On Fri, 2009-07-31 at 10:36 -0500, Dennis B. Hopp wrote: > I couldn't get sa-stats to give me any useful information.
AFAIK it understands spamd logs, not Amavis logs. You would need to adjust the script for that -- as discussed just a few days ago. > If I'm reading that correctly less then 50% of mail is actually > being filtered (seems like it should be higher then that). Those stats Actually, the numbers you gave for the "last couple days" are even lower. About one third, <15k out of 45k do have a BAYES_xx hit and thus are scanned by SA. I told you how to train your Bayes, if you're not satisfied with the result. Whether you like it not, there really isn't an other way. FWIW, blocking the obvious offenders early seems like a proper explanation for Bayes not showing a lot of high hitters. Anyway, considering the back and forth -- IMHO, you *first* should get a clear picture how exactly your mail is being processed. I don't feel like stabbing in the dark. > Maybe I'm worried about nothing but given some of the spam that I get > forwarded that gets through (some very obvious spam) and then to see > what rules it hits just makes me think that something isn't quite right. Forwarded -- as in reports by your users, or forwarded from external MXs to yours? In the latter case, the obvious thing to check is your internal and trusted network settings. -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}