Re: [webmin-l] OrangeAssassin

Also to throw this out, make sure you haven't limited "testing size" too
small.  Traditionally spam was small, no too much anymore.  I fixed a lot of
issues by cranking this number up.

See here:  After logging into Virtualmin, click Email Messages -> Spam and
Virus Scanning.
There, you can set "Maximum message size to process for spamc".

Mine is set for 1Mb now.  And still unchecked spam sneaks through.

Check the mail headers, make sure the messages getting through are getting
checked, it will guide you further.

Dave



> -----Original Message-----
> From: Kris Deugau [mailto:[email protected]]
> Sent: Thursday, April 20, 2017 7:55 AM
> To: Webmin users list
> Subject: Re: [webmin-l] OrangeAssassin
> 
> Marcos Rubinstein wrote:
> > Thanks Kris and Dave for your feedback :)
> >
> > I was (actually I am) looking for a replacement of SpamAssassin
> > because it's not working right :(
> 
> You should probably ask the SA users list
> (https://wiki.apache.org/spamassassin/MailingLists) for help;  chances
> are someone there can narrow down what's going wrong.
> 
> A replacement like OrangeAssassin isn't likely to do you much good,
> since it's relying on essentially the same actual filter rules and DNS
> lookups.
> 
> > for one of the domains that I use it in a virtual server, with less
> > than
> > 10 users, but with one of the users getting over 600 emails a day...
> > with about 400 clearly marked as spam... but from the remaining 200
> > about 130 should be spam, but not detected.. even though the client
> > using usermin (with the virtualmin theme for email) religiously uses
> > the "delete spam" button, it seems that SpamAssassin doesn't
> > "learn"... :(
> 
> A couple of questions to get you going before asking spamassassin-
> users:
> 
> 1) Does this machine run its own local DNS cache, configured *without*
> upstream forwarding cache(s)?  Many "poor filter results" issues are
> due to using a large central DNS cache (or something like the Google or
> EasyDNS caches), and having queries for many DNSBLs blocked.  Look for
> URIBL_BLOCKED in your SA logging or message headers - if you see this,
> check your DNS server configuration to make sure you're using a local
> cache (either directly on that machine, or one that's only shared with
> a few other low-volume systems), and that it's not forwarding queries
> to a more central cache.
> 
> If you have a local cache on this machine, with no forwarding, and
> you're seeing URIBL_BLOCKED, you may want to consider a datafeed
> subscription to one or more DNSBLs.  The free public servers for lists
> with usage limits (Spamhaus, uribl.com, surbl.com at least) are
> suitable for a fairly high volume of mail;  several orders of magnitude
> more than a couple of personal or small business domains.
> 
> 2) If you retest some of those missed messages some time later, does SA
> tag them as spam?  If your targeted user happens to be in the unlucky
> position of "first target of the spam run", the DNSBLs may simply have
> no data to match that message when first received, but easily score 20+
> even five minutes later due to the DNSBL hits.
> 
> 3) What does "sa-learn --dump magic" show when run in a shell under the
> user account having trouble?  Look particularly at the nspam and nham
> lines;  if one or both is less than 200, the Bayes subsystem won't be
> used in scoring.  Ham in particular tends to be a bit tricky to learn
> per-user, and unfortunately autolearning tends to learn low-scoring
> spam as ham, leading to more spam hitting low-scoring BAYES_* rules.
> Learning the entire Inbox as ham, after making sure it doesn't have any
> spam in it, is a quick way to rebalance things.  Learning the Sent
> folder is probably safer, but likely has less variety of ham.
> 
> Those should help you get started on tuning SA;  if you have further
> questions you should probably take them to the SA users list.
> 
> -kgd
> 
> -----------------------------------------------------------------------
> -------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> -
> Forwarded by the Webmin mailing list at webadmin-
> [email protected]
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
-
Forwarded by the Webmin mailing list at [email protected]
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list