You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Thomas Wetmore <sp...@wetmore.ca> on 2004/09/29 23:21:18 UTC

AWL: How to view entries and/or remove a wrong entry?

Hi

 

AWL sometimes learns a spam incorrectly as ham. Then when another spam comes
in from the same place, it is AWL'd as ham. How can I remove an entry in the
AWL or change its value? Even if I sa-learn --spam the mail, it still is
AWL'd as ham. (I didn't see anything in the FAQ)

 

 

 

Thanks,

Thomas

RE: AWL: How to view entries and/or remove a wrong entry?

Posted by Matt Kettler <mk...@evi-inc.com>.
At 05:38 PM 9/29/2004, Thomas Wetmore wrote:
>A message was scored with bayes only and it gave it 0.1. So it was
>auto-learned as ham. Then I did an sa-learn --spam on it. I re-ran
>spamassassin on it to see the value. Bayes gave it a 5.1 score (I changed it
>from the default value, I believe) and when AWL came in, it put it somewhere
>in the middle (2.x or 3.x). So I ran it through a bunch of times and
>eventually it averaged out to > 5. So when bayes missed it, it cause the
>ripple effect, whereas if bayes had known it was highly spam, it would have
>given a higher score and AWL wouldn't have classified it as ham.

That's a legitimate problem where you might want to manually tweak the AWL 
using the command line. I'd really just use the remove feature on it in 
that case and let it rebuild a new average from scratch.

I merely worded caution strongly because there's a lot of admins that get 
scared when they see the AWL score -5.0, and the final email score is 21.3. 
That kind of thing is quite normal, and healthy, and just means that SA 
thought the email should have scored 16.3 (which is still spam) and split 
the difference between 16.3 and 26.3.

RE: AWL: How to view entries and/or remove a wrong entry?

Posted by Thomas Wetmore <sp...@wetmore.ca>.
Here is an example of one:

A message was scored with bayes only and it gave it 0.1. So it was
auto-learned as ham. Then I did an sa-learn --spam on it. I re-ran
spamassassin on it to see the value. Bayes gave it a 5.1 score (I changed it
from the default value, I believe) and when AWL came in, it put it somewhere
in the middle (2.x or 3.x). So I ran it through a bunch of times and
eventually it averaged out to > 5. So when bayes missed it, it cause the
ripple effect, whereas if bayes had known it was highly spam, it would have
given a higher score and AWL wouldn't have classified it as ham.


Thomas


-----Original Message-----
From: Matt Kettler [mailto:mkettler@evi-inc.com] 
Sent: Wednesday, September 29, 2004 6:28 PM
To: Thomas Wetmore; users@spamassassin.apache.org
Subject: Re: AWL: How to view entries and/or remove a wrong entry?

At 05:21 PM 9/29/2004, Thomas Wetmore wrote:
>Hi
>
>AWL sometimes learns a spam incorrectly as ham. Then when another spam 
>comes in from the same place, it is AWL'd as ham. How can I remove an 
>entry in the AWL or change its value? Even if I sa-learn --spam the mail, 
>it still is AWL'd as ham. (I didn't see anything in the FAQ)

1) first make sure you understand how the AWL works.. Just because the AWL 
subtracts points, doesn't mean it thinks it's ham.

         http://wiki.apache.org/spamassassin/AwlWrongWay

2) if you MUST change a value, and you fully understand what was said 
above, you can use the following commands parameters to spamassassin (see 
man spamassassin for more details)


  -W, --add-to-whitelist            Add addresses in mail to whitelist (AWL)
  --add-to-blacklist                Add addresses in mail to blacklist (AWL)
  -R, --remove-from-whitelist       Remove all addresses found in mail
                                    from whitelist (AWL)
  --add-addr-to-whitelist=addr      Add addr to whitelist (AWL)
  --add-addr-to-blacklist=addr      Add addr to blacklist (AWL)
  --remove-addr-from-whitelist=addr Remove addr from whitelist (AWL)


WARNING: make sure you understand what the AWL really is before manually 
adjusting it. The AWL is NOT a white/blacklist system, it merely has a 
similar effect due to it's score averaging behaviors.

Re: AWL: How to view entries and/or remove a wrong entry?

Posted by Matt Kettler <mk...@evi-inc.com>.
At 05:21 PM 9/29/2004, Thomas Wetmore wrote:
>Hi
>
>AWL sometimes learns a spam incorrectly as ham. Then when another spam 
>comes in from the same place, it is AWL'd as ham. How can I remove an 
>entry in the AWL or change its value? Even if I sa-learn –-spam the mail, 
>it still is AWL’d as ham. (I didn't see anything in the FAQ)

1) first make sure you understand how the AWL works.. Just because the AWL 
subtracts points, doesn't mean it thinks it's ham.

         http://wiki.apache.org/spamassassin/AwlWrongWay

2) if you MUST change a value, and you fully understand what was said 
above, you can use the following commands parameters to spamassassin (see 
man spamassassin for more details)


  -W, --add-to-whitelist            Add addresses in mail to whitelist (AWL)
  --add-to-blacklist                Add addresses in mail to blacklist (AWL)
  -R, --remove-from-whitelist       Remove all addresses found in mail
                                    from whitelist (AWL)
  --add-addr-to-whitelist=addr      Add addr to whitelist (AWL)
  --add-addr-to-blacklist=addr      Add addr to blacklist (AWL)
  --remove-addr-from-whitelist=addr Remove addr from whitelist (AWL)


WARNING: make sure you understand what the AWL really is before manually 
adjusting it. The AWL is NOT a white/blacklist system, it merely has a 
similar effect due to it's score averaging behaviors.