Granted, it is possible that if you're talking about mail that passed as ham, then the address might have a positive AWL score that you don't really want. If anything here, I would call --add-addr-to-blacklist to give them 100 points in AWL. The only problem that I see with doing the '--add-addr-to-blacklist' is that it would 'blacklist' my email address as well. spamassassin -R --mbox reads the addresses in the header as well as any that are in the body. Is there a way that I can add the senders to blacklist, and not myself in the process? -- Jeff Ramsey MIS Administrator Tubafor Mill, Inc. signature.asc Description: This is a digitally signed message part
Re: Undo what autolearn has done
On Sun, 2004-12-12 at 16:49, Michael Parker wrote: Using autolearn doesn't necessarily auto whitelist messages or from addresses. It only causes the message to be learned as ham or spam. Over time a from addresses average score might be affected by this. That said, if you still have the messages in question, you can just run sa-learn --forget on them and they will be removed from the bayes database. If you truely wish to start over you can do so with sa-learn --clear. This will remove all traces of the existing database. Michael I have only been running SA 3X for a fw short weeks, I'll just use the clear flag. Will this also clear the auto whitelist entries as well? How can I be sure that nobody gets auto whitelisted again? Auto whitelist is not something that I care to implement here. -- Jeff Ramsey MIS Administrator Tubafor Mill, Inc.
Re: Undo what autolearn has done
On Mon, 2004-12-13 at 09:23, Michael Parker wrote: No, Bayes and AWL are unrelated. If you truely do not want to use AWL, then you can just turn it off. perldoc Mail::SpamAssassin::Conf to find out how to do that. Michael I'd actually like to use AWL, however I am getting some spam that is not being tagged, and when I check out the headers, it has a negative number because of the AWL rule. IS there anyway that I can alter the AWL list, ie. sa-learn --forget on the messages that have the AWL rule flagged? -- Jeff Ramsey MIS Administrator Tubafor Mill, Inc.
Undo what autolearn has done
When I first setup version 3.0.X, I turned on auto-learn. It let way too many messages through. I have turned it off, and I am now using a slightly modified version of the 'learnspam' script from the wiki. My problem is that during the auto-learn days some messages got auto whitelisted, and now I cannot seem to get rid of them. Is there a way that I can 'unlearn' these messages, or just start SA's learn process over? Thanks, -- Jeff Ramsey MIS Administrator Tubafor Mill, Inc.
Re: duplicate messages
On Thu, 2004-11-11 at 15:36, Dan Nelson wrote: If you see two, then it's sendmail or the milter's fault. If you see one, then it could be a local delivery or procmail rule issue. I am only seeing one line like this for each message. (disregard that last 'empty' reply. I hit ctrl +enter instead of enter. - sorry) So does this mean that it is a local delivery issue? Why did it stop happening when I stopped using SA and SA-milter for an hour? Thanks, Jeff
Re: duplicate messages
On Thu, 2004-11-11 at 18:22, Dan Nelson wrote: If there's just one delivery line, it points the finger at something happening after sendmail finishes with the message. Do you have any procmail rules that might be duplicating messages? Maybe something that would match text within the X-Spam-* headers? No. Should be a default install of Fedora Core 2. Perhaps there is a problem with Dovecot iMap/Pop3 server and SA headers? Jeff
duplicate messages
Hi all, I am using SA 3.0.1, spamass-milter 0.2.0, and Sendmail 8.12.11. Seems to work fine. I am using it with the sql tables and everything. There is one problem. I am getting a duplicate for about 2/3 of the mail that is processed by the server. Here are the flags set for each app: Spamassassin: SPAMDOPTIONS=-u spamassassin -D -d -m10 -x -q Spamass-milter: SOCKET=/var/run/spamassassin/spamass.sock EXTRA_FLAGS=-f -d3 -b junkmail Sendmail: sendmail.mc compilied with: INPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/spamassassin/spamass.sock, F=, T=C:15m;S:4m;R:4m;E:10m')dnl I thought I had this working, and then I started to notice the duplicates. Maybe there is something I have changed? Maybe it's just a configuration issue. I have stopped the SA and milter apps, and recompiled my cf file to not use the milter to make certain that this is what is causing the issue. Jeff Ramsey MIS Administrator Tubafor Mill, Inc.
Re: duplicate messages
On Thu, 2004-11-11 at 14:59, Jeff Ramsey wrote: Hi all, I am using SA 3.0.1, spamass-milter 0.2.0, and Sendmail 8.12.11. Seems to work fine. I am using it with the sql tables and everything. There is one problem. I am getting a duplicate for about 2/3 of the mail that is processed by the server. Here are the flags set for each app: Spamassassin: SPAMDOPTIONS=-u spamassassin -D -d -m10 -x -q Spamass-milter: SOCKET=/var/run/spamassassin/spamass.sock EXTRA_FLAGS=-f -d3 -b junkmail Sendmail: sendmail.mc compilied with: INPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/spamassassin/spamass.sock, F=, T=C:15m;S:4m;R:4m;E:10m')dnl I thought I had this working, and then I started to notice the duplicates. Maybe there is something I have changed? Maybe it's just a configuration issue. I have stopped the SA and milter apps, and recompiled my cf file to not use the milter to make certain that this is what is causing the issue. Is there a timeout period for message parsing for either sendmail, SA, or SA-milter? I think this may be due to me having my SQL lookups take a bit too long. I'm testing this theory out now... Jeff
Re: duplicate messages
On Thu, 2004-11-11 at 15:36, Dan Nelson wrote: In the last episode (Nov 11), Jeff Ramsey said: On Thu, 2004-11-11 at 15:26, Dan Nelson wrote: In the last episode (Nov 11), Jeff Ramsey said: I am using SA 3.0.1, spamass-milter 0.2.0, and Sendmail 8.12.11. Seems to work fine. I am using it with the sql tables and everything. There is one problem. I am getting a duplicate for about 2/3 of the mail that is processed by the server. Exact dupes? Same Received: headers and timestamps? The only thing that should be able to cause duplicates is the -B flag, and only on spam. They are exact. Same timestamp, same headers, and message id. And not all of them are being marked as spam. I turned off the SA and SA-milter functions for an hour, and I did not have any duplicates. It has to be something with SA or SA-milter... Do you see two sendmail delivery lines in your maillog for the messages? Ones like this: Nov 11 17:31:53 2.6 dan sm-mta[27804]: iABNVriE027802: to=dan@dan.emsphone.com, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=32492, dsn=2.0.0, stat=Sent If you see two, then it's sendmail or the milter's fault. If you see one, then it could be a local delivery or procmail rule issue.
3.0 upgrade - SQL quirk
I upgraded to 3.0.1 today, and now my sql custom rules table works perfectly when there is a rule listed for the user receiving email, and SA does not test messages at all if there is no database entry for that user. For example, if I send email to [EMAIL PROTECTED], it does the SQL lookup, finds 28 rows for that username (ramsejc) and applies them. If I send a message to [EMAIL PROTECTED], which is an alias to my ramsejc account, not only does SA not apply the rules for ramsejc, (I know why this is), it does not even parse the message, or at least it does not add the header lines for doing so.
YUM repository for 3.0 RPMs?
Does anyone know of a YUM repository with RPMS for version 3?
Re: ver 3.0 opinions
Thanks for the help and info. I'll tell my friend why his 3.0 install is letting more spam through and he has autolearn turned on, so his should get better. As for me, I'll upgrade to at least version 2.64. I use lots of the custom rules - antidrug.cf, etc. If I upgrade SA to 3.0, can I still use my SQL custom rules score table to alter the scoring for the rules, which I think would give me the best of both worlds? Thanks, Jeff Ramsey Tubafor Mill, Inc.
