Bayes Question

[Craig <cc...@unitedwayqc.org>]

Hello All-
 
My bayes database seems to have problems and I would like suggestion on
how to correct.  Here is my issue-
I take any spam email from my users and run the following commands
a. spamassassin -R name of spam file to check
b. spamassassin -r name of spam file to check
c. sa-learn --forget name of spam file to check
d. sa-learn --spam name of spam file to check
 
I re-run an email (spamassassin -D -t <name of spam file to check> name
of spam file to check.txt)
 to check all is well-that bayes learned the email as spam.  Today
after running the above I still have several messages with the following
output info:
 
 
Content analysis details:   (-0.1 points, 5.0 required)
 
 pts rule name              description
---- ----------------------
--------------------------------------------------
 0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
-0.2 BAYES_40               BODY: Bayesian spam probability is 20 to
40%
                            [score: 0.2729]
Thoughts?
 
Thanks
Craig
 

Re: Bayes Question

[Matt Kettler <mk...@verizon.net>]

Craig wrote:
> Hello All-
>  
> My bayes database seems to have problems and I would like suggestion
> on how to correct.  Here is my issue-
> I take any spam email from my users and run the following commands
> a. spamassassin -R name of spam file to check
> b. spamassassin -r name of spam file to check
> c. sa-learn --forget name of spam file to check
> d. sa-learn --spam name of spam file to check
1) running forget before training is redundant. SpamAssassin is smart
enough to realize when it is retraining a message that was previously
learned the wrong way and compensate correctly.

2) Running sa-learn --spam after spamassassin -r is redundant, unless
you've set bayes_learn_during_report to 0.

So really, you only need to do a and b. I assume you're trying to
"over-do-it" on purpose, but did want to point out what parts are
redundant for clarity sake.

>  
> I re-run an email (spamassassin -D -t <name of spam file to check>
> name of spam file to check.txt)
>  to check all is well-that bayes learned the email as spam.  Today
> after running the above I still have several messages with the
> following output info:
>  
>  
> Content analysis details:   (-0.1 points, 5.0 required)
>  
>  pts rule name              description
> ---- ----------------------
> --------------------------------------------------
>  0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
> -0.2 BAYES_40               BODY: Bayesian spam probability is 20 to 40%
>                             [score: 0.2729]
> Thoughts?
My first thought is:

What was it's bayes score *before* you trained?

Training a single message as spam will not guarantee that it will
immediately get a high bayes score. If most of the tokens in the message
strongly match a large volume of nonspam training, it will take a
similar volume of spam training to overcome it. Otherwise one
mis-trained message could wildly upset your whole bayes database causing
large numbers of mis-marked messages.

If you really are seeing this problem a lot, you might want to take some
of the spams and run them through "spamassassin -D bayes" in order to
get the individual tokens and their scores to be printed out.
(Previously you used spamassassin -D -t, which isn't the same. That's
general debugging, but doesn't enable detailed bayes debugging.)