You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Benjamin Adams <ba...@ambrosiasw.com> on 2006/05/16 17:42:56 UTC
Increase overall preformance
In Four days,
Spamassasin marked 1477 messages and missed 755 that where spam.
I have my Required set to 5
what is the variable to drop the required in 3.1?
I is it still required_score?
Is there something else I can do to help the overall performance?
--Ben
Re: Increase overall preformance
Posted by Michael Monnerie <mi...@it-management.at>.
On Dienstag, 16. Mai 2006 17:42 Benjamin Adams wrote:
> Is there something else I can do to help the overall performance?
If you mean "performance" like "correctness":
1) Harden your MTA, e.g. use some RBL there, greylisting helps a lot,
SPF checking also
2) SA could maybe need additional rules, see SARE
http://rulesemporium.com, especially the stocks rules are necessary
ATM. Use the rules-du-jour script, the link is on the SARE website
3) use all online lists like URIBL, pyzor, razor, dcc, ...
4) train your bayes DB with spam/ham
mfg zmi
--
// Michael Monnerie, Ing.BSc ----- http://it-management.at
// Tel: 0660/4156531 .network.your.ideas.
// PGP Key: "lynx -source http://zmi.at/zmi3.asc | gpg --import"
// Fingerprint: 44A3 C1EC B71E C71A B4C2 9AA6 C818 847C 55CB A4EE
// Keyserver: www.keyserver.net Key-ID: 0x55CBA4EE
Re: Increase overall preformance
Posted by David Baron <d_...@012.net.il>.
On Tuesday 16 May 2006 18:50, Theo Van Dinter wrote:
> On Tue, May 16, 2006 at 11:42:56AM -0400, Benjamin Adams wrote:
> > Spamassasin marked 1477 messages and missed 755 that where spam.
>
> Seems unusual.
>
> > what is the variable to drop the required in 3.1?
> > I is it still required_score?
>
> Yes, but I wouldn't do that due to the large FP increase.
>
> > Is there something else I can do to help the overall performance?
>
> This comes up on the irc channel a bit. The three things I suggest to
> folks, running 3.1.1 or later, are:
>
> a) use sa-udpate
This is not yet contributing to successful spam flagging. Still problematic
and may be the cause rather than the cure right now
> b) use network tests, specifically the URIBLs
> c) use Razor (and/or DCC or Pyzor)
Need to learn about these.
Re: Increase overall preformance
Posted by Theo Van Dinter <fe...@apache.org>.
On Tue, May 16, 2006 at 11:42:56AM -0400, Benjamin Adams wrote:
> Spamassasin marked 1477 messages and missed 755 that where spam.
Seems unusual.
> what is the variable to drop the required in 3.1?
> I is it still required_score?
Yes, but I wouldn't do that due to the large FP increase.
> Is there something else I can do to help the overall performance?
This comes up on the irc channel a bit. The three things I suggest to folks,
running 3.1.1 or later, are:
a) use sa-udpate
b) use network tests, specifically the URIBLs
c) use Razor (and/or DCC or Pyzor)
--
Randomly Generated Tagline:
"Your next question is 'How does this gate work?' I don't know. I
don't have to know, I'm not an Electrical Engineer, I'm a Computer
Scientist." - Prof. Hamel
Re: Increase overall preformance
Posted by Benjamin Adams <ba...@ambrosiasw.com>.
I am using sa-learn on the missed messages(using for a few months now
seems to be no help)
SpamAssassin Server version 3.1.1
running on Perl 5.8.6
my local.cf
# Bayesian Auto Learn
bayes_auto_learn 1
bayes_file_mode 0777
bayes_path /var/mail/spamassassin/bayes
bayes_auto_expire 1
# Safe Reporting
report_safe 1
use_dcc 0
dcc_timeout 10
use_razor2 0
use_pyzor 1
rewrite_header Subject ****SPAM****
# Rewrite the Subject
skip_rbl_checks 0
# Use Bayesian Filtering
use_bayes 1
use_bayes_rules 1
bayes_learn_during_report 1
# OK locals
ok_locales en
# OK languages
ok_languages en fr de
I change the Scores below, an are looking at others.
Just to check with my config:
score FUZZY_PHENT 2.560 1.155 2.960 1.799
I change the 2.960 score number.
Thanks for help
-Ben
On May 16, 2006, at 12:04 PM, Dermot Paikkos wrote:
> I agree with the Theo. 3.1 is too low. You don't want to reject real
> mail.
>
> 1) Use the network/dns tests.
> 2) increase the score on individual rules especially those for URIBL
>
> score URIBL_WS_SURBL 5.5
> score URIBL_SBL 5.5
> score URIBL_OB_SURBL 5.5
> score DRUGS_ERECTILE 5.0
>
> Study the mails to see what other rules would help your site and then
> have a looks rulesemporium.
>
> HTH.
> Dp.
>
>
> On 16 May 2006 at 11:42, Benjamin Adams wrote:
>
>> In Four days,
>> Spamassasin marked 1477 messages and missed 755 that where spam.
>>
>> I have my Required set to 5
>>
>> what is the variable to drop the required in 3.1?
>> I is it still required_score?
>>
>>
>> Is there something else I can do to help the overall performance?
>> --Ben
>
>
>
Re: Increase overall preformance
Posted by Mike Jackson <mj...@mightymerchant.com>.
>I agree with the Theo. 3.1 is too low. You don't want to reject real
> mail.
>
> 1) Use the network/dns tests.
> 2) increase the score on individual rules especially those for URIBL
>
> score URIBL_WS_SURBL 5.5
> score URIBL_SBL 5.5
> score URIBL_OB_SURBL 5.5
> score DRUGS_ERECTILE 5.0
>
> Study the mails to see what other rules would help your site and then
> have a looks rulesemporium.
But beware that many of the SARE rulesets are rather large, therefore will
increase system load and scanning time. Plus, spammers adapt to the rules
too quickly for them to be truly effective. On one of my servers (~180
domains for a web hosting company, though not filtering mail for all
addresses), in the past week SpamAssassin identified 4356 spam messages. Of
those, the 70_sare_specific.cf rule file contributed to pushing 17 messages
over the required hits threshold, and 70_sare_stocks.cf contributed to 10.
Five of the rulesets I use - 70_sare_obfu0.cf, 70_sare_html0.cf,
70_sc_top200.cf, 70_sare_html0.cf, and 70_sare_bayes_poison_nxm.cf - pushed
no messages over the threshold. Consistently, the strongest spam identifers
are Razor, Bayes, and the DNS tests.
Re: Increase overall preformance
Posted by Dermot Paikkos <de...@sciencephoto.com>.
I agree with the Theo. 3.1 is too low. You don't want to reject real
mail.
1) Use the network/dns tests.
2) increase the score on individual rules especially those for URIBL
score URIBL_WS_SURBL 5.5
score URIBL_SBL 5.5
score URIBL_OB_SURBL 5.5
score DRUGS_ERECTILE 5.0
Study the mails to see what other rules would help your site and then
have a looks rulesemporium.
HTH.
Dp.
On 16 May 2006 at 11:42, Benjamin Adams wrote:
> In Four days,
> Spamassasin marked 1477 messages and missed 755 that where spam.
>
> I have my Required set to 5
>
> what is the variable to drop the required in 3.1?
> I is it still required_score?
>
>
> Is there something else I can do to help the overall performance?
> --Ben