You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Steve Mansfield <sy...@wanadoo.fr> on 2004/05/14 11:57:17 UTC
Local or not local
I'm still in the early days of using SA and quite a few spams are still
getting through. My setup for spamd (in /etc/sysconfig/spamd) includes the -L
switch for local checking only. I figured using the internet-available checks
might help improve the success rate, but ever since I removed the -L switch
and restarted spamd I'm finding that my internet connection is hanging up at
some point, regardless of whether I'm using Fetchmail or Kmail to gets
messages. I'm on a single-channel (64k) ISDN connection. Should I expect this
to be slow? What do other people do with low-bandwidth dial-up connections?
For the time being I've reinstalled the -L switch...
(Incidentally, I am using sa-learn - it's run as a cron job each night).
@+
Steve
Re: Local or not local
Posted by Steve Mansfield <sy...@wanadoo.fr>.
-------------------
On Friday 14 May 2004 16:36, you wrote:
| Ah, good. Your other option is to go get a bunch of extra rulesets, from:
|
| http://www.rulesemporium.com/
| and/or
| http://www.exit0.us/
|
| I personally use:
|
| 70_sare_bayes_poison_nxm.cf
| 99_sare_adult.cf
| Obfu1.cf
| bigevil.cf
| header_abuse.cf
| myrules.cf (this is my own collection, obviously)
| virusbounce.cf
| 70_sare_random.cf
| 99_sare_spoof.cf
| antidrug.cf
| coding_html.cf
| ratware.cf
Thanks for the advice. I've started collecting those rulesets and will
probably implement them tomorrow. It's useful to know what other people use.
(BTW, anyone know why this maillist puts its own address in the CC field
rather than the From field? It means when I hit 'reply' the message goes to
the poster not the list. I know I can do 'reply all' and therefore mail to
both but that seems like a waste of bandwidth somehow...).
Re: Local or not local
Posted by Kevin Peuhkurinen <ke...@hepcoe.com>.
Ah, good. Your other option is to go get a bunch of extra rulesets, from:
http://www.rulesemporium.com/
and/or
http://www.exit0.us/
I personally use:
70_sare_bayes_poison_nxm.cf
99_sare_adult.cf
Obfu1.cf
bigevil.cf
header_abuse.cf
myrules.cf (this is my own collection, obviously)
virusbounce.cf
70_sare_random.cf
99_sare_spoof.cf
antidrug.cf
coding_html.cf
ratware.cf
Steve Mansfield wrote:
>-------------------
>On Friday 14 May 2004 14:14, Kevin Peuhkurinen wrote:
>| You could try lowering the spam threshold if you see that your ham is
>| getting scored low enough to avoid becoming FP's. I found that as
>| Bayes got better, I was able to lower the threshold by 0.5 from my
>| starting point of 9 every week or so until I reached my current
>| threshold of 3.5.
>
>I have, in fact, started down that road! My site-wide setting is 10 - ie, lets
>loads of stuff through and I've been reducing my user settings - currently at
>4 and still not getting any false-positives. But I've seen some spam coming
>through with ratings much lower - eg, a message entitled
>"9-need a loan8 it takes 2 minutes to apply" got a rating of:
>
>X-Spam-Status: No, hits=1.7 required=4.0 tests=HTML_30_40,HTML_MESSAGE,
> MIME_HTML_ONLY autolearn=no version=2.63
>
>I've set up filters in Kmail using regular expressions to weed out mails
>offering certain performance-enhancing drugs, and as that filter comes before
>the SA one for emails coming direct into Kmail from the POP server (rather
>than the Fetchmail route) then I'm already weeding out a lot of stuff that
>way.
>
>
>
Re: Local or not local
Posted by Steve Mansfield <sy...@wanadoo.fr>.
-------------------
On Friday 14 May 2004 14:14, Kevin Peuhkurinen wrote:
| You could try lowering the spam threshold if you see that your ham is
| getting scored low enough to avoid becoming FP's. I found that as
| Bayes got better, I was able to lower the threshold by 0.5 from my
| starting point of 9 every week or so until I reached my current
| threshold of 3.5.
I have, in fact, started down that road! My site-wide setting is 10 - ie, lets
loads of stuff through and I've been reducing my user settings - currently at
4 and still not getting any false-positives. But I've seen some spam coming
through with ratings much lower - eg, a message entitled
"9-need a loan8 it takes 2 minutes to apply" got a rating of:
X-Spam-Status: No, hits=1.7 required=4.0 tests=HTML_30_40,HTML_MESSAGE,
MIME_HTML_ONLY autolearn=no version=2.63
I've set up filters in Kmail using regular expressions to weed out mails
offering certain performance-enhancing drugs, and as that filter comes before
the SA one for emails coming direct into Kmail from the POP server (rather
than the Fetchmail route) then I'm already weeding out a lot of stuff that
way.
Re: Local or not local
Posted by Kevin Peuhkurinen <ke...@hepcoe.com>.
You could try lowering the spam threshold if you see that your ham is
getting scored low enough to avoid becoming FP's. I found that as
Bayes got better, I was able to lower the threshold by 0.5 from my
starting point of 9 every week or so until I reached my current
threshold of 3.5.
Steve Mansfield wrote:
>I'm still in the early days of using SA and quite a few spams are still
>getting through. My setup for spamd (in /etc/sysconfig/spamd) includes the -L
>switch for local checking only. I figured using the internet-available checks
>might help improve the success rate, but ever since I removed the -L switch
>and restarted spamd I'm finding that my internet connection is hanging up at
>some point, regardless of whether I'm using Fetchmail or Kmail to gets
>messages. I'm on a single-channel (64k) ISDN connection. Should I expect this
>to be slow? What do other people do with low-bandwidth dial-up connections?
>
>For the time being I've reinstalled the -L switch...
>
>(Incidentally, I am using sa-learn - it's run as a cron job each night).
>
>@+
>Steve
>
>
>