LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 07-26-2010, 12:02 AM   #1
wpost
LQ Newbie
 
Registered: Jul 2004
Location: Comayagua, Honduras
Distribution: Mageia
Posts: 24

Rep: Reputation: 1
SpamAsssassin training no longer seems to work


I keep training SpamAssassin with the spam that slips through, but don't see any improvement is spam detection. The details are these:

Using ssh I trained SpamAssassin with examples of spam and ham I had saved for that purpose, perhaps 500 of each. I set up email recipes such that spam@example.com would go through sa-learn --spam --mbox, and ham@example.com would go through sa-learn --ham --mbox. Since then I have forwarded (as an attachment) any spam that slips through to spam@... and an equal amount of fresh ham to ham@...

That worked well for about a year. Spam in the inbox went from 150 per day to less than one per week on average, with no false positives. Naturally, spam blooms sometimes appeared, but training dealt with them.

I wrote up my spam setup in greater detail in these notes to myself:

http://my.opera.com/wpost/blog/spamassassin

For the past month or so, however, a steady stream of nearly identical spam has been getting through and despite training it all I see no change in spam scores on it. Here are relevant headers from a typical message:

(snip)
X-Spam-Status: No, hits=-6.6 required=3.5
tests=BAYES_00,RCVD_IN_DNSWL_MED,STOX_REPLY_TYPE autolearn=ham
version=3.002005
(snip)
X-AVES-Antispam: Maybe spam, 17.32 >= 4.00 [as:15.30 cc:0.00 hc:2.02
sa:17.32]
(snip)

Notice that a spam filter on an upstream server correctly flagged it, but my SpamAssassin. Nor does the score on these nearly identical messages seem to change with training.

Another clue: previously my spam folder was receiving fresh spam every hour. Since this problem began the spam folder receives almost nothing.

Sure, it would be easy to cook up a procmail recipe to filter on the upstream server's "maybe spam" header, but I'd rather fix the underlying problem with SpamAssassin, not cover it up.

Prior to coming here I searched the web, consulted my web host's knowledge base's articles on SpamAssassin, and read everything relevant at spamassassin.apache.org, but I remain stumped.

Any thoughts on what might I be doing wrong here, and what might I look at to improve spam training?

Last edited by wpost; 07-26-2010 at 07:28 AM.
 
Old 07-26-2010, 05:53 AM   #2
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Ubuntu 10.10, Slackware 64-current
Posts: 2,124

Rep: Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776
Something doesn't completely add up.
Quote:
X-Spam-Status: No, hits=-6.6 required=3.5
tests=BAYES_00,RCVD_IN_DNSWL_MED,STOX_REPLY_TYPE autolearn=ham
version=3.002005
This says that the email scored as -6.6 on the spam meter and that 3.5 is required to take action. You have three rules that came into play on this message: Bayes_00, Received in DNSWL (medium level) and Stox Reply type. According to SpamAssassin documentation, the default scores for these (with bayes) would range form 0 -1.9 for the Bayes (0%), 1.89 to .1 for the reply type, and 0 to -2.3 for being in a whitelist sender category.

This means, by default, at best this could score about -4.2 and you are getting -6.6. Did you alter any of the severity levels with your modifications?

Also, your BAYES filter THINKS that this message is NOT spam, declaring a spam percentage of less than 1%. Apparently it has been taught that this type of content is valid.

Perhaps you should 'clear' things out and re-teach it?
 
1 members found this post helpful.
  


Reply

Tags
spam, spamassassin


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
USB devices no longer work! buldir Fedora 6 07-20-2010 11:42 AM
Mandriva Control Center no longer work! BoB-WorK Linux - Software 0 05-11-2010 06:59 AM
k3b and cdrecord no longer work Z038 Slackware 13 10-08-2006 01:08 AM
System Notifications No Longer Work AvatarofVirgo Suse/Novell 0 02-02-2005 05:52 PM
things no longer work after uprgrade rsarson Fedora 2 08-10-2004 06:57 PM


All times are GMT -5. The time now is 04:32 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration