You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Luis Croker <lc...@megacable.com.mx> on 2008/12/18 23:37:06 UTC
Learning SPAM
Hi all....
I have a question... I have configured a mail server with Postfix
+spamassassin+amavis. The server is working very good and blocking
well. I have installed another server... with the same procedure... and
I have the same rules, configuration files...
I mean, everything is exactly the same. When I send the traffic to this
new server, some spam mails pass, these mails are not being blocked, but
If I switch the same traffic to the old server, this blocks everything
fine. I have turned on the bayes_auto_learn and use_bayer parameters.
Is this a normal behaivor in the new server??? Maybe the server
needs to learn about the spam mails and start blocking later... if this
is true, when wiil the new server starts to block the real spam ?
Thanks. Regards.
Re: Learning SPAM
Posted by Luis Croker <lc...@megacable.com.mx>.
Hi...
I have fixed the problem... I dont know if this is the best
method... I have copied the following files, from the old server to
the new server...
mailgw# pwd
/var/amavis/.spamassassin
mailgw# ls -al
total 25298
drwx------ 2 vscan vscan 512 Dec 19 11:31 .
drwxr-x--- 7 vscan vscan 512 Dec 18 17:59 ..
-rw------- 1 vscan vscan 1584 Dec 19 11:33 bayes.mutex
-rw------- 1 vscan vscan 59784 Dec 19 11:33 bayes_journal
-rw------- 1 vscan vscan 20758528 Dec 19 11:33 bayes_seen
-rw------- 1 vscan vscan 5046272 Dec 19 11:33 bayes_toks
I supposs that the new server can not block cause the the DBs didnt
have enough information to apply bayes rules... right now the server is
blocking like the old server...
thanks all send me an answer. ..
On Thu, 2008-12-18 at 15:53 -0800, John Hardin wrote:
> On Thu, 18 Dec 2008, Luis Croker wrote:
>
> > I have been looking in my files... and the logs show me that the
> > rules BAYES_* (BAYES_00.. BAYES_99) are not doing match in the mails...
> > I mean... these rules are not being used...
>
> Is BAYES_50 the only BAYES rule you see hitting? That means your bayes
> database isn't sufficiently trained yet. You need 200 spams and 200 hams
> before bayes starts scoring messages.
>
> > How can i try to do Amavis uses these rules ?
>
> Amavis is irrelevant.
>
> >>> I have installed another server... with the same
> >>> procedure... and I have the same rules, configuration files...
> >>> I mean, everything is exactly the same.
>
> Did you copy the bayes database files to the new server?
>
> You'll have to set up some mechanism to copy the bayes database files from
> the system that is doing training to the other system(s), or set up bayes
> from a SQL database that they both connect to.
>
Luis Croker
SCSA - SCNA
Administrador de Sistemas
Megacable Comunicaciones
GPG Key1024D/48C1764B
Key fingerprint = E8B6 E84F ECE4 661E 30C7 7208 042D BD09 48C1 764B
Re: Learning SPAM
Posted by John Hardin <jh...@impsec.org>.
On Thu, 18 Dec 2008, Luis Croker wrote:
> I have been looking in my files... and the logs show me that the
> rules BAYES_* (BAYES_00.. BAYES_99) are not doing match in the mails...
> I mean... these rules are not being used...
Is BAYES_50 the only BAYES rule you see hitting? That means your bayes
database isn't sufficiently trained yet. You need 200 spams and 200 hams
before bayes starts scoring messages.
> How can i try to do Amavis uses these rules ?
Amavis is irrelevant.
>>> I have installed another server... with the same
>>> procedure... and I have the same rules, configuration files...
>>> I mean, everything is exactly the same.
Did you copy the bayes database files to the new server?
You'll have to set up some mechanism to copy the bayes database files from
the system that is doing training to the other system(s), or set up bayes
from a SQL database that they both connect to.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
"Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never
does quite what I want. I wish Christopher Robin was here."
-- Peter da Silva in a.s.r
-----------------------------------------------------------------------
7 days until Christmas
Re: Learning SPAM
Posted by Luis Croker <lc...@megacable.com.mx>.
I have been looking in my files... and the logs show me that the
rules BAYES_* (BAYES_00.. BAYES_99) are not doing match in the mails...
I mean... these rules are not being used...
How can i try to do Amavis uses these rules ?
Thanks.
On Thu, 2008-12-18 at 15:07 -0800, Evan Platt wrote:
> Luis Croker wrote:
> > I have a question... I have configured a mail server with
> > Postfix+spamassassin+amavis. The server is working very good and
> > blocking well. I have installed another server... with the same
> > procedure... and I have the same rules, configuration files...
> > I mean, everything is exactly the same. When I send the traffic to
> > this new server, some spam mails pass, these mails are not being
> > blocked, but If I switch the same traffic to the old server, this
> > blocks everything fine. I have turned on the bayes_auto_learn and
> > use_bayer parameters.
> >
> > Is this a normal behaivor in the new server??? Maybe the server
> > needs to learn about the spam mails and start blocking later... if
> > this is true, when wiil the new server starts to block the real spam ?
> >
>
> SpamAssassin doesn't block e-mails.
>
> So you may want to look at whatever is actually doing the blocking, and
> see why it's blocking on one system but not the other.
>
Re: Learning SPAM
Posted by Evan Platt <ev...@espphotography.com>.
Luis Croker wrote:
> I have a question... I have configured a mail server with
> Postfix+spamassassin+amavis. The server is working very good and
> blocking well. I have installed another server... with the same
> procedure... and I have the same rules, configuration files...
> I mean, everything is exactly the same. When I send the traffic to
> this new server, some spam mails pass, these mails are not being
> blocked, but If I switch the same traffic to the old server, this
> blocks everything fine. I have turned on the bayes_auto_learn and
> use_bayer parameters.
>
> Is this a normal behaivor in the new server??? Maybe the server
> needs to learn about the spam mails and start blocking later... if
> this is true, when wiil the new server starts to block the real spam ?
>
SpamAssassin doesn't block e-mails.
So you may want to look at whatever is actually doing the blocking, and
see why it's blocking on one system but not the other.