Do this stats from our server give you (or anyone else) any clue about
whats
causing
spam to get through?
http://65.170.183.59:16080/amavis-stats/
This can only be a guess without more data. However it is obvious your mail
volume is up greatly in the past two months, and the spam detection rate is
also down.
Now your previous volume indicates that something like 80% of the mail is
ham. I don't know if that is true, or if SA has been missing 50% of the
spam all along. In any case SA is now only catching about 50% of what it
was before, and probably a bunch of that increased mail volume is also spam.
Assuming no other system changes, this tells me that the makeup of the spam
has changed and your SA hasn't kept up with those changes.
The two major changes in spam recently have been a huge increase in stock
spams, and a huge increase in image spams, most of which are also stock
spams. The stock SA rules aren't real good at catching either of these.
Some addon rulesets from www.rulesemproium.com will catch a good many of the
stock (and other) spams quite well. There is a new OCR plugin for SA,
FuzzyOCR, that is still somewhat experimental, but the few dozen people
using it are really happy with the results for the most part. It is a
little bit of work to install because it requires a number of pieces to
work. The rulesemporium rules are easy to install.
You might also have some other problems with your configuration and trust
paths that could really be hurting SA's detection rate. We can't tell that
without seeing some actual hit information from a few mails that made it
through.
Loren
