Re: why: auto-learn? no: scored as spam but autolearn wanted ham

[Benny Pedersen]

On November 5, 2015 3:54:25 PM Matthias Apitz  wrote:


...
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on c720-r276659
X-Spam-Flag: YES
X-Spam-Level: **
X-Spam-Status: Yes, score=1000.0 required=3.0 tests=GTUBE,NO_RECEIVED,
NO_RELAYS autolearn=no autolearn_force=no version=3.4.0
X-Spam-Report: ++
* 1000 GTUBE BODY: Generic Test for Unsolicited Bulk Email
* -0.0 NO_RELAYS Informational: message was not relayed via SMTP
* -0.0 NO_RECEIVED Informational: message has no Received
* headers
...

Why auto-learn wants the mail as HAM?


where did you see this ?, GTUBE disables autolearn

Re: why: auto-learn? no: scored as spam but autolearn wanted ham

[Matthias Apitz]

El día Thursday, November 05, 2015 a las 04:24:04PM +0100, John Wilcock 
escribió:

> Le 05/11/2015 15:54, Matthias Apitz a écrit :
> > X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on c720-r276659
> > X-Spam-Flag: YES
> > X-Spam-Level: **
> > X-Spam-Status: Yes, score=1000.0 required=3.0 tests=GTUBE,NO_RECEIVED,
> >  NO_RELAYS autolearn=no autolearn_force=no version=3.4.0
> > X-Spam-Report: ++
> >  * 1000 GTUBE BODY: Generic Test for Unsolicited Bulk Email
> >  * -0.0 NO_RELAYS Informational: message was not relayed via SMTP
> >  * -0.0 NO_RECEIVED Informational: message has no Received
> >  * headers
> > ...
> >
> > Why auto-learn wants the mail as HAM?
> 
> Because autolearning ignores rules with the noautolearn, userconf or 
> learn tflags set (and uses the scores from scoreset 0 or 1).
> 
> ...

Thanks for all explanations. I now have a better understanding of the
autolearning process. Please, can someone forward me off-list (gzip'ed with
complete header lines) a SPAM which resulted in autolearn=spam.

Thanks in advance.

matthias
-- 
Matthias Apitz, ✉ g...@unixarea.de,  http://www.unixarea.de/  ☎ 
+49-176-38902045

Re: why: auto-learn? no: scored as spam but autolearn wanted ham

[Reindl Harald]

* 1000 GTUBE BODY: Generic Test for Unsolicited Bulk Email
https://en.wikipedia.org/wiki/GTUBE

Am 05.11.2015 um 15:54 schrieb Matthias Apitz:

This is with version 3.4.0 on FreeBSD 11-CURRENT. If I run with the
sample file:

$ spamassassin -tD < Mail-SpamAssassin-3.4.0/sample-spam.txt

it says on STDERR:
...
nov  5 15:47:54.521 [3855] dbg: learn: auto-learn: currently using scoreset 1
nov  5 15:47:54.521 [3855] dbg: learn: auto-learn: message score: 999.998, 
computed score for autolearn: 0
nov  5 15:47:54.521 [3855] dbg: learn: auto-learn? ham=0.1, spam=12, 
body-points=0, head-points=0, learned-points=0
nov  5 15:47:54.521 [3855] dbg: learn: auto-learn? no: scored as spam but 
autolearn wanted ham
nov  5 15:47:54.521 [3855] dbg: check: is spam? score=999.998 required=3
...

and returns the mail with this header:

...
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on c720-r276659
X-Spam-Flag: YES
X-Spam-Level: **
X-Spam-Status: Yes, score=1000.0 required=3.0 tests=GTUBE,NO_RECEIVED,
 NO_RELAYS autolearn=no autolearn_force=no version=3.4.0
X-Spam-Report: ++
 * 1000 GTUBE BODY: Generic Test for Unsolicited Bulk Email
 * -0.0 NO_RELAYS Informational: message was not relayed via SMTP
 * -0.0 NO_RECEIVED Informational: message has no Received
 * headers
...

Why auto-learn wants the mail as HAM?




signature.asc
Description: OpenPGP digital signature

Re: why: auto-learn? no: scored as spam but autolearn wanted ham

[Matthias Apitz]

El día Thursday, November 05, 2015 a las 03:57:01PM +0100, Reindl Harald 
escribió:

> * 1000 GTUBE BODY: Generic Test for Unsolicited Bulk Email
> https://en.wikipedia.org/wiki/GTUBE

Maybe because you are top posting you have not read my question, at
lease you have not answered it.

> nov  5 15:47:54.521 [3855] dbg: learn: auto-learn? no: scored as spam but 
> autolearn wanted ham
> nov  5 15:47:54.521 [3855] dbg: check: is spam? score=999.998 required=3  
>  

> > X-Spam-Status: Yes, score=1000.0 required=3.0 tests=GTUBE,NO_RECEIVED,
> >  NO_RELAYS autolearn=no autolearn_force=no version=3.4.0
> > X-Spam-Report: ++
> >  * 1000 GTUBE BODY: Generic Test for Unsolicited Bulk Email
> >  * -0.0 NO_RELAYS Informational: message was not relayed via SMTP
> >  * -0.0 NO_RECEIVED Informational: message has no Received
> >  * headers
> > ...
> >
> > Why auto-learn wants the mail as HAM?

Again, why it wants to declare the SPAM message as autolearn=ham?

matthias
-- 
Matthias Apitz, ✉ g...@unixarea.de,  http://www.unixarea.de/  ☎ 
+49-176-38902045

Re: why: auto-learn? no: scored as spam but autolearn wanted ham

[Kris Deugau]

Matthias Apitz wrote:
> This is with version 3.4.0 on FreeBSD 11-CURRENT. If I run with the
> sample file:
> 
> $ spamassassin -tD < Mail-SpamAssassin-3.4.0/sample-spam.txt

> Why auto-learn wants the mail as HAM?

> it says on STDERR:
> ...
> nov  5 15:47:54.521 [3855] dbg: learn: auto-learn: currently using scoreset 1
> nov  5 15:47:54.521 [3855] dbg: learn: auto-learn: message score: 999.998, 
> computed score for autolearn: 0

This line reports the score used to decide which direction to autolearn.
 There are a number of conditions that mean the "normal" score on the
message is not the one used to decide on autolearn.

> nov  5 15:47:54.521 [3855] dbg: learn: auto-learn? ham=0.1, spam=12, 
> body-points=0, head-points=0, learned-points=0

This line reports the current thresholds for autolearn.

0 < 0.1, so if the message is to be autolearned, it should be learned as
ham.

> nov  5 15:47:54.521 [3855] dbg: learn: auto-learn? no: scored as spam but 
> autolearn wanted ham

This line reports that the live score (note, not the score used to
decide how to autolearn) scored as spam, so the message will not be
autolearned at all.

See the man page for Mail::SpamAssassin::Plugin::AutoLearnThreshold for
the full set of details.

-kgd

Re: why: auto-learn? no: scored as spam but autolearn wanted ham

[John Wilcock]

Le 05/11/2015 15:54, Matthias Apitz a écrit :

X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on c720-r276659
X-Spam-Flag: YES
X-Spam-Level: **
X-Spam-Status: Yes, score=1000.0 required=3.0 tests=GTUBE,NO_RECEIVED,
 NO_RELAYS autolearn=no autolearn_force=no version=3.4.0
X-Spam-Report: ++
 * 1000 GTUBE BODY: Generic Test for Unsolicited Bulk Email
 * -0.0 NO_RELAYS Informational: message was not relayed via SMTP
 * -0.0 NO_RECEIVED Informational: message has no Received
 * headers
...

Why auto-learn wants the mail as HAM?


Because autolearning ignores rules with the noautolearn, userconf or 
learn tflags set (and uses the scores from scoreset 0 or 1).


Without GTUBE, this message would have had a score below the default 
autolearn ham threshold of 0.1 and would thus have been learnt as ham. 
For safety, however, SA checks the autolearn score against the actual 
classification before it goes ahead with the learning process.


--
John