You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Joe Acquisto-j4 <jo...@j4computers.com> on 2013/04/20 15:10:26 UTC
re-learning ? was - bayes - large message
>>> On 4/19/2013 at 8:33 PM, "Joe Acquisto-j4" <jo...@j4computers.com> wrote:
>>>> On 4/19/2013 at 8:26 PM, "Joe Acquisto-j4" <jo...@j4computers.com> wrote:
>> I thought I had corrected this issue, with someone's assistance, a while
> ago:
>>
>> Apr 19 20:21:02.477 [23670] dbg: bayes: expiry completed
>> Apr 19 20:21:02.477 [23670] info: archive-iterator: skipping large message
>> Learned tokens from 0 message(s) (0 message(s) examined)
>
> Please ignore. As much as possible. I was testing manually and forgot
> --mbox on the command line.
>
> However, I can see something is amiss as it is happily accepting spam I
> thought had been previously submitted.
>
> joe a.
Ok, I am officially puzzled.
I setup email addresses on my SA box, to which I and others (they say) send ham/spam. Then I have cron tasks that feed those emails twice daily to bayes. And emails the output to my admin mailbox.
I can review those admin messages and see "Learned tokens from n message(s) (n message(s) examined)". Yet, if i resend the bayes food from those dates, it appears to re-learn them. I would expect "Learned tokens from 0 messages(s) (n messages(s). . . "
if it already had seen them.
I have tried this for several dates and get the same result. What could it be? Not Operator Trouble, surely . . .
joe a
Re: re-learning ? was - bayes - large message
Posted by RW <rw...@googlemail.com>.
On Sat, 20 Apr 2013 09:10:26 -0400
Joe Acquisto-j4 wrote:
>
> Ok, I am officially puzzled.
>
> I setup email addresses on my SA box, to which I and others (they
> say) send ham/spam. Then I have cron tasks that feed those emails
> twice daily to bayes. And emails the output to my admin mailbox.
>
> I can review those admin messages and see "Learned tokens from n
> message(s) (n message(s) examined)". Yet, if i resend the bayes
> food from those dates, it appears to re-learn them. I would expect
> "Learned tokens from 0 messages(s) (n messages(s). . . " if it
> already had seen them.
>
> I have tried this for several dates and get the same result. What
> could it be? Not Operator Trouble, surely . . .
It could be that you are learning into a difference database - this is a
common error.
How are you forwarding? The correct way is to have the users forward as
attachment and then feed the attachments to Bayes. At very least you
need to forward in a way that doesn't add a new date header - usually
called a redirect.
Re: re-learning ? was - bayes - large message
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>>>> On 4/19/2013 at 8:33 PM, "Joe Acquisto-j4" <jo...@j4computers.com> wrote:
>>>>> On 4/19/2013 at 8:26 PM, "Joe Acquisto-j4" <jo...@j4computers.com> wrote:
>>> I thought I had corrected this issue, with someone's assistance, a while
>> ago:
>>>
>>> Apr 19 20:21:02.477 [23670] dbg: bayes: expiry completed
>>> Apr 19 20:21:02.477 [23670] info: archive-iterator: skipping large message
>>> Learned tokens from 0 message(s) (0 message(s) examined)
>>
>> Please ignore. As much as possible. I was testing manually and forgot
>> --mbox on the command line.
>>
>> However, I can see something is amiss as it is happily accepting spam I
>> thought had been previously submitted.
>>
>> joe a.
On 20.04.13 09:10, Joe Acquisto-j4 wrote:
>I setup email addresses on my SA box, to which I and others (they say) send
> ham/spam. Then I have cron tasks that feed those emails twice daily to
> bayes. And emails the output to my admin mailbox.
Do they bounce (e.g. mozilla mail redirect addin does that) spam there? It
can have bad results, if users forward (as attachment or inline) mail there.
Using shared mailbox and copy mail into it would be better.
Also, are they two different mailboxes, one clearly for spam and one for ham?
Attempts to classify all mail there as mistrained and mail tagged as
spam feeding as ham can result into spam re-trained (some users don't get it
and feed all spam there)
Is it exactly the database that is used by spamassassin when scanning mail
on delivery? If SA uses different database, your training causes nothing :-)
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
You have the right to remain silent. Anything you say will be misquoted,
then used against you.
Re: re-learning ? was - bayes - large message
Posted by RW <rw...@googlemail.com>.
On Sat, 20 Apr 2013 10:38:57 -0400
Jeff Mincy wrote:
> Bayes uses the message id from the email message to remember which
> messages it has seen. If you are really emailing the messages then
> you are getting a new message-id which is then learned. You need to
> train on the unadulterated original email message.
Bayes generates it's own ID from the beginning of the body, the first
(i.e. submission) received header and the date header. This gets
preserved with a redirect or an extracted attachment (from forward as
attachment), but not with a forward or non-extracted attachment.
It's particularly important to get this right if auto-learning is used
because otherwise incorrect learning is not properly corrected, it
just ends up being learned both ways.
Re: re-learning ? was - bayes - large message
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 20.04.13 15:18, Joe Acquisto-j4 wrote:
>Looks as if I misunderstood something here. I thought it was OK to forward, as an attachment and SA/Bayes would
>"figure it out". I did think that curious, but, hey, what do I know? That's obvious now . . . Anyway it made it easier for
>me to feed bayes that way.
there's a "munpack" tool that should be able to extract attachments from
e-mail, so you should be able to feed those attachments (original messages)
to sa-learn, or even "spamassassin -r" (can report to systems like network
databases and SpamCop).
However, microsoft outlook used to strip some message headers when
forwarding it as attachment, so it's really better to use shared folders:
one for spam to learn, one for already learned spam, one for ham to learn
and one fot already learned ham. That way you can manually check what do
your users report (some users tend to report anything...).
>Looks like I gotta learn to Samba.
This has nothing to do with samba.
>I suppose I should clear bayes and start over, then?
apparently yes. But if yopu have stored messages that were feed into BAYES,
you can extract older attachments, would help at the begin.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Nothing is fool-proof to a talented fool.
Re: re-learning ? was - bayes - large message
Posted by John Hardin <jh...@impsec.org>.
On Sat, 20 Apr 2013, Joe Acquisto-j4 wrote:
>>>> On 4/20/2013 at 2:00 PM, John Hardin <jh...@impsec.org> wrote:
>> On Sat, 20 Apr 2013, Joe Acquisto-j4 wrote:
>>
>>> In order to send the samples, the user will forward the messages, as an
>>> attachment. Each is an individual message to either ham or spam, with
>>> the (hopefully) correct attachment.
>>
>> Are you extracting the attachments off those messages to feed to sa-learn?
>> Or are you feeding in the entire forwarded message including the
>> attachment?
>>
>> If the latter, you're training stuff you shouldn't be (the headers of the
>> submission to the training folders) and you'll see every user's submission
>> of the same multi-recipient spam as being learned separately.
>>
>> This is one reason it's better, if possible, to have global training
>> folders that users can just move/copy messages into. If training
>> submissions pass though your mail system again, things get complicated.
>>
>> --
>> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
> . . .
>
> Well, err . . . umm.
>
> Looks as if I misunderstood something here. I thought it was OK to
> forward, as an attachment and SA/Bayes would "figure it out".
SA is smart enough to strip the markup it has added to the spam message
when it was scanned, which can include awrapping the original message as
an attachment rather than modifying it. It's not smart enough to figure
out that the message you are really interested in is attached to the
message you're giving it absent that markup.
This is a pretty common situation. I've added a feature request for an
--attachment option for sa-learn, to tell it to learn from an attachment
rather than the entire message.
> I did think that curious, but, hey, what do I know? That's obvious now
> . . . Anyway it made it easier for me to feed bayes that way.
>
> Too bad it does not work.
>
> Looks like I gotta learn to Samba.
Oh, no - I didn't mean to imply copying to a shared *file* folder for
training. What I meant by "if possible" is if you have server-side message
storage and your users are reading their mail via IMAP or are using a mail
server (e.g. MSExchange) that allows you to set up a single shared
server-side *mail* folder that everyone can access. (Well, two folders,
one for training misclassified spam and the other for training
misclassified ham.)
If you are using IMAP rather than POP and you want to offer greater
privacy to your users, you can set up per-user ham and spam training
folders in their local mail directories, have them copy messages to those
mail folders for training, and your training script can just directly read
those folders.
However, your using forwarding suggests that you're not using server-side
storage.
You're *almost* there with your current setup. Rather than learning Samba,
you need to learn some mail tools that will let you step through the
messages in your existing training folder, pull out the RFC822 attachment
from each and feed that to sa-learn.
It might be easier to use two separate scripts: one that processes a mail
folder full of forwarded messages, extracts the attached message from each
and adds that to a second mail folder, and another (very simple) script to
learn from that second folder. You already have the second script, so you
just need to write the first one.
> I suppose I should clear bayes and start over, then?
Yes, but you don't need to discard your existing corpora of messages that
your users have submitted (assuming you kept them).
Once you have your training script extracting the attachments and have
reset the bayes database, just drop your entire corpus of forwarded
learn-as-spam messages back into the spam training folder and the entire
corpus of forwarded learn-as-ham messages back into the ham training
folder and you should be good.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
My sidearm is a piece of emergency equipment. It absolutely must
be reliable, not "smart".
-----------------------------------------------------------------------
3 days until Max Planck's 155th birthday
Re: re-learning ? was - bayes - large message
Posted by Joe Acquisto-j4 <jo...@j4computers.com>.
>>> On 4/20/2013 at 2:00 PM, John Hardin <jh...@impsec.org> wrote:
> On Sat, 20 Apr 2013, Joe Acquisto-j4 wrote:
>
>> In order to send the samples, the user will forward the messages, as an
>> attachment. Each is an individual message to either ham or spam, with
>> the (hopefully) correct attachment.
>
> Are you extracting the attachments off those messages to feed to sa-learn?
> Or are you feeding in the entire forwarded message including the
> attachment?
>
> If the latter, you're training stuff you shouldn't be (the headers of the
> submission to the training folders) and you'll see every user's submission
> of the same multi-recipient spam as being learned separately.
>
> This is one reason it's better, if possible, to have global training
> folders that users can just move/copy messages into. If training
> submissions pass though your mail system again, things get complicated.
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
. . .
Well, err . . . umm.
Looks as if I misunderstood something here. I thought it was OK to forward, as an attachment and SA/Bayes would
"figure it out". I did think that curious, but, hey, what do I know? That's obvious now . . . Anyway it made it easier for
me to feed bayes that way.
Too bad it does not work.
Looks like I gotta learn to Samba.
I suppose I should clear bayes and start over, then?
joe a.
Re: re-learning ? was - bayes - large message
Posted by John Hardin <jh...@impsec.org>.
On Sat, 20 Apr 2013, Joe Acquisto-j4 wrote:
> In order to send the samples, the user will forward the messages, as an
> attachment. Each is an individual message to either ham or spam, with
> the (hopefully) correct attachment.
Are you extracting the attachments off those messages to feed to sa-learn?
Or are you feeding in the entire forwarded message including the
attachment?
If the latter, you're training stuff you shouldn't be (the headers of the
submission to the training folders) and you'll see every user's submission
of the same multi-recipient spam as being learned separately.
This is one reason it's better, if possible, to have global training
folders that users can just move/copy messages into. If training
submissions pass though your mail system again, things get complicated.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Christian martyrs don't explode. -- Marisol
-----------------------------------------------------------------------
3 days until Max Planck's 155th birthday
Re: re-learning ? was - bayes - large message
Posted by Joe Acquisto-j4 <jo...@j4computers.com>.
. . .
> Ok, I am officially puzzled.
>
> I setup email addresses on my SA box, to which I and others (they say)
> send ham/spam. Then I have cron tasks that feed those emails twice daily to
> bayes. And emails the output to my admin mailbox.
>
> I can review those admin messages and see "Learned tokens from n
> message(s) (n message(s) examined)". Yet, if i resend the bayes food from
> those dates, it appears to re-learn them. I would expect "Learned tokens
> from 0 messages(s) (n messages(s). . . "
> if it already had seen them.
>
> I have tried this for several dates and get the same result. What could
> it be? Not Operator Trouble, surely . . .
>
> joe a
>
> Bayes uses the message id from the email message to remember which
> messages it has seen. If you are really emailing the messages then
> you are getting a new message-id which is then learned. You need to
> train on the unadulterated original email message. You can do this by
> attaching the complete email message. Otherwise you are training
> bayes to recognize tokens added by your users during the forwarding
> process as a spam indicator.
>
> -jeff
To attempt to answer several at one go -
I do email them to the Linux box that hosts SA. Postfix is in use there. spam and ham each have their own "mailbox" there, which appears to be essentially a file named for the account.
In order to send the samples, the user will forward the messages, as an attachment. Each is an individual message to either ham or spam, with the (hopefully) correct attachment.
I think this meets requirements. ? But, if it is reading the forwarders info, that explains why it is "re-learning" and suggests my bayes data is worthless.
joe a.
Re: re-learning ? was - bayes - large message
Posted by Jeff Mincy <je...@delphioutpost.com>.
From: "Joe Acquisto-j4" <jo...@j4computers.com>
Date: Sat, 20 Apr 2013 09:10:26 -0400
>>> On 4/19/2013 at 8:33 PM, "Joe Acquisto-j4" <jo...@j4computers.com> wrote:
>>>> On 4/19/2013 at 8:26 PM, "Joe Acquisto-j4" <jo...@j4computers.com> wrote:
>> I thought I had corrected this issue, with someone's assistance, a while
> ago:
>>
>> Apr 19 20:21:02.477 [23670] dbg: bayes: expiry completed
>> Apr 19 20:21:02.477 [23670] info: archive-iterator: skipping large message
>> Learned tokens from 0 message(s) (0 message(s) examined)
>
> Please ignore. As much as possible. I was testing manually and forgot
> --mbox on the command line.
>
> However, I can see something is amiss as it is happily accepting spam I
> thought had been previously submitted.
>
> joe a.
Ok, I am officially puzzled.
I setup email addresses on my SA box, to which I and others (they say) send ham/spam. Then I have cron tasks that feed those emails twice daily to bayes. And emails the output to my admin mailbox.
I can review those admin messages and see "Learned tokens from n message(s) (n message(s) examined)". Yet, if i resend the bayes food from those dates, it appears to re-learn them. I would expect "Learned tokens from 0 messages(s) (n messages(s). . . "
if it already had seen them.
I have tried this for several dates and get the same result. What could it be? Not Operator Trouble, surely . . .
joe a
Bayes uses the message id from the email message to remember which
messages it has seen. If you are really emailing the messages then
you are getting a new message-id which is then learned. You need to
train on the unadulterated original email message. You can do this by
attaching the complete email message. Otherwise you are training
bayes to recognize tokens added by your users during the forwarding
process as a spam indicator.
-jeff