You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Bazooka Joe <fa...@gmail.com> on 2006/05/10 20:56:28 UTC
spam getting autolearn=ham problem
more and more i am seeing spam marked as autolearn=ham
I was wondering the best way to correct this? I was going to delete the
bayes and whitelist files and start over but I thought I would see what you
do when this happens.
my setup
using fc4
sendmail
spamass-milter - one bayes file for all users on server
spamassassin
-chris
Re: {SPAM}{!} Re: spam getting autolearn=ham problem
Posted by Matt Kettler <mk...@evi-inc.com>.
Bazooka Joe wrote:
> the spam
<snip>
> and no I haven't done any bayes training. and dns is working.
Are you running with SpamAssassin's built-in support for RBLs and URIBLs?
That message text got *TORN UP* by the URIBLs on my system:
X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=15.259, required 5,
HTML_40_50 0.50, HTML_MESSAGE 0.00, INFO_GREYLIST_NOTDELAYED -0.00,
LOCAL_FORGED_REFERENCES 0.10, RAZOR2_CF_RANGE_51_100 0.50,
RAZOR2_CF_RANGE_E8_51_100 1.50, RAZOR2_CHECK 0.50, SPF_PASS -0.00,
SURBL_MULTI1 -0.50, SURBL_MULTI2 -0.20, URIBL_BLACK 1.50,
URIBL_BLACK_OVERLAP -1.00, URIBL_JP_SURBL 4.09, URIBL_SBL 1.64,
URIBL_SC_SURBL 4.50, URIBL_WS_SURBL 2.14)
Check your init.pre and see if the uribl plugin is loaded, also check to make
sure you have Net::DNS installed.
Re: spam getting autolearn=ham problem
Posted by Jay Lee <jl...@pbu.edu>.
The message you sent directly to me hit the following:
* 0.5 HTML_40_50 BODY: Message is 40% to 50% HTML
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
* above 50%
* [cf: 100]
* 0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
* 3.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
* [cf: 100]
* 10 URIBL_SBL Contains an URL listed in the SBL blocklist
* [URIs: missusoandforever.org]
* 4.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
* [URIs: missusoandforever.org]
Of course, the scores are heavily inflated by my own personal rules (I
don't recommend doing this unless you know what you're doing) but the
point is, your SA doesn't seem to be firing on certain things it should,
do you have the DNS BL's working? Are you using Razor or DCC? Are you
on the latest 3.1.1?
Jay
Re: spam getting autolearn=ham problem
Posted by Bazooka Joe <fa...@gmail.com>.
the spam
Hi Robar
It is sad but it is true that the large groups of women are unhappy with
the size of there BF is thing. Don't be that guy,
www.missusoandforever.org/ab1/.
and station, designed been grabbed theorized to artist
Thank you
i run rules
TRUSTED_RULESETS="SARE_STOCKS TRIPWIRE SARE_EVILNUMBERS0 SARE_EVILNUMBERS1
BOGUSVIRUS SARE_ADULT SARE_FRAUD SARE_BML SARE_SPOOF SARE_BAYES_POISON_NXM
SARE_OEM SARE_RANDOM SARE_HEA
DER SARE_HTML SARE_SPECIFIC SARE_OBFU SARE_REDIRECT SARE_GENLSUBJ SARE_UNSUB
SARE_WHITELIST";
on my account I get about 10 spams a day scoring below a 3 out of 50 spams
total (thats a guess)
I will try moving the ham threshold down.
and no I haven't done any bayes training. and dns is working.
some stats for my box for one week
I block using sbl-xbl.spamhaus.org, or spamassass catches, or clamav rejects
about 45,000 emails. "ham" email w/ a score of 3 or less is about 9,000
On 5/10/06, Jay Lee <jl...@pbu.edu> wrote:
>
> Bazooka Joe wrote:
>
>
> *X-Spam-Status:* No, score=1.0 required=3.0 tests=BAYES_60 autolearn=ham
> version=3.0.4
> *X-Spam-Level:* *
> *X-Spam-Checker-Version:* SpamAssassin 3.0.4 (2005-06-05) on agwebinc.com
>
> I have required of 3 which you can see and i have the milter rejecting
> email w/ score more than 7
>
>
> On 5/10/06, Matt Kettler <mk...@evi-inc.com> wrote:
> >
> > Bazooka Joe wrote:
> > > more and more i am seeing spam marked as autolearn=ham
> > >
> > > I was wondering the best way to correct this?
> >
> > Depends.. Really you first need to figure out why it this happened
> > before you
> > take any action at all.
> >
> > Can you post a X-Spam-Status header for one of the messages?
> >
> > Have you modified the required_score, or any of the learning thresholds
> > in your
> > config?
> >
> > In general there are only a few rules that can cause a message to be
> > tagged as
> > spam, but do not count toward the computation of score for learning
> > purposes.
> > *_IN_BLACKLIST, AWL, BAYES_*, and GTUBE are the most noteworthy ones.
> >
>
> You can set bayes_auto_learn_threshold_nonspam in local.cf to be 0 or a
> negative number, then autolearn=ham won't kick in unless it's below a
> certain score (not sure if this counts bayes or not). But yes, the real
> question is why are no rules triggering... Is DNS working? Are you using
> the blacklist rules, etc? What does the spam look like?
>
> Jay
>
Re: spam getting autolearn=ham problem
Posted by Jay Lee <jl...@pbu.edu>.
Bazooka Joe wrote:
>
> *X-Spam-Status:* No, score=1.0 required=3.0 tests=BAYES_60 autolearn=ham
> version=3.0.4
> *X-Spam-Level:* *
> *X-Spam-Checker-Version:* SpamAssassin 3.0.4 (2005-06-05) on
> agwebinc.com <http://agwebinc.com>
>
>
> I have required of 3 which you can see and i have the milter rejecting
> email w/ score more than 7
>
>
> On 5/10/06, *Matt Kettler * <mkettler@evi-inc.com
> <ma...@evi-inc.com>> wrote:
>
> Bazooka Joe wrote:
> > more and more i am seeing spam marked as autolearn=ham
> >
> > I was wondering the best way to correct this?
>
> Depends.. Really you first need to figure out why it this happened
> before you
> take any action at all.
>
> Can you post a X-Spam-Status header for one of the messages?
>
> Have you modified the required_score, or any of the learning
> thresholds in your
> config?
>
> In general there are only a few rules that can cause a message to
> be tagged as
> spam, but do not count toward the computation of score for
> learning purposes.
> *_IN_BLACKLIST, AWL, BAYES_*, and GTUBE are the most noteworthy ones.
>
>
You can set bayes_auto_learn_threshold_nonspam in local.cf to be 0 or a
negative number, then autolearn=ham won't kick in unless it's below a
certain score (not sure if this counts bayes or not). But yes, the real
question is why are no rules triggering... Is DNS working? Are you
using the blacklist rules, etc? What does the spam look like?
Jay
Re: spam getting autolearn=ham problem
Posted by Matt Kettler <mk...@evi-inc.com>.
Bazooka Joe wrote:
>
> *X-Spam-Status:* No, score=1.0 required=3.0 tests=BAYES_60 autolearn=ham
> version=3.0.4
> *X-Spam-Level:* *
> *X-Spam-Checker-Version:* SpamAssassin 3.0.4 (2005-06-05) on
> agwebinc.com <http://agwebinc.com>
As far as the autolearner is concerned, the score of that message is 0.
(BAYES_60 is the only rule matched, and the autolearner doesn't consider BAYES
rule scores to prevent "self-feedback" in the bayes learning).
0 is less than the default ham learning threshold of 0.1, and the existing
training only scores 60 (not strongly known as spam), so it autolearns it as ham.
I would approach this from two angles.
1) why did the spam message fail to match any rules other than bayes? Your SA
version is a little old, you might consider testing it against 3.1.1. You might
also consider some rulesemporium.com add-on rulesets to help detect the
particular spam message.
2) Why did it only rank as BAYES_60. Have you done any manual training?
Re: spam getting autolearn=ham problem
Posted by Bazooka Joe <fa...@gmail.com>.
*X-Spam-Status:* No, score=1.0 required=3.0 tests=BAYES_60 autolearn=ham
version=3.0.4
*X-Spam-Level:* *
*X-Spam-Checker-Version:* SpamAssassin 3.0.4 (2005-06-05) on agwebinc.com
I have required of 3 which you can see and i have the milter rejecting email
w/ score more than 7
On 5/10/06, Matt Kettler <mk...@evi-inc.com> wrote:
>
> Bazooka Joe wrote:
> > more and more i am seeing spam marked as autolearn=ham
> >
> > I was wondering the best way to correct this?
>
> Depends.. Really you first need to figure out why it this happened before
> you
> take any action at all.
>
> Can you post a X-Spam-Status header for one of the messages?
>
> Have you modified the required_score, or any of the learning thresholds in
> your
> config?
>
> In general there are only a few rules that can cause a message to be
> tagged as
> spam, but do not count toward the computation of score for learning
> purposes.
> *_IN_BLACKLIST, AWL, BAYES_*, and GTUBE are the most noteworthy ones.
>
Re: spam getting autolearn=ham problem
Posted by Matt Kettler <mk...@evi-inc.com>.
Bazooka Joe wrote:
> more and more i am seeing spam marked as autolearn=ham
>
> I was wondering the best way to correct this?
Depends.. Really you first need to figure out why it this happened before you
take any action at all.
Can you post a X-Spam-Status header for one of the messages?
Have you modified the required_score, or any of the learning thresholds in your
config?
In general there are only a few rules that can cause a message to be tagged as
spam, but do not count toward the computation of score for learning purposes.
*_IN_BLACKLIST, AWL, BAYES_*, and GTUBE are the most noteworthy ones.