> One crucial thing you didn't post: you ran the learning as root. Is the > user that spamd is running as also root? The bayes database is > user-specific, and a common problem is to train the database as a > different user than the MTA+spamd is running under.
Owner and Group of the folder .spamassassin and the files in it are both amavis. I hope this is the right user. But I made a big mistake: I recently changed the server and all the learned spams were on the old server. This is why there was so few spam only (801). So now I took the old files of learned spam and ham into the new server and now I have more (6225): root@example:~# sa-learn --dbpath /var/lib/amavis/.spamassassin/bayes --dump magic 0.000 0 3 0 non-token data: bayes db version 0.000 0 6225 0 non-token data: nspam 0.000 0 52634 0 non-token data: nham 0.000 0 1884302 0 non-token data: ntokens 0.000 0 1279163247 0 non-token data: oldest atime 0.000 0 1338890042 0 non-token data: newest atime 0.000 0 1338889064 0 non-token data: last journal sync atime 0.000 0 1284701742 0 non-token data: last expiry atime 0.000 0 5529600 0 non-token data: last expire atime delta 0.000 0 2438 0 non-token data: last expire reduction count So maybe this was the real problem.
