Could you scan your logs for me?
Hi, can I ask a small favor from some of you running SA with Bayes enabled:
Please run the following perl-oneliner on your SA-log (mine is current):
perl -ne 'if (/result:/) {$n++; $b++ if (/BAYES/);} } print $b/$n,\n; {'
current
(I promise it's not a rootkit :-)
I get:
0.710109622411693
I suspect you really ought to see 1, always. What do you get?
Thanks, Ole.
Re: Could you scan your logs for me?
1
{^_^}On 10 weeks of mail logs 1. (You have something sincerely broken.)
- Original Message -
From: Ole Nomann Thomsen [EMAIL PROTECTED]
Hi, can I ask a small favor from some of you running SA with Bayes enabled:
Please run the following perl-oneliner on your SA-log (mine is current):
perl -ne 'if (/result:/) {$n++; $b++ if (/BAYES/);} } print $b/$n,\n; {'
current
(I promise it's not a rootkit :-)
I get:
0.710109622411693
I suspect you really ought to see 1, always. What do you get?
Thanks, Ole.
Re: Could you scan your logs for me?
0.998502994011976
Op 3-feb-06, om 10:27 heeft Ole Nomann Thomsen het volgende geschreven:
Hi, can I ask a small favor from some of you running SA with Bayes
enabled:
Please run the following perl-oneliner on your SA-log (mine is
current):
perl -ne 'if (/result:/) {$n++; $b++ if (/BAYES/);} } print $b/
$n,\n; {'
current
(I promise it's not a rootkit :-)
I get:
0.710109622411693
I suspect you really ought to see 1, always. What do you get?
Thanks, Ole.
Re: Could you scan your logs for me?
* Ole Nomann Thomsen wrote (03/02/06 09:27):
Hi, can I ask a small favor from some of you running SA with Bayes enabled:
Please run the following perl-oneliner on your SA-log (mine is current):
perl -ne 'if (/result:/) {$n++; $b++ if (/BAYES/);} } print $b/$n,\n; {'
current
(I promise it's not a rootkit :-)
I get:
0.710109622411693
I suspect you really ought to see 1, always. What do you get?
0.960777058279371
In my case, the difference is attributable to this in local.cf:
bayes_ignore_to users@spamassassin.apache.org
whitelist_to users@spamassassin.apache.org
Chris
Re: Could you scan your logs for me?
Ole Nomann Thomsen wrote:
Hi, can I ask a small favor from some of you running SA with Bayes enabled:
Please run the following perl-oneliner on your SA-log (mine is current):
perl -ne 'if (/result:/) {$n++; $b++ if (/BAYES/);} } print $b/$n,\n; {'
current
(I promise it's not a rootkit :-)
I get:
0.710109622411693
I suspect you really ought to see 1, always. What do you get?
Thanks, Ole.
1
--
Steve
Re: Could you scan your logs for me?
Ole Nomann Thomsen wrote:
Hi, can I ask a small favor from some of you running SA with Bayes enabled:
Please run the following perl-oneliner on your SA-log (mine is current):
perl -ne 'if (/result:/) {$n++; $b++ if (/BAYES/);} } print $b/$n,\n; {'
current
(I promise it's not a rootkit :-)
Modified to support mailscanner:
perl -ne 'if (/spam, SpamAssassin/) {$n++; $b++ if (/BAYES/);} }
print $b/$n,\n; {' /var/log/maillog
Note: this will match both spam and nonspam log lines for MailScanner, and I do
have logging of non-spam turned on in my MailScanner setup.
I get:
0.965083118870418
As others have pointed out, I too use bayes_ignore_to/from on this list, as well
as the MailScanner list.
I have 503 non-bayes matching emails in my logs. Of those 503, all but 14 can be
attributed to my bayes_ignores.. The remaining 14 are SpamAssassin timeouts.
Such as this:
Feb 1 22:40:08 xanadu MailScanner[14477]: Message k123U5En007816 from *MUNGED*
(*MUNGED*) to evitechnology.com is not spam, SpamAssassin (timed out)
(FWIW: I have a 10 minute SA timeout, and I have bayes_auto_expire disabled in
local.cf. However, timeouts usually appear to be that SA did an auto-expire
anyway.. *grumble*)
Re: Could you scan your logs for me?
1
-Ruben
El vie, 03-02-2006 a las 10:27 +0100, Ole Nomann Thomsen escribi:
Hi, can I ask a small favor from some of you running SA with Bayes enabled:
Please run the following perl-oneliner on your SA-log (mine is current):
perl -ne 'if (/result:/) {$n++; $b++ if (/BAYES/);} } print $b/$n,\n; {'
current
(I promise it's not a rootkit :-)
I get:
0.710109622411693
I suspect you really ought to see 1, always. What do you get?
Thanks, Ole.
Re: Could you scan your logs for me?
Ruben Cardenal wrote: 1 here too. 1. - Nick.
Re: Could you scan your logs for me?
Thanks Matt, Ed, Ruben, Nicklas, Patrick, jdow, Chis et.al. for all the replies, you can stop sending them now, unless you get far below one. At least I now know for sure that I'm stumped :-) For the record: I have no bayes_ignore anywhere, and I don't believe I have missed something in my setups. Look at the following test-sequence, and note that the same testspam sometimes hits BAYES_99 and sometimes hits no bayes. Prompt is timestamp in GMT+1, so as you can see, there are no timeouts. There is no config bayes_be_stocastic is there? ;-P 14:48:28)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES X-Spam-Score: tests=ADDRESS_IN_SUBJECT=0.533,BAYES_99=3.5,BIZ_TLD=2.013, 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% (14:48:32)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES X-Spam-Score: tests=ADDRESS_IN_SUBJECT=0.533,BAYES_99=3.5,BIZ_TLD=2.013, 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% (14:48:36)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES X-Spam-Score: tests=ADDRESS_IN_SUBJECT=0.533,BAYES_99=3.5,BIZ_TLD=2.013, 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% (14:48:40)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES X-Spam-Score: tests=ADDRESS_IN_SUBJECT=0.533,BAYES_99=3.5,BIZ_TLD=2.013, 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% (14:48:43)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES (14:48:47)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES X-Spam-Score: tests=ADDRESS_IN_SUBJECT=0.533,BAYES_99=3.5,BIZ_TLD=2.013, 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% (14:48:50)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES X-Spam-Score: tests=ADDRESS_IN_SUBJECT=0.533,BAYES_99=3.5,BIZ_TLD=2.013, 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% (14:48:54)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES X-Spam-Score: tests=ADDRESS_IN_SUBJECT=0.533,BAYES_99=3.5,BIZ_TLD=2.013, 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% (14:48:57)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES X-Spam-Score: tests=ADDRESS_IN_SUBJECT=0.533,BAYES_99=3.5,BIZ_TLD=2.013, 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% (14:49:01)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES X-Spam-Score: tests=ADDRESS_IN_SUBJECT=0.533,BAYES_99=3.5,BIZ_TLD=2.013, 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% (14:49:05)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES (14:49:09)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES X-Spam-Score: tests=ADDRESS_IN_SUBJECT=0.533,BAYES_99=3.5,BIZ_TLD=2.013, 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% (14:49:13)$ spamc -d host -p 7830 spam-1740.txt | grep BAYES (14:49:18)$
RE: Could you scan your logs for me?
Ole Nomann Thomsen wrote:
Hi, can I ask a small favor from some of you running SA with Bayes
enabled: Please run the following perl-oneliner on your SA-log (mine
is current):
perl -ne 'if (/result:/) {$n++; $b++ if (/BAYES/);} } print
$b/$n,\n; {' current
(I promise it's not a rootkit :-)
I get:
0.710109622411693
I suspect you really ought to see 1, always. What do you get?
It should be 1 as long as all of your users have a working bayes
database. When I ran it, I got 0.58. Further investigation revealed
that my sa-learn routine was learning to the wrong database locations
(oops). Per-user configuration can be tricky with virtual users...
I guess it pays to look at these things from time to time! :)
--
Bowie
Re: Could you scan your logs for me?
Someone else was recently saying (or maybe its even in Bugzilla) that they see Bayes hit sometimes and not others when they think it should. This might be the first indication though that it is hitting randomly on the *same message*. Sounds like it would be worth trying to figure out why. Loren
Re: Could you scan your logs for me?
From: Ole Nomann Thomsen [EMAIL PROTECTED]
Thanks Matt, Ed, Ruben, Nicklas, Patrick, jdow, Chis et.al. for all the
replies, you can stop sending them now, unless you get far below one. At
least I now know for sure that I'm stumped :-)
For the record: I have no bayes_ignore anywhere, and I don't believe I have
missed something in my setups. Look at the following test-sequence, and
note that the same testspam sometimes hits BAYES_99 and sometimes hits no
bayes. Prompt is timestamp in GMT+1, so as you can see, there are no
timeouts. There is no config bayes_be_stocastic is there? ;-P
Do you have a rawbody or full rule with per user rules enabled?
That might do it. But it's usual symptom is tests performed and scored
in the logs but no markup on the message is generated.
{^_^}
