Steven W. Orr wrote: > I have some spam getting through that has USER_IN_WHITELIST. I go and > look and sher nuff, the From address is there in the email column of > the awl table. USER_IN_WHITELIST has NOTHING to do with the AWL.
This is strictly a whitelist_from, whitelist_from_rcvd or whitelist_from_spf thing. Be sure to check *all* header that SA considers to be From: equivalents, including Return-Path. > I don't know how it got there but it's there. Can someone please > 'splain to me how this works? > > * My understanding is that a positive value in the awl table in the > totscore column is a blacklist entry. A negative value is a > whitelist entry. Am I correct? No. That's the total score. The AWL is a score-averager, not a black or whitelist. AWL score = (totalscore/count)-(current message score before AWL) * (awl factor, default 0.5). > * What is the purpose of the count column. Is it used as a parameter > in the calculation with the totscore value? Yes. See above > * Is there a command line interface to change something from a > whitelist value to a blacklist value? no, because it's not a black or whitelist. In theory --add-addr-to-whitelist and --add-addr-to-blacklist can be used to bias these numbers, but last time I tried it didn't work properly for existing entries. > * If an address is added to the table for a user, can I make that > address be made somehow 'global' so that it weighs against email to > any user? Not unless you use a global AWL. > * Is all mail that comes in, both ham and spam, using From addresses > to add to the awl table? Yes. > * (Last question). All spam that comes in is run through > sa-learn --spam > Is there something else I should do to better manage the awl? sa-learn --spam has no affect on the AWL. That affects the BAYES system.
