Re: Uncatched spam and rules weith modification..

[Frederic Goudal <go...@enseirb.fr>]

Robert Menschel <Ro...@menschel.net>
> Cc: SPAMassassin Users <us...@spamassassin.apache.org>
> Date: Wed, 11 May 2005 19:07:50 PDT
> Subject: Re: Uncatched spam and rules weith modification..

>Hello Frederic,

>FG> X-spam-status: No, hits=5.312 tagged_above=-999 required=6.31 
tests=BAYES_99,
>FG>  RCVD_HELO_IP_MISMATCH, RCVD_NUMERIC_HELO
>that does score high enough to be classified as spam, but you or your
>administrator have raised the required score from 5.0 to 6.31.

It is what is put in Amavisd config.  I will maybe lower it a bit.



>If your Bayes database is reliable and stable, bump the score for
>BAYES_99.  

In fact I forgot to uprgrade to SA 3.0.3 which bumbs bayes a lot.
But from my own mail it seems that bayes_99 never hits a false positive.


>Or look into adopting some of SARE's rules files, at
>http://www.rulesemporium.com (or other custom files available via the
>wiki).

I have most of sare rules, but I have not seen a set for stock ads..

THanks for the advice

f.g.

Re[2]: Uncatched spam and rules weith modification..

[Robert Menschel <Ro...@Menschel.net>]

Hello Frederic,

Thursday, May 12, 2005, 8:40:17 AM, you wrote:

>>FG> X-spam-status: No, hits=5.312 tagged_above=-999 required=6.31
FG> tests=BAYES_99,
>>FG>  RCVD_HELO_IP_MISMATCH, RCVD_NUMERIC_HELO
>>that does score high enough to be classified as spam, but you or your
>>administrator have raised the required score from 5.0 to 6.31.

FG> It is what is put in Amavisd config.  I will maybe lower it a bit.

If you're not getting FPs, then cautious lowering is viable.

>>If your Bayes database is reliable and stable, bump the score for
>>BAYES_99.  

FG> In fact I forgot to uprgrade to SA 3.0.3 which bumbs bayes a lot.
FG> But from my own mail it seems that bayes_99 never hits a false positive.

Then definitely bump Bayes, at least until you upgrade to 3.0.3 or 3.1

>>Or look into adopting some of SARE's rules files, at
>>http://www.rulesemporium.com (or other custom files available via the
>>wiki).

FG> I have most of sare rules, but I have not seen a set for stock ads..

Should be in the BML set, through that hasn't been updated in a long
while and might not help against the current set.  Those that have
been using obfuscations should start getting hit by the new
obfuscation rule set files.

Bob Menschel