You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Sam <li...@ingescom.com> on 2009/10/27 13:33:14 UTC
sa-learn spam and Bayes_50
Hi,
I run spamassassin quite fine on a debian-lenny system.
But I'm having a problem with sa-learn --spam and 1 message :
http://www.pastebin.org/48668
lenny:/home/samuel# sa-learn --dump magic
0.000 0 3 0 non-token data: bayes db version
0.000 0 112507 0 non-token data: nspam
0.000 0 844 0 non-token data: nham
0.000 0 1934989 0 non-token data: ntokens
0.000 0 1047578051 0 non-token data: oldest atime
0.000 0 1256645591 0 non-token data: newest atime
0.000 0 1256642650 0 non-token data: last journal
sync atime
0.000 0 0 0 non-token data: last expiry atime
0.000 0 0 0 non-token data: last expire
atime delta
0.000 0 0 0 non-token data: last expire
reduction count
sa-learn --forget
/home/samuel/Maildir/.Spam_Ingescom/cur/1256632851.M372194P2272V0000000000001602I0006E328_0.lenny\,S\=9970\:2\,S
Forgot tokens from 1 message(s) (1 message(s) examined)
lenny:/home/samuel# sa-learn --spam
/home/samuel/Maildir/.Spam_Ingescom/cur/1256632851.M372194P2272V0000000000001602I0006E328_0.lenny\,S\=9970\:2\,S
Learned tokens from 1 message(s) (1 message(s) examined)
But Bayes still show BAYES_50 :
spamassassin -D <
/home/samuel/Maildir/.Spam_Ingescom/cur/1256632851.M372194P2272V0000000000001602I0006E328_0.lenny\,S\=9970\:2\,S
[9414] dbg: logger: adding facilities: all
[9414] dbg: logger: logging level is DBG
[9414] dbg: generic: SpamAssassin version 3.2.5
[9414] dbg: config: score set 0 chosen.
[9414] dbg: util: running in taint mode? yes
[9414] dbg: util: taint mode: deleting unsafe environment variables,
resetting PATH
[9414] dbg: util: PATH included '/usr/local/sbin', keeping
[9414] dbg: util: PATH included '/usr/local/bin', keeping
[9414] dbg: util: PATH included '/usr/sbin', keeping
[9414] dbg: util: PATH included '/usr/bin', keeping
[9414] dbg: util: PATH included '/sbin', keeping
[9414] dbg: util: PATH included '/bin', keeping
[9414] dbg: util: final PATH set to:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
[9414] dbg: dns: is Net::DNS::Resolver available? yes
[9414] dbg: dns: Net::DNS version: 0.63
[9414] dbg: config: using "/etc/spamassassin" for site rules pre files
[9414] dbg: config: read file /etc/spamassassin/init.pre
[9414] dbg: config: read file /etc/spamassassin/v310.pre
[9414] dbg: config: read file /etc/spamassassin/v312.pre
[9414] dbg: config: read file /etc/spamassassin/v320.pre
[9414] dbg: config: using "/var/lib/spamassassin/3.002005" for sys rules
pre files
[9414] dbg: config: using "/var/lib/spamassassin/3.002005" for default
rules dir
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org.cf
[9414] dbg: config: using "/etc/spamassassin" for site rules dir
[9414] dbg: config: read file /etc/spamassassin/65_debian.cf
[9414] dbg: config: read file /etc/spamassassin/iXhash.cf
[9414] dbg: config: read file /etc/spamassassin/local.cf
[9414] dbg: config: read file /etc/spamassassin/sql.cf
[9414] dbg: config: using "/root/.spamassassin" for user state dir
[9414] dbg: config: using "/root/.spamassassin/user_prefs" for user
prefs file
[9414] dbg: config: read file /root/.spamassassin/user_prefs
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::DCC from @INC
[9414] dbg: dcc: network tests on, registering DCC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor from @INC
[9414] dbg: pyzor: network tests on, attempting Pyzor
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::Razor2 from @INC
[9414] dbg: razor2: razor2 is available, version 2.84
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::SpamCop from @INC
[9414] dbg: reporter: network tests on, attempting SpamCop
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::AWL from @INC
[9414] dbg: plugin: loading
Mail::SpamAssassin::Plugin::AutoLearnThreshold from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::WhiteListSubject
from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEHeader from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::ReplaceTags from
@INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::Check from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::HTTPSMismatch
from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDetail from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::Bayes from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::BodyEval from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::DNSEval from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::HTMLEval from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::HeaderEval from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEEval from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::RelayEval from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIEval from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::WLBLEval from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::VBounce from @INC
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::ImageInfo from @INC
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/10_default_prefs.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/10_default_prefs.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/10_default_prefs.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_advance_fee.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_advance_fee.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_advance_fee.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_body_tests.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_body_tests.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_body_tests.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_compensate.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_compensate.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_compensate.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dnsbl_tests.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dnsbl_tests.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dnsbl_tests.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_drugs.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_drugs.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_drugs.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dynrdns.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dynrdns.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_dynrdns.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_fake_helo_tests.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_fake_helo_tests.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_fake_helo_tests.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_head_tests.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_head_tests.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_head_tests.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_html_tests.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_html_tests.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_html_tests.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_imageinfo.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_imageinfo.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_imageinfo.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_meta_tests.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_meta_tests.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_meta_tests.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_net_tests.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_net_tests.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_net_tests.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_phrases.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_phrases.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_phrases.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_porn.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_porn.cf" for
included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_porn.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_ratware.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_ratware.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_ratware.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_uri_tests.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_uri_tests.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_uri_tests.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_vbounce.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_vbounce.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/20_vbounce.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/23_bayes.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/23_bayes.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/23_bayes.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_accessdb.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_accessdb.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_accessdb.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_antivirus.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_antivirus.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_antivirus.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_asn.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_asn.cf" for
included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_asn.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dcc.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dcc.cf" for
included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dcc.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dkim.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dkim.cf" for
included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dkim.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_domainkeys.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_domainkeys.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_domainkeys.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_hashcash.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_hashcash.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_hashcash.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_pyzor.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_pyzor.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_pyzor.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_razor2.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_razor2.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_razor2.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_replace.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_replace.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_replace.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_spf.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_spf.cf" for
included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_spf.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_textcat.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_textcat.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_textcat.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_uribl.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_uribl.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_uribl.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_de.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_de.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_de.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_fr.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_fr.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_fr.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_it.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_it.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_it.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_nl.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_nl.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_nl.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pl.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pl.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pl.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pt_br.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pt_br.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/30_text_pt_br.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/50_scores.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_awl.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_awl.cf" for
included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_awl.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_shortcircuit.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_shortcircuit.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_shortcircuit.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dk.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dk.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dk.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dkim.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dkim.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dkim.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_spf.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_spf.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_spf.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_subject.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_subject.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_subject.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_active.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_removed.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_removed.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_removed.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_scores.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_scores.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/72_scores.cf
[9414] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/80_additional.cf
[9414] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/80_additional.cf"
for included file
[9414] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/80_additional.cf
[9414] dbg: plugin: loading Mail::SpamAssassin::Plugin::iXhash from
/etc/spamassassin/iXhash.pm
[9414] dbg: IXHASH: Using iXhash plugin 1.5.5
[9414] dbg: rules: __MO_OL_9B90B merged duplicates: __MO_OL_C65FA
[9414] dbg: rules: __XM_OL_22B61 merged duplicates: __XM_OL_A842E
[9414] dbg: rules: __MO_OL_07794 merged duplicates: __MO_OL_8627E
__MO_OL_F3B05
[9414] dbg: rules: __JM_REACTOR_DATE merged duplicates: __RATWARE_0_TZ_DATE
[9414] dbg: rules: __XM_OL_07794 merged duplicates: __XM_OL_25340
__XM_OL_3857F __XM_OL_4F240 __XM_OL_58CB5 __XM_OL_6554A __XM_OL_812FF
__XM_OL_C65FA __XM_OL_CF0C0 __XM_OL_F475E __XM_OL_F6D01
[9414] dbg: rules: FH_MSGID_01C67 merged duplicates: __MSGID_VGA
[9414] dbg: rules: FS_NEW_SOFT_UPLOAD merged duplicates:
HS_SUBJ_NEW_SOFTWARE
[9414] dbg: rules: __FH_HAS_XMSMAIL merged duplicates: __HAS_MSMAIL_PRI
[9414] dbg: rules: __MO_OL_015D5 merged duplicates: __MO_OL_6554A
[9414] dbg: rules: __XM_OL_015D5 merged duplicates: __XM_OL_4BF4C
__XM_OL_4EEDB __XM_OL_5B79A __XM_OL_9B90B __XM_OL_ADFF7 __XM_OL_B30D1
__XM_OL_B4B40 __XM_OL_BC7E6 __XM_OL_F3B05 __XM_OL_FF5C8
[9414] dbg: rules: __MO_OL_91287 merged duplicates: __MO_OL_B30D1
__MO_OL_CF0C0
[9414] dbg: rules: KAM_STOCKOTC merged duplicates: KAM_STOCKTIP15
KAM_STOCKTIP20 KAM_STOCKTIP21 KAM_STOCKTIP4 KAM_STOCKTIP6
[9414] dbg: rules: __MO_OL_22B61 merged duplicates: __MO_OL_4F240
__MO_OL_ADFF7
[9414] dbg: rules: __MO_OL_812FF merged duplicates: __MO_OL_BC7E6
[9414] dbg: rules: __MO_OL_25340 merged duplicates: __MO_OL_4EEDB
__MO_OL_7533E
[9414] dbg: rules: __MO_OL_58CB5 merged duplicates: __MO_OL_B4B40
[9414] dbg: rules: __DOS_HAS_ANY_URI merged duplicates: __HAS_ANY_URI
[9414] dbg: rules: __XM_OL_C9068 merged duplicates: __XM_OL_EF20B
[9414] dbg: rules: AXB_RCVD_ZOOBSEND merged duplicates:
BROKEN_RATWARE_BOM CTYPE_001C_A DEAR_HOMEOWNER DIV_CENTER_A_HREF
DRUG_RA_PRICE FM_DDDD_TIMES_2 FM_SEX_HOSTDDDD HG_HORMONE HS_PHARMA_1
HS_UPLOADED_SOFTWARE OEBOUND RCVD_IN_DSBL STOX_RCVD_N_NN_N
URIBL_RHS_ABUSE URIBL_RHS_BOGUSMX URIBL_RHS_DSN URIBL_RHS_POST
URIBL_RHS_TLD_WHOIS URIBL_RHS_WHOIS URIBL_XS_SURBL URI_L_PHP
XMAILER_MIMEOLE_OL_5E7ED XMAILER_MIMEOLE_OL_C7C33
XMAILER_MIMEOLE_OL_D03AB X_LIBRARY YOUR_CRD_RATING
[9414] dbg: rules: __MO_OL_72641 merged duplicates: __MO_OL_A842E
[9414] dbg: rules: __MO_OL_F475E merged duplicates: __MO_OL_FF5C8
[9414] dbg: rules: __MO_OL_4BF4C merged duplicates: __MO_OL_F6D01
[9414] dbg: conf: finish parsing
[9414] dbg: plugin:
Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x8f53fc8) implements
'finish_parsing_end', priority 0
[9414] dbg: replacetags: replacing tags
[9414] dbg: replacetags: done replacing tags
[9414] dbg: bayes: tie-ing to DB file R/O /var/bayes/bayes_toks
[9414] dbg: bayes: tie-ing to DB file R/O /var/bayes/bayes_seen
[9414] dbg: bayes: found bayes db version 3
[9414] dbg: bayes: DB journal sync: last sync: 1256646232
[9414] dbg: config: score set 3 chosen.
[9414] dbg: message: main message type: multipart/alternative
[9414] dbg: plugin: Mail::SpamAssassin::Plugin::DNSEval=HASH(0x8fdcc08)
implements 'check_start', priority 0
[9414] dbg: plugin: Mail::SpamAssassin::Plugin::Check=HASH(0x8f9bea8)
implements 'check_main', priority 0
[9414] dbg: conf: internal_networks not configured, using
trusted_networks configuration for internal_networks; if you really want
internal_networks to only contain the required 127/8 add
'internal_networks !0/0' to your configuration
[9414] dbg: received-header: parsed as [ ip=212.179.134.66
rdns=mail.proacti5.net helo=proacti5.net by=serveur.ingescom.com ident=
envfrom= intl=0 id=1N2Yz4-0004mc-NT auth= msa=0 ]
[9414] dbg: received-header: relay 212.179.134.66 trusted? no internal?
no msa? no
[9414] dbg: received-header: parsed as [ ip=10.0.0.242 rdns=
helo=media-20786b6e9 by=proacti5.net ident= envfrom= intl=0 id= auth=
msa=0 ]
[9414] dbg: received-header: parsed as [ ip=10.0.0.242 rdns=
helo=media-20786b6e9 by=proacti5.net ident=
envfrom=mgrayacheraphy@emprom4.com intl=0 id= auth= msa=0 ]
[9414] dbg: received-header: relay 10.0.0.242 trusted? no internal? no
msa? no
[9414] dbg: metadata: X-Spam-Relays-Trusted:
[9414] dbg: metadata: X-Spam-Relays-Untrusted: [ ip=212.179.134.66
rdns=mail.proacti5.net helo=proacti5.net by=serveur.ingescom.com ident=
envfrom= intl=0 id=1N2Yz4-0004mc-NT auth= msa=0 ] [ ip=10.0.0.242 rdns=
helo=media-20786b6e9 by=proacti5.net ident=
envfrom=mgrayacheraphy@emprom4.com intl=0 id= auth= msa=0 ]
[9414] dbg: metadata: X-Spam-Relays-Internal:
[9414] dbg: metadata: X-Spam-Relays-External: [ ip=212.179.134.66
rdns=mail.proacti5.net helo=proacti5.net by=serveur.ingescom.com ident=
envfrom= intl=0 id=1N2Yz4-0004mc-NT auth= msa=0 ] [ ip=10.0.0.242 rdns=
helo=media-20786b6e9 by=proacti5.net ident=
envfrom=mgrayacheraphy@emprom4.com intl=0 id= auth= msa=0 ]
[9414] dbg: message: ---- MIME PARSER START ----
[9414] dbg: message: parsing multipart, got boundary:
L5ol=_QVjBLMRbRtHFOOf7DSNgN3xtSOMR
[9414] dbg: message: found part of type text/plain, boundary:
L5ol=_QVjBLMRbRtHFOOf7DSNgN3xtSOMR
[9414] dbg: message: added part, type: text/plain
[9414] dbg: message: found part of type text/html, boundary:
L5ol=_QVjBLMRbRtHFOOf7DSNgN3xtSOMR
[9414] dbg: message: added part, type: text/html
[9414] dbg: message: parsing normal part
[9414] dbg: message: parsing normal part
[9414] dbg: message: ---- MIME PARSER END ----
[9414] dbg: message: decoding other encoding type (8bit), ignoring
[9414] dbg: message: decoding other encoding type (8bit), ignoring
[9414] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8b66488)
implements 'parsed_metadata', priority 0
[9414] dbg: dns: is Net::DNS::Resolver available? yes
[9414] dbg: dns: Net::DNS version: 0.63
[9414] dbg: dns: name server: 127.0.0.1, LocalAddr: 0.0.0.0
[9414] dbg: dns: resolver socket rx buffer size is 111616 bytes
[9414] dbg: dns: dns_available set to yes in config file, skipping test
[9414] dbg: uridnsbl: domains to query: proacti2.net emprom4.com
[9414] dbg: async: starting: URI-DNSBL,
DNSBL:multi.surbl.org.:proacti2.net (timeout 15.0s, min 3.0s)
[9414] dbg: dns: URIBL_PH_SURBL lookup start
[9414] dbg: async: starting: URI-DNSBL,
DNSBL:multi.uribl.com.:proacti2.net (timeout 15.0s, min 3.0s)
[9414] dbg: dns: URIBL_BLACK lookup start
[9414] dbg: dns: URIBL_RED lookup start
[9414] dbg: dns: URIBL_GREY lookup start
[9414] dbg: async: starting: URI-DNSBL,
DNSBL:dob.sibl.support-intelligence.net:proacti2.net (timeout 15.0s, min
3.0s)
[9414] dbg: dns: URIBL_RHS_DOB lookup start
[9414] dbg: dns: URIBL_SC_SURBL lookup start
[9414] dbg: dns: URIBL_AB_SURBL lookup start
[9414] dbg: dns: URIBL_JP_SURBL lookup start
[9414] dbg: dns: URIBL_WS_SURBL lookup start
[9414] dbg: dns: URIBL_OB_SURBL lookup start
[9414] dbg: async: starting: URI-NS, NS:proacti2.net (timeout 15.0s, min
3.0s)
[9414] dbg: dns: URIBL_SBL lookup start
[9414] dbg: async: starting: URI-DNSBL,
DNSBL:multi.surbl.org.:emprom4.com (timeout 15.0s, min 3.0s)
[9414] dbg: dns: URIBL_PH_SURBL lookup start
[9414] dbg: async: starting: URI-DNSBL,
DNSBL:multi.uribl.com.:emprom4.com (timeout 15.0s, min 3.0s)
[9414] dbg: dns: URIBL_BLACK lookup start
[9414] dbg: dns: URIBL_RED lookup start
[9414] dbg: dns: URIBL_GREY lookup start
[9414] dbg: async: starting: URI-DNSBL,
DNSBL:dob.sibl.support-intelligence.net:emprom4.com (timeout 15.0s, min
3.0s)
[9414] dbg: dns: URIBL_RHS_DOB lookup start
[9414] dbg: dns: URIBL_SC_SURBL lookup start
[9414] dbg: dns: URIBL_AB_SURBL lookup start
[9414] dbg: dns: URIBL_JP_SURBL lookup start
[9414] dbg: dns: URIBL_WS_SURBL lookup start
[9414] dbg: dns: URIBL_OB_SURBL lookup start
[9414] dbg: async: starting: URI-NS, NS:emprom4.com (timeout 15.0s, min
3.0s)
[9414] dbg: dns: URIBL_SBL lookup start
[9414] dbg: dns: checking RBL sa-other.bondedsender.org., set bsp-untrusted
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs:
[9414] dbg: dns: checking RBL plus.bondedsender.org., set ssc-firsttrusted
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: launching DNS A query for
66.134.179.212.plus.bondedsender.org. in background
[9414] dbg: async: starting: DNSBL-A,
dns:A:66.134.179.212.plus.bondedsender.org. (timeout 15.0s, min 3.0s)
[9414] dbg: dns: checking RBL combined.njabl.org., set njabl
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: launching DNS A query for
66.134.179.212.combined.njabl.org. in background
[9414] dbg: async: starting: DNSBL-A,
dns:A:66.134.179.212.combined.njabl.org. (timeout 15.0s, min 3.0s)
[9414] dbg: dns: checking RBL bl.spamcop.net., set spamcop
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: launching DNS TXT query for
66.134.179.212.bl.spamcop.net. in background
[9414] dbg: async: starting: DNSBL-TXT,
dns:TXT:66.134.179.212.bl.spamcop.net. (timeout 15.0s, min 3.0s)
[9414] dbg: dns: checking RBL zen.spamhaus.org., set zen-lastexternal
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: launching DNS A query for
66.134.179.212.zen.spamhaus.org. in background
[9414] dbg: async: starting: DNSBL-A,
dns:A:66.134.179.212.zen.spamhaus.org. (timeout 15.0s, min 3.0s)
[9414] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs-lastexternal
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: launching DNS A query for
66.134.179.212.dnsbl.sorbs.net. in background
[9414] dbg: async: starting: DNSBL-A,
dns:A:66.134.179.212.dnsbl.sorbs.net. (timeout 15.0s, min 3.0s)
[9414] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: checking RBL zen.spamhaus.org., set zen-lastexternal
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: checking RBL sa-accredit.habeas.com., set
habeas-firsttrusted
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: launching DNS A query for
66.134.179.212.sa-accredit.habeas.com. in background
[9414] dbg: async: starting: DNSBL-A,
dns:A:66.134.179.212.sa-accredit.habeas.com. (timeout 15.0s, min 3.0s)
[9414] dbg: dns: checking RBL list.dnswl.org., set dnswl-firsttrusted
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: launching DNS A query for
66.134.179.212.list.dnswl.org. in background
[9414] dbg: async: starting: DNSBL-A,
dns:A:66.134.179.212.list.dnswl.org. (timeout 15.0s, min 3.0s)
[9414] dbg: dns: checking RBL sa-trusted.bondedsender.org., set
bsp-firsttrusted
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: launching DNS TXT query for
66.134.179.212.sa-trusted.bondedsender.org. in background
[9414] dbg: async: starting: DNSBL-TXT,
dns:TXT:66.134.179.212.sa-trusted.bondedsender.org. (timeout 15.0s, min
3.0s)
[9414] dbg: dns: checking RBL zen.spamhaus.org., set zen
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: checking RBL iadb.isipp.com., set iadb-firsttrusted
[9414] dbg: dns: IPs found: full-external: 212.179.134.66, 10.0.0.242
untrusted: 212.179.134.66 originating:
[9414] dbg: dns: only inspecting the following IPs: 212.179.134.66
[9414] dbg: dns: launching DNS A query for
66.134.179.212.iadb.isipp.com. in background
[9414] dbg: async: starting: DNSBL-A,
dns:A:66.134.179.212.iadb.isipp.com. (timeout 15.0s, min 3.0s)
[9414] dbg: check: running tests for priority: -1000
[9414] dbg: async: select found 6 responses ready (t.o.=0.0)
[9414] dbg: async: completed in 0.052 s: URI-NS, NS:proacti2.net
[9414] dbg: async: starting: URI-A, A:ns2.amenworld.com. (timeout 15.0s,
min 3.0s)
[9414] dbg: async: starting: URI-A, A:ns1.amenworld.com. (timeout 15.0s,
min 3.0s)
[9414] dbg: async: completed in 0.067 s: URI-DNSBL,
DNSBL:multi.surbl.org.:proacti2.net
[9414] dbg: async: completed in 0.047 s: URI-NS, NS:emprom4.com
[9414] dbg: async: starting: URI-A, A:sdns1.ovh.net. (timeout 15.0s, min
3.0s)
[9414] dbg: async: starting: URI-A, A:ns354691.ovh.net. (timeout 15.0s,
min 3.0s)
[9414] dbg: async: completed in 0.027 s: DNSBL-A,
dns:A:66.134.179.212.dnsbl.sorbs.net.
[9414] dbg: async: completed in 0.020 s: DNSBL-A,
dns:A:66.134.179.212.list.dnswl.org.
[9414] dbg: async: completed in 0.010 s: DNSBL-A,
dns:A:66.134.179.212.iadb.isipp.com.
[9414] dbg: async: queries completed: 6, started: 4
[9414] dbg: async: queries active: DNSBL-A=4 DNSBL-TXT=2 URI-A=4
URI-DNSBL=5 at Tue Oct 27 13:25:06 2009
[9414] dbg: dns: harvested completed queries
[9414] dbg: rules: running head tests; score so far=0
[9414] dbg: rules: compiled head tests
[9414] dbg: eval: all '*From' addrs: mgrayacheraphy@emprom4.com
[9414] dbg: eval: all '*To' addrs: samuelduran@ingescom.com
[9414] dbg: rules: running body tests; score so far=0
[9414] dbg: rules: compiled body tests
[9414] dbg: rules: running uri tests; score so far=0
[9414] dbg: rules: compiled uri tests
[9414] dbg: rules: running rawbody tests; score so far=0
[9414] dbg: rules: compiled rawbody tests
[9414] dbg: rules: running full tests; score so far=0
[9414] dbg: rules: compiled full tests
[9414] dbg: rules: running meta tests; score so far=0
[9414] dbg: rules: compiled meta tests
[9414] dbg: check: running tests for priority: -950
[9414] dbg: rules: running head tests; score so far=0
[9414] dbg: rules: compiled head tests
[9414] dbg: rules: running body tests; score so far=0
[9414] dbg: rules: compiled body tests
[9414] dbg: rules: running uri tests; score so far=0
[9414] dbg: rules: compiled uri tests
[9414] dbg: rules: running rawbody tests; score so far=0
[9414] dbg: rules: compiled rawbody tests
[9414] dbg: rules: running full tests; score so far=0
[9414] dbg: rules: compiled full tests
[9414] dbg: rules: running meta tests; score so far=0
[9414] dbg: rules: compiled meta tests
[9414] dbg: check: running tests for priority: -900
[9414] dbg: rules: running head tests; score so far=0
[9414] dbg: rules: compiled head tests
[9414] dbg: rules: running body tests; score so far=0
[9414] dbg: rules: compiled body tests
[9414] dbg: rules: running uri tests; score so far=0
[9414] dbg: rules: compiled uri tests
[9414] dbg: rules: running rawbody tests; score so far=0
[9414] dbg: rules: compiled rawbody tests
[9414] dbg: rules: running full tests; score so far=0
[9414] dbg: rules: compiled full tests
[9414] dbg: rules: running meta tests; score so far=0
[9414] dbg: rules: compiled meta tests
[9414] dbg: check: running tests for priority: -400
[9414] dbg: rules: running head tests; score so far=0
[9414] dbg: rules: compiled head tests
[9414] dbg: rules: running body tests; score so far=0
[9414] dbg: rules: compiled body tests
[9414] dbg: rules: running uri tests; score so far=0
[9414] dbg: rules: compiled uri tests
[9414] dbg: plugin: Mail::SpamAssassin::Plugin::WLBLEval=HASH(0x90ae400)
implements 'check_wb_list', priority 0
[9414] dbg: bayes: DB journal sync: last sync: 1256646232
[9414] dbg: bayes: corpus size: nspam = 112507, nham = 844
[9414] dbg: bayes: score = 0.56497642812688
[9414] dbg: bayes: DB journal sync: last sync: 1256646232
[9414] dbg: bayes: untie-ing
[9414] dbg: rules: running rawbody tests; score so far=0
[9414] dbg: rules: compiled rawbody tests
[9414] dbg: rules: running full tests; score so far=0
[9414] dbg: rules: compiled full tests
[9414] dbg: rules: running meta tests; score so far=0
[9414] dbg: rules: compiled meta tests
[9414] dbg: check: running tests for priority: 0
[9414] dbg: rules: running head tests; score so far=0
[9414] dbg: rules: compiled head tests
[9414] dbg: rules: ran header rule MISSING_MID ======> got hit: "UNSET"
[9414] dbg: rules: ran header rule __CTYPE_MULTIPART_ALT ======> got
hit: "multipart/alternative"
[9414] dbg: rules: ran header rule __CTYPE_HAS_BOUNDARY ======> got hit:
"boundary"
[9414] dbg: rules: ran header rule __CT ======> got hit: "m"
[9414] dbg: rules: ran header rule __LAST_UNTRUSTED_RELAY_NO_AUTH
======> got hit: "[ ip=212.179.134.66 rdns=mail.proacti5.net
helo=proacti5.net by=serveur.ingescom.com ident= envfrom= intl=0
id=1N2Yz4-0004mc-NT auth= "
[9414] dbg: rules: ran header rule __MISSING_REF ======> got hit: "UNSET"
[9414] dbg: rules: ran header rule __NAKED_TO ======> got hit:
"samuelduran@ingescom.com"
[9414] dbg: rules: ran header rule __DOS_HAS_LIST_UNSUB ======> got hit: "<"
[9414] dbg: rules: ran header rule __MIME_VERSION ======> got hit: "1"
[9414] dbg: rules: ran header rule __TOCC_EXISTS ======> got hit: "s"
[9414] dbg: rules: ran header rule __REPTO_QUOTE ======> got hit:
""ayache" <"
[9414] dbg: rules: ran header rule __REPTO_OVERQUOTE ======> got hit:
""ayache" <"
[9414] dbg: rules: ran header rule __DOS_RELAYED_EXT ======> got hit:
"Received: from mail.proacti5.net ([212.179.134.66] helo=proacti5.net)
by serveur.ingescom.com with smtp id 1N2Yz4-0004mc-NT for
samuelduran@ingescom.com; Tue, 27 Oct 2009 00:28:24 +0100
[9414] dbg: rules: Comment: DomainKeys? See
http://domainkeys.sourceforge.net/
[9414] dbg: rules: DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=default; d=emprom4.com;
b=XQCU5JWyl4Pr3XnBgiUt4N7Dsde0dd4DaY7jT7FcE01JNRY1wsnkzUrO21rtYWQ5RCkOJ0B6dFPFrQFt7aC6cu9xUU59FSJ6t25/c78av4kyBCxCj4QAWqUBPY5qyJXN;
h=Received:Received:X-Antivirus-MYDOMAIN-Mail-From:X-Antivirus-MYDOMAIN:Received:From:Subject:To:Content-Type:MIME-Version:Reply-To:Date:X-Priority:List-Unsubscribe:X-Antivirus-MYDOMAIN-Message-ID;
[9414] dbg: rules: DKIM-Signature: v=1; a=rsa-sha1; c=relaxed;
d=emprom4.com; h=from:
subject:to:content-type:mime-version:reply-to:date: list-unsubscribe;
q=dns/txt; s=default; bh=WZ0MkCWV4kc83W3PWhvNB 2q/+3s=;
b=V8nLAHPOwMmDiRko1Ufn5yDr3N5iXW3fYtsfYJbNeBu6NjYcgKVIB
5gsyWjI2VLXNDDv5jgkjzC47XLvi37Wc0Gl4hMI1gHFiJYYu7IxuWzf3BVASnQkL 6G0qxaSwtm0
[9414] dbg: rules: Received: (qmail 11216 invoked by uid 10002); 26 Oct
2009 23:25:58 -0000
[9414] dbg: rules: Received: from 10.0.0.242 by localhost (envelope-from
<mg...@emprom4.com>, uid 2027) with qmail-scanner-1.25-st-qms
(perlscan: 1.25-st-qms. Clear:RC:1(10.0.0.242):. Processed in 2.277999
secs); 26 Oct 2009 23:25:58 -0000
[9414] dbg: rules: X-Antivirus-MYDOMAIN-Mail-From:
mgrayacheraphy@emprom4.com via localhost
[9414] dbg: rules: X-Antivirus-MYDOMAIN: 1.25-st-qms
(Clear:RC:1(10.0.0.242):. Processed in 2.277999 secs Process 11204)
[9414] dbg: rules: Received: "
[9414] dbg: rules: ran header rule __SUBJECT_ENCODED_QP ======> got hit:
"=?ISO-8859-1?Q?"
[9414] dbg: rules: ran header rule __FH_HAS_XPRIORITY ======> got hit: "5"
[9414] dbg: rules: ran header rule __HAS_RCVD ======> got hit: "f"
[9414] dbg: rules: ran header rule __DOS_RCVD_TUE ======> got hit: " Tue, "
[9414] dbg: rules: ran header rule __EXCLAIM_SUBJ ======> got hit: "!"
[9414] dbg: rules: ran header rule __SUBJECT_NEEDS_MIME ======> got hit: "à"
[9414] dbg: rules: ran header rule __HAS_SUBJECT ======> got hit: "V"
[9414] dbg: spf: checking to see if the message has a Received-SPF
header that we can use
[9414] dbg: spf: using Mail::SPF for SPF checks
[9414] dbg: spf: checking HELO (helo=proacti5.net, ip=212.179.134.66)
[9414] dbg: spf: query for /212.179.134.66/proacti5.net: result: none,
comment: , text: No applicable sender policy available
[9414] dbg: spf: already checked for Received-SPF headers, proceeding
with DNS based checks
[9414] dbg: spf: cannot get Envelope-From, cannot use SPF
[9414] dbg: spf: def_spf_whitelist_from: already checked spf and didn't
get pass, skipping whitelist check
[9414] dbg: spf: whitelist_from_spf: already checked spf and didn't get
pass, skipping whitelist check
[9414] dbg: rules: running body tests; score so far=0.001
[9414] dbg: rules: compiled body tests
[9414] dbg: rules: ran body rule __HAS_ANY_EMAIL ======> got hit:
"6@orange.f"
[9414] dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "V"
[9414] dbg: rules: running uri tests; score so far=0.001
[9414] dbg: rules: compiled uri tests
[9414] dbg: rules: ran uri rule __DOS_HAS_ANY_URI ======> got hit: "h"
[9414] dbg: rules: ran eval rule __MIME_HTML ======> got hit (1)
[9414] dbg: IXHASH: IxHash querying ctyme.ixhash.net
[9414] dbg: IXHASH: Computed hash-value 9097dff8f5cf8fe84756de167e019f5b
via method 1, using perl exclusively
[9414] dbg: IXHASH: Now checking
9097dff8f5cf8fe84756de167e019f5b.ctyme.ixhash.net
[9414] dbg: IXHASH: Computed hash-value 5c7dc7888d1ab8a4fd7bf21413f5c908
via method 2, using perl exclusively
[9414] dbg: IXHASH: Now checking
5c7dc7888d1ab8a4fd7bf21413f5c908.ctyme.ixhash.net
[9414] dbg: IXHASH: Computed hash-value 55ddef5cd5c491b8f8d767a6bd7bf219
via method 3
[9414] dbg: IXHASH: Now checking
55ddef5cd5c491b8f8d767a6bd7bf219.ctyme.ixhash.net
[9414] dbg: rules: ran eval rule HTML_MESSAGE ======> got hit (1)
[9414] dbg: eval: stock info total: 0
[9414] dbg: rules: ran eval rule __TAG_EXISTS_HTML ======> got hit (1)
[9414] dbg: rules: ran eval rule __TAG_EXISTS_BODY ======> got hit (1)
[9414] dbg: rules: ran eval rule BAYES_50 ======> got hit (1)
[9414] dbg: eval: text words: 44, html words: 259
[9414] dbg: eval: madiff: left: 237, orig: 259, max-difference: 91.51%
[9414] dbg: rules: ran eval rule HTML_IMAGE_RATIO_08 ======> got hit (1)
[9414] dbg: rules: ran eval rule __TVD_MIME_ATT_TP ======> got hit (1)
[9414] dbg: IXHASH: IxHash querying hosteurope.ixhash.net
[9414] dbg: IXHASH: Hash value for method #1 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
9097dff8f5cf8fe84756de167e019f5b.hosteurope.ixhash.net
[9414] dbg: IXHASH: Hash value for method #2 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
5c7dc7888d1ab8a4fd7bf21413f5c908.hosteurope.ixhash.net
[9414] dbg: IXHASH: Hash value for method #3 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
55ddef5cd5c491b8f8d767a6bd7bf219.hosteurope.ixhash.net
[9414] dbg: IXHASH: IxHash querying ix.dnsbl.manitu.net
[9414] dbg: IXHASH: Hash value for method #1 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
9097dff8f5cf8fe84756de167e019f5b.ix.dnsbl.manitu.net
[9414] dbg: IXHASH: Hash value for method #2 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
5c7dc7888d1ab8a4fd7bf21413f5c908.ix.dnsbl.manitu.net
[9414] dbg: IXHASH: Hash value for method #3 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
55ddef5cd5c491b8f8d767a6bd7bf219.ix.dnsbl.manitu.net
[9414] dbg: IXHASH: IxHash querying generic.ixhash.net
[9414] dbg: IXHASH: Hash value for method #1 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
9097dff8f5cf8fe84756de167e019f5b.generic.ixhash.net
[9414] dbg: IXHASH: Hash value for method #2 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
5c7dc7888d1ab8a4fd7bf21413f5c908.generic.ixhash.net
[9414] dbg: IXHASH: Hash value for method #3 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
55ddef5cd5c491b8f8d767a6bd7bf219.generic.ixhash.net
[9414] dbg: IXHASH: IxHash querying nospam.login-solutions.de
[9414] dbg: IXHASH: Hash value for method #1 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
9097dff8f5cf8fe84756de167e019f5b.nospam.login-solutions.de
[9414] dbg: IXHASH: Hash value for method #2 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
5c7dc7888d1ab8a4fd7bf21413f5c908.nospam.login-solutions.de
[9414] dbg: IXHASH: Hash value for method #3 found in metadata, re-using
that one
[9414] dbg: IXHASH: Now checking
55ddef5cd5c491b8f8d767a6bd7bf219.nospam.login-solutions.de
[9414] dbg: rules: ran eval rule __TAG_EXISTS_HEAD ======> got hit (1)
[9414] dbg: async: select found no responses ready (t.o.=0.0)
[9414] dbg: async: completed in 0.555 s: URI-DNSBL,
DNSBL:multi.surbl.org.:emprom4.com
[9414] dbg: async: completed in 0.527 s: DNSBL-A,
dns:A:66.134.179.212.zen.spamhaus.org.
[9414] dbg: async: completed in 0.485 s: URI-A, A:sdns1.ovh.net.
[9414] dbg: async: starting: URI-DNSBL,
DNSBL:sbl.spamhaus.org.:140.188.251.213 (timeout 15.0s, min 3.0s)
[9414] dbg: async: completed in 0.485 s: URI-A, A:ns2.amenworld.com.
[9414] dbg: async: starting: URI-DNSBL,
DNSBL:sbl.spamhaus.org.:73.229.43.212 (timeout 15.0s, min 3.0s)
[9414] dbg: async: completed in 0.483 s: URI-A, A:ns354691.ovh.net.
[9414] dbg: async: starting: URI-DNSBL,
DNSBL:sbl.spamhaus.org.:104.111.121.91 (timeout 15.0s, min 3.0s)
[9414] dbg: async: completed in 0.518 s: DNSBL-TXT,
dns:TXT:66.134.179.212.sa-trusted.bondedsender.org.
[9414] dbg: async: completed in 0.538 s: DNSBL-A,
dns:A:66.134.179.212.plus.bondedsender.org.
[9414] dbg: async: completed in 0.491 s: URI-A, A:ns1.amenworld.com.
[9414] dbg: async: starting: URI-DNSBL,
DNSBL:sbl.spamhaus.org.:145.206.193.62 (timeout 15.0s, min 3.0s)
[9414] dbg: async: completed in 0.535 s: DNSBL-A,
dns:A:66.134.179.212.combined.njabl.org.
[9414] dbg: async: completed in 0.562 s: URI-DNSBL,
DNSBL:multi.uribl.com.:proacti2.net
[9414] dbg: async: completed in 0.561 s: URI-DNSBL,
DNSBL:dob.sibl.support-intelligence.net:proacti2.net
[9414] dbg: async: completed in 0.534 s: DNSBL-TXT,
dns:TXT:66.134.179.212.bl.spamcop.net.
[9414] dbg: async: completed in 0.552 s: URI-DNSBL,
DNSBL:dob.sibl.support-intelligence.net:emprom4.com
[9414] dbg: async: completed in 0.554 s: URI-DNSBL,
DNSBL:multi.uribl.com.:emprom4.com
[9414] dbg: async: completed in 0.524 s: DNSBL-A,
dns:A:66.134.179.212.sa-accredit.habeas.com.
[9414] dbg: async: queries completed: 15, started: 4
[9414] dbg: async: queries active: URI-DNSBL=4 at Tue Oct 27 13:25:08 2009
[9414] dbg: dns: harvested completed queries
[9414] dbg: rules: running rawbody tests; score so far=0.004
[9414] dbg: rules: compiled rawbody tests
[9414] dbg: rules: ran rawbody rule __TVD_BODY ======> got hit: "Vent"
[9414] dbg: rules: running full tests; score so far=0.004
[9414] dbg: rules: compiled full tests
[9414] dbg: info: entering helper-app run mode
[9414] dbg: info: leaving helper-app run mode
[9414] dbg: razor2: part=0 engine=4 contested=0 confidence=0
[9414] dbg: razor2: part=0 engine=8 contested=0 confidence=0
[9414] dbg: razor2: part=1 engine=4 contested=0 confidence=0
[9414] dbg: razor2: part=1 engine=8 contested=0 confidence=0
[9414] dbg: razor2: results: spam? 0
[9414] dbg: razor2: results: engine 8, highest cf score: 0
[9414] dbg: razor2: results: engine 4, highest cf score: 0
[9414] dbg: util: current PATH is:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
[9414] dbg: util: executable for pyzor was found at /usr/bin/pyzor
[9414] dbg: pyzor: pyzor is available: /usr/bin/pyzor
[9414] dbg: info: entering helper-app run mode
[9414] dbg: pyzor: opening pipe: /usr/bin/pyzor check <
/tmp/.spamassassin9414Rt3lehtmp
[9424] dbg: util: setuid: ruid=0 euid=0
[9414] dbg: pyzor: [9424] finished: exit=0x0100
[9414] dbg: pyzor: got response: public.pyzor.org:24441 (200, 'OK') 0 0
[9414] dbg: info: leaving helper-app run mode
[9414] dbg: dcc: dccifd is not available: no r/w dccifd socket found
[9414] dbg: util: executable for dccproc was found at /usr/local/bin/dccproc
[9414] dbg: dcc: dccproc is available: /usr/local/bin/dccproc
[9414] dbg: info: entering helper-app run mode
[9414] dbg: dcc: opening pipe: /usr/local/bin/dccproc -H -x 0 -a
212.179.134.66 < /tmp/.spamassassin9414Rt3lehtmp
[9425] dbg: util: setuid: ruid=0 euid=0
[9414] dbg: dcc: got response: X-DCC-EATSERVER-Metrics: lenny 1166;
Body=29 Fuz1=1294 Fuz2=1287
[9414] dbg: info: leaving helper-app run mode
[9414] dbg: async: select found 4 responses ready (t.o.=0.0)
[9414] dbg: async: completed in 8.039 s: URI-DNSBL,
DNSBL:sbl.spamhaus.org.:140.188.251.213
[9414] dbg: async: completed in 8.033 s: URI-DNSBL,
DNSBL:sbl.spamhaus.org.:145.206.193.62
[9414] dbg: async: completed in 8.037 s: URI-DNSBL,
DNSBL:sbl.spamhaus.org.:104.111.121.91
[9414] dbg: async: completed in 8.038 s: URI-DNSBL,
DNSBL:sbl.spamhaus.org.:73.229.43.212
[9414] dbg: dns: harvested completed queries
[9414] dbg: rules: running meta tests; score so far=0.004
[9414] dbg: rules: compiled meta tests
[9414] dbg: check: running tests for priority: 500
[9414] dbg: dns: harvest_dnsbl_queries
[9414] dbg: async: timing: 0.010 . dns:A:66.134.179.212.iadb.isipp.com.
[9414] dbg: async: timing: 0.020 . dns:A:66.134.179.212.list.dnswl.org.
[9414] dbg: async: timing: 0.027 . dns:A:66.134.179.212.dnsbl.sorbs.net.
[9414] dbg: async: timing: 0.047 . NS:emprom4.com
[9414] dbg: async: timing: 0.052 . NS:proacti2.net
[9414] dbg: async: timing: 0.067 . DNSBL:multi.surbl.org.:proacti2.net
[9414] dbg: async: timing: 0.483 . A:ns354691.ovh.net.
[9414] dbg: async: timing: 0.485 . A:sdns1.ovh.net.
[9414] dbg: async: timing: 0.485 . A:ns2.amenworld.com.
[9414] dbg: async: timing: 0.491 . A:ns1.amenworld.com.
[9414] dbg: async: timing: 0.518 .
dns:TXT:66.134.179.212.sa-trusted.bondedsender.org.
[9414] dbg: async: timing: 0.524 .
dns:A:66.134.179.212.sa-accredit.habeas.com.
[9414] dbg: async: timing: 0.527 . dns:A:66.134.179.212.zen.spamhaus.org.
[9414] dbg: async: timing: 0.534 . dns:TXT:66.134.179.212.bl.spamcop.net.
[9414] dbg: async: timing: 0.535 . dns:A:66.134.179.212.combined.njabl.org.
[9414] dbg: async: timing: 0.538 .
dns:A:66.134.179.212.plus.bondedsender.org.
[9414] dbg: async: timing: 0.552 .
DNSBL:dob.sibl.support-intelligence.net:emprom4.com
[9414] dbg: async: timing: 0.554 . DNSBL:multi.uribl.com.:emprom4.com
[9414] dbg: async: timing: 0.555 . DNSBL:multi.surbl.org.:emprom4.com
[9414] dbg: async: timing: 0.561 .
DNSBL:dob.sibl.support-intelligence.net:proacti2.net
[9414] dbg: async: timing: 0.562 . DNSBL:multi.uribl.com.:proacti2.net
[9414] dbg: async: timing: 8.033 . DNSBL:sbl.spamhaus.org.:145.206.193.62
[9414] dbg: async: timing: 8.037 . DNSBL:sbl.spamhaus.org.:104.111.121.91
[9414] dbg: async: timing: 8.038 . DNSBL:sbl.spamhaus.org.:73.229.43.212
[9414] dbg: async: timing: 8.039 . DNSBL:sbl.spamhaus.org.:140.188.251.213
[9414] dbg: rules: running head tests; score so far=0.004
[9414] dbg: rules: compiled head tests
[9414] dbg: rules: running body tests; score so far=0.004
[9414] dbg: rules: compiled body tests
[9414] dbg: rules: running uri tests; score so far=0.004
[9414] dbg: rules: compiled uri tests
[9414] dbg: rules: running rawbody tests; score so far=0.004
[9414] dbg: rules: compiled rawbody tests
[9414] dbg: rules: running full tests; score so far=0.004
[9414] dbg: rules: compiled full tests
[9414] dbg: rules: running meta tests; score so far=0.004
[9414] dbg: rules: compiled meta tests
[9414] dbg: check: running tests for priority: 1000
[9414] dbg: rules: running head tests; score so far=0.004
[9414] dbg: rules: compiled head tests
[9414] dbg: rules: running body tests; score so far=0.004
[9414] dbg: rules: compiled body tests
[9414] dbg: rules: running uri tests; score so far=0.004
[9414] dbg: rules: compiled uri tests
[9414] dbg: rules: running rawbody tests; score so far=0.004
[9414] dbg: rules: compiled rawbody tests
[9414] dbg: rules: running full tests; score so far=0.004
[9414] dbg: rules: compiled full tests
[9414] dbg: rules: running meta tests; score so far=0.004
[9414] dbg: rules: compiled meta tests
[9414] dbg: plugin:
Mail::SpamAssassin::Plugin::AutoLearnThreshold=HASH(0x8f36ff8)
implements 'autolearn_discriminator', priority 0
[9414] dbg: learn: auto-learn: currently using scoreset 3, recomputing
score based on scoreset 1
[9414] dbg: learn: auto-learn: message score: 0.004, computed score for
autolearn: 0.003
[9414] dbg: learn: auto-learn? ham=-16, spam=16, body-points=0.003,
head-points=0.003, learned-points=0.001
[9414] dbg: learn: auto-learn? no: inside auto-learn thresholds, not
considered ham or spam
[9414] dbg: check: is spam? score=0.004 required=5
[9414] dbg: check:
tests=BAYES_50,HTML_IMAGE_RATIO_08,HTML_MESSAGE,MISSING_MID
[9414] dbg: check:
subtests=__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__DOS_HAS_ANY_URI,__DOS_HAS_LIST_UNSUB,__DOS_RCVD_TUE,__DOS_RELAYED_EXT,__EXCLAIM_SUBJ,__FH_HAS_XPRIORITY,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_RCVD,__HAS_SUBJECT,__LAST_UNTRUSTED_RELAY_NO_AUTH,__MIME_HTML,__MIME_VERSION,__MISSING_REF,__NAKED_TO,__NONEMPTY_BODY,__REPTO_OVERQUOTE,__REPTO_QUOTE,__SUBJECT_ENCODED_QP,__SUBJECT_NEEDS_MIME,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TOCC_EXISTS,__TVD_BODY,__TVD_MIME_ATT_TP
Return-path: <mg...@emprom4.com>
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
lenny.ingescom.com
X-Spam-Level:
X-Spam-Status: No, score=0.0 required=5.0
tests=BAYES_50,HTML_IMAGE_RATIO_08,
HTML_MESSAGE,MISSING_MID autolearn=no version=3.2.5
There is no autolearning for Ham, all is manual for Ham (and only me)
Autolearning treshold spam is up to 16 points
Is it normal to get Bayes_50 after sa-learn --spam ?
Someone got an idea ?
Thanks a lot.
Sam.
Re: sa-learn spam and Bayes_50
Posted by RW <rw...@googlemail.com>.
On Tue, 27 Oct 2009 23:09:10 -0400
Alex <my...@gmail.com> wrote:
> In either case, is there a way to exclude mails with USER_IN_WHITELIST
> altogether? I have my ham level set at -0.3, but the USER_IN_WHITELIST
> (and there are quite a few) adds -100.0, automatically making it ham.
> I'm concerned that a spoofed mail passing through the whitelist could
> skew the db without my knowledge and without my ability to control it.
Whitelisting rules are marked noautolearn, so they have no affect on
the score used to decide autolearning.
The overall score acts as a sanity check, so it's unlikely that
whitelisted mail will be autolearned as spam, but it wont automatically
be learned as ham either.
Re: sa-learn spam and Bayes_50
Posted by Alex <my...@gmail.com>.
Hi,
> Instead, be more selective about the spam you train. Only train
> messages that completely missed with respect to Bayes (e.g. a spam
> that got BAYES_00 or a ham that got BAYES_80) rather than corner cases
> (e.g. a spam with BAYES_50 that got marked as spam, a spam that got
> marked as BAYES_80). Try to train as much inbound ham as possible
> (but again, not internal messages that never hit the live internet).
> If you use autolearn, bump the bayes_auto_learn_threshold_spam up some.
This sounds like really good advice. I've recently enabled autolearn
and I'm a bit concerned that my database is skewed. I found quite a
few spams in the quarantine with a bayes score less than 50. However,
I'm not sure that wasn't the case before I started the autolearn.
In either case, is there a way to exclude mails with USER_IN_WHITELIST
altogether? I have my ham level set at -0.3, but the USER_IN_WHITELIST
(and there are quite a few) adds -100.0, automatically making it ham.
I'm concerned that a spoofed mail passing through the whitelist could
skew the db without my knowledge and without my ability to control it.
Thanks,
Alex
Re: sa-learn spam and Bayes_50
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
> Benny Pedersen wrote:
> > On tir 27 okt 2009 18:44:28 CET, John Hardin wrote
> >
> >>> 0.000 0 112532 0 non-token data: nspam
> >>> 0.000 0 844 0 non-token data: nham
> >
> > try to get them more equal numbered in your trains
> >
> >> reflect your actual raw spam/ham ratio, but yours is a little strongly
> >> skewed towards spammy tokens..
> >
> > result of not scanning outgoing mails will be sign of this
On 27.10.09 18:14, Adam Katz wrote:
> I disagree. I see no reason to scan outbound mail, and this
> particular aspect of it is more harmful than helpful.
I see good reason to scan (and even refuse over some score) outbound mail:
If your customers start spreading spam, you can save yourself from problems.
Of course, the rejecton limit should be safely high and you should be
carefull when choosing 3rd party rules, e.g. botnet.
> Bayes examines both bodies and headers of messages; if you scan your
> outbound mail to even out your ham:spam ratio, you are watering down
> your bayes db. Basically, it will learn from the headers that all
> outbound mail is ham and all inbound mail is spam.
Outbound mail must not be automatically marked as ham, mostly because of the
reason above. This is just another reason to be careful about that.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I just got lost in thought. It was unfamiliar territory.
Re: sa-learn spam and Bayes_50
Posted by Adam Katz <an...@khopis.com>.
Benny Pedersen wrote:
> On tir 27 okt 2009 18:44:28 CET, John Hardin wrote
>
>>> 0.000 0 112532 0 non-token data: nspam
>>> 0.000 0 844 0 non-token data: nham
>
> try to get them more equal numbered in your trains
>
>> reflect your actual raw spam/ham ratio, but yours is a little strongly
>> skewed towards spammy tokens..
>
> result of not scanning outgoing mails will be sign of this
I disagree. I see no reason to scan outbound mail, and this
particular aspect of it is more harmful than helpful.
Bayes examines both bodies and headers of messages; if you scan your
outbound mail to even out your ham:spam ratio, you are watering down
your bayes db. Basically, it will learn from the headers that all
outbound mail is ham and all inbound mail is spam.
Instead, be more selective about the spam you train. Only train
messages that completely missed with respect to Bayes (e.g. a spam
that got BAYES_00 or a ham that got BAYES_80) rather than corner cases
(e.g. a spam with BAYES_50 that got marked as spam, a spam that got
marked as BAYES_80). Try to train as much inbound ham as possible
(but again, not internal messages that never hit the live internet).
If you use autolearn, bump the bayes_auto_learn_threshold_spam up some.
Re: sa-learn spam and Bayes_50
Posted by Benny Pedersen <me...@junc.org>.
On tir 27 okt 2009 18:44:28 CET, John Hardin wrote
>> 0.000 0 112532 0 non-token data: nspam
>> 0.000 0 844 0 non-token data: nham
try to get them more equal numbered in your trains
> reflect your actual raw spam/ham ratio, but yours is a little
> strongly skewed towards spammy tokens..
result of not scanning outgoing mails will be sign of this
--
xpoint
Re: sa-learn spam and Bayes_50
Posted by Sam <li...@ingescom.com>.
John Hardin a écrit :
> On Tue, 27 Oct 2009, Sam wrote:
>
>> John Hardin a écrit :
>>> On Tue, 27 Oct 2009, Sam wrote:
>>>
>>> > And after learning with sa-learn, it is still saying bayes_50 >
>>> whereas sa-learn told it has learned it.
>>>
>>> Okay, basic Bayes troubleshooting questions:
>>>
>>> (1) Are you running sa-learn as the same user that SA itself is
>>> running as, so that you're training the Bayes database that SA is
>>> actually using to score messages?
>>>
>>> (2) Please run sa-learn --dump magic and send us the results.
>>
>> 1) For all users there is only one database in /var/bayes. I've done
>> some tests with su Debian-exim and it is same result.
>>
>> 2) lenny:/home/samuel# sa-learn --dump magic
>> 0.000 0 3 0 non-token data: bayes db version
>> 0.000 0 112532 0 non-token data: nspam
>> 0.000 0 844 0 non-token data: nham
>> 0.000 0 1935545 0 non-token data: ntokens
>
> Okay, good. About the only comment I can make based on this is, you
> might want to learn a bunch of ham. You want the database to kinda
> reflect your actual raw spam/ham ratio, but yours is a little strongly
> skewed towards spammy tokens...
>
Thanks to everybody for yours comments.
If I understand well, the few french spam I give to sa-learn are too
little front of the tons of english spam feed to sa-learn.
It could be interesting (but not existing I think) to have one bayes for
each langage if I understand that this the problem in my case.
Thanks a lot.
Sam.
Re: sa-learn spam and Bayes_50
Posted by John Hardin <jh...@impsec.org>.
On Tue, 27 Oct 2009, Sam wrote:
> John Hardin a écrit :
>> On Tue, 27 Oct 2009, Sam wrote:
>>
>> > And after learning with sa-learn, it is still saying bayes_50
>> > whereas sa-learn told it has learned it.
>>
>> Okay, basic Bayes troubleshooting questions:
>>
>> (1) Are you running sa-learn as the same user that SA itself is
>> running as, so that you're training the Bayes database that SA is
>> actually using to score messages?
>>
>> (2) Please run sa-learn --dump magic and send us the results.
>
> 1) For all users there is only one database in /var/bayes. I've done
> some tests with su Debian-exim and it is same result.
>
> 2) lenny:/home/samuel# sa-learn --dump magic
> 0.000 0 3 0 non-token data: bayes db version
> 0.000 0 112532 0 non-token data: nspam
> 0.000 0 844 0 non-token data: nham
> 0.000 0 1935545 0 non-token data: ntokens
Okay, good. About the only comment I can make based on this is, you might
want to learn a bunch of ham. You want the database to kinda reflect your
actual raw spam/ham ratio, but yours is a little strongly skewed towards
spammy tokens...
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
4 days until Halloween
Re: sa-learn spam and Bayes_50
Posted by Sam <li...@ingescom.com>.
John Hardin a écrit :
> On Tue, 27 Oct 2009, Sam wrote:
>
>> Oct 27 00:28:24 lenny spamd[20399]: spamd: clean message (0.0/5.0)
>> for samuelduran@ingescom.com:102 in 4.8 seconds, 9803 bytes.
>> Oct 27 00:28:24 lenny spamd[20399]: spamd: result: . 0 -
>> BAYES_50,HTML_IMAGE_RATIO_08,HTML_MESSAGE,MISSING_MID
>> scantime=4.8,size=9803,user=samuelduran@ingescom.com,uid=102,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=39593,mid=(unknown),bayes=0.500000,autolearn=no
>>
>> O
>>
>> And after learning with sa-learn, it is still saying bayes_50 whereas
>> sa-learn told it has learned it.
>
> Okay, basic Bayes troubleshooting questions:
>
> (1) Are you running sa-learn as the same user that SA itself is
> running as, so that you're training the Bayes database that SA is
> actually using to score messages?
>
> (2) Please run sa-learn --dump magic and send us the results.
>
1) For all users there is only one database in /var/bayes. I've done
some tests with su Debian-exim and it is same result.
2) lenny:/home/samuel# sa-learn --dump magic
0.000 0 3 0 non-token data: bayes db version
0.000 0 112532 0 non-token data: nspam
0.000 0 844 0 non-token data: nham
0.000 0 1935545 0 non-token data: ntokens
0.000 0 1047578051 0 non-token data: oldest atime
0.000 0 1256661628 0 non-token data: newest atime
0.000 0 1256648676 0 non-token data: last journal
sync atime
0.000 0 0 0 non-token data: last expiry atime
0.000 0 0 0 non-token data: last expire
atime delta
0.000 0 0 0 non-token data: last expire
reduction count
Thanks.
Sam.
Re: sa-learn spam and Bayes_50
Posted by John Hardin <jh...@impsec.org>.
On Tue, 27 Oct 2009, Sam wrote:
> Oct 27 00:28:24 lenny spamd[20399]: spamd: clean message (0.0/5.0) for
> samuelduran@ingescom.com:102 in 4.8 seconds, 9803 bytes.
> Oct 27 00:28:24 lenny spamd[20399]: spamd: result: . 0 -
> BAYES_50,HTML_IMAGE_RATIO_08,HTML_MESSAGE,MISSING_MID
> scantime=4.8,size=9803,user=samuelduran@ingescom.com,uid=102,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=39593,mid=(unknown),bayes=0.500000,autolearn=no
> O
>
> And after learning with sa-learn, it is still saying bayes_50 whereas
> sa-learn told it has learned it.
Okay, basic Bayes troubleshooting questions:
(1) Are you running sa-learn as the same user that SA itself is running
as, so that you're training the Bayes database that SA is actually using
to score messages?
(2) Please run sa-learn --dump magic and send us the results.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
4 days until Halloween
Re: sa-learn spam and Bayes_50
Posted by Sam <li...@ingescom.com>.
Matus UHLAR - fantomas a écrit :
>>> On Tue, 27 Oct 2009 13:33:14 +0100
>>> Sam <li...@ingescom.com> wrote:
>>>
>>>> I run spamassassin quite fine on a debian-lenny system.
>>>> But I'm having a problem with sa-learn --spam and 1 message :
>>>>
>>>> ...
>>>> But Bayes still show BAYES_50 :
>>>>
>
>
>> RW a écrit :
>>
>>> If you find it surprising that that can happen, you don't understand
>>> how Bayes works. It's a leaning system that's intended to classify mail
>>> it hasn't seen based on mail it has seen.
>>>
>
> On 27.10.09 15:01, Sam wrote:
>
>> I agree with you for non-seen mail. But after learning with sa-learn I
>> thought bayes should increase over Bayes_50 for the same learned message.
>>
>
> what was the score in the begin?
>
I got it this night :
Oct 27 00:28:24 lenny spamd[20399]: spamd: clean message (0.0/5.0) for
samuelduran@ingescom.com:102 in 4.8 seconds, 9803 bytes.
Oct 27 00:28:24 lenny spamd[20399]: spamd: result: . 0 -
BAYES_50,HTML_IMAGE_RATIO_08,HTML_MESSAGE,MISSING_MID
scantime=4.8,size=9803,user=samuelduran@ingescom.com,uid=102,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=39593,mid=(unknown),bayes=0.500000,autolearn=no
O
And after learning with sa-learn, it is still saying bayes_50 whereas
sa-learn told it has learned it.
Thanks.
Sam
Re: sa-learn spam and Bayes_50
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>> On Tue, 27 Oct 2009 13:33:14 +0100
>> Sam <li...@ingescom.com> wrote:
>>> I run spamassassin quite fine on a debian-lenny system.
>>> But I'm having a problem with sa-learn --spam and 1 message :
>>>
>>> ...
>>> But Bayes still show BAYES_50 :
> RW a écrit :
>> If you find it surprising that that can happen, you don't understand
>> how Bayes works. It's a leaning system that's intended to classify mail
>> it hasn't seen based on mail it has seen.
On 27.10.09 15:01, Sam wrote:
> I agree with you for non-seen mail. But after learning with sa-learn I
> thought bayes should increase over Bayes_50 for the same learned message.
what was the score in the begin?
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"They say when you play that M$ CD backward you can hear satanic messages."
"That's nothing. If you play it forward it will install Windows."
Re: sa-learn spam and Bayes_50
Posted by Sam <li...@ingescom.com>.
RW a écrit :
> On Tue, 27 Oct 2009 15:01:39 +0100
> Sam <li...@ingescom.com> wrote:
>
>
>> RW a écrit :
>>
>>> On Tue, 27 Oct 2009 13:33:14 +0100
>>>
>
>
>>> If you find it surprising that that can happen, you don't understand
>>> how Bayes works. It's a leaning system that's intended to classify
>>> mail it hasn't seen based on mail it has seen.
>>>
>>>
>>>
>> I agree with you for non-seen mail. But after learning with sa-learn
>> I thought bayes should increase over Bayes_50 for the same learned
>> message.
>>
>
> Most mails contain a number of hapaxes, one-off tokens that are never
> seen again. If you train on a mail and then retest, hapaxes and other
> rare tokens often skew the result to produce a positive match; this is
> why sometimes a retest will score BAYES_99, but an almost identical spam
> will hit BAYES_50.
>
> On some retests the hapaxes don't dominate on retesting and the
> probability stays close to .5. Like many such filters BAYES clusters
> strongly around 0, 0.5 and 1. If it allowed you to retrain to
> exhaustion (which it doesn't) you would probably see several BAYES_50
> results followed by a step change to BAYES_99.
>
>
> Check that you haven't set "bayes_use_hapaxes 0". Otherwise if you are
> seeing a lot of trained mails hit BAYES_50 on retesting (and I mean 10%
> or so) you may have a mistrained database. If you only see a few, forget
> about it.
>
>
There is no hapax option set.
When a spam isn't marked by spamassassin and bayes isn't bayes_99 I
always train manually with sa-learn.
And I think that I have always seen sa-learn making message going from
bayes_X to bayes_99 when learning and restesting.
I do not remember this situation anytime.
Thanks.
Re: sa-learn spam and Bayes_50
Posted by RW <rw...@googlemail.com>.
On Tue, 27 Oct 2009 15:01:39 +0100
Sam <li...@ingescom.com> wrote:
> RW a écrit :
> > On Tue, 27 Oct 2009 13:33:14 +0100
> > If you find it surprising that that can happen, you don't understand
> > how Bayes works. It's a leaning system that's intended to classify
> > mail it hasn't seen based on mail it has seen.
> >
> >
> I agree with you for non-seen mail. But after learning with sa-learn
> I thought bayes should increase over Bayes_50 for the same learned
> message.
Most mails contain a number of hapaxes, one-off tokens that are never
seen again. If you train on a mail and then retest, hapaxes and other
rare tokens often skew the result to produce a positive match; this is
why sometimes a retest will score BAYES_99, but an almost identical spam
will hit BAYES_50.
On some retests the hapaxes don't dominate on retesting and the
probability stays close to .5. Like many such filters BAYES clusters
strongly around 0, 0.5 and 1. If it allowed you to retrain to
exhaustion (which it doesn't) you would probably see several BAYES_50
results followed by a step change to BAYES_99.
Check that you haven't set "bayes_use_hapaxes 0". Otherwise if you are
seeing a lot of trained mails hit BAYES_50 on retesting (and I mean 10%
or so) you may have a mistrained database. If you only see a few, forget
about it.
Re: sa-learn spam and Bayes_50
Posted by Sam <li...@ingescom.com>.
RW a écrit :
> On Tue, 27 Oct 2009 13:33:14 +0100
> Sam <li...@ingescom.com> wrote:
>
>
>> Hi,
>>
>> I run spamassassin quite fine on a debian-lenny system.
>> But I'm having a problem with sa-learn --spam and 1 message :
>>
>> ...
>> But Bayes still show BAYES_50 :
>>
>
> If you find it surprising that that can happen, you don't understand
> how Bayes works. It's a leaning system that's intended to classify mail
> it hasn't seen based on mail it has seen.
>
>
I agree with you for non-seen mail. But after learning with sa-learn I
thought bayes should increase over Bayes_50 for the same learned message.
Sam.
Re: sa-learn spam and Bayes_50
Posted by Sam <li...@ingescom.com>.
Adam Katz a écrit :
> Sam wrote:
>
>>> I run spamassassin quite fine on a debian-lenny system.
>>> But I'm having a problem with sa-learn --spam and 1 message :
>>> But Bayes still show BAYES_50 :
>>>
>
> The Bayesian algorithm adds tokens from messages it is taught. These
> tokens are then added to the database's existing tokens and
> probabilities are recalculated for each token. Sometimes those new
> tokens aren't terribly useful, having been trained in both ham and
> spam. It is always possible that a message you just trained still
> lacks certainty, thus getting /rounded/ to BAYES_50.
>
> RW wrote:
>
>> If you find it surprising that that can happen, you don't
>> understand how Bayes works. It's a leaning system that's intended
>> to classify mail it hasn't seen based on mail it has seen.
>>
>
> BAYES_50 may be the default for a new mail with no known tokens (a
> pure 50.000%), but it can also be the result of conflicting tokens
> already in the system (anything ranging from 45.000% to 54.999%).
>
> If you were to tell SpamAssassin to report the actual bayes score
> (e.g. "add_header all Bayes _BAYES_" in your local.cf), you'd probably
> find that that message wasn't a pure 50% (though I can't recall how
> many significant digits it uses).
>
>
Ok, I will try to look that bayes log in detail.
Thanks.
Sam.
Re: sa-learn spam and Bayes_50
Posted by Adam Katz <an...@khopis.com>.
Sam wrote:
>> I run spamassassin quite fine on a debian-lenny system.
>> But I'm having a problem with sa-learn --spam and 1 message :
>> But Bayes still show BAYES_50 :
The Bayesian algorithm adds tokens from messages it is taught. These
tokens are then added to the database's existing tokens and
probabilities are recalculated for each token. Sometimes those new
tokens aren't terribly useful, having been trained in both ham and
spam. It is always possible that a message you just trained still
lacks certainty, thus getting /rounded/ to BAYES_50.
RW wrote:
> If you find it surprising that that can happen, you don't
> understand how Bayes works. It's a leaning system that's intended
> to classify mail it hasn't seen based on mail it has seen.
BAYES_50 may be the default for a new mail with no known tokens (a
pure 50.000%), but it can also be the result of conflicting tokens
already in the system (anything ranging from 45.000% to 54.999%).
If you were to tell SpamAssassin to report the actual bayes score
(e.g. "add_header all Bayes _BAYES_" in your local.cf), you'd probably
find that that message wasn't a pure 50% (though I can't recall how
many significant digits it uses).
Re: sa-learn spam and Bayes_50
Posted by RW <rw...@googlemail.com>.
On Tue, 27 Oct 2009 13:33:14 +0100
Sam <li...@ingescom.com> wrote:
> Hi,
>
> I run spamassassin quite fine on a debian-lenny system.
> But I'm having a problem with sa-learn --spam and 1 message :
>
>...
> But Bayes still show BAYES_50 :
If you find it surprising that that can happen, you don't understand
how Bayes works. It's a leaning system that's intended to classify mail
it hasn't seen based on mail it has seen.