Share your knowledge at the LQ Wiki.
Go Back > Forums > Linux Forums > Linux - Server
User Name
Linux - Server This forum is for the discussion of Linux Software used in a server related context.


  Search this Thread
Old 07-26-2010, 01:02 AM   #1
LQ Newbie
Registered: Jul 2004
Location: Honduras
Distribution: openSUSE
Posts: 28

Rep: Reputation: 1
SpamAsssassin training no longer seems to work

I keep training SpamAssassin with the spam that slips through, but don't see any improvement is spam detection. The details are these:

Using ssh I trained SpamAssassin with examples of spam and ham I had saved for that purpose, perhaps 500 of each. I set up email recipes such that would go through sa-learn --spam --mbox, and would go through sa-learn --ham --mbox. Since then I have forwarded (as an attachment) any spam that slips through to spam@... and an equal amount of fresh ham to ham@...

That worked well for about a year. Spam in the inbox went from 150 per day to less than one per week on average, with no false positives. Naturally, spam blooms sometimes appeared, but training dealt with them.

I wrote up my spam setup in greater detail in these notes to myself:

For the past month or so, however, a steady stream of nearly identical spam has been getting through and despite training it all I see no change in spam scores on it. Here are relevant headers from a typical message:

X-Spam-Status: No, hits=-6.6 required=3.5
X-AVES-Antispam: Maybe spam, 17.32 >= 4.00 [as:15.30 cc:0.00 hc:2.02

Notice that a spam filter on an upstream server correctly flagged it, but my SpamAssassin. Nor does the score on these nearly identical messages seem to change with training.

Another clue: previously my spam folder was receiving fresh spam every hour. Since this problem began the spam folder receives almost nothing.

Sure, it would be easy to cook up a procmail recipe to filter on the upstream server's "maybe spam" header, but I'd rather fix the underlying problem with SpamAssassin, not cover it up.

Prior to coming here I searched the web, consulted my web host's knowledge base's articles on SpamAssassin, and read everything relevant at, but I remain stumped.

Any thoughts on what might I be doing wrong here, and what might I look at to improve spam training?

Last edited by wpost; 07-26-2010 at 08:28 AM.
Old 07-26-2010, 06:53 AM   #2
Senior Member
Registered: Jul 2007
Distribution: Ubuntu 10.10, Slackware 64-current
Posts: 2,124

Rep: Reputation: 779Reputation: 779Reputation: 779Reputation: 779Reputation: 779Reputation: 779Reputation: 779
Something doesn't completely add up.
X-Spam-Status: No, hits=-6.6 required=3.5
This says that the email scored as -6.6 on the spam meter and that 3.5 is required to take action. You have three rules that came into play on this message: Bayes_00, Received in DNSWL (medium level) and Stox Reply type. According to SpamAssassin documentation, the default scores for these (with bayes) would range form 0 -1.9 for the Bayes (0%), 1.89 to .1 for the reply type, and 0 to -2.3 for being in a whitelist sender category.

This means, by default, at best this could score about -4.2 and you are getting -6.6. Did you alter any of the severity levels with your modifications?

Also, your BAYES filter THINKS that this message is NOT spam, declaring a spam percentage of less than 1%. Apparently it has been taught that this type of content is valid.

Perhaps you should 'clear' things out and re-teach it?
1 members found this post helpful.


spam, spamassassin

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
USB devices no longer work! buldir Fedora 6 07-20-2010 12:42 PM
Mandriva Control Center no longer work! BoB-WorK Linux - Software 0 05-11-2010 07:59 AM
k3b and cdrecord no longer work Z038 Slackware 13 10-08-2006 02:08 AM
System Notifications No Longer Work AvatarofVirgo SUSE / openSUSE 0 02-02-2005 06:52 PM
things no longer work after uprgrade rsarson Fedora 2 08-10-2004 07:57 PM > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 12:17 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration