I think you might be on to something here. When I run "sa-learn --dump magic"
as root and as amavis they are definitely different. Here is the result as "root" again: # sa-learn --dump magic 0.000 0 3 0 non-token data: bayes db version 0.000 0 7026 0 non-token data: nspam 0.000 0 1196 0 non-token data: nham 0.000 0 149494 0 non-token data: ntokens 0.000 0 1449680159 0 non-token data: oldest atime 0.000 0 1451321886 0 non-token data: newest atime 0.000 0 1451322014 0 non-token data: last journal sync atime 0.000 0 1450885282 0 non-token data: last expiry atime 0.000 0 820848 0 non-token data: last expire atime delta 0.000 0 99486 0 non-token data: last expire reduction count and as amavis $ sa-learn --dump magic 0.000 0 3 0 non-token data: bayes db version 0.000 0 4404 0 non-token data: nspam 0.000 0 36752 0 non-token data: nham 0.000 0 174328 0 non-token data: ntokens 0.000 0 1450679028 0 non-token data: oldest atime 0.000 0 1451342303 0 non-token data: newest atime 0.000 0 1451341892 0 non-token data: last journal sync atime 0.000 0 1451327190 0 non-token data: last expiry atime 0.000 0 0 0 non-token data: last expire atime delta 0.000 0 0 0 non-token data: last expire reduction count so this is going to complicate how I educate SpamAsssassin about what spam and ham are. The script that I use to pull the messages out of a spam bucket invoking sa-learn runs as root which has permissions to read from anywhere. The complication is the amavis does not have permissions to read the Maildir files for trivial users like root does. That said, I have some thoughts as how to solve that. -- Peter L. Berghold <pe...@berghold.net> Blogs:http://3d-art.berghold.net , http://puppet-blog.beghold.net ,http://nix.berghold.net Passionate Gourmet Cook, Brewer of Beer, DogbEnthusiast and IT Professional