Your (mail)logs might come in handy for this, if you write out SpamAssassin's basic output there. With a basic Perl-script (you can do this in almost any other script-language of course) you can see most likely everything you need. Spam, ham and mail-scores, scan-times, tests that where hit (!), etc. With only a small bit of programming, you can calculate and see everything you need! You should check wat AWL and BAYES -tests are doing, especially if they hit on Spam.
When I upgraded, (2.64 > 3.02) I noticed only a small increase in scores for spam and decrease for ham from SpamAssassin. Not the big results I had hoped for, but I'll patiently wait for 3.1. Overall results are slightly better, and technically, there should be a lower possiblility of ham being marked as spam (due to SPF-checking, did you install that?). As to your setup. How up to date are those extra custom rules? Any reason why your are using 70_sare_html2.cf and 70_sare_html3.cf but not 70_sare_header0, cf70_sare_header1.cf, 70_sare_genlsubj0.cf, 70_sare_genlsubj1.cf, etc, etc...? There are more effective rules out there than just sare_html or just sare rules! I use most of the Sare-rules + some extra rules, and results are very good (though watch your memory and scantimes!). Have yet to see a false positive with a treshold of 9, and only 1-2% of all traffic scores between 5 and 9. Kind Regards, Sander Holthaus > -----Original Message----- > From: Johann Spies [mailto:[EMAIL PROTECTED] > Sent: Thursday, February 10, 2005 8:20 AM > To: [EMAIL PROTECTED] > Subject: Less spam blocked with 3.02 - AWL-related? > > I have upgraded spamassassin on three mail (2.63 -> 3.02 on two and > 2.64 -> 3.02 on the other) servers about two weeks ago. > > On the old system I have disabled AWL and Auto-learn because > they corrupted my bayesian database on at least one occasion. > > I have decided to try out AWL with 3.02. > > At first I did not use any extra rules but installed the > following after a week: > > 70_sare_bayes_poison_nxm.cf > 70_sare_html2.cf > 99_sare_fraud_post25x.cf > 70_sare_html0.cf > 70_sare_html3.cf > evilnumbers.cf > 70_sare_html1.cf > 70_sare_html_eng.cf > > I have experienced less false positives with the new one. > Complaints came down from about 6 per week to maybe 1 in the > last two weeks. > > But the feedback from users about spam received increased and > the following statistics shows that something is not working > as effectively as it was previously: > > Average spam blocked per minute for the last > > Day Week Month Year (Since April-June last year) > mail1 5.94 6.21 7.67 8.20 > mail2 5.04 5.95 6.48 6.69 > mail3 4.95 4.67* 6.23 6.85 > > * mail3 was down for a few hours during the week. > > The three servers started out with the same bayesian database > and are trained with the same spam/ham on a nearly daily basis. > > > I am suspecting AWL to be the culprit but I am not sure how > to determine it other than switching it of for a period. > > Any commentary? > > Regards > Johann > -- > Johann Spies Telefoon: 021-808 4036 > Informasietegnologie, Universiteit van Stellenbosch > > "I was glad when they said unto me, Let us go into the > house of the LORD." Psalms 122:1
