You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by pichels <sc...@weirminerals.com> on 2008/02/20 18:24:28 UTC
sa-learn "not" learning?
Hi all,
I'm new to the forum, please bear with me on details or eticate!
I have a RHEL 2.1 Linux machine running Postfix/Amavis/SA.
SA version:
[amavis@mail spam-email]$ sa-learn --version
SpamAssassin version 3.1.1
Perl version:
[root@mail root]# perl -v
This is perl, v5.6.1 built for i386-linux
Recently I started getting these errors when trying to learn spam email
messages:
[amavis@mail spam-email]$ sa-learn --spam < mosconj-022008-1
Use of uninitialized value in pattern match (m//) at
/usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Message/Node.pm line 119.
Use of uninitialized value in pattern match (m//) at
/usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Message/Node.pm line 119.
Use of uninitialized value in pattern match (m//) at
/usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Message/Node.pm line 119.
Learned tokens from 0 message(s) (1 message(s) examined)
So, I found a post that explained this was a bug and to pach the Node.pm
file and so I patched it:
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5823
Then, when I tried to run sa-learn - none of my messages are learning?
[amavis@mail spam-email]$ sa-learn --spam < mosconj-022008-1
Learned tokens from 0 message(s) (1 message(s) examined)
Perhaps I have more issues with my BayesDB - I don;t know at this point.
However, why does SA with debug and lint score the email?
[amavis@mail spam-email]$ /usr/bin/spamassassin -DtL < mosconj-022008-1
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on
mail.weirminerals.com
X-Spam-Report:
* 2.5 MISSING_HB_SEP Missing blank line between message header and
body
* 1.3 INFO_TLD URI: Contains an URL in the INFO top-level domain
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.4471]
* 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
* [Blocked - see
<http://www.spamcop.net/bl.shtml?125.115.21.32>]
* 1.8 MISSING_SUBJECT Missing Subject: header
X-Spam-Status: Yes, score=7.1 required=4.0 tests=BAYES_50,INFO_TLD,
MISSING_HB_SEP,MISSING_SUBJECT,RCVD_IN_BL_SPAMCOP_NET autolearn=no
version=3.1.1
X-Spam-Level: *******
But, in my maillog - the email is being sent thru and passing as a low score
under the spam cutoff score?
Feb 19 18:25:53 mail amavis[3261]: (03261-01) Passed,
<dw...@randytravis.com> -> <jo...@weirminerals.com>,
Message-ID: <88...@randytravis.com>, Hits: 1.217
Feb 19 18:25:53 mail postfix/smtp[3586]: > 66.170.10.8[66.170.10.8]: MAIL
FROM:<dw...@randytravis.com> SIZE=2806
Feb 19 18:25:53 mail postfix/smtp[3586]: < 66.170.10.8[66.170.10.8]: 250
dwrandytravism@randytravis.com... Sender OK
Any ideas as to what could have happened?
Many thanks for any help!
Scott
--
View this message in context: http://www.nabble.com/sa-learn-%22not%22-learning--tp15594114p15594114.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: sa-learn "not" learning?
Posted by pichels <sc...@weirminerals.com>.
Hi Theo,
Can I just paste the source header info of a similar spam mail here - none
are getting caught by SA?
Hope that is ok...Or did you mean something else?
(My spamasssin --lint check seems to check out)
###################################################
Received: from mail.weirminerals.com ([66.170.10.4])
by external1.us.war.weirgroup.net (Lotus Domino Release 6.5.6FP2)
with ESMTP id 2008022011532554-286823 ;
Wed, 20 Feb 2008 11:53:25 -0600
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.weirminerals.com (Postfix) with ESMTP
id 27717642D2; Wed, 20 Feb 2008 11:53:23 -0600 (CST)
Received: from mail.weirminerals.com ([127.0.0.1])
by localhost (mail.weirminerals.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 09727-01-21; Wed, 20 Feb 2008 11:53:19 -0600 (CST)
Received: from mninter.net (cpe-075-191-175-010.carolina.res.rr.com
[75.191.175.10])
by mail.weirminerals.com (Postfix) with SMTP
id 9BF79645E9; Wed, 20 Feb 2008 11:52:50 -0600 (CST)
Reply-To: "Claude" <co...@mninter.net>
From: "Roberto" <co...@mninter.net>
User-Agent: Mozilla 4.76 (Macintosh; U; PPC)
MIME-Version: 1.0
To: "africa.pumps" <af...@weirminerals.com>
Subject: howdy
Message-ID: <E6...@mninter.net>
Date: Thu, 21 Feb 2008 05:36:53 +1100
Bcc: john.moscon@weirminerals.com
X-MIMETrack: Itemize by SMTP Server on EXTERNAL1/WINET/Weir(Release
6.5.6FP2|October 17, 2007) at
02/20/2008 11:53:25 AM,
Serialize by Notes Client on Scott
Pichelman/US/WAR/Weir(Release 8.0|August
02, 2007) at 02/20/2008 11:56:36 AM,
Serialize complete at 02/20/2008 11:56:36 AM
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
charset="us-ascii"
Those crazy japaneses girls...
http://2j1f.com/2 japanese 1 finger !
####################################
[amavis@mail spam-email]$ /usr/bin/spamassassin -DtL < mosconj-022008-1
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on
mail.weirminerals.com
X-Spam-Report:
* 2.5 MISSING_HB_SEP Missing blank line between message header and
body
* 1.3 INFO_TLD URI: Contains an URL in the INFO top-level domain
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.4551]
* 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
* [Blocked - see
<http://www.spamcop.net/bl.shtml?125.115.21.32>]
* 1.8 MISSING_SUBJECT Missing Subject: header
X-Spam-Status: Yes, score=7.1 required=4.0 tests=BAYES_50,INFO_TLD,
MISSING_HB_SEP,MISSING_SUBJECT,RCVD_IN_BL_SPAMCOP_NET autolearn=no
version=3.1.1
X-Spam-Level: *******
Received: from mail.weirminerals.com ([66.170.10.4])
by external1.us.war.weirgroup.net (Lotus Domino Release 6.5.6FP2)
with ESMTP id 2008021919132074-278683 ;
Tue, 19 Feb 2008 19:13:20 -0600
Received: from localhost (localhost.localdomain [127.0.0.1])
by mail.weirminerals.com (Postfix) with ESMTP id 4859F6436B
for <jo...@weirminerals.com>; Tue, 19 Feb 2008
19:13:20 -0600 (CST)
Received: from mail.weirminerals.com ([127.0.0.1])
by localhost (mail.weirminerals.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 03608-02-49 for <jo...@weirminerals.com>;
Tue, 19 Feb 2008 19:13:16 -0600 (CST)
Received: from lenovo-d9bbc4ce (unknown [125.115.21.32])
by mail.weirminerals.com (Postfix) with SMTP id D41506439A
for <jo...@weirminerals.com>; Tue, 19 Feb 2008
19:12:53 -0600 (CST)
Received: from [125.115.21.32] by swmail.swagelok.com; Wed, 20 Feb 2008
09:50:11 +0800
From: "Ronda Gill" <a-...@adelaide.swagelok.com>
To: <jo...@weirminerals.com>Subject: What are you up to?
MIME-Version: 1.0
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.1830
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
Message-ID: <01...@a-anthrs>
X-Priority: 3 (Normal)
Date: Wed, 20 Feb 2008 09:50:11 +0800
X-MIMETrack: Itemize by SMTP Server on EXTERNAL1/WINET/Weir(Release
6.5.6FP2|October 17, 2007) at
02/19/2008 07:13:20 PM,
Serialize by Notes Client on Scott
Pichelman/US/WAR/Weir(Release 8.0|August
02, 2007) at 02/20/2008 09:31:22 AM,
Serialize complete at 02/20/2008 09:31:22 AM
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
format=flowed;
charset="us-ascii"
Hello! I am bored this afternoon. I am nice girl that would like to chat
with you. Email me at Kayla@ThePaganDoorway.info only, because I am using my
friend's email to write this. You will see some of my private pics.
Theo Van Dinter-2 wrote:
>
> On Wed, Feb 20, 2008 at 09:24:28AM -0800, pichels wrote:
>> /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Message/Node.pm line
>> 119.
>> Learned tokens from 0 message(s) (1 message(s) examined)
>>
>> So, I found a post that explained this was a bug and to pach the Node.pm
>> file and so I patched it:
>> http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5823
>
> bug 5823 isn't related to Message::Node
>
>> [amavis@mail spam-email]$ sa-learn --spam < mosconj-022008-1
>> Learned tokens from 0 message(s) (1 message(s) examined)
>
> It could mean that the message was already learned.
>
>> However, why does SA with debug and lint score the email?
>> * 2.5 MISSING_HB_SEP Missing blank line between message header
>> and body
>
> It is exceedingly likely that your input message is malformed. If you can
> pastebot the message somewhere, we can look at it for you and let you
> know.
>
> --
> Randomly Selected Tagline:
> "That's why I don't like video's - no commercial to read through."
> - Robert Gombert
>
>
>
--
View this message in context: http://www.nabble.com/sa-learn-%22not%22-learning--tp15594114p15596189.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: sa-learn "not" learning?
Posted by Theo Van Dinter <fe...@apache.org>.
On Wed, Feb 20, 2008 at 09:24:28AM -0800, pichels wrote:
> /usr/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Message/Node.pm line 119.
> Learned tokens from 0 message(s) (1 message(s) examined)
>
> So, I found a post that explained this was a bug and to pach the Node.pm
> file and so I patched it:
> http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5823
bug 5823 isn't related to Message::Node
> [amavis@mail spam-email]$ sa-learn --spam < mosconj-022008-1
> Learned tokens from 0 message(s) (1 message(s) examined)
It could mean that the message was already learned.
> However, why does SA with debug and lint score the email?
> * 2.5 MISSING_HB_SEP Missing blank line between message header and body
It is exceedingly likely that your input message is malformed. If you can
pastebot the message somewhere, we can look at it for you and let you know.
--
Randomly Selected Tagline:
"That's why I don't like video's - no commercial to read through."
- Robert Gombert
Re: sa-learn "not" learning?
Posted by Luis Hernán Otegui <lu...@gmail.com>.
Hi, Scott, I'll give you my two cents here
2008/2/20, scott.pichelman@weirminerals.com <
scott.pichelman@weirminerals.com>:
>
>
> Hi John,
>
> Looks like yo replied directly to me. I couldn't find your reply on the
> list yet?
> At any rate...
>
> The Bayes DB has been learned and in effect for a long time - years before
> my time.
>
> No ID's have changed or the config that has caused this error.
> I add users to the whitelist - and use sa-learn - that's it.
>
>
> 1.
> [amavis@mail spam-email]$ sa-learn --dump magic
> 0.000 0 3 0 non-token data: bayes db version
> 0.000 0 797361 0 non-token data: nspam
> 0.000 0 665377 0 non-token data: nham
> 0.000 0 186483 0 non-token data: ntokens
> 0.000 0 1203464108 0 non-token data: oldest atime
> 0.000 0 1203536991 0 non-token data: newest atime
> 0.000 0 1203536443 0 non-token data: last journal sync
> atime
> 0.000 0 1203507419 0 non-token data: last expiry atime
> 0.000 0 43200 0 non-token data: last expire atime
> delta
> 0.000 0 101794 0 non-token data: last expire
> reduction count
>
>
> 2.
> sa-learn running as "amavis".
>
> [amavis@mail spam-email]$ id
> uid=503(amavis) gid=504(amavis) groups=504(amavis)
>
> 3.
> I think we are filtering with Spamd - how can I tell - in a config file or
> dir? (/etc/mail./spamassasin or /var/amavis/.spamassassin)
> I have both binaries...
[amavis@mail spam-email]$ which spamd
>
/usr/bin/spamd
> [amavis@mail spam-email]$ which spamc
> /usr/bin/spamc
>
>
> 4.
> [root@mail root]# ps axu | grep spamd
>
> root 18580 0.0 0.1 1736 588 pts/2 S 14:00 0:00 grep spamd
Amavis loads the pertinent SA routines and code by itself, it doesn't call
SA OR Spamd at any moment.
>From what I've read, you SA-Amavis duo has been running from some time ago.
Anyway, I recommend you read the HOWTO by Gary V. It has some interesting
notes about the users under Amavis runs, and other valuable material. It's
located here:
http://www200.pair.com/mecham/spam/
You could try running Amavis in debug mode (i.e., stop amavis and from the
command line type:
*# amavisd debug*-*sa
*
That will show you how Amavis treats the message. I do also suggest rising
the detail level in Amavis' logs
Anyway, my answer is getting totally OT here. You might have more luck
asking in the Amavis list.
Hope this helps,
Luis
Scott Pichelman
> Systems Administrator
>
> Weir Minerals North America
> 2701 S Stoughton Rd
> Madison WI 53716 USA
>
> T: +(00)1 608 226 5615
> F: +(00)1 608 221 5807
> M: +(00)1 608 279 5056
> E: scott.pichelman@weirminerals.com
> W: www.weirminerals.com
>
>
> *John Hardin <jh...@impsec.org>*
>
> 02/20/2008 01:43 PM
> To
> pichels <sc...@weirminerals.com> cc
> users@spamassassin.apache.org Subject
> Re: sa-learn "not" learning?
>
>
>
>
>
>
> On Wed, 20 Feb 2008, pichels wrote:
>
> > But, I've tried learning any email after I recieved the Perl error
> > message and none are being learned?
> > And why is the spam being scored wioth spamassassin?
> > I don't understand? Could my Bayes DB need to be re-synced or forced to
> > expire some dups or ?
>
> Note that bayes needs at least 200 spams and 200 hams before is starts
> scoring. Have you learned that many yet?
>
> If you have kept your training corpus, you could delete the bayes database
>
> files entirely and start training over from scratch.
>
> > My users are getting the "nice girl emails and they are not scoring as
> I've
> > shown in my post - why?
> > They score with spamassassin debug but are not being stopped by SA in my
> > maillogs?
>
> That smells like a user ID problem. If the user ID that spamassassin/spamd
>
> is running under is different than the user ID you are running sa-learn
> under, the bayes databases are different - you're training a database that
>
> SA isn't looking at. Verify that you are training using the same user as
> the user spamassassin/spamd is running as to filter mail.
>
> > Can I provide more details?
>
> What does "sa-learn --dump magic" report?
>
> How are you filtering messages? spamc+spamd?
>
> What user is spamd running as? What user are you running sa-learn as?
>
> What (if anything) does "ps axu | grep spamd" report?
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/<http://www.impsec.org/%7Ejhardin/>
> jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
> [Small arms] are fundamentally dangerous and their removal from the
> equation either by control, neutralisation or removal is essential.
> The first step is to gain information on their numbers and
> whereabouts. -- the UN, who "doesn't want to confiscate guns"
> -----------------------------------------------------------------------
> 2 days until George Washington's 276th Birthday
>
>
> This document should only be read by those persons to whom it is addressed
> and is not intended to be relied upon by any person without subsequent
> written confirmation of its contents. Accordingly, our company disclaim all
> responsibility and accept no liability (including in negligence) for the
> consequences for any person acting, or refraining from acting, on such
> information prior to the receipt by those persons of subsequent written
> confirmation., If you have received this E-mail message in error, please
> notify us immediately by telephone. Please also destroy and delete the
> message from your computer., Any form of reproduction, dissemination,
> copying, disclosure, modification, distribution and/or publication of this
> E-mail message is strictly prohibited.
>
--
-------------------------------------------------
GNU-GPL: "May The Source Be With You...
Linux Registered User #448382.
When I grow up, I wanna be like Theo...
-------------------------------------------------
Re: sa-learn "not" learning?
Posted by John Hardin <jh...@impsec.org>.
On Wed, 20 Feb 2008, scott.pichelman@weirminerals.com wrote:
> The Bayes DB has been learned and in effect for a long time - years
> before my time.
>
> No ID's have changed or the config that has caused this error.
> I add users to the whitelist - and use sa-learn - that's it.
ok.
> 0.000 0 797361 0 non-token data: nspam
> 0.000 0 665377 0 non-token data: nham
ok.
> 2.
> sa-learn running as "amavis".
>
> [amavis@mail spam-email]$ id
> uid=503(amavis) gid=504(amavis) groups=504(amavis)
>
> 3.
> I think we are filtering with Spamd - how can I tell - in a config file or
> dir? (/etc/mail./spamassasin or /var/amavis/.spamassassin)
> I have both binaries...
I'm not sure, I'm not familiar with how amavisd hooks into SA.
> 4.
> [root@mail root]# ps axu | grep spamd
> root 18580 0.0 0.1 1736 588 pts/2 S 14:00 0:00 grep spamd
That seems to indicate spamd isn't in use.
Hmm.
Do you have autolearn turned on? Perhaps the messages were already
automatically learned and are being ignored when you later try to manually
train.
You said those sa-learn errors started happening recently - was SA
updated? Was perl updated?
Grab a missed spam out of your mailbox and run it through SA with debug,
then compare the score to what it got when it went through your MTA. As
Theo noted, the earlier example looked misformatted enough (the MISSING_*
hits) to push the score over the threshold.
And given that the bug was not related to Node.pm, did you keep the
unpatched Node.pm around? You might want to consider upgrading to 3.1.9,
if you're not willing to go to 3.2.x yet...
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The fetters imposed on liberty at home have ever been forged out
of the weapons provided for defense against real, pretended, or
imaginary dangers from abroad. -- James Madison, 1799
-----------------------------------------------------------------------
2 days until George Washington's 276th Birthday
Re: sa-learn "not" learning?
Posted by sc...@weirminerals.com.
Hi John,
Looks like yo replied directly to me. I couldn't find your reply on the
list yet?
At any rate...
The Bayes DB has been learned and in effect for a long time - years before
my time.
No ID's have changed or the config that has caused this error.
I add users to the whitelist - and use sa-learn - that's it.
1.
[amavis@mail spam-email]$ sa-learn --dump magic
0.000 0 3 0 non-token data: bayes db version
0.000 0 797361 0 non-token data: nspam
0.000 0 665377 0 non-token data: nham
0.000 0 186483 0 non-token data: ntokens
0.000 0 1203464108 0 non-token data: oldest atime
0.000 0 1203536991 0 non-token data: newest atime
0.000 0 1203536443 0 non-token data: last journal sync
atime
0.000 0 1203507419 0 non-token data: last expiry atime
0.000 0 43200 0 non-token data: last expire atime
delta
0.000 0 101794 0 non-token data: last expire
reduction count
2.
sa-learn running as "amavis".
[amavis@mail spam-email]$ id
uid=503(amavis) gid=504(amavis) groups=504(amavis)
3.
I think we are filtering with Spamd - how can I tell - in a config file or
dir? (/etc/mail./spamassasin or /var/amavis/.spamassassin)
I have both binaries...
[amavis@mail spam-email]$ which spamd
/usr/bin/spamd
[amavis@mail spam-email]$ which spamc
/usr/bin/spamc
4.
[root@mail root]# ps axu | grep spamd
root 18580 0.0 0.1 1736 588 pts/2 S 14:00 0:00 grep spamd
Scott Pichelman
Systems Administrator
Weir Minerals North America
2701 S Stoughton Rd
Madison WI 53716 USA
T: +(00)1 608 226 5615
F: +(00)1 608 221 5807
M: +(00)1 608 279 5056
E: scott.pichelman@weirminerals.com
W: www.weirminerals.com
John Hardin <jh...@impsec.org>
02/20/2008 01:43 PM
To
pichels <sc...@weirminerals.com>
cc
users@spamassassin.apache.org
Subject
Re: sa-learn "not" learning?
On Wed, 20 Feb 2008, pichels wrote:
> But, I've tried learning any email after I recieved the Perl error
> message and none are being learned?
> And why is the spam being scored wioth spamassassin?
> I don't understand? Could my Bayes DB need to be re-synced or forced to
> expire some dups or ?
Note that bayes needs at least 200 spams and 200 hams before is starts
scoring. Have you learned that many yet?
If you have kept your training corpus, you could delete the bayes database
files entirely and start training over from scratch.
> My users are getting the "nice girl emails and they are not scoring as
I've
> shown in my post - why?
> They score with spamassassin debug but are not being stopped by SA in my
> maillogs?
That smells like a user ID problem. If the user ID that spamassassin/spamd
is running under is different than the user ID you are running sa-learn
under, the bayes databases are different - you're training a database that
SA isn't looking at. Verify that you are training using the same user as
the user spamassassin/spamd is running as to filter mail.
> Can I provide more details?
What does "sa-learn --dump magic" report?
How are you filtering messages? spamc+spamd?
What user is spamd running as? What user are you running sa-learn as?
What (if anything) does "ps axu | grep spamd" report?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
[Small arms] are fundamentally dangerous and their removal from the
equation either by control, neutralisation or removal is essential.
The first step is to gain information on their numbers and
whereabouts. -- the UN, who "doesn't want to confiscate guns"
-----------------------------------------------------------------------
2 days until George Washington's 276th Birthday
This document should only be read by those persons to whom it is addressed and is not intended to be relied upon by any person without subsequent written confirmation of its contents. Accordingly, our company disclaim all responsibility and accept no liability (including in negligence) for the consequences for any person acting, or refraining from acting, on such information prior to the receipt by those persons of subsequent written confirmation., If you have received this E-mail message in error, please notify us immediately by telephone. Please also destroy and delete the message from your computer., Any form of reproduction, dissemination, copying, disclosure, modification, distribution and/or publication of this E-mail message is strictly prohibited.
Re: sa-learn "not" learning?
Posted by John Hardin <jh...@impsec.org>.
On Wed, 20 Feb 2008, pichels wrote:
> But, I've tried learning any email after I recieved the Perl error
> message and none are being learned?
> And why is the spam being scored wioth spamassassin?
> I don't understand? Could my Bayes DB need to be re-synced or forced to
> expire some dups or ?
Note that bayes needs at least 200 spams and 200 hams before is starts
scoring. Have you learned that many yet?
If you have kept your training corpus, you could delete the bayes database
files entirely and start training over from scratch.
> My users are getting the "nice girl emails and they are not scoring as I've
> shown in my post - why?
> They score with spamassassin debug but are not being stopped by SA in my
> maillogs?
That smells like a user ID problem. If the user ID that spamassassin/spamd
is running under is different than the user ID you are running sa-learn
under, the bayes databases are different - you're training a database that
SA isn't looking at. Verify that you are training using the same user as
the user spamassassin/spamd is running as to filter mail.
> Can I provide more details?
What does "sa-learn --dump magic" report?
How are you filtering messages? spamc+spamd?
What user is spamd running as? What user are you running sa-learn as?
What (if anything) does "ps axu | grep spamd" report?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
[Small arms] are fundamentally dangerous and their removal from the
equation either by control, neutralisation or removal is essential.
The first step is to gain information on their numbers and
whereabouts. -- the UN, who "doesn't want to confiscate guns"
-----------------------------------------------------------------------
2 days until George Washington's 276th Birthday
Re: sa-learn "not" learning?
Posted by pichels <sc...@weirminerals.com>.
Hi John,
But, I've tried learning any email after I recieved the Perl error message
and none are being learned?
And why is the spam being scored wioth spamassassin?
I don't understand? Could my Bayes DB need to be re-synced or forced to
expire some dups or ?
My users are getting the "nice girl emails and they are not scoring as I've
shown in my post - why?
They score with spamassassin debug but are not being stopped by SA in my
maillogs?
Can I provide more details?
Thanks,
pichels
John Hardin wrote:
>
> On Wed, 20 Feb 2008, pichels wrote:
>
>> Then, when I tried to run sa-learn - none of my messages are learning?
>>
>> [amavis@mail spam-email]$ sa-learn --spam < mosconj-022008-1
>> Learned tokens from 0 message(s) (1 message(s) examined)
>
> That just means that sa-learn has already learned that message and is
> ignoring it. It does not by itself indicate a problem exists.
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
> jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
> The third basic rule of firearms safety:
> Keep your booger hook off the bang switch!
> -----------------------------------------------------------------------
> 2 days until George Washington's 276th Birthday
>
>
--
View this message in context: http://www.nabble.com/sa-learn-%22not%22-learning--tp15594114p15594744.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: sa-learn "not" learning?
Posted by John Hardin <jh...@impsec.org>.
On Wed, 20 Feb 2008, pichels wrote:
> Then, when I tried to run sa-learn - none of my messages are learning?
>
> [amavis@mail spam-email]$ sa-learn --spam < mosconj-022008-1
> Learned tokens from 0 message(s) (1 message(s) examined)
That just means that sa-learn has already learned that message and is
ignoring it. It does not by itself indicate a problem exists.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The third basic rule of firearms safety:
Keep your booger hook off the bang switch!
-----------------------------------------------------------------------
2 days until George Washington's 276th Birthday