Re: FW: spam scores being neutralized by bayes

That is the correct change Bob. I also found that this score was out of 
line with my expectations. It's a poor man's SPF and I adjusted the 
score similar to a valid SPF record. In my case, setting it to -0.1.

You might make sure you've restarted amavisd after making the local.cf 
change. Also, make sure you're editing the correct local.cf for your 
spamassassin installation. Running spamassassin -D as the amavis user 
should display the LOCAL_RULES_DIR in the first few lines. This is where 
my local.cf lives.

--Blake


Bob wrote on 7/14/2015 6:08 PM:
> I've noticed that the problem I have with spam getting through is the 
> spamassassin rule RP_MATCHES_RCVD. This rule is set at -1.429 and 
> spammers know this. My ham doesn't need this rule. I tried to change 
> its value in local.cf (score RP_MATCHES_RCVD 0.01), but it isn't 
> working. Is there something I need to do with maia? I know we don't 
> use spamd so that can't be it. Any thoughts?
>
> I don't think Bayes is the culprit with me. It's the RP_MATCHES rule 
> the spammers are tripping.
>
> Thanks,
> Bob
>
> On 7/14/2015 2:00 AM, Jason Street wrote:
>> Thank you all,
>>
>> Joshua, I think this is the route I'll have to take, bayes just 
>> appears to be problematic at this stage.  Any spam actually being 
>> caught as spam, removing bayes is not going to do much score wise
>>
>> I have seen a massive increase in spam getting through, all coming 
>> from .eu and .xyz addresses and all being allowed through thanks to 
>> Bayes  doing a "-1.900 BAYES_00"
>>
>>
>> Although maybe just as worryingly, I've had spam hit the bayes rule 
>> *and*  "-2.200 RCVD_IN_IADB_VOUCHED".   Looks like the spammers are 
>> getting better...
>>
>> 1.347     RCVD_IN_BL_SPAMCOP_NET     Received via a relay in 
>> bl.spamcop.net
>> 0.100     DKIM_SIGNED     Domain Keys Identified Mail: message has a 
>> signature
>> 0.010     T_REMOTE_IMAGE     (No description provided)
>> 0.001     HTML_MESSAGE     HTML included in message
>> -0.001     SPF_PASS     SPF: sender matches SPF record
>> -0.001     RCVD_IN_IADB_LISTED     Participates in the IADB system
>> -0.001     RCVD_IN_IADB_SENDERID     IADB: Sender publishes Sender ID 
>> record
>> -0.010     T_RP_MATCHES_RCVD     Envelope sender domain matches 
>> handover relay domain
>> -0.059     RCVD_IN_IADB_SPF     IADB: Sender publishes SPF record
>> -0.100     DKIM_VALID     Message has at least one valid DKIM or DK 
>> signature
>> -0.235     RCVD_IN_IADB_RDNS     IADB: Sender has reverse DNS record
>> -1.470     RCVD_IN_IADB_OPTIN     IADB: All mailing list mail is opt-in
>> -1.900     BAYES_00     Bayesian spam probability is 0 to 1%
>> -2.200     RCVD_IN_IADB_VOUCHED     ISIPP IADB lists as vouched-for 
>> sender
>>
>>
>>
>> ¬¬JS
>>
>>
>> On 2015-07-08 23:13, Joshua Small wrote:
>>> Your point below was always my issue with Bayes. The whole "you just
>>> need to train it" argument might be fine for users of this list, but
>>> the customers running these products are comparing them to everything
>>> else on the market, which "just works".
>>>
>>> Given I pretty much never saw Bayes trained correctly, I've only ever
>>> seen bayes fall into these categories: Spam flagged as spam that would
>>> have been captured by other rules anyway, spam that would have been
>>> flagged and quarantined if not for an incorrect negative bayes score,
>>> and mail flagged as spam by Bayes that was a false positive. In short,
>>> I disabled bayes on all my environments.
>>>
>>> -----Original Message-----
>>> From: Maia-users [mailto:[email protected]] On Behalf
>>> Of Jason Street
>>> Sent: Wednesday, 8 July 2015 9:13 PM
>>> To: Blake Hudson
>>> Cc: [email protected]
>>> Subject: Re: [Maia-users] spam scores being neutralized by bayes
>>>
>>> On 2015-07-07 15:23, Blake Hudson wrote:
>>>> Jason, it sounds like your Bayes database has learned SPAM. This could
>>>> be from incorrect user reports (messages were reported as NOT SPAM
>>>> when they were SPAM) or from auto learning.
>>>
>>> Potentially but the users are pretty hands off and ignore their cache
>>> contents in the web interface, except for checking the spam cache for
>>> anything valid caught.
>>>
>>> For the most occasion "non-spam cache" is ignored and left to be 
>>> auto cleared.
>>>
>>>> My suggestion is to turn off auto learning (bayes_auto_learn 0 in
>>>> local.cf) and use Maia's digest function to confirm HAM/SPAM daily in
>>>> order to train bayes. To help speed up the learning you may want to
>>>> clear out your current bayes db. You can do this with the
>>>> maiadbtool.pl script and the --clear-bayes option.
>>>
>>> Forgive me ignorance  but how do I do the digest function you suggest?
>>>
>>> _______________________________________________
>>> Maia-users mailing list
>>> [email protected]
>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>> _______________________________________________
>>> Maia-users mailing list
>>> [email protected]
>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>
>> _______________________________________________
>> Maia-users mailing list
>> [email protected]
>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>
> _______________________________________________
> Maia-users mailing list
> [email protected]
> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users