A weekend SpamAssassin success - and a Razor score question

[James Bucanek <su...@gloaming.com>]

Greetings,

My weekend spam assassination resumed yesterday, when I found a few hour to implement the suggestions from the list last month (well, some of them -- there were so many good suggestions).

I upgraded SA to 3.0.4.  That went as smooth as silk.

Installed Razor 2.75.  Very much unlike my previous attempt to install Razor 1.x, this also went very smoothly.  It took me about 2 hours to download the software, upgrade SA, install Razor, read the docs and configure everything to work together.

My spam detection rate has improved significantly.  So a hearty thanks to all the list members who answered my cries for help last month!

Now, my question. I have upped the scored for the RAZOR rules by adding a morerazor.cf file to my /etc/mail/spamassassin directory with something like

    score RAZOR2_CF_RANGE_51_100 0 (1.5) 0 (1.5)
    score RAZOR2_CHECK 0 (1.5) 0 (1.5)

This has gotten my spam detection rates above the 97% mark for the first time. I'd like to consider raising the RAZOR rule scores more, but I want to understand the difference between the scores before I do that.

It seems obvious that RAZOR2_CF_RANGE_XX_YY means that the razor server give this message between an X and Y probability of being spam.

But what does the RAZOR2_CHECK score mean? Poking around, I would guess that it means that Razor has determined the "confidence" value for the message is higher than the threshold I've configured in the Razor config files; but I can find no documentation that states that.

TIA,

James

-- 
James Bucanek <ma...@gloaming.com>

Re: A weekend SpamAssassin success - and a Razor score question

[Matt Kettler <mk...@evi-inc.com>]

James Bucanek wrote:
> Greetings,
> 
> My weekend spam assassination resumed yesterday, when I found a few hour to implement the suggestions from the list last month (well, some of them -- there were so many good suggestions).
> 
> I upgraded SA to 3.0.4.  That went as smooth as silk.
> 
> Installed Razor 2.75.  Very much unlike my previous attempt to install Razor 1.x, this also went very smoothly.  It took me about 2 hours to download the software, upgrade SA, install Razor, read the docs and configure everything to work together.
> 
> My spam detection rate has improved significantly.  So a hearty thanks to all the list members who answered my cries for help last month!
> 
> Now, my question. I have upped the scored for the RAZOR rules by adding a morerazor.cf file to my /etc/mail/spamassassin directory with something like
> 
>     score RAZOR2_CF_RANGE_51_100 0 (1.5) 0 (1.5)
>     score RAZOR2_CHECK 0 (1.5) 0 (1.5)
> 
> This has gotten my spam detection rates above the 97% mark for the first time. I'd like to consider raising the RAZOR rule scores more, but I want to understand the difference between the scores before I do that.
> 
> It seems obvious that RAZOR2_CF_RANGE_XX_YY means that the razor server give this message between an X and Y probability of being spam.

Unfortunately, that's not the case. It's the razor "confidence factor"
(abbreviated cf by the razor debug output), which is NOT a percentage-chance of
spam.

This score ranges from -100 to +100, with 0 being undecided, and +100 being the
strongest chance of spam. The entire scoring system is based on the TeS system,
which is undocumented, but revolves around ranking reporters as trusted or not.

I'd venture to say that razor has some considerable bias towards 100 on "fresh"
objects, as they get reported a handful of times by good reporters they appear
to immediately become 100 until revoked down.

This was extraordinarily true right around the introduction of e8, where the
small set of reporting data caused razor to jump wildly and nearly every message
matching e8 got a cf of 100. That should have stabilized by now.

While you can definitely say that razor believes a CF of 100 has a higher chance
of being spam than 99, you cannot directly translate these to probabilities, it
doesn't seem to be a very linear function.


> 
> But what does the RAZOR2_CHECK score mean? Poking around, I would guess that it means that Razor has determined the "confidence" value for the message is higher than the threshold I've configured in the Razor config files; but I can find no documentation that states that.

Yes, this means that cf was >= min_cf in your razor config.

Re: A weekend SpamAssassin success - and a Razor score question

[Theo Van Dinter <fe...@apache.org>]

On Mon, Jul 25, 2005 at 08:09:55AM -0700, James Bucanek wrote:
> But what does the RAZOR2_CHECK score mean? Poking around, I would guess that it means that Razor has determined the "confidence" value for the message is higher than the threshold I've configured in the Razor config files; but I can find no documentation that states that.

Yeah, that's pretty much it.  RAZOR2_CHECK returns to you the same yes/no
as razor_check.  The other ones ignore your cf setting and just look at
the raw cf from the message.

-- 
Randomly Generated Tagline:
"Somebody should iron you."
 
 	--Ralph Wiggum
 	  Wild Barts Can't Be Broken (Episode AABF07)