AWL

[Matthew Yette <my...@mapolce.com>]

I've been getting emails from echannellineUSA@echannelline.com which my
spam filter rightly tags as spam. However, the rules it flags are as
follows:

X-Spam-Status: Yes, hits=6.7 required=5.0
X-Spam-Level: ++++++
X-Spam-Report: SA TESTS
  1.5 NO_REAL_NAME           From: does not include a real name
  0.1 EXCUSE_3               BODY: Claims you can be removed from the
list
  0.2 REMOVE_PAGE            URI: URL of page called "remove"
  0.1 MAILTO_TO_REMOVE       URI: Includes a 'remove' email address
  0.1 HTML_80_90             BODY: Message is 80% to 90% HTML
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.0 BAYES_50               BODY: Bayesian spam probability is 40 to
60%
                             [score: 0.5000]
  1.5 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.5 MAILTO_SUBJ_REMOVE     RAW: mailto URI includes removal text
  3.2 URIBL_OB_SURBL         Contains an URL listed in the OB SURBL
blocklist
                             [URIs: integratedmar.com]
 -0.6 AWL                    AWL: From: address is in the auto
white-list

What troubles me is the AWL score. Pulling up stats on the email address
from the AWL database, it has a count of 8 and a totalscore of 50.168.
Wouldn't this mean that the score it would assign the message for AWL
would be something like 6.1? Not a -0.6?

--
Matthew Yette
Senior Engineer - NOC/Operations
MA Polce Consulting, Inc.
myette@mapolce.com
315-838-1644 (w)
315-356-0597 (f)
AIM/Yahoo: MAPolceNOC
MSN: noc@mapolce.com

Re: AWL

[Matt Kettler <mk...@comcast.net>]

At 08:22 AM 7/29/2005, Matthew Yette wrote:
>I've been getting emails from echannellineUSA@echannelline.com which my
>spam filter rightly tags as spam. However, the rules it flags are as
>follows:
>
>X-Spam-Status: Yes, hits=6.7 required=5.0
>
>What troubles me is the AWL score.

It should not.

>  Pulling up stats on the email address
>from the AWL database, it has a count of 8 and a totalscore of 50.168.
>Wouldn't this mean that the score it would assign the message for AWL
>would be something like 6.1? Not a -0.6?

No. The total score is the TOTAL score.. not the AWL tracked average..

AWL total score 50.168:
AWL count: 8
AWL average: 6.271

Current score 6.7, thus the AWL should subtract, not add. Remember, the AWL 
doesn't add it's score, it tries to split the difference between the 
historical average and the current message. Since the historical average is 
less than the current score, it has to subtract.


In order to add +6.1, the AWL average would have to be 18.9, which it isn't.


Besides.. you should NOT be troubled by negative AWL scores on spam. This 
is *completely* normal and does NOT mean the AWL thinks the message is 
nonspam.. In this case, the AWL still felt the message was spam, as the AWL 
average score is 6.2.

Read:
http://wiki.apache.org/spamassassin/AwlWrongWay