You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by David B Funk <db...@engineering.uiowa.edu> on 2016/03/11 05:17:59 UTC
sa-stats log analyzer (RE: Missed spam, suggestions?)
That's the output from Dallas Engelken's "sa-stats.pl" log analyzer.
You feed it a segment of your spamd logs and it gives you
those rule hit statistics.
See: http://wiki.apache.org/spamassassin/StatsAndAnalyzers
Looking at that wiki page, I noticed that the copy available is v0.93.
I've got v1.03
Does anybody know what was the newest one last avaialable on the rulesemporium
site? Anbody got something newer than v1.03?
I've done a bit of hacking to my copy (such as adding the S/O ratio stats).
On Thu, 10 Mar 2016, Erickarlo Porro wrote:
>
> I would like to know how to get these stats too.
>
>
>
> From: Robert Chalmers [mailto:robert@chalmers.com.au]
> Sent: Tuesday, March 08, 2016 5:25 AM
> To: users@spamassassin.apache.org
> Subject: Re: Missed spam, suggestions?
>
>
>
> Can I ask, how are you getting these stats please?
>
>
>
> Thanks
>
> On 8 Mar 2016, at 05:11, David B Funk <db...@engineering.uiowa.edu> wrote:
>
>
>
> On Mon, 7 Mar 2016, Charles Sprickman wrote:
>
>
> I’ve been running with some daily training for a little over a week and I’m seeing less spam in my
> inbox. I’ve seen a few things slip through because bayes tipped them below the default score, these
> were two phishing emails.
>
> Here’s some rule stats for anyone interested:
>
> TOP SPAM RULES FIRED
>
> RANK RULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM
>
> 1 TXREP 13171 8.47 40.38 91.00 72.91
> 2 HTML_MESSAGE 12714 8.18 38.98 87.85 90.80
> 3 DCC_CHECK 10593 6.81 32.48 73.19 33.78
> 4 RDNS_NONE 10269 6.60 31.48 70.95 5.63
> 5 SPF_HELO_PASS 10070 6.48 30.87 69.58 23.41
> 6 URIBL_BLACK 9711 6.25 29.77 67.10 1.58
> 7 BODY_NEWDOMAIN_FMBLA 9550 6.14 29.28 65.98 1.64
> 8 FROM_NEWDOMAIN_FMBLA 9483 6.10 29.07 65.52 1.36
> 9 BAYES_99 8486 5.46 26.02 58.63 1.18
> 10 BAYES_999 8141 5.24 24.96 56.25 1.06
>
> TOP HAM RULES FIRED
>
> RANK RULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM
>
> 1 HTML_MESSAGE 16473 9.13 50.51 87.85 90.80
> 2 DKIM_SIGNED 13776 7.64 42.24 13.81 75.93
> 3 TXREP 13228 7.33 40.56 91.00 72.91
> 4 DKIM_VALID 12962 7.19 39.74 11.93 71.44
> 5 RCVD_IN_DNSWL_NONE 9941 5.51 30.48 8.08 54.79
> 6 DKIM_VALID_AU 8711 4.83 26.71 7.99 48.01
> 7 BAYES_00 8390 4.65 25.72 1.84 46.24
> 8 RCVD_IN_JMF_W 7369 4.09 22.59 2.54 40.62
> 9 RCVD_IN_MSPIKE_WL 6713 3.72 20.58 4.39 37.00
> 10 BAYES_50 6201 3.44 19.01 25.56 34.18
>
>
> Based upon your stats it looks like you need more Bayes training. Your Bayes 00/99 hits should rank higher in the
> rules-fired stats and BAYES_50 shouldn't be in the top-10 at all.
> (of course if you've only been training for a week that would explain it).
>
> For example, here's my top-10 hits (for a one month interval).
>
> TOP SPAM RULES FIRED
> ----------------------------------------------------------------------
> RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM S/O
> ----------------------------------------------------------------------
> 1 T__BOTNET_NOTRUST 114907 60.32 86.81 42.66 0.5755
> 2 BAYES_99 109138 32.98 82.45 0.01 0.9998
> 3 BAYES_999 104903 31.70 79.25 0.01 0.9999
> 4 HTML_MESSAGE 90850 79.41 68.63 86.59 0.3456
> 5 URIBL_BLACK 90845 27.61 68.63 0.27 0.9942
> 6 T_QUARANTINE_1 90640 27.40 68.47 0.02 0.9996
> 7 URIBL_DBL_SPAM 79152 24.02 59.79 0.17 0.9956
> 8 KAM_VERY_BLACK_DBL 74301 22.45 56.13 0.00 1.0000
> 9 L_FROM_SPAMMER1k 73667 22.26 55.65 0.00 1.0000
> 10 T__RECEIVED_1 72413 42.60 54.70 34.54 0.5135
>
> OP HAM RULES FIRED
> ----------------------------------------------------------------------
> RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM S/O
> ----------------------------------------------------------------------
> 1 BAYES_00 182674 56.03 2.11 91.97 0.0150
> 2 HTML_MESSAGE 171992 79.41 68.63 86.59 0.3456
> 3 SPF_PASS 136623 63.08 54.52 68.78 0.3457
> 4 T_RP_MATCHES_RCVD 130879 53.75 35.54 65.89 0.2644
> 5 T__RECEIVED_2 125492 53.76 39.62 63.18 0.2947
> 6 DKIM_SIGNED 114808 38.57 9.72 57.80 0.1008
> 7 DKIM_VALID 105385 34.70 7.16 53.06 0.0825
> 8 RCVD_IN_DNSWL_NONE 92951 29.90 4.56 46.80 0.0609
> 9 T__BOTNET_NOTRUST 84741 60.32 86.81 42.66 0.5755
> 10 KHOP_RCVD_TRUST 84623 26.44 2.19 42.60 0.0331
>
> Note how highly BAYES 00/99 ranked. What you don't see is that BAYES_50 is way down in the mud (below 50 rank).
>
> BTW, this is with a Bayes that is mostly fed via auto-learning. I occasionally
> hand feed corner cases that get mis-classified (usually things like phishes, or conference announcments that can
> look shakey).
>
>
> --
> Dave Funk University of Iowa
> <dbfunk (at) engineering.uiowa.edu> College of Engineering
> 319/335-5751 FAX: 319/384-0549 1256 Seamans Center
> Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
> #include <std_disclaimer.h>
> Better is not better, 'standard' is better. B{
>
>
>
> Robert Chalmers
>
> robert@chalmers.com.au Quantum Radio: http://tinyurl.com/lwwddov
>
> Mac mini 6.2 - 2012, Intel Core i7,2.3 GHz, Memory:16 GB. El-Capitan 10.11. XCode 7.2.1
>
> 2TB: Drive 0:HGST HTS721010A9E630. Upper bay. Drive 1:ST1000LM024 HN-M101MBB. Lower Bay
>
>
>
>
>
>
>
>
>
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: sa-stats log analyzer (RE: Missed spam, suggestions?)
Posted by "robert@chalmers.com.au" <ro...@chalmers.com.au>.
The rulesemporium site appears to be down.
If anyone has a newer version, it might be good to post it somewhere? My site for eg?
Robert
Sent from my iPad
> On 11 Mar 2016, at 04:17, David B Funk <db...@engineering.uiowa.edu> wrote:
>
> That's the output from Dallas Engelken's "sa-stats.pl" log analyzer.
> You feed it a segment of your spamd logs and it gives you
> those rule hit statistics.
>
> See: http://wiki.apache.org/spamassassin/StatsAndAnalyzers
>
> Looking at that wiki page, I noticed that the copy available is v0.93.
> I've got v1.03
> Does anybody know what was the newest one last avaialable on the rulesemporium site? Anbody got something newer than v1.03?
>
> I've done a bit of hacking to my copy (such as adding the S/O ratio stats).
>
>
>> On Thu, 10 Mar 2016, Erickarlo Porro wrote:
>>
>> I would like to know how to get these stats too.
>>
>> From: Robert Chalmers [mailto:robert@chalmers.com.au]
>> Sent: Tuesday, March 08, 2016 5:25 AM
>> To: users@spamassassin.apache.org
>> Subject: Re: Missed spam, suggestions?
>>
>> Can I ask, how are you getting these stats please?
>>
>> Thanks
>>
>> On 8 Mar 2016, at 05:11, David B Funk <db...@engineering.uiowa.edu> wrote:
>>
>> On Mon, 7 Mar 2016, Charles Sprickman wrote:
>>
>> I’ve been running with some daily training for a little over a week and I’m seeing less spam in my
>> inbox. I’ve seen a few things slip through because bayes tipped them below the default score, these
>> were two phishing emails.
>>
>> Here’s some rule stats for anyone interested:
>>
>> TOP SPAM RULES FIRED
>>
>> RANK RULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM
>>
>> 1 TXREP 13171 8.47 40.38 91.00 72.91
>> 2 HTML_MESSAGE 12714 8.18 38.98 87.85 90.80
>> 3 DCC_CHECK 10593 6.81 32.48 73.19 33.78
>> 4 RDNS_NONE 10269 6.60 31.48 70.95 5.63
>> 5 SPF_HELO_PASS 10070 6.48 30.87 69.58 23.41
>> 6 URIBL_BLACK 9711 6.25 29.77 67.10 1.58
>> 7 BODY_NEWDOMAIN_FMBLA 9550 6.14 29.28 65.98 1.64
>> 8 FROM_NEWDOMAIN_FMBLA 9483 6.10 29.07 65.52 1.36
>> 9 BAYES_99 8486 5.46 26.02 58.63 1.18
>> 10 BAYES_999 8141 5.24 24.96 56.25 1.06
>>
>> TOP HAM RULES FIRED
>>
>> RANK RULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM
>>
>> 1 HTML_MESSAGE 16473 9.13 50.51 87.85 90.80
>> 2 DKIM_SIGNED 13776 7.64 42.24 13.81 75.93
>> 3 TXREP 13228 7.33 40.56 91.00 72.91
>> 4 DKIM_VALID 12962 7.19 39.74 11.93 71.44
>> 5 RCVD_IN_DNSWL_NONE 9941 5.51 30.48 8.08 54.79
>> 6 DKIM_VALID_AU 8711 4.83 26.71 7.99 48.01
>> 7 BAYES_00 8390 4.65 25.72 1.84 46.24
>> 8 RCVD_IN_JMF_W 7369 4.09 22.59 2.54 40.62
>> 9 RCVD_IN_MSPIKE_WL 6713 3.72 20.58 4.39 37.00
>> 10 BAYES_50 6201 3.44 19.01 25.56 34.18
>> Based upon your stats it looks like you need more Bayes training. Your Bayes 00/99 hits should rank higher in the
>> rules-fired stats and BAYES_50 shouldn't be in the top-10 at all.
>> (of course if you've only been training for a week that would explain it).
>> For example, here's my top-10 hits (for a one month interval).
>> TOP SPAM RULES FIRED
>> ----------------------------------------------------------------------
>> RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM S/O
>> ----------------------------------------------------------------------
>> 1 T__BOTNET_NOTRUST 114907 60.32 86.81 42.66 0.5755
>> 2 BAYES_99 109138 32.98 82.45 0.01 0.9998
>> 3 BAYES_999 104903 31.70 79.25 0.01 0.9999
>> 4 HTML_MESSAGE 90850 79.41 68.63 86.59 0.3456
>> 5 URIBL_BLACK 90845 27.61 68.63 0.27 0.9942
>> 6 T_QUARANTINE_1 90640 27.40 68.47 0.02 0.9996
>> 7 URIBL_DBL_SPAM 79152 24.02 59.79 0.17 0.9956
>> 8 KAM_VERY_BLACK_DBL 74301 22.45 56.13 0.00 1.0000
>> 9 L_FROM_SPAMMER1k 73667 22.26 55.65 0.00 1.0000
>> 10 T__RECEIVED_1 72413 42.60 54.70 34.54 0.5135
>> OP HAM RULES FIRED
>> ----------------------------------------------------------------------
>> RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM S/O
>> ----------------------------------------------------------------------
>> 1 BAYES_00 182674 56.03 2.11 91.97 0.0150
>> 2 HTML_MESSAGE 171992 79.41 68.63 86.59 0.3456
>> 3 SPF_PASS 136623 63.08 54.52 68.78 0.3457
>> 4 T_RP_MATCHES_RCVD 130879 53.75 35.54 65.89 0.2644
>> 5 T__RECEIVED_2 125492 53.76 39.62 63.18 0.2947
>> 6 DKIM_SIGNED 114808 38.57 9.72 57.80 0.1008
>> 7 DKIM_VALID 105385 34.70 7.16 53.06 0.0825
>> 8 RCVD_IN_DNSWL_NONE 92951 29.90 4.56 46.80 0.0609
>> 9 T__BOTNET_NOTRUST 84741 60.32 86.81 42.66 0.5755
>> 10 KHOP_RCVD_TRUST 84623 26.44 2.19 42.60 0.0331
>> Note how highly BAYES 00/99 ranked. What you don't see is that BAYES_50 is way down in the mud (below 50 rank).
>> BTW, this is with a Bayes that is mostly fed via auto-learning. I occasionally
>> hand feed corner cases that get mis-classified (usually things like phishes, or conference announcments that can
>> look shakey).
>> --
>> Dave Funk University of Iowa
>> <dbfunk (at) engineering.uiowa.edu> College of Engineering
>> 319/335-5751 FAX: 319/384-0549 1256 Seamans Center
>> Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
>> #include <std_disclaimer.h>
>> Better is not better, 'standard' is better. B{
>>
>> Robert Chalmers
>> robert@chalmers.com.au Quantum Radio: http://tinyurl.com/lwwddov
>> Mac mini 6.2 - 2012, Intel Core i7,2.3 GHz, Memory:16 GB. El-Capitan 10.11. XCode 7.2.1
>> 2TB: Drive 0:HGST HTS721010A9E630. Upper bay. Drive 1:ST1000LM024 HN-M101MBB. Lower Bay
>>
>>
>>
>>
>
> --
> Dave Funk University of Iowa
> <dbfunk (at) engineering.uiowa.edu> College of Engineering
> 319/335-5751 FAX: 319/384-0549 1256 Seamans Center
> Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
> #include <std_disclaimer.h>
> Better is not better, 'standard' is better. B{