You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Thomas Kinghorn [MTNNS -Rosebank]" <th...@mtnns.net> on 2005/07/05 07:37:54 UTC
More spam since upgrading
Morning list.
I have recently upgraded to SpamAssassin 3.0.4 from 3.0.1 and have
noticed
Quite a large increase of the number of SPAM slipping through.
Have all the standard ruleset scores been lowered?
I am using the rulesets from sare aswell.
Does anyone else see the same trend?
Many thanks
Regards,
Tom Kinghorn
Re: More spam since upgrading
Posted by Kai Schaetzl <ma...@conactive.com>.
Thomas Kinghorn [MTNNS -Rosebank] wrote on Tue, 5 Jul 2005 07:37:54 +0200:
> Does anyone else see the same trend?
No. Check if you still get all the same tests run and have the same
scoreas than before.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org
Re: More spam since upgrading
Posted by Kai Schaetzl <ma...@conactive.com>.
Steven Dickenson wrote on Wed, 6 Jul 2005 06:33:59 -0400:
> That's probably what makes me a little paranoid about bayes, we run
> it site wide so I'm always worried the database will go south PDQ.
I think the decision on using user-specific or site-wide Bayes strongly
depends on how much (many?) mail your users get. If they get too few mail
their Bayes may take quite a while to kick in and it may also take only a
few errants to spoil the Bayes (or the AWL) db. A site-wide db protects
them much better, against spam and against FPs. If you have a big
site-wide db just a few spam learned to it won't spoil the db. It also
means that spam going to one user will also protect other users. I'm all
in favor of site-wide dbs unless your users (each of them) has a
considerably high mail influx.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org
Re: More spam since upgrading
Posted by Steven Dickenson <st...@mrchuckles.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Jul 6, 2005, at 12:44 AM, jdow wrote:
> OK OK - I made it 4.999 just for you. {^_-}
Thanks, I'll sleep better now knowing this... :-P
I was under the impression you made BAYES_99 worth 99 points. 5
points for bayes isn't terrible, provided you have a well trained
bayes database and the possibility for ham to trigger some negative
rules. My sites run BAYES_99 in the 4.5-ish range.
> (That said, the rules for Bayes need bayesic reworking. There are two
> modes in which it works, per user or global. In per user mode with
> some
> decent manual training it is quite good. In global with hundreds of
> users and "autolearn" it is probably at best an 80% thing. Some
> personal
> for the per user with no autolearn is quite worthwhile.)
That's probably what makes me a little paranoid about bayes, we run
it site wide so I'm always worried the database will go south PDQ.
On my personal machine at home with per-user accounts, I've never
seen bayes score a FP.
Steven
- ---
Steven Dickenson <st...@mrchuckles.net>
http://www.mrchuckles.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)
iD8DBQFCy7Oa5L54ch7cA1QRApQfAKCNaYetO0QGinxerigEK8KjL2m5RQCffVfA
RKiUsgSe2inqkx07ZKcJsEs=
=WpJl
-----END PGP SIGNATURE-----
Re: More spam since upgrading
Posted by jdow <jd...@earthlink.net>.
From: "Steven Dickenson" <st...@mrchuckles.net>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Jul 5, 2005, at 8:37 AM, Jerry Van Brimmer wrote:
> >> I also set my bayes to score 5 points for a 99 score, that gets
> >> the stock
> >> scam guys who think they are just too slick by using a different
> >> clean IP
> >> every time.
> >
> > I'm just learning how to use SA. Would you please tell me How to
> > set this option?
>
> It's not a wise idea to set any rule to score this high, particularly
> something as variable as a Bayes rule. In general, it's considered
> bad form for any one rule to score a message as spam by itself.
>
> With that being said, you're going to want to add a SCORE entry in
> your local.cf. This page should help you get up to speed with
> writing SA rules (or just re-scoring existing ones).
>
> http://wiki.apache.org/spamassassin/WritingRules
>
> Steven
> - ---
> Steven Dickenson <st...@mrchuckles.net>
> http://www.mrchuckles.net
OK OK - I made it 4.999 just for you. {^_-}
If a rule has not shot me false alarms in a VERY long time and it has
caught spams nothing else seemed to touch I like to give it a nice solid
score. I don't believe fighting by "Roberts Rules" or even "Marquis of
Queensbury" rules makes sense if things are bad enough to make fighting
a good idea. But in deference to the one rule bigots out there I just
lowered it a tenth of a point. But if I see that on ANYTHING that has
no other markups it goes back to 5.0. Otherwise, what is the point of
Bayes if you are not going to believe it?
I prefer to see how high I can get scores to go with collections of rules
that show very low false alarm rates when used. But then I also like nice
"sure thing" rules such as my addresses but at mail.earthlink.com. And
another good one for awhile was "X-Mailer =~ /MOM Agent/i". I never
received a real mailing from it. But for a couple months it sent me a
lot of spam. Why cripple yourself when you have a working killer stroke?
(That said, the rules for Bayes need bayesic reworking. There are two
modes in which it works, per user or global. In per user mode with some
decent manual training it is quite good. In global with hundreds of
users and "autolearn" it is probably at best an 80% thing. Some personal
for the per user with no autolearn is quite worthwhile.)
{^_^} <- Joanne believes in the "largest weapon that has zero collateral
damage as she can bring to bear. 'Fair' is for losers.")
Re: More spam since upgrading
Posted by Steven Dickenson <st...@mrchuckles.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Jul 5, 2005, at 8:37 AM, Jerry Van Brimmer wrote:
>> I also set my bayes to score 5 points for a 99 score, that gets
>> the stock
>> scam guys who think they are just too slick by using a different
>> clean IP
>> every time.
>
> I'm just learning how to use SA. Would you please tell me How to
> set this option?
It's not a wise idea to set any rule to score this high, particularly
something as variable as a Bayes rule. In general, it's considered
bad form for any one rule to score a message as spam by itself.
With that being said, you're going to want to add a SCORE entry in
your local.cf. This page should help you get up to speed with
writing SA rules (or just re-scoring existing ones).
http://wiki.apache.org/spamassassin/WritingRules
Steven
- ---
Steven Dickenson <st...@mrchuckles.net>
http://www.mrchuckles.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)
iD8DBQFCyw+W5L54ch7cA1QRAix6AKC/p1rfdSfQH/GcwEgNxg5V7hj9EgCfV5H/
tmO5JdfxYdzMMVT/XKTeOLE=
=/DdZ
-----END PGP SIGNATURE-----
Re: More spam since upgrading
Posted by Jerry Van Brimmer <je...@runbox.com>.
----- Start Original Message -----
From: "Greg Allen" <sa...@floridacpu.com>
To: <us...@spamassassin.apache.org>
Subject: RE: More spam since upgrading
> I also set my bayes to score 5 points for a 99 score, that gets the stock
> scam guys who think they are just too slick by using a different clean IP
> every time.
Hello,
I'm just learning how to use SA. Would you please tell me How to set this option?
Thanks
RE: More spam since upgrading
Posted by Greg Allen <sa...@floridacpu.com>.
More spam since upgradingI filter a fair amount of email with 3.0.4, and
very little spam ever gets through these days. Almost none actually.
Make sure you have everything working correctly.
run the command
spamassassin -D --lint
Look very very carefully in the results for any plugins missing or other
errors. You may have to run lint in super user mode if your SA runs as a
different user.
If so, su username, then run lint as above.
I also set my bayes to score 5 points for a 99 score, that gets the stock
scam guys who think they are just too slick by using a different clean IP
every time.
-----Original Message-----
From: Thomas Kinghorn [MTNNS -Rosebank] [mailto:thomask@mtnns.net]
Sent: Tuesday, July 05, 2005 1:38 AM
To: users@spamassassin.apache.org
Subject: More spam since upgrading
Morning list.
I have recently upgraded to SpamAssassin 3.0.4 from 3.0.1 and have noticed
Quite a large increase of the number of SPAM slipping through.
Have all the standard ruleset scores been lowered?
I am using the rulesets from sare aswell.
Does anyone else see the same trend?
Many thanks
Regards,
Tom Kinghorn