You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Payal Rathod <pa...@scriptkitchen.com> on 2004/10/04 10:40:14 UTC
bayes problem
Hi,
I am trying SA for the first time on my friend's server. We are starting it like,
# ps waux | grep spam
root 10589 0.0 1.9 25264 19808 ? S Oct02 0:03 /usr/bin/spamd -d -a
We use SpamAssassin version 2.61 an RPM install on RH Linux.
Now we have a qmail system there and we are calling spamc from my .qmail file with a
program ifspamh (http://www.gbnet.net/~jrg/qmail/ifspamh)
which essentially just dumps the mails marked with spam in a different folder.
When I run spamd -D and find bayes there I have 4 lines of it,
debug: bayes: no dbs present, cannot scan: /tmp/spamd-9119-init/.spamassassin/bayes_toks
debug: bayes: Not available for scanning, only 0 spam(s) in Bayes DB < 200
debug: bayes: 9119 untie-ing
debug: bayes: 9119 untie-ing db_toks
# sa-learn --dump magic
0.000 0 2 0 non-token data: bayes db version
0.000 0 267 0 non-token data: nspam
0.000 0 219 0 non-token data: nham
[...]
But still I find that there is no word bayes in header of any spam mails?
Is my bayes working?
Thanks a lot in advance.
With warm regards,
-Payal
Re: bayes problem
Posted by Payal Rathod <pa...@scriptkitchen.com>.
On Mon, Oct 04, 2004 at 12:05:35PM -0500, Andy Jezierski wrote:
>
> In your local.cf you should have use_bayes 1
Now it is,
required_hits 4.5
report_safe 0
skip_rbl_checks 1
rewrite_subject 1
subject_tag [SPAM]
score DEAR_SOMETHING 0.8
score FROM_WEBMAIL_END_NUMS6 1.5
bayes_path /root/.spamassassin
use_bayes 1
# pwd
/root/.spamassassin
# ls
bayes_seen bayes_toks user_prefs
Is there anything more I need?
With warm regards,
-Payal
Re: bayes problem
Posted by Andy Jezierski <aj...@stepan.com>.
Payal Rathod <pa...@scriptkitchen.com> wrote on 10/04/2004 11:58:23 AM:
> On Mon, Oct 04, 2004 at 11:52:04AM -0500, Andy Jezierski wrote:
> > Look farther down in the debug, after the plugins get loaded and before
the
> > DNS lookups..
>
> [...]
>
> I get no such output. There are only 4 lines with word bayes in them.
> Is there anything I am missing? Do I have to enable bayes somewhere?
>
> Regards,
> -Payal
In your local.cf you should have use_bayes 1
Andy
Re: bayes problem
Posted by Payal Rathod <pa...@scriptkitchen.com>.
On Mon, Oct 04, 2004 at 11:52:04AM -0500, Andy Jezierski wrote:
> Look farther down in the debug, after the plugins get loaded and before the
> DNS lookups..
[...]
I get no such output. There are only 4 lines with word bayes in them.
Is there anything I am missing? Do I have to enable bayes somewhere?
Regards,
-Payal
Re: bayes problem
Posted by Payal Rathod <pa...@scriptkitchen.com>.
On Mon, Oct 04, 2004 at 01:07:43PM -0500, Andy Jezierski wrote:
> You have to continually keep bayes updated! If not, it won't help much
> with the ever changing nature of spam messages. Read through the docs
[...]
Thanks for the info. I am still a little bit unconvinced that bayes
is really working. Because I can see no header matching bayes
in my ham and none in my spam too.
With warm reagrds,
-Payal
Re: bayes problem
Posted by Andy Jezierski <aj...@stepan.com>.
Payal Rathod <pa...@scriptkitchen.com> wrote on 10/04/2004 12:54:46 PM:
> On Mon, Oct 04, 2004 at 12:48:18PM -0500, Andy Jezierski wrote:
> > Yep, bayes is working, notice the BAYESS_99 rule hit above. Another
thing
> > to keep in mind is that Bayes only kicks in after you have 200 ham &
200
> > spam messages learned. Looks like your bayes has only recently gone
above
> > the 200 mark.
>
> Thanks a lot for the mails all of you. For how many more messages do I
have
> to train bayes? It is rather a tiring job.
>
> -Payal
>
You have to continually keep bayes updated! If not, it won't help much
with the ever changing nature of spam messages. Read through the docs
about bayes auto-learning to see if it's something that you might want to
implement. Some people use it, others don't. It's a matter of personal
preference as well as how well you trust your existing SA implementation to
correctly classify incoming messages. If you are currently getting a lot
of false positives or false negatives, I'd think twice before turning on
auto learning. If you pollute your bayes database with incorrectly
classified messages, your users will start screaming, and you'll have to
trash your bayes database and start all over again.
Andy
Re: bayes problem
Posted by Payal Rathod <pa...@scriptkitchen.com>.
On Mon, Oct 04, 2004 at 12:48:18PM -0500, Andy Jezierski wrote:
> Yep, bayes is working, notice the BAYESS_99 rule hit above. Another thing
> to keep in mind is that Bayes only kicks in after you have 200 ham & 200
> spam messages learned. Looks like your bayes has only recently gone above
> the 200 mark.
Thanks a lot for the mails all of you. For how many more messages do I have
to train bayes? It is rather a tiring job.
-Payal
Re: bayes problem
Posted by Theo Van Dinter <fe...@kluge.net>.
On Mon, Oct 04, 2004 at 01:34:58PM -0400, Payal Rathod wrote:
> You mean spamd -D, right. spamassassin -D just waits for till I
> press ctrl-c
No, I meant "run a message through spamassassin -D".
> I modified the local.cf file slightly to have,
> use_bayes 1
unnecessary, but ok...
> debug: bayes: found bayes db version 2
> debug: bayes corpus size: nspam = 267, nham = 235
good.
> debug: bayes token 'N:H*m:NNNNNNNNNN' => 0.998514469453376
> debug: bayes token 'H*F:D*org' => 0.978
> debug: bayes token 'somewhat' => 0.958
only found 3 tokens in the message.
> debug: bayes: score = 0.999904058950849
looks very spammy.
> debug: is spam? score=7.477 required=4.5 tests=BAYES_99,DATE_MISSING,NO_REAL_NAM
hits BAYES_99.
> Does this mean that bayes is working?
yep. :)
--
Randomly Generated Tagline:
"Now, medium starch potatoes do look kind of like Russets but they always
have [a] lighter kind of thinner skin. Now, varieties like this Yukon
Gold, Kennebecs, Superiors or, say, these California Longs are for some
reason always marketed as white. Racism. It's ugly. Even in tubers."
- Alton Brown, Good Eats, "This Spud's For You"
Re: bayes problem
Posted by Andy Jezierski <aj...@stepan.com>.
Payal Rathod <pa...@scriptkitchen.com> wrote on 10/04/2004 12:34:58 PM:
> On Mon, Oct 04, 2004 at 01:13:50PM -0400, Theo Van Dinter wrote:
> > Watch the rest of the debug output, run "spamassassin -D", etc.
>
> You mean spamd -D, right. spamassassin -D just waits for till I
> press ctrl-c
>
> I modified the local.cf file slightly to have,
> #bayes_path /root/.spamassassin/bayes
> use_bayes 1
>
> # spamd -D > sss 2>&1
> # grep -i bayes sss
> # grep -i bayes sss
> debug: bayes: 4983 tie-ing to DB file R/O /root/.spamassassin/bayes_toks
> debug: bayes: 4983 tie-ing to DB file R/O /root/.spamassassin/bayes_seen
> debug: bayes: found bayes db version 2
> debug: bayes corpus size: nspam = 267, nham = 235
> debug: bayes token 'N:H*m:NNNNNNNNNN' => 0.998514469453376
> debug: bayes token 'H*F:D*org' => 0.978
> debug: bayes token 'somewhat' => 0.958
> debug: bayes: score = 0.999904058950849
> debug: bayes: 4983 untie-ing
> debug: bayes: 4983 untie-ing db_toks
> debug: bayes: 4983 untie-ing db_seen
> debug: is spam? score=7.477 required=4.5
tests=BAYES_99,DATE_MISSING,NO_REAL_NAM
>
> Does this mean that bayes is working?
>
> With warm regards,
> -Payal
Yep, bayes is working, notice the BAYESS_99 rule hit above. Another thing
to keep in mind is that Bayes only kicks in after you have 200 ham & 200
spam messages learned. Looks like your bayes has only recently gone above
the 200 mark.
Andy
Re: bayes problem
Posted by Payal Rathod <pa...@scriptkitchen.com>.
On Mon, Oct 04, 2004 at 01:13:50PM -0400, Theo Van Dinter wrote:
> Watch the rest of the debug output, run "spamassassin -D", etc.
You mean spamd -D, right. spamassassin -D just waits for till I
press ctrl-c
I modified the local.cf file slightly to have,
#bayes_path /root/.spamassassin/bayes
use_bayes 1
# spamd -D > sss 2>&1
# grep -i bayes sss
# grep -i bayes sss
debug: bayes: 4983 tie-ing to DB file R/O /root/.spamassassin/bayes_toks
debug: bayes: 4983 tie-ing to DB file R/O /root/.spamassassin/bayes_seen
debug: bayes: found bayes db version 2
debug: bayes corpus size: nspam = 267, nham = 235
debug: bayes token 'N:H*m:NNNNNNNNNN' => 0.998514469453376
debug: bayes token 'H*F:D*org' => 0.978
debug: bayes token 'somewhat' => 0.958
debug: bayes: score = 0.999904058950849
debug: bayes: 4983 untie-ing
debug: bayes: 4983 untie-ing db_toks
debug: bayes: 4983 untie-ing db_seen
debug: is spam? score=7.477 required=4.5 tests=BAYES_99,DATE_MISSING,NO_REAL_NAM
Does this mean that bayes is working?
With warm regards,
-Payal
Re: bayes problem
Posted by Theo Van Dinter <fe...@kluge.net>.
On Mon, Oct 04, 2004 at 12:39:24PM -0400, Payal Rathod wrote:
> > That's the init message being sent through spamd -- there are no Bayes DBs at
> > that point. Ignore it. :)
>
> But how do I know for sure bayes is working or not?
Watch the rest of the debug output, run "spamassassin -D", etc.
--
Randomly Generated Tagline:
It's not really a rule--it's more like a trend.
-- Larry Wall in <19...@wall.org>
Re: bayes problem
Posted by Andy Jezierski <aj...@stepan.com>.
Payal Rathod <pa...@scriptkitchen.com> wrote on 10/04/2004 11:39:24 AM:
> On Mon, Oct 04, 2004 at 11:59:12AM -0400, Theo Van Dinter wrote:
> > That's the init message being sent through spamd -- there are no Bayes
DBs at
> > that point. Ignore it. :)
>
> But how do I know for sure bayes is working or not?
> -Payal
Look farther down in the debug, after the plugins get loaded and before the
DNS lookups..
Example:
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8bcda28)
inhibited further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8bcda28)
inhibited further callbacks
debug: using "/home/spamd/.spamassassin" for user state dir
debug: bayes: 98221 tie-ing to DB file R/O
/home/spamd/.spamassassin/bayes_toks
debug: bayes: 98221 tie-ing to DB file R/O
/home/spamd/.spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: using "/home/spamd/.spamassassin" for user state dir
debug: bayes: opportunistic call found journal sync due
debug: Syncing Bayes and expiring old tokens...
debug: lock: 98221 created /home/spamd/.spamassassin/bayes.mutex
debug: lock: 98221 trying to get lock on /home/spamd/.spamassassin/bayes
with 10 timeout
debug: lock: 98221 link to /home/spamd/.spamassassin/bayes.mutex: link ok
debug: bayes: 98221 tie-ing to DB file R/W
/home/spamd/.spamassassin/bayes_toks
debug: bayes: 98221 tie-ing to DB file R/W
/home/spamd/.spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: refresh: 98221 refresh /home/spamd/.spamassassin/bayes.mutex
debug: refresh: 98221 refresh /home/spamd/.spamassassin/bayes.mutex
debug: synced Bayes databases from journal in 9 seconds: 5039 unique
entries (11593 total entries)
debug: Syncing complete.
debug: Score set 3 chosen.
debug: received-header: parsed as [ ip=66.223.142.99
rdns=99-142-223-66.gci.net helo=marketing-matters.co.uk by=viper.stepan.com
ident= envfrom= intl=0 id=i91HOYiK056567 ]
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.47
Andy
Re: bayes problem
Posted by Payal Rathod <pa...@scriptkitchen.com>.
On Mon, Oct 04, 2004 at 11:59:12AM -0400, Theo Van Dinter wrote:
> That's the init message being sent through spamd -- there are no Bayes DBs at
> that point. Ignore it. :)
But how do I know for sure bayes is working or not?
-Payal
Re: bayes problem
Posted by Theo Van Dinter <fe...@kluge.net>.
On Mon, Oct 04, 2004 at 04:40:14AM -0400, Payal Rathod wrote:
> When I run spamd -D and find bayes there I have 4 lines of it,
> debug: bayes: no dbs present, cannot scan: /tmp/spamd-9119-init/.spamassassin/bayes_toks
> debug: bayes: Not available for scanning, only 0 spam(s) in Bayes DB < 200
> debug: bayes: 9119 untie-ing
> debug: bayes: 9119 untie-ing db_toks
That's the init message being sent through spamd -- there are no Bayes DBs at
that point. Ignore it. :)
--
Randomly Generated Tagline:
"Jack- she's two. You could surprise her with a piece of old bread."
- From Just Shoot Me