Re: Large volume of 0.0 scores suddenly
Sorry, yeah - all BAYES rules were gone after --clear. When I trained it with another fresh 1000 spam and ham it started again with BAYES_00. I will need to go through the spam and ham again On 11 September 2015 at 23:26, RW <rwmailli...@googlemail.com> wrote: > On Fri, 11 Sep 2015 22:25:46 +0100 > Peter Kelly wrote: > > > > I can actually see the 0.0 scores directly in the logs > > > I tested one and it was out, but only by 0.04. I thought it was > probably due to your cron job running a bit too early for this morning's > update. > > > > It must be the bayes is completely messed up. I actually did a > > sa-learn --clear and ran a fresh 1000 spam and ham (verified) through > > again, still seeing BAYES_00 an unusually high number of times. > > Are you sure you ran that on the right database? With an empty > database you should see log entries without any BAYES_* rules. > > > I will look into my own DNS nameserver for the RELAY and TRUSTED > > problem. > > ALL_TRUSTED doesn't have anything to do with DNS, it's determined from > the received headers. spamassassin -D is useful for debugging it. >
Re: Large volume of 0.0 scores suddenly
Bill, I checked there first, I always assume it is something I am doing wrong first. Yes mailchecker (not that obsolete version) is the http service we use and it in turn uses this Golang lib for spamc - https://github.com/saintienn/go-spamc I can actually see the 0.0 scores directly in the logs at /var/log/mail.log on the spamassassin servers. E.g. Sep 11 21:07:19 ip-10-181-62-231 spamd[13929]: spamd: clean message (0.0/5.0) for (unknown):65534 in 0.4 seconds, 8128 bytes. Sep 11 21:07:19 ip-10-181-62-231 spamd[13929]: spamd: result: . 0 - BAYES_00,FREEMAIL_FROM,HTML_IMAGE_ONLY_32,HTML_MESSAGE,HTML_TAG_BALANCE_BODY,NO_RELAYS,SPF_NEUTRAL,T_DKIM_INVALID,URIBL_BLOCKED It must be the bayes is completely messed up. I actually did a sa-learn --clear and ran a fresh 1000 spam and ham (verified) through again, still seeing BAYES_00 an unusually high number of times. I will look into my own DNS nameserver for the RELAY and TRUSTED problem. On 11 September 2015 at 21:58, Bill Cole < sausers-20150...@billmail.scconsult.com> wrote: > On 11 Sep 2015, at 6:12, Peter Kelly wrote: > > Hi, >> >> Starting on 3rd Sept, I have seen a huge number of 0.0 scores being >> returned from spamassassin - see attached screenshot from my logs that >> show >> I never once received a 0.0 score before 3rd Sept. >> > > The default scores for the rules shown do not add up to 0.00 in the 2 > examples I did the arithmetic manually for. > > This indicates that whatever is generating those records (I'm guessing it > is a version of this: https://github.com/peterkellyonline/mailchecker ?) > is doing something wrong, I'd guess in parsing the spamc output. >
Re: Fwd: Large volume of 0.0 scores suddenly
Why Antony? What would that do for me other than save hits against URIBL? I am signing up for their paid service so I will not have the URIBL_BLOCKED issue anymore. It does not explain the 0.0 issue I am having anyway. On 11 September 2015 at 13:42, Antony Stone < antony.st...@spamassassin.open.source.it> wrote: > > On 09/11/2015 01:17 PM, Peter Kelly wrote: > > > > - Are you using a local, non forwarding, DNS resolver/caching server ? > > > > > > No > > > > - Are you handling mail for a company, personal email, ISP, one domain, > > > many domains, etc? > > > > > > Handling mail for thousands of different companies - we run a SaaS > > > Helpdesk system like Zendesk. We see a huge range of emails and > > > domains. > > Without a local DNS server I'm amazed you haven't had problems before now. > > > Antony. > > -- > I want to build a machine that will be proud of me. > > - Danny Hillis, creator of The Connection Machine > >Please reply to the > list; > please *don't* CC > me. >
Re: Fwd: Large volume of 0.0 scores suddenly
Axb, We have a SaaS app hosted in AWS that takes in 500k emails a month. We parse these emails and convert them into tickets for the customer - they see a Helpdesk system like Zendesk. Every incoming email gets run through spamassassin via the daemon. Here is a link to the output of --lint -D http://pastebin.com/8eM88hX2 On 11 September 2015 at 13:08, Axb <axb.li...@gmail.com> wrote: > On 09/11/2015 01:17 PM, Peter Kelly wrote: > >> - How are you using SA? >> (pls specify: amavis, MIMEDefang, a milter, Mailscanner, procmail, >> Fuglu, etc, etc) >> >> Just spamassassin on its own, calling the daemon from an app >> > > an "app"? Pls be more explicit. > > can you pastebin the output of > > spamassassin --lint -D > > > - Are you using a local, non forwarding, DNS resolver/caching server ? >> >> No >> > > you should, to avoid URIBL_BLOCKED > (http://uribl.com/refused.shtml) > > > >
Re: Fwd: Large volume of 0.0 scores suddenly
Hi Benny, This has nothing to do with URIBL. It has always been blocked for me. I am in the process of paying for their service. It has always been like that, yet the 0.0 scores only started last week. Been running for months before that. Peter On 11 September 2015 at 13:38, Benny Pedersen <m...@junc.eu> wrote: > Peter Kelly skrev den 2015-09-11 12:12: > > Any help greatly appreciated, >> > > google URIBL_BLOCKED > > https://www.google.dk/search?q=uribl_blcoked > > http://uribl.com/refused.shtml > > plenty of other links to see how and why > > do you miss a local dns resolver ? > > if yes you use shared problems and things like your questions come up > randomly when more people dont read about it, its free to do nothing :=) >
