Setting negative pontuation can cause false positives?

["Lauro Costa G. Borges" <nh...@gmail.com>]

 SpamAssassin version 3.2.5
  running on Perl version 5.10.0

 Ubuntu 8.10

----


 I configured some addresses to be -9.0 or even -20.0 on Amavis (there were
some addresses with -3.0, from default config on Ubuntu), does that make it
possible that SpamAssassin will mark some emails with a pontuation higher
than they should be, or were in the past (since -9 and -20 are far from -3)?
I have users being blocked, and these users were not blocked before, simple
messages with Office and such attachments, or links, are being banned,
identified as spam, with scores around 5 and 6.

 ----

$sa_spam_subject_tag = '***SPAM*** ';
$sa_tag_level_deflt  = -10;  # add spam info headers if at, or above that
level
$sa_tag2_level_deflt = 3.0; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 4.10; # triggers spam evasive actions
$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent
-------------

Re: Setting negative pontuation can cause false positives?

[Bowie Bailey <Bo...@BUC.com>]

Lauro Costa G. Borges wrote:
>
>  I configured some addresses to be -9.0 or even -20.0 on Amavis (there
> were some addresses with -3.0, from default config on Ubuntu), does
> that make it possible that SpamAssassin will mark some emails with a
> pontuation higher than they should be, or were in the past (since -9
> and -20 are far from -3)? I have users being blocked, and these users
> were not blocked before, simple messages with Office and such
> attachments, or links, are being banned, identified as spam, with
> scores around 5 and 6.
>
>  ----
>
> $sa_spam_subject_tag = '***SPAM*** ';
> $sa_tag_level_deflt  = -10;  # add spam info headers if at, or above
> that level
> $sa_tag2_level_deflt = 3.0; # add 'spam detected' headers at that level
> $sa_kill_level_deflt = 4.10; # triggers spam evasive actions
> $sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent
> -------------

These settings just configure what Amavis does with messages with a
particular score.  They have no bearing on determining the scores.

However, I notice that you are marking spam at 3 points and rejecting or
quarantining it at 4.1 points.  SA is normally tuned to mark spam at 5
points, so I doubt you want to reject messages that score
4.1...particularly if you are having problems with false positives.  I
would suggest that $sa_tag2_level_deflt should be 5 and
$sa_kill_level_deflt should be at least 7.

-- 
Bowie

Re: Setting negative pontuation can cause false positives?

[Karsten Bräckelmann <gu...@rudersport.de>]

No. It is logically impossible, that an additional negative score
*causes* the FPs.

On Mon, 2010-05-10 at 21:31 +0800, Lauro Costa G. Borges wrote:
> I configured some addresses to be -9.0 or even -20.0 on Amavis (there
> were some addresses with -3.0, from default config on Ubuntu), does

Err, what exactly did you configure?

> that make it possible that SpamAssassin will mark some emails with a
> pontuation higher than they should be, or were in the past (since -9
> and -20 are far from -3)? I have users being blocked, and these users
> were not blocked before, simple messages with Office and such
> attachments, or links, are being banned, identified as spam, with
> scores around 5 and 6.

There is no way for us to help you and spot the issue, unless you
provide headers. At the very least, the SA rules triggered by these
messages.

A quick guess though is, you did *not* run sa-update in the past few
months, and now suffer from a buggy rule adding a few points to each and
every message.


Again: Please do show us the headers (or rules triggered) of these
messages.

  guenther


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}