SA efficency degrades quickly

["Mailing List Account - Nereal.Com" <ma...@nereal.com>]

Hi!
 I have a little problem with spam recognition. I have re-learned
SpamAssassin (deleting old file from ".spamassassin" directory, to clear
old information) and it worked really nice... but after few days, the
efficency of SpamAssassin degrades from >90% of spam correctly
identified to a 60%... I tried to learn it again with new, not
recognized spam (and with all new ham, to respect a 1:1 - about - ratio
of spam:ham) but without any result.

Can you help me?

Thank you,
        Claudio!

Re: problem with SURBL checks

[Jeff Chan <je...@surbl.org>]

It would be useful if you could run spamassassin -D --lint as
Kevin suggested.

See also:

  http://www.surbl.org/faq.html#nettest
  http://www.surbl.org/faq.html#test-uris

etc.

Jeff C.
-- 
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/

problem with SURBL checks

[Irina <ir...@nas.net>]

Hello at SA list,

I enabled SURBL in SA 3.0.2 from init.pre.  Then checked on people's
mailboxes for this string
    SURBL (I even checked for RBL string)

But I don't see if any of RBL scores were assigned for 10 minutes.  Do you
know what and how I can test.  I tried to use the test from
http://www.stearns.org/sa-blacklist/

==============================
MAIL FROM: martha@sendmails.com
250 martha@sendmails.com sender accepted
RCPT TO: irina@nas.net
250 irina@nas.net will relay mail from a client address
DATA
354 Enter mail, end with "." on a line by itself
From: martha@sendmails.com
Subject: Test mail for blacklist

This is a test message
<a href="http://www.sendmails.com">www.sendmails.com</a>
.
250 1110389 message accepted for delivery
quit
==============================

After I checked on the score in the arrived message, I did not see any RBL
in it.

Then checked by sending a message from mail.ru with
http://surbl-org-permanent-test-point.com in it.  It had a score of 0.

After I enabled SURBL checks I also noticed I did not have NET::DNS, I only
then installed it.

I saw the suggestions from David B Funk about running SA with -D.  We don't
run spamd, we run cgpsa.  Not sure how to debug with it.


Can somebody point out where I can check/test?  I may be missing another
step or a perl module.


Thank you for your help in advance.

Irina

Re: SA efficency degrades quickly

[Robert Menschel <Ro...@Menschel.net>]

Hello Mailing,

Tuesday, June 21, 2005, 10:48:44 AM, you wrote:

MLANC> Hi!
MLANC>  I have a little problem with spam recognition. I have re-learned
MLANC> SpamAssassin (deleting old file from ".spamassassin" directory, to clear
MLANC> old information) and it worked really nice... but after few days, the
MLANC> efficency of SpamAssassin degrades from >90% of spam correctly
MLANC> identified to a 60%... I tried to learn it again with new, not
MLANC> recognized spam (and with all new ham, to respect a 1:1 - about - ratio
MLANC> of spam:ham) but without any result.

My experience is the opposite -- after wiping a Bayes database SA is
initially 70%-80% accurate, and then rises steadily to 95% and better
(better = with SARE rules).

I'm guessing you may have auto-learn enabled with the default limits,
and spam that sneaks by with 0.0 or 0.1 scores are learned as
non-spam, polluting your database.

If you have reliable negative-scoring ham rules (which generally are
domain- or user-specific, then set your auto-learn ham threshold to
some negative score (-0.2 or -0.5 or something like that).  If you
have no reliable negative-scoring ham rules, then turn off auto-learn
and ONLY use sa-learn manually as you describe above.

That may take care of your problem.

Alternately, are you using SARE rules?  Start with the most reliable
SARE rules files, expand slowly, and they'll probably help you avoid
Bayes degredation.

Bob Menschel

Re: SA efficency degrades quickly

[Loren Wilton <lw...@earthlink.net>]

> but after few days, the
> efficency of SpamAssassin degrades from >90% of spam correctly
> identified to a 60%... I tried to learn it again with new, not

You must have something really wrong here.  SA does degrade with time, but
it is over months, not days, and it is only around 10% degredation.

You don't say what kind of learning you are doing, Bayes or Awl.  I will
assume it is probably Bayes, but maybe you are doing both.

You also don't show an example spam that didn't get marked, so we don't know
what rules it hit.  So all we can really do is make guesses rather than
telling you what the real problem is.

I'm hesitant to guess at what the problem is, so you should probably show an
excerpt of a spam that failed to be marked, including the rules that hit on
it.

        Loren