On 4/19/2013 at 12:06 AM, John Hardin <jhar...@impsec.org> wrote:
BAYES_50 is the bayes classifier's way of saying "insufficient data" or "I
don't know".
Do you really want to assign 3 points for "I don't know"?
On 19.04.13 06:09, Joe Acquisto-j4 wrote:
In this case, from the samples I've seen. Absolutely, yes.
as I said, the problem is that your BAYES database does not have enough of
spam/ham samples. You have to feed it, not to increase score for BAYES_50.
With your logic you can give high score to any other rule that hits, e.g.
HTML_MESSAGE.
For me, this last few days, I have seen lots of missed spam that has
virtually nothing else to trigger on.
do you have network checks enabled? Plugins allowed? packages installed?
blacklist, uribl?
razor, pyzor, DCC, they all need plugins and installed clients.
Do you have your trusted_networks and internal_networks properly set?
Been so irritated by this I considered giving it a 5.0. But, even for me,
that's over the top.
If you receive many spam with BAYES_50, there's something wrong with your
BAYES database, even disabling could behave better (but training would do
much better.
What output does the command "sa-learn --dump magic" produce?
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
(R)etry, (A)bort, (C)ancer
