Varying scores for same message ?

[rn...@xoxy.net]

Hi,

I've recently been seeing some rather strange behaviour with Bayes and
AWLs.  Basically, I have a SA 3.0.4 installation running through Spamd
on a server, to handle spam filtering.  I find, though, that the same
message, presented to two different users running through the same spamc
for filtering, are presented with significantly different scores, by
scores which I would have assumed do NOT have any connection to Bayes or
AWLs.  

For example, one mail might get the following list with one user:

Content analysis details:   (18.4 points, 5.0 required)

 pts rule name              
---- ----------------------
 0.6 J_CHICKENPOX_72
 0.1 HTML_30_40
 0.0 HTML_MESSAGE
 1.5 RAZOR2_CF_RANGE_51_100
 1.2 MIME_HTML_ONLY
 0.1 RAZOR2_CHECK
 2.0 PYZOR_CHECK
 1.4 DCC_CHECK
 0.4 DNS_FROM_RFC_ABUSE
 0.5 DNS_FROM_RFC_WHOIS
 1.4 DNS_FROM_RFC_POST
 0.6 URIBL_SBL
 1.5 URIBL_JP_SURBL
 2.0 URIBL_OB_SURBL
 3.9 URIBL_SC_SURBL
 0.2 DIGEST_MULTIPLE
 1.0 DRUGS_ERECTILE

While the same mail would trigger the following list and get the
differing score:

Content analysis details:   (25.4 points, 5.0 required)

 pts rule name              
---- ---------------------- 
 0.6 J_CHICKENPOX_72
 0.0 HTML_30_40
 0.0 HTML_MESSAGE
 0.1 RAZOR2_CF_RANGE_51_100
 3.5 BAYES_99
 0.2 MIME_HTML_ONLY
 1.5 RAZOR2_CHECK
 3.5 PYZOR_CHECK
 2.2 DCC_CHECK
 0.3 DNS_FROM_RFC_WHOIS
 1.6 DNS_FROM_RFC_POST
 1.0 URIBL_SBL
 2.5 URIBL_JP_SURBL
 3.2 URIBL_OB_SURBL
 4.3 URIBL_SC_SURBL
 0.1 DIGEST_MULTIPLE
 1.0 DRUGS_ERECTILE

Why does the same e-mail, when processed on the same machine, through
the same spamc, for differing users, have different values for
RAZOR2_CF_RANGE_51_100 (1,5, 0.1),  RAZOR2_CHECK (0.1, 1.5),
PYZOR_CHECK (2.0, 3.5)?  As far as I krow, these tests aren't affected
by Bayes DBs

I find that the user processing the first set of results is in fact very
good at it's scoring, with spam mail usually getting a fairly high mark,
while ham mails might even be AWLd into finally having a negative total
score.  

Would appreciate any help in clearing this up.  

Best wishes,

Roshan

Re: Varying scores for same message ?

[Loren Wilton <lw...@earthlink.net>]

>  pts rule name
> ---- ----------------------
>  0.6 J_CHICKENPOX_72
>  0.1 HTML_30_40
>  0.0 HTML_MESSAGE
>  1.5 RAZOR2_CF_RANGE_51_100

>  pts rule name
> ---- ---------------------- 
>  0.6 J_CHICKENPOX_72
>  0.0 HTML_30_40
>  0.0 HTML_MESSAGE
>  0.1 RAZOR2_CF_RANGE_51_100
>  3.5 BAYES_99

> Why does the same e-mail, when processed on the same machine, through
> the same spamc, for differing users, have different values for
> RAZOR2_CF_RANGE_51_100 (1,5, 0.1),  RAZOR2_CHECK (0.1, 1.5),
> PYZOR_CHECK (2.0, 3.5)?  As far as I krow, these tests aren't affected
> by Bayes DBs

I suspect they are.  There are four possible scoresets, and I would expect
that one user is in scoreset 3 and the other in scoreset 4, at a guess.

        Loren

Re: Varying scores for same message ?

[Theo Van Dinter <fe...@apache.org>]

On Wed, Jun 22, 2005 at 12:57:26AM +0100, rns.spamassassin.n.semba@xoxy.net wrote:
> Why does the same e-mail, when processed on the same machine, through
> the same spamc, for differing users, have different values for
> RAZOR2_CF_RANGE_51_100 (1,5, 0.1),  RAZOR2_CHECK (0.1, 1.5),
> PYZOR_CHECK (2.0, 3.5)?  As far as I krow, these tests aren't affected
> by Bayes DBs

score RAZOR2_CF_RANGE_51_100 0 1.485 0 0.056
score RAZOR2_CHECK 0 0.150 0 1.511
score PYZOR_CHECK 0 2.041 0 3.451

One of the users does not have Bayes active, so they use scoreset 1
(1.5, 0.2, 2.0 == 3.7).  The other user does have Bayes active, so they
use scoreset 3 (0.1, 1.5, 3.5 == 5.1).

For more information, please see the POD.

-- 
Randomly Generated Tagline:
"M: Would anybody like some wine?
  W: What flavors do you have?
  M: You mean besides grape?
  W: Oh, ok."                  - Dream On