autolearn=no flag?

[Bill Landry <bi...@pointshare.com>]

I'm curious how to determine why a message gets flagged with "autolearn=no",
as shown below:

X-Spam-Status: No, hits=-5.9 required=5.0 tests=AWL,NO_REAL_NAME
autolearn=no
 version=2.60-spambr_20030926a

Also, what does this "version=2.60-spambr_20030926a" mean?  This was a very
obvious pill spam message, yet it ended up with -5.9.  Any insight would be
greatly appreciated.

Bill

Re: autolearn=no flag?

[Bill Landry <bi...@pointshare.com>]

Oops, never mind, these were not my SA headers, they were someone else's.
This message didn't actually go through one of my SA gateways.  Sorry for
the noise...

Bill
----- Original Message ----- 
From: "Bill Landry" <bi...@pointshare.com>
To: <us...@spamassassin.apache.org>
Sent: Tuesday, September 14, 2004 4:26 PM
Subject: autolearn=no flag?


> I'm curious how to determine why a message gets flagged with
"autolearn=no",
> as shown below:
>
> X-Spam-Status: No, hits=-5.9 required=5.0 tests=AWL,NO_REAL_NAME
> autolearn=no
>  version=2.60-spambr_20030926a
>
> Also, what does this "version=2.60-spambr_20030926a" mean?  This was a
very
> obvious pill spam message, yet it ended up with -5.9.  Any insight would
be
> greatly appreciated.
>
> Bill
>

Re: autolearn=no flag?

[Bill Landry <bi...@pointshare.com>]

[Top Post]

I'm actually running 2.64 (3.0 soon).  Everyone, please disregard the former
distraction and return to your regularly scheduled, bi-annual "subject line"
debate...  ;-)

Bill
----- Original Message ----- 
From: "Matt Kettler" <mk...@evi-inc.com>
To: "Bill Landry" <bi...@pointshare.com>; <us...@spamassassin.apache.org>
Sent: Tuesday, September 14, 2004 4:37 PM
Subject: Re: autolearn=no flag?


> At 07:26 PM 9/14/2004, Bill Landry wrote:
> >I'm curious how to determine why a message gets flagged with
"autolearn=no",
> >as shown below:
>
> Well, as far as the learner was concerned it scored only whatever
> NO_REAL_NAME contributes in scoreset 0 or 1. In 2.60, that's 0.339 or
0.285.
>   That's not high enough to learn as spam, nor low enough to learn as ham.
>
> Poof, no autolearn performed due to midline score.
>
> Then the AWL kicked in and deducted a large number of points.
>
>
> >X-Spam-Status: No, hits=-5.9 required=5.0 tests=AWL,NO_REAL_NAME
> >autolearn=no
> >  version=2.60-spambr_20030926a
> >
> >Also, what does this "version=2.60-spambr_20030926a" mean?
>
> That's the build of SA which generated the X-Spam-Status header in
> question..  It's some Brazilian localized fork if I recall.
>
> >   This was a veryobvious pill spam message, yet it ended up with
> > -5.9.  Any insight would be
> >greatly appreciated.
>
> 2.60 is now a year old has serious AWL bugs that spammers can abuse.
> Upgrade to something more recent.
>
> Also, if your system isn't running 2.50-spambr, then make sure you're not
> doing something foolish like skipping the scan for messages with
> X-Spam-Status headers in them (which spammers can forge or other untrusted
> systems can add).
>
>
>
>

Re: autolearn=no flag?

[Matt Kettler <mk...@evi-inc.com>]

At 07:26 PM 9/14/2004, Bill Landry wrote:
>I'm curious how to determine why a message gets flagged with "autolearn=no",
>as shown below:

Well, as far as the learner was concerned it scored only whatever 
NO_REAL_NAME contributes in scoreset 0 or 1. In 2.60, that's 0.339 or 0.285.
  That's not high enough to learn as spam, nor low enough to learn as ham.

Poof, no autolearn performed due to midline score.

Then the AWL kicked in and deducted a large number of points.


>X-Spam-Status: No, hits=-5.9 required=5.0 tests=AWL,NO_REAL_NAME
>autolearn=no
>  version=2.60-spambr_20030926a
>
>Also, what does this "version=2.60-spambr_20030926a" mean?

That's the build of SA which generated the X-Spam-Status header in 
question..  It's some Brazilian localized fork if I recall.

>   This was a veryobvious pill spam message, yet it ended up with 
> -5.9.  Any insight would be
>greatly appreciated.

2.60 is now a year old has serious AWL bugs that spammers can abuse. 
Upgrade to something more recent.

Also, if your system isn't running 2.50-spambr, then make sure you're not 
doing something foolish like skipping the scan for messages with 
X-Spam-Status headers in them (which spammers can forge or other untrusted 
systems can add).