You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Robert Bartlett <ro...@digitalphx.com> on 2006/01/12 19:31:12 UTC
AWL and Auto Learn Bayes
Since finding out the trusted_network issue I question the rest of my
local.cf setup. Right now I have AWL turned off and auto learning for bayes
turned off. My question is does SA benefit from turning those 2 back on? Of
course I would clear out AWL and bayes and start from scratch if I did. But
would it make it easier for bayes to be "poisoned" if I turned auto learn
on? Im on SA 3.0.1.
Thanks
Robert
Re: SURBL
Posted by Irina <ir...@nas.net>.
Thank you.
We catch so many now I see in scores.
Irina
----- Original Message -----
From: "Matt Kettler" <mk...@evi-inc.com>
To: "Irina" <ir...@nas.net>
Cc: <us...@spamassassin.apache.org>
Sent: Thursday, January 12, 2006 4:05 PM
Subject: Re: SURBL
> Irina wrote:
> > Thank you Matt and Leonardo,
> >
> > Oh, noooo. I checked about everything, but not this file. I am missing
it
> > there. I am afraid I don't have the original file and will have to find
in
> > a TAR file.
>
> Yes, you NEED init.pre.
>
> Also, if you're using SA 3.1.0 you'll need v310.pre.
>
> (In SA 3.1.0 you can't even use the AWL without it's loadplugin in
v310.pre)
>
>
>
Re: SURBL
Posted by Jeff Chan <je...@surbl.org>.
I forgot to add, if you're processing more than 100k messages per
day, then you should probably apply for rsync access to the SURBL
zone files and serve them up locally:
http://www3.surbl.org/rsync-signup.html
That too will improve performance.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: SURBL
Posted by Jeff Chan <je...@surbl.org>.
On Friday, January 13, 2006, 10:12:40 AM, Irina Irina wrote:
> Hello Matt and all,
> I enabled SURBL checks on a secondary server yesterday. It catches spam so
> great that I like it very much.
> Today I enabled it on our main server... Queue started to grow, messages
> were piling up. I had to revert back, queue then went down gradually.
> Compared on both servers with
> spamassassin -D --lint
> and did not notice too big difference in time (thought it would take much
> longer on the main server).
> Do I need to have this in local
> skip_rbl_checks 0
> to hit SURBL checks? Or only loadplugin
> Mail::SpamAssassin::Plugin::URIDNSBL?
I believe you need both, however skip_rbl_checks 0 enables all
the RBL tests, not just SURBLs.
http://spamassassin.apache.org/full/3.1.x/dist/rules/20_dnsbl_tests.cf
If you were previously not using RBL tests and only want to use
SURBLs, then you can give zero scores to the other RBL tests.
That may save some processing time, if it lowers your scores
somewhat.
http://spamassassin.apache.org/full/3.1.x/dist/rules/50_scores.cf
score RCVD_IN_BL_SPAMCOP_NET 0 1.332 0 1.558
score RCVD_IN_DSBL 0 1.801 0 2.600
score RCVD_IN_IADB_VOUCHED 0 -1.825 0 -2.200
score RCVD_IN_NJABL_CGI 0 # n=1 n=3
score RCVD_IN_NJABL_DUL 0 1.713 0 1.946
score RCVD_IN_NJABL_MULTI 0 # n=1 n=3
score RCVD_IN_NJABL_PROXY 0 0.327 0 0.721
score RCVD_IN_NJABL_RELAY 0
score RCVD_IN_NJABL_SPAM 0 1.905 0 2.775
score RCVD_IN_SBL 0 2.712 0 3.160
score RCVD_IN_SORBS_BLOCK 0 # n=1 n=3
score RCVD_IN_SORBS_DUL 0 1.988 0 2.046
score RCVD_IN_SORBS_HTTP 0
score RCVD_IN_SORBS_MISC 0
score RCVD_IN_SORBS_SMTP 0 0 0 0.201
score RCVD_IN_SORBS_SOCKS 0 1.823 0 2.159
score RCVD_IN_SORBS_WEB 0 1.236 0 1.456
score RCVD_IN_SORBS_ZOMBIE 0 0.240 0 0.258
score RCVD_IN_WHOIS_BOGONS 0 1.811 0 2.430
score RCVD_IN_WHOIS_INVALID 0 2.151 0 2.234
score RCVD_IN_XBL 0 3.114 0 3.897
Presumably you would zero these out in the local server config
files, and not the installed configs.
Cheers,
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: SURBL
Posted by Matt Kettler <mk...@evi-inc.com>.
Irina wrote:
> Thank you Matt and Leonardo,
>
> Oh, noooo. I checked about everything, but not this file. I am missing it
> there. I am afraid I don't have the original file and will have to find in
> a TAR file.
Yes, you NEED init.pre.
Also, if you're using SA 3.1.0 you'll need v310.pre.
(In SA 3.1.0 you can't even use the AWL without it's loadplugin in v310.pre)
Re: SURBL
Posted by Irina <ir...@nas.net>.
Thank you Matt and Leonardo,
Oh, noooo. I checked about everything, but not this file. I am missing it
there. I am afraid I don't have the original file and will have to find in
a TAR file.
If I have posted this messages to the list before..... would save my time.
Thank you very much.
Irina
===========================
----- Original Message -----
From: "Matt Kettler" <mk...@evi-inc.com>
To: "Irina" <ir...@nas.net>
Cc: <us...@spamassassin.apache.org>
Sent: Thursday, January 12, 2006 3:40 PM
Subject: Re: SURBL
> Irina wrote:
> > Hello everybody again.
> >
> > Here is my other issue I found. I can not find any of SURBL in spam
> > reports. I am looking for this exact string SURBL (may be I am wrong?).
> >
> > Spamassassin -D --lint shows the module is installed
> > [53711] dbg: dns: is Net::DNS::Resolver available? yes
> > [53711] dbg: dns: Net::DNS version: 0.55
> >
> > local.cf has
> > skip_rbl_checks 0
> > not sure if this is required for Net::DNS?
> >
> > Not sure where else to look. Please help.
>
> Check your init.pre for:
>
> loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
>
Re: SURBL
Posted by Matt Kettler <mk...@evi-inc.com>.
Irina wrote:
> Hello everybody again.
>
> Here is my other issue I found. I can not find any of SURBL in spam
> reports. I am looking for this exact string SURBL (may be I am wrong?).
>
> Spamassassin -D --lint shows the module is installed
> [53711] dbg: dns: is Net::DNS::Resolver available? yes
> [53711] dbg: dns: Net::DNS version: 0.55
>
> local.cf has
> skip_rbl_checks 0
> not sure if this is required for Net::DNS?
>
> Not sure where else to look. Please help.
Check your init.pre for:
loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
Re: SURBL
Posted by Leonardo Rodrigues Magalhães <le...@solutti.com.br>.
Irina escreveu:
>Hello everybody again.
>
>Here is my other issue I found. I can not find any of SURBL in spam
>reports. I am looking for this exact string SURBL (may be I am wrong?).
>
>Spamassassin -D --lint shows the module is installed
> [53711] dbg: dns: is Net::DNS::Resolver available? yes
> [53711] dbg: dns: Net::DNS version: 0.55
>
>local.cf has
> skip_rbl_checks 0
>not sure if this is required for Net::DNS?
>
>
>
Maybe you're looking for the wrong string.
[vscan@ns1 vscan]$ spamassassin --lint -D 2>&1 | grep URIDNS -i
[2864] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
[2864] dbg: plugin: registered
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x926047c)
[2864] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x926047c)
implements 'parsed_metadata'
[2864] dbg: uridnsbl: domains to query:
[2864] dbg: plugin: registering glue method for check_uridnsbl
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x926047c))
[2864] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x926047c)
implements 'check_tick'
[2864] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x926047c)
implements 'check_post_dnsbl'
[vscan@ns1 vscan]$
--
Atenciosamente / Sincerily,
Leonardo Rodrigues
Solutti Tecnologia
http://www.solutti.com.br
Minha armadilha de SPAM, NÃO mandem email
gertrudes@solutti.com.br
My SPAMTRAP, do not email it
SURBL
Posted by Irina <ir...@nas.net>.
Hello everybody again.
Here is my other issue I found. I can not find any of SURBL in spam
reports. I am looking for this exact string SURBL (may be I am wrong?).
Spamassassin -D --lint shows the module is installed
[53711] dbg: dns: is Net::DNS::Resolver available? yes
[53711] dbg: dns: Net::DNS version: 0.55
local.cf has
skip_rbl_checks 0
not sure if this is required for Net::DNS?
Not sure where else to look. Please help.
Thank you very much.
Irina
===========================
Re: AWL and Auto Learn Bayes
Posted by Jim Knuth <jk...@jkart.de>.
Heute (12.01.2006/20:51 Uhr) schrieb Matt Kettler (mkettler@evi-inc.com),
> Jim Knuth wrote:
>> Heute (12.01.2006/20:24 Uhr) schrieb Matt Kettler (mkettler@evi-inc.com),
>>
>>
>>>>>Bayes autolearning can be very useful, but I'd suggest adjusting the ham
>>>>>learning threshold. The default of 0.5
>>
>>
>> I see as default 0.1
> Yeah, my bad. I thought it was 0.5, but it's not that bad. I still dislike
> having a positive threshold.
;) I already thought, I am stupid.
>>
>>>http://spamassassin.apache.org/full/3.1.x/dist/doc/Mail_SpamAssassin_Plugin_AutoLearnThreshold.html
>>
>>
>> and this is what I do including in my local.cf?
> Yep. If you've got the plugin loaded, those are ordinary SA config options.
cool, thank you.
--
Viele Gruesse, Kind regards,
Jim Knuth
jk@jkart.de
ICQ #277289867 - VoIP: +49 (0) 322 212 044 67
Key ID: 0x1F78066F
----------
Zufalls-Zitat
----------
Wär die Katze ein Pferd, könnte man die Bäume raufreiten.
----------
Der Text hat nichts mit dem Empfaenger der Mail zu tun
----------
Virus free. Checked by NOD32 Version 1.1363 Build 6612 12.01.2006
Re: AWL and Auto Learn Bayes
Posted by Matt Kettler <mk...@evi-inc.com>.
Jim Knuth wrote:
> Heute (12.01.2006/20:24 Uhr) schrieb Matt Kettler (mkettler@evi-inc.com),
>
>
>>>>Bayes autolearning can be very useful, but I'd suggest adjusting the ham
>>>>learning threshold. The default of 0.5
>
>
> I see as default 0.1
Yeah, my bad. I thought it was 0.5, but it's not that bad. I still dislike
having a positive threshold.
>
>>http://spamassassin.apache.org/full/3.1.x/dist/doc/Mail_SpamAssassin_Plugin_AutoLearnThreshold.html
>
>
> and this is what I do including in my local.cf?
Yep. If you've got the plugin loaded, those are ordinary SA config options.
Re: AWL and Auto Learn Bayes
Posted by Jim Knuth <jk...@jkart.de>.
Heute (12.01.2006/20:24 Uhr) schrieb Matt Kettler (mkettler@evi-inc.com),
>>>Bayes autolearning can be very useful, but I'd suggest adjusting the ham
>>>learning threshold. The default of 0.5
I see as default 0.1
>>
>> how can I change the defaults of learning threshold? I use SA V
>> 3.1.0
> See the docs for the autolearner:
> http://spamassassin.apache.org/full/3.1.x/dist/doc/Mail_SpamAssassin_Plugin_AutoLearnThreshold.html
and this is what I do including in my local.cf?
> and see the bayes_auto_learn_threshold_nonspam option.
> (That's assuming you did not disable the loadplugin
no, I enabled the loadplugin
> Mail::SpamAssassin::Plugin::AutoLearnThreshold in your v310.pre, otherwise
> you'll have to turn it back on first. )
--
Viele Gruesse, Kind regards,
Jim Knuth
jk@jkart.de
ICQ #277289867 - VoIP: +49 (0) 322 212 044 67
Key ID: 0x1F78066F
----------
Zufalls-Zitat
----------
Erfahrung ist eine nützliche Sache. Leider macht man sie
immer erst kurz nachdem man sie brauchte... (Christoph Lipp)
----------
Der Text hat nichts mit dem Empfaenger der Mail zu tun
----------
Virus free. Checked by NOD32 Version 1.1363 Build 6612 12.01.2006
Re: AWL and Auto Learn Bayes
Posted by Matt Kettler <mk...@evi-inc.com>.
Jim Knuth wrote:
> Heute (12.01.2006/20:04 Uhr) schrieb Matt Kettler (mkettler@evi-inc.com),
>
>
>
>>The AWL can be poisoned by a slightly clever spammer, but at best this gets them
>>a "half off your score" for the real spam. For this reason, I keep it disabled.
>
>
>>Bayes autolearning can be very useful, but I'd suggest adjusting the ham
>>learning threshold. The default of 0.5 is too high for my liking and can
>>sometimes cause problems.
>
>
> how can I change the defaults of learning threshold? I use SA V
> 3.1.0
See the docs for the autolearner:
http://spamassassin.apache.org/full/3.1.x/dist/doc/Mail_SpamAssassin_Plugin_AutoLearnThreshold.html
and see the bayes_auto_learn_threshold_nonspam option.
(That's assuming you did not disable the loadplugin
Mail::SpamAssassin::Plugin::AutoLearnThreshold in your v310.pre, otherwise
you'll have to turn it back on first. )
Re: AWL and Auto Learn Bayes
Posted by Matt Kettler <mk...@evi-inc.com>.
Craig McLean wrote:
> Jim Knuth wrote:
> [snip]
>
>>>how can I change the defaults of learning threshold? I use SA V
>>>3.1.0
>
>
> http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.html#learning_options
>
> Specifically, bayes_auto_learn_threshold_nonspam and
> bayes_auto_learn_threshold_spam
Craig, Those are 3.0.x docs, not 3.1.x docs. One thing to note is this option
was removed from Mail::SpamAssassin::Conf in 3.1.0 because the autolearner is
now a plugin and can actually be removed completely from SA. The threshold
options are now documented in the AutoLearnThreshold plugin docs
So the docs you are referencing will work in a default 3.1.0 config, but they
can be syntax errors in 3.1.0 if someone turned the plugin off.
Re: AWL and Auto Learn Bayes
Posted by Craig McLean <cr...@fukka.co.uk>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Jim Knuth wrote:
[snip]
>
> how can I change the defaults of learning threshold? I use SA V
> 3.1.0
http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.html#learning_options
Specifically, bayes_auto_learn_threshold_nonspam and
bayes_auto_learn_threshold_spam
C.
- --
Craig McLean http://fukka.co.uk
craig@fukka.co.uk Where the fun never starts
Powered by FreeBSD, and GIN!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDxquHMDDagS2VwJ4RAu7yAJwMerw6z+HTG1EsYJPz0J/0xocxBACeLDMt
gm0hP0p6Zj76V6x98dReqxw=
=bjQa
-----END PGP SIGNATURE-----
Re: AWL and Auto Learn Bayes
Posted by Jim Knuth <jk...@jkart.de>.
Heute (12.01.2006/20:04 Uhr) schrieb Matt Kettler (mkettler@evi-inc.com),
> The AWL can be poisoned by a slightly clever spammer, but at best this gets them
> a "half off your score" for the real spam. For this reason, I keep it disabled.
> Bayes autolearning can be very useful, but I'd suggest adjusting the ham
> learning threshold. The default of 0.5 is too high for my liking and can
> sometimes cause problems.
how can I change the defaults of learning threshold? I use SA V
3.1.0
> I run mine at -0.01 and have added a bunch of simple
> rules with small negative scores (-0.01 to -0.1) such that common business
> related ham messages will get autolearned.
> That said, several people like Justin Mason run the bayes system on autolearning
> only with the default settings and have no problems. Really most of the sites
> I've seen where the autolearner went awry started off with no manual training.
> While most of the time this goes OK, sometimes the bayes DB can start off on the
> wrong foot due to some low-scoring spam. It seems that this is the biggest risk
> of the bayes autolearner.
--
Viele Gruesse, Kind regards,
Jim Knuth
jk@jkart.de
ICQ #277289867 - VoIP: +49 (0) 322 212 044 67
Key ID: 0x1F78066F
----------
Zufalls-Zitat
----------
Die Schwierigkeit liegt darin, daß wir als Menschen nicht
nur Probleme lösen, sondern auch Probleme schaffen. (Edward
Teller)
----------
Der Text hat nichts mit dem Empfaenger der Mail zu tun
----------
Virus free. Checked by NOD32 Version 1.1363 Build 6612 12.01.2006
Re: AWL and Auto Learn Bayes
Posted by Loren Wilton <lw...@earthlink.net>.
Going to 3.0.5 should be pretty painless. Going to 3.1 will be a bit more
of a bother.
Loren
Re: AWL and Auto Learn Bayes
Posted by jdow <jd...@earthlink.net>.
From: "Matt Kettler" <mk...@evi-inc.com>
> Robert Bartlett wrote:
>> Hello,
>> Thanks for the help. It seems to be painless, but in the headers it still
>> shows 3.0.1, but when I startup SA in debug mode it says 3.0.5. I vagually
>> remember a file I had to edit to show the proper version in the email
>> headers?
>
> No, there shouldn't be. SA adds the headers based on the version number that's
> really running.
>
> Maybe Im thinking of something else? I tried restarting SA, still
>> shows 3.0.1. Or does it really matter? I just want to make sure 3.0.5 is
>> running.
>>
>
> How are you calling SA? Are you using a MTA integration tool, or a script that
> pipes stuff into spamc?
I wonder if he forgot to restart spamd.
{^_^}
Re: AWL and Auto Learn Bayes
Posted by Matt Kettler <mk...@evi-inc.com>.
Robert Bartlett wrote:
> Jan 12 15:01:35 milkyway spamd[17235]: Can't write to PID file: Too many
> levels of symbolic links
>
> I look in the directory for the pid file and its highlighted red, so now the
> link is not working? And it still shows as 3.0.1 in the header of emails.
Did you mean that the directory the pidfile is in is a dead symlink? or the
pidfile itself?
The pid file shouldn't be a symlink. In fact, if spamd isn't running, it
shouldn't even exist. Try stopping spamd, mv'ing the pidfile out of the way, and
restarting spamd.
RE: AWL and Auto Learn Bayes
Posted by Robert Bartlett <ro...@digitalphx.com>.
Looks like it was erroring out trying to access the pid file? It was pointed
to the wrong file. So now when I stop and restart it, it nows shows this in
the maillog:
Jan 12 15:01:35 milkyway spamd[17235]: server started on port 783/tcp
(running version 3.0.5)
Jan 12 15:01:35 milkyway spamd[17235]: server successfully spawned child
process, pid 17240
Jan 12 15:01:35 milkyway spamd[17235]: server successfully spawned child
process, pid 17241
Jan 12 15:01:35 milkyway spamd[17235]: server successfully spawned child
process, pid 17242
Jan 12 15:01:35 milkyway spamd[17235]: server successfully spawned child
process, pid 17243
Jan 12 15:01:35 milkyway spamd[17235]: server successfully spawned child
process, pid 17244
Jan 12 15:01:35 milkyway spamd[17235]: Can't write to PID file: Too many
levels of symbolic links
I look in the directory for the pid file and its highlighted red, so now the
link is not working? And it still shows as 3.0.1 in the header of emails.
Robert
-----Original Message-----
From: Matt Kettler [mailto:mkettler@evi-inc.com]
Sent: Thursday, January 12, 2006 2:42 PM
To: Robert Bartlett
Cc: users@spamassassin.apache.org
Subject: Re: AWL and Auto Learn Bayes
Robert Bartlett wrote:
> Hello,
> Thanks for the help. It seems to be painless, but in the headers it
> still shows 3.0.1, but when I startup SA in debug mode it says 3.0.5.
> I vagually remember a file I had to edit to show the proper version in
> the email headers?
No, there shouldn't be. SA adds the headers based on the version number
that's really running.
Maybe Im thinking of something else? I tried restarting SA, still
> shows 3.0.1. Or does it really matter? I just want to make sure 3.0.5
> is running.
>
How are you calling SA? Are you using a MTA integration tool, or a script
that pipes stuff into spamc?
Re: AWL and Auto Learn Bayes
Posted by Matt Kettler <mk...@evi-inc.com>.
Robert Bartlett wrote:
> I start SA by using service spamassassin start which is a file that pipes
> stuff to spamc.
Erm.. No.
service spamassassin starts up spamd. Nothing else. Period.
I assume you separately pump things into spamc? Where?
RE: AWL and Auto Learn Bayes
Posted by Robert Bartlett <ro...@digitalphx.com>.
I start SA by using service spamassassin start which is a file that pipes
stuff to spamc.
Robert
-----Original Message-----
From: Matt Kettler [mailto:mkettler@evi-inc.com]
Sent: Thursday, January 12, 2006 2:42 PM
To: Robert Bartlett
Cc: users@spamassassin.apache.org
Subject: Re: AWL and Auto Learn Bayes
Robert Bartlett wrote:
> Hello,
> Thanks for the help. It seems to be painless, but in the headers it
> still shows 3.0.1, but when I startup SA in debug mode it says 3.0.5.
> I vagually remember a file I had to edit to show the proper version in
> the email headers?
No, there shouldn't be. SA adds the headers based on the version number
that's really running.
Maybe Im thinking of something else? I tried restarting SA, still
> shows 3.0.1. Or does it really matter? I just want to make sure 3.0.5
> is running.
>
How are you calling SA? Are you using a MTA integration tool, or a script
that pipes stuff into spamc?
Re: AWL and Auto Learn Bayes
Posted by Matt Kettler <mk...@evi-inc.com>.
Robert Bartlett wrote:
> Hello,
> Thanks for the help. It seems to be painless, but in the headers it still
> shows 3.0.1, but when I startup SA in debug mode it says 3.0.5. I vagually
> remember a file I had to edit to show the proper version in the email
> headers?
No, there shouldn't be. SA adds the headers based on the version number that's
really running.
Maybe Im thinking of something else? I tried restarting SA, still
> shows 3.0.1. Or does it really matter? I just want to make sure 3.0.5 is
> running.
>
How are you calling SA? Are you using a MTA integration tool, or a script that
pipes stuff into spamc?
RE: AWL and Auto Learn Bayes
Posted by Robert Bartlett <ro...@digitalphx.com>.
Hello,
Thanks for the help. It seems to be painless, but in the headers it still
shows 3.0.1, but when I startup SA in debug mode it says 3.0.5. I vagually
remember a file I had to edit to show the proper version in the email
headers? Maybe Im thinking of something else? I tried restarting SA, still
shows 3.0.1. Or does it really matter? I just want to make sure 3.0.5 is
running.
Robert
-----Original Message-----
From: Matt Kettler [mailto:mkettler@evi-inc.com]
Sent: Thursday, January 12, 2006 2:16 PM
To: Robert Bartlett
Cc: users@spamassassin.apache.org
Subject: Re: AWL and Auto Learn Bayes
Robert Bartlett wrote:
> Need to upgrade heh? I installed it from source and am very weary of
> doing any updates as it's a "production" server. But I guess I don't
> have a chance. Any documents out there you suggest reading on steps to
upgrade it?
>
Being a production box, I'd suggest doing an upgrade to 3.0.5 instead of
3.1.0.
This will fix the significant problems, but doesn't change any
configuration options, requirements or APIs.. it's just a basic maintenance
release, and in theory should go very smoothly with no hitches.
Upgrading to 3.1.0 could be more work as some config items changed in the
process.
You can get 3.0.5 from the archive:
http://archive.apache.org/dist/spamassassin/
You should be able to go through a normal procedure for installing SA to do
the upgrade and you shouldn't need to change any configuration.
Just untar it,
perl Makefile.PL
make
make install
Should be quite painless.
The only problem I've heard with the 3.0.5 release is those who use rpmbuild
to make custom RPMs from it have to fix the spec file (because they missed
updating the tarball name in the specfile). However, if you're just
installing from source this isn't relevant.
Re: AWL and Auto Learn Bayes
Posted by Matt Kettler <mk...@evi-inc.com>.
Robert Bartlett wrote:
> Need to upgrade heh? I installed it from source and am very weary of doing
> any updates as it's a "production" server. But I guess I don't have a
> chance. Any documents out there you suggest reading on steps to upgrade it?
>
Being a production box, I'd suggest doing an upgrade to 3.0.5 instead of 3.1.0.
This will fix the significant problems, but doesn't change any configuration
options, requirements or APIs.. it's just a basic maintenance release, and in
theory should go very smoothly with no hitches.
Upgrading to 3.1.0 could be more work as some config items changed in the process.
You can get 3.0.5 from the archive:
http://archive.apache.org/dist/spamassassin/
You should be able to go through a normal procedure for installing SA to do the
upgrade and you shouldn't need to change any configuration.
Just untar it,
perl Makefile.PL
make
make install
Should be quite painless.
The only problem I've heard with the 3.0.5 release is those who use rpmbuild to
make custom RPMs from it have to fix the spec file (because they missed updating
the tarball name in the specfile). However, if you're just installing from
source this isn't relevant.
RE: AWL and Auto Learn Bayes
Posted by Robert Bartlett <ro...@digitalphx.com>.
Need to upgrade heh? I installed it from source and am very weary of doing
any updates as it's a "production" server. But I guess I don't have a
chance. Any documents out there you suggest reading on steps to upgrade it?
Thanks
Robert
-----Original Message-----
From: Matt Kettler [mailto:mkettler@evi-inc.com]
Sent: Thursday, January 12, 2006 12:04 PM
To: Robert Bartlett
Cc: users@spamassassin.apache.org
Subject: Re: AWL and Auto Learn Bayes
Robert Bartlett wrote:
> Since finding out the trusted_network issue I question the rest of my
> local.cf setup. Right now I have AWL turned off and auto learning for
> bayes turned off. My question is does SA benefit from turning those 2
> back on? Of course I would clear out AWL and bayes and start from
> scratch if I did. But would it make it easier for bayes to be
> "poisoned" if I turned auto learn on? Im on SA 3.0.1.
Warning: 3.0.1 is subject to a DOS vulnerability. Unless you're using a
distro-port which has backported fixes, consider upgrading to 3.0.5 or
3.1.0.
Personally, I don't like the AWL, but it does have its uses. The nice thing
about the AWL is you'll avoid FPs from people who frequently mail you. At
the same time, people who frequently spam you will be less likely to have a
FN, but since spam addresses change constantly this is less common.
The AWL can be poisoned by a slightly clever spammer, but at best this gets
them a "half off your score" for the real spam. For this reason, I keep it
disabled.
Bayes autolearning can be very useful, but I'd suggest adjusting the ham
learning threshold. The default of 0.5 is too high for my liking and can
sometimes cause problems. I run mine at -0.01 and have added a bunch of
simple rules with small negative scores (-0.01 to -0.1) such that common
business related ham messages will get autolearned.
That said, several people like Justin Mason run the bayes system on
autolearning only with the default settings and have no problems. Really
most of the sites I've seen where the autolearner went awry started off with
no manual training.
While most of the time this goes OK, sometimes the bayes DB can start off on
the wrong foot due to some low-scoring spam. It seems that this is the
biggest risk of the bayes autolearner.
Re: AWL and Auto Learn Bayes
Posted by Matt Kettler <mk...@evi-inc.com>.
Robert Bartlett wrote:
> Since finding out the trusted_network issue I question the rest of my
> local.cf setup. Right now I have AWL turned off and auto learning for bayes
> turned off. My question is does SA benefit from turning those 2 back on? Of
> course I would clear out AWL and bayes and start from scratch if I did. But
> would it make it easier for bayes to be "poisoned" if I turned auto learn
> on? Im on SA 3.0.1.
Warning: 3.0.1 is subject to a DOS vulnerability. Unless you're using a
distro-port which has backported fixes, consider upgrading to 3.0.5 or 3.1.0.
Personally, I don't like the AWL, but it does have its uses. The nice thing
about the AWL is you'll avoid FPs from people who frequently mail you. At the
same time, people who frequently spam you will be less likely to have a FN, but
since spam addresses change constantly this is less common.
The AWL can be poisoned by a slightly clever spammer, but at best this gets them
a "half off your score" for the real spam. For this reason, I keep it disabled.
Bayes autolearning can be very useful, but I'd suggest adjusting the ham
learning threshold. The default of 0.5 is too high for my liking and can
sometimes cause problems. I run mine at -0.01 and have added a bunch of simple
rules with small negative scores (-0.01 to -0.1) such that common business
related ham messages will get autolearned.
That said, several people like Justin Mason run the bayes system on autolearning
only with the default settings and have no problems. Really most of the sites
I've seen where the autolearner went awry started off with no manual training.
While most of the time this goes OK, sometimes the bayes DB can start off on the
wrong foot due to some low-scoring spam. It seems that this is the biggest risk
of the bayes autolearner.
Re: AWL and Auto Learn Bayes
Posted by Loren Wilton <lw...@earthlink.net>.
> local.cf setup. Right now I have AWL turned off and auto learning for
bayes
> turned off. My question is does SA benefit from turning those 2 back on?
Of
You are in opinion territory.
Some people like AWL and some don't much care for it. I personally have it
turned off, and don't feel any lack. However, it might be of some help for
you. Or it might cause problems, depending on the sort of mail people send
there.
Bayes autolearning *by itself*, is almost always the wrong decision.
However, if you have a moderately well trained bayes database to start with
(hand trained), AND you have moderately clean ham and spam feeds, then it
can potentially help. Again, I have it turned off, and only hand train now
and then when it seems necessary.
You do have to watch your bayes scores if you are using autoleanring to
catch any tendency where bayes might be starting to get the wrong ideas, and
do something about it before it becomes a problem.
Loren
RE: AWL and Auto Learn Bayes
Posted by Robert Bartlett <ro...@digitalphx.com>.
Are there any "starter" ham/spam emails I can use? I thought I saw one, but
it wasn't for a MySQL database. Im using Bayes, site wide, in mysql. I hate
to feed it emails I think is ham or spam.
Robert
-----Original Message-----
From: jdow [mailto:jdow@earthlink.net]
Sent: Thursday, January 12, 2006 3:20 PM
To: users@spamassassin.apache.org
Subject: Re: AWL and Auto Learn Bayes
From: "Craig McLean" <cr...@fukka.co.uk>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Robert Bartlett wrote:
>> Since finding out the trusted_network issue I question the rest of my
>> local.cf setup. Right now I have AWL turned off and auto learning for
>> bayes turned off. My question is does SA benefit from turning those 2
>> back on? Of course I would clear out AWL and bayes and start from
>> scratch if I did. But would it make it easier for bayes to be
>> "poisoned" if I turned auto learn on? Im on SA 3.0.1.
...
> Bayes: Round here, BAYES_99 hit 92.77% of spam and 0.40% of ham in the
> last year, BAYES_00 hit 80.31% of ham and 0.41% of spam in the same
> period. I'd say a well trained bayed db is *very* worthwhile.
> As for "bayes poison", I don't think it exists in the sense it's being
> used here. Almost every spam I've got with long, random paragraphs in
> it
There is no inherent Bayes poison that can be placed in spam to poison the
database. However, sufficiently large numbers of mistrained messages amount
to leaving the Bayes database in a poisoned state that leaves it basically
ineffective. In that case it's better to toss the bad Bayes training out and
retrain from the start.
{^_^}
Re: AWL and Auto Learn Bayes
Posted by jdow <jd...@earthlink.net>.
From: "Craig McLean" <cr...@fukka.co.uk>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Robert Bartlett wrote:
>> Since finding out the trusted_network issue I question the rest of my
>> local.cf setup. Right now I have AWL turned off and auto learning for bayes
>> turned off. My question is does SA benefit from turning those 2 back on? Of
>> course I would clear out AWL and bayes and start from scratch if I did. But
>> would it make it easier for bayes to be "poisoned" if I turned auto learn
>> on? Im on SA 3.0.1.
...
> Bayes: Round here, BAYES_99 hit 92.77% of spam and 0.40% of ham in the
> last year, BAYES_00 hit 80.31% of ham and 0.41% of spam in the same
> period. I'd say a well trained bayed db is *very* worthwhile.
> As for "bayes poison", I don't think it exists in the sense it's being
> used here. Almost every spam I've got with long, random paragraphs in it
There is no inherent Bayes poison that can be placed in spam to poison
the database. However, sufficiently large numbers of mistrained messages
amount to leaving the Bayes database in a poisoned state that leaves it
basically ineffective. In that case it's better to toss the bad Bayes
training out and retrain from the start.
{^_^}
Re: AWL and Auto Learn Bayes
Posted by Craig McLean <cr...@fukka.co.uk>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Robert Bartlett wrote:
> Since finding out the trusted_network issue I question the rest of my
> local.cf setup. Right now I have AWL turned off and auto learning for bayes
> turned off. My question is does SA benefit from turning those 2 back on? Of
> course I would clear out AWL and bayes and start from scratch if I did. But
> would it make it easier for bayes to be "poisoned" if I turned auto learn
> on? Im on SA 3.0.1.
Opinions vary. Here's mine:
AWL: I use it, and it has never caused me pain, however it does
sometimes assigned positive, i.e. bad, scores to ham senders (esp. on
this list). I'm considering turning it off because it doesn't add
*enough* value to my setup to justify the CPU cycles it burns.
Bayes: Round here, BAYES_99 hit 92.77% of spam and 0.40% of ham in the
last year, BAYES_00 hit 80.31% of ham and 0.41% of spam in the same
period. I'd say a well trained bayed db is *very* worthwhile.
As for "bayes poison", I don't think it exists in the sense it's being
used here. Almost every spam I've got with long, random paragraphs in it
is scored by bayes just fine. My bayes FP rate doesn't get pushed up
either.
Regards,
C.
- --
Craig McLean http://fukka.co.uk
craig@fukka.co.uk Where the fun never starts
Powered by FreeBSD, and GIN!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDxqNRMDDagS2VwJ4RAtwgAKDQlxuG1W7kLYQb1e/6v/YGQ+QrLwCg+T7w
I/LF8QnC/kE+CCm0VwarWbo=
=578H
-----END PGP SIGNATURE-----