Re: No more BAYES hits after upgrades
Danilo Godec <[email protected]> Wed, 15 Oct 2025 11:19:34 +0200
| Newsgroups | gmane.mail.virus.amavis.user |
|---|---|
| Organization | Agenda d.o.o. |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------YTdEtk0BeP5IEwpXvog7lCAE
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
To answer my own questions:
It seems that by default SpamAssasin requires a minimum of 200 SPAM and=20
200 HAM messages in Bayes training database before it starts using Bayes.
This can be changed via SpamAssasins's local.cf by setting:
bayes_min_ham_num 50
bayes_min_spam_num 50
Also, I was able to copy Bayes databases from the old server to the new=20
one, but that revealed another issue with Bayes that was present on the=20
old server already.=C2=A0 Databases were extremely 'imbalanced' - there w=
ere=20
millions of 'HAM' messages in the database and 'only' several thousand=20
of 'SPAM' messages - which is quite bad, as most tokens have been seen=20
in HAM messages much more often than in SPAM (or at least that's how I=20
understand the problem).
The cause for that was that=C2=A0I had Bayes auto learning enabled=20
while=C2=A0using Amavis as a centralized filter for all users and multipl=
e=20
domains.
So for now I turned auto learning off - again in local.cf by setting:
bayes_auto_learn 0
I removed old Bayes databases to start over and am now training both HAM=20
and SPAM manually...
=C2=A0 =C2=A0Regards,
=C2=A0 =C2=A0 Danilo
On 09.10.25 09:46, Danilo Godec wrote:
>
> Hello,
>
> I recently upgraded my central Amavis server from CentOS 7 to Rocky=20
> Linux 9, which brought a few version changes in the relevant packages:
>
> * amavis 2.12.3 -> 2.13.1
> * spamassassin 3.4.0 -> 3.4.6
> * rpsamd 3.8.4 -> 3.13.2
> * dspam is no longer available on Rocky Linux (was 3.10.2 on CentOS 7=
)
> * clamav 0.103.11 -> 1.4.3
>
>
> Things mostly work, but I noticed that the new server never lists=20
> 'BAYES' in the tests list.
>
> tests=3D[DKIM_SIGNED=3D0.1, DKIM_VALID=3D-0.1, HEADER_FROM_DIFFERENT_DO=
MAINS=3D0.001, HTML_MESSAGE=3D0.001, HTML_MIME_NO_HTML_TAG=3D0.635, MIME_=
HTML_ONLY=3D0.1, RCVD_IN_MSPIKE_H2=3D0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=
=3D0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=3D0.001, SPF_HELO_PASS=3D-0.001, =
SPF_PASS=3D-0.001, R_UNDISC_RCPT=3D3, R_DKIM_REJECT=3D0, DKIM_TRACE=3D0, =
MIME_HTML_ONLY=3D0.2, ARC_ALLOW=3D-1, RCVD_TLS_LAST=3D0, ASN=3D0, FORGED_=
RECIPIENTS=3D2, DMARC_POLICY_SOFTFAIL=3D0.1, FORGED_SENDER=3D0.3, DKIM_MI=
XED=3D0, RWL_MAILSPIKE_POSSIBLE=3D0, TO_DN_ALL=3D0, R_SPF_ALLOW=3D-0.2, F=
ROM_HAS_DN=3D0, MIME_TRACE=3D0, RCVD_COUNT_FIVE=3D0, MISSING_XM_UA=3D0, T=
AGGED_FROM=3D0, RCPT_COUNT_ONE=3D0, MID_RHS_NOT_FQDN=3D0.5, FROM_NEQ_ENVF=
ROM=3D0, R_DKIM_ALLOW=3D-0.2]
>
>
> I only trained the new server for a couple of days now, could it be=20
> that it just didn't gather enough training data yet?
>
>
> =C2=A0 =C2=A0Best regards,
>
> =C2=A0 =C2=A0 Danilo
>
>
>
--------------YTdEtk0BeP5IEwpXvog7lCAE
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html>
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
</head>
<body>
<div class=3D"moz-cite-prefix">To answer my own questions:</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix">It seems that by default SpamAssasin
requires a minimum of 200 SPAM and 200 HAM messages in Bayes
training database before it starts using Bayes.</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix">This can be changed via SpamAssasins's
local.cf by setting:</div>
<div class=3D"moz-cite-prefix"><br>
<pre>bayes_min_ham_num 50
bayes_min_spam_num 50</pre>
</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix">Also, I was able to copy Bayes
databases from the old server to the new one, but that revealed
another issue with Bayes that was present on the old server
already.=C2=A0 Databases were extremely 'imbalanced' - there were
millions of 'HAM' messages in the database and 'only' several
thousand of 'SPAM' messages - which is quite bad, as most tokens
have been seen in HAM messages much more often than in SPAM (or at
least that's how I understand the problem).</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix">The cause for that was that=C2=A0I had=
Bayes
auto learning enabled while=C2=A0using Amavis as a centralized filt=
er
for all users and multiple domains.</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix">So for now I turned auto learning off =
-
again in local.cf by setting:</div>
<div class=3D"moz-cite-prefix">
<pre>bayes_auto_learn 0<span style=3D"font-family:monospace"></span=
></pre>
<span style=3D"font-family:monospace"></span></div>
<div class=3D"moz-cite-prefix"><span style=3D"font-family:monospace">=
<br>
</span></div>
<div class=3D"moz-cite-prefix">I removed old Bayes databases to start
over and am now training both HAM and SPAM manually...</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix">=C2=A0 =C2=A0Regards,=C2=A0</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix">=C2=A0 =C2=A0 Danilo</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix"><br>
</div>
<div class=3D"moz-cite-prefix">On 09.10.25 09:46, Danilo Godec wrote:=
<br>
</div>
<blockquote type=3D"cite"
cite=3D"mid:[email protected]">
<meta http-equiv=3D"content-type" content=3D"text/html; charset=3DU=
TF-8">
<p>Hello,</p>
<p>I recently upgraded my central Amavis server from CentOS 7 to
Rocky Linux 9, which brought a few version changes in the
relevant packages:</p>
<ul>
<li>amavis 2.12.3 -> 2.13.1</li>
<li>spamassassin 3.4.0 -> 3.4.6</li>
<li>rpsamd 3.8.4 -> 3.13.2</li>
<li>dspam is no longer available on Rocky Linux (was 3.10.2 on
CentOS 7)</li>
<li>clamav 0.103.11 -> 1.4.3</li>
</ul>
<p><br>
</p>
<p>Things mostly work, but I noticed that the new server never
lists 'BAYES' in the tests list.<br>
<br>
</p>
<pre>tests=3D[DKIM_SIGNED=3D0.1, DKIM_VALID=3D-0.1, HEADER_FROM_DIF=
FERENT_DOMAINS=3D0.001, HTML_MESSAGE=3D0.001, HTML_MIME_NO_HTML_TAG=3D0.6=
35, MIME_HTML_ONLY=3D0.1, RCVD_IN_MSPIKE_H2=3D0.001, RCVD_IN_VALIDITY_RPB=
L_BLOCKED=3D0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=3D0.001, SPF_HELO_PASS=3D=
-0.001, SPF_PASS=3D-0.001, R_UNDISC_RCPT=3D3, R_DKIM_REJECT=3D0, DKIM_TRA=
CE=3D0, MIME_HTML_ONLY=3D0.2, ARC_ALLOW=3D-1, RCVD_TLS_LAST=3D0, ASN=3D0,=
FORGED_RECIPIENTS=3D2, DMARC_POLICY_SOFTFAIL=3D0.1, FORGED_SENDER=3D0.3,=
DKIM_MIXED=3D0, RWL_MAILSPIKE_POSSIBLE=3D0, TO_DN_ALL=3D0, R_SPF_ALLOW=3D=
-0.2, FROM_HAS_DN=3D0, MIME_TRACE=3D0, RCVD_COUNT_FIVE=3D0, MISSING_XM_UA=
=3D0, TAGGED_FROM=3D0, RCPT_COUNT_ONE=3D0, MID_RHS_NOT_FQDN=3D0.5, FROM_N=
EQ_ENVFROM=3D0, R_DKIM_ALLOW=3D-0.2]</pre>
<p><br>
</p>
<p>I only trained the new server for a couple of days now, could
it be that it just didn't gather enough training data yet?</p>
<p><br>
</p>
<p>=C2=A0 =C2=A0Best regards,</p>
<p>=C2=A0 =C2=A0 Danilo</p>
<p><br>
</p>
<p><br>
</p>
</blockquote>
<br>
<div class=3D"moz-signature">
<div>
<table cellpadding=3D"0" cellspacing=3D"0" border=3D"0"
style=3D"background: none; border-width: 0px; border: 0px; margin: 0; pad=
ding: 0;">
<tbody>
<tr>
<td valign=3D"top"
style=3D"vertical-align: top; color: #666666; font-size: 12px; font-famil=
y: Arial, Helvetica, sans-serif;"><br>
</td>
</tr>
<tr>
<td valign=3D"top"
style=3D"vertical-align: top; color: #666666; font-size: 12px; font-famil=
y: Arial, Helvetica, sans-serif;"><br>
</td>
</tr>
<tr>
<td valign=3D"top"
style=3D"vertical-align: top; color: #666666; font-size: 12px; font-famil=
y: Arial, Helvetica, sans-serif;"><br>
</td>
</tr>
<tr>
<td valign=3D"top"
style=3D"vertical-align: top; color: #666666; font-size: 12px; font-famil=
y: Arial, Helvetica, sans-serif; padding-top: 12px;"><br>
</td>
</tr>
<tr>
<td valign=3D"top"
style=3D"vertical-align: top; color: #666666; font-size: 12px; font-famil=
y: Arial, Helvetica, sans-serif;"><br>
</td>
</tr>
<tr>
<td valign=3D"top"
style=3D"vertical-align: top; color: #666666; font-size: 12px; font-famil=
y: Arial, Helvetica, sans-serif;"><br>
</td>
</tr>
<tr>
<td valign=3D"top"
style=3D"vertical-align: top; color: #666666; font-size: 12px; font-famil=
y: Arial, Helvetica, sans-serif; padding-top: 22px; padding-bottom: 22px;=
"><br>
</td>
</tr>
<tr>
<td valign=3D"top"
style=3D"vertical-align: top; color: #666666; font-size: 12px; font-famil=
y: Arial, Helvetica, sans-serif;"><br>
</td>
</tr>
<tr>
<td valign=3D"top"
style=3D"vertical-align: top; color: #666666; font-size: 12px; font-famil=
y: Arial, Helvetica, sans-serif; padding-top: 22px; padding-bottom: 22px;=
"><br>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</body>
</html>
--------------YTdEtk0BeP5IEwpXvog7lCAE--