Steven W. Orr wrote: > On Monday, Dec 4th 2006 at 23:34 -0500, quoth Theo Van Dinter: > > >On Mon, Dec 04, 2006 at 10:12:26PM -0500, Steven W. Orr wrote: > > > I have some spam getting through that has USER_IN_WHITELIST. I go and > > > look and sher nuff, the From address is there in the email column of > > > the awl table. I don't know how it got there but it's there. Can > > > someone please 'splain to me how this works? > > > > USER_IN_WHITELIST has nothing to do with the AWL. You'll want to find > > your whitelist_from/whitelist_from_rcvd entry that matches the mail. > > I promise that the addresses that got through do not have any such entries > in any cf file. But I guess the problem I have is this: > > I reject all mail that hits a 5 via a milter before reception completes. > It would seem to me that the ones that get through would be acting as a > type of poison for the awl table. When a spam message comes through, > should I not do something to tell the awl table that the address it saved > is bad the same way that I run sa-learn to fix th4e bayes tables?
The AWL is simply a score averager. It doesn't know or care if a message is spam. It simply keeps track of the average score of each sender. If a new message has a higher score than the previous average, AWL applies a negative score to the message. If a new message has a lower score than the previous average, AWL applies a positive score. The idea is that a particular sender will probably continue sending the same type of mail that he has in the past. So AWL attempts to mitigate any sudden score changes to help prevent false negatives or false positives. The AWL will actually work better if it sees all of your mail. You can read all the details in the wiki: http://wiki.apache.org/spamassassin/AutoWhitelist -- Bowie
