Re: [webmin-l] OrangeAssassin

Marcos Rubinstein wrote:
> Thanks Kris and Dave for your feedback :)
>
> I was (actually I am) looking for a replacement of SpamAssassin because
> it's not working right :(

You should probably ask the SA users list 
(https://wiki.apache.org/spamassassin/MailingLists) for help;  chances 
are someone there can narrow down what's going wrong.

A replacement like OrangeAssassin isn't likely to do you much good, 
since it's relying on essentially the same actual filter rules and DNS 
lookups.

> for one of the domains that I use it in a virtual server, with less than
> 10 users, but with one of the users getting over 600 emails a day...
> with about 400 clearly marked as spam... but from the remaining 200
> about 130 should be spam, but not detected.. even though the client
> using usermin (with the virtualmin theme for email) religiously uses the
> "delete spam" button, it seems that SpamAssassin doesn't "learn"... :(

A couple of questions to get you going before asking spamassassin-users:

1) Does this machine run its own local DNS cache, configured *without* 
upstream forwarding cache(s)?  Many "poor filter results" issues are due 
to using a large central DNS cache (or something like the Google or 
EasyDNS caches), and having queries for many DNSBLs blocked.  Look for 
URIBL_BLOCKED in your SA logging or message headers - if you see this, 
check your DNS server configuration to make sure you're using a local 
cache (either directly on that machine, or one that's only shared with a 
few other low-volume systems), and that it's not forwarding queries to a 
more central cache.

If you have a local cache on this machine, with no forwarding, and 
you're seeing URIBL_BLOCKED, you may want to consider a datafeed 
subscription to one or more DNSBLs.  The free public servers for lists 
with usage limits (Spamhaus, uribl.com, surbl.com at least) are suitable 
for a fairly high volume of mail;  several orders of magnitude more than 
a couple of personal or small business domains.

2) If you retest some of those missed messages some time later, does SA 
tag them as spam?  If your targeted user happens to be in the unlucky 
position of "first target of the spam run", the DNSBLs may simply have 
no data to match that message when first received, but easily score 20+ 
even five minutes later due to the DNSBL hits.

3) What does "sa-learn --dump magic" show when run in a shell under the 
user account having trouble?  Look particularly at the nspam and nham 
lines;  if one or both is less than 200, the Bayes subsystem won't be 
used in scoring.  Ham in particular tends to be a bit tricky to learn 
per-user, and unfortunately autolearning tends to learn low-scoring spam 
as ham, leading to more spam hitting low-scoring BAYES_* rules. 
Learning the entire Inbox as ham, after making sure it doesn't have any 
spam in it, is a quick way to rebalance things.  Learning the Sent 
folder is probably safer, but likely has less variety of ham.

Those should help you get started on tuning SA;  if you have further 
questions you should probably take them to the SA users list.

-kgd

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
-
Forwarded by the Webmin mailing list at [email protected]
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list