I dont use any ham training.Should I scan all my folders with this command:
sa-learn --ham --mbox /home/username/mail/foldername
"is the bayes-db of this user *realy* used at scan time"
how do i check that?
I use the procemail to pass all mail through spam assassin.
I use default ubuntu setup with Razors enabled.
It does catches spam but not the one i attached in original post.
example mail sa headers:
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
ip-10-254-37-89.us-west-2.compute.internal
X-Spam-Level: ***
X-Spam-Status: No, score=3.1 required=5.0 tests=BAYES_00,HTML_MESSAGE,
RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,SPF_HELO_PASS,
SPF_PASS,URIBL_BLOCKED,URIBL_DBL_SPAM autolearn=no autolearn_force=no
version=3.4.0
ubuntu@ip-10-254-37-89:~$ cat /etc/spamassassin/local.cf
# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
# Only a small subset of options are listed below
#
###########################################################################
# Add *****SPAM***** to the Subject header of spam e-mails
#
# rewrite_header Subject *****SPAM*****
# Save spam messages as a message/rfc822 MIME attachment instead of
# modifying the original message (0: off, 2: use text/plain instead)
#
# report_safe 1
# Set which networks or hosts are considered 'trusted' by your mail
# server (i.e. not spammers)
#
# trusted_networks 212.17.35.
# Set file-locking method (flock is not safe over NFS, but is faster)
#
# lock_method flock
# Set the threshold at which a message is considered spam (default: 5.0)
#
# required_score 5.0
# Use Bayesian classifier (default: 1)
#
# use_bayes 1
# Bayesian classifier auto-learning (default: 1)
#
# bayes_auto_learn 1
# Set headers which may provide inappropriate cues to the Bayesian
# classifier
#
# bayes_ignore_header X-Bogosity
# bayes_ignore_header X-Spam-Flag
# bayes_ignore_header X-Spam-Status
# Some shortcircuiting, if the plugin is enabled
#
ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
#
# default: strongly-whitelisted mails are *really* whitelisted now, if the
# shortcircuiting plugin is active, causing early exit to save CPU load.
# Uncomment to turn this on
#
# shortcircuit USER_IN_WHITELIST on
# shortcircuit USER_IN_DEF_WHITELIST on
# shortcircuit USER_IN_ALL_SPAM_TO on
# shortcircuit SUBJECT_IN_WHITELIST on
# the opposite; blacklisted mails can also save CPU
#
# shortcircuit USER_IN_BLACKLIST on
# shortcircuit USER_IN_BLACKLIST_TO on
# shortcircuit SUBJECT_IN_BLACKLIST on
# if you have taken the time to correctly specify your "trusted_networks",
# this is another good way to save CPU
#
# shortcircuit ALL_TRUSTED on
# and a well-trained bayes DB can save running rules, too
#
# shortcircuit BAYES_99 spam
# shortcircuit BAYES_00 ham
endif # Mail::SpamAssassin::Plugin::Shortcircuit
# Vipul's Razor options.
use_razor2 1
#razor_timeout 10
razor_config /etc/razor/razor-agent.conf
loadplugin Mail::SpamAssassin::Plugin::Razor2
required_hits 5
report_safe 0
rewrite_header Subject [SPAM]
procmail setup:
:0fw: spamassassin.lock
* < 256000
| spamassassin
# Mails with a score of 15 or higher are almost certainly spam (with 0.05%
# false positives according to rules/STATISTICS.txt). Let's put them in a
# different mbox. (This one is optional.)
:0:
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
/var/spool/mail/junk
# All mail tagged as spam (eg. with a score higher than the set threshold)
# is moved to "probably-spam".
:0:
* ^X-Spam-Status: Yes
/var/spool/mail/junk
>
>
> Am 27.10.2015 um 18:50 schrieb j...@lexoncom.com:
>> I use spam assassin with razors on ubuntu server.
>> In recent months i started to get tons of spam.
>> Spam assassin does not catch it and scores are very low.
>>
>> Are those emails fabricated so well that they look like legitimate? Can
>> i
>> do something to catch those as spam?
>>
>> I moved them all to one folder called spam and i run this command every
>> 5
>> minutes on that folder:
>> sa-learn --spam --mbox /home/username/mail/INBOX.spam
>> but it does not help
>
> do you have enough *ham* trained?
> is the bayes-db of this user *realy* used at scan time
> what are the SA-headers of mails passing through?
>
> sorry but you need to provide basic informations
>
>
