Re: FW: spam scores being neutralized by bayes

Hi,

Also make double sure you run load-sa-rules.pl  if you change / add any 
scores.

--Ed


On 07/15/2015 09:19 AM, Blake Hudson wrote:
> That is the correct change Bob. I also found that this score was out of
> line with my expectations. It's a poor man's SPF and I adjusted the
> score similar to a valid SPF record. In my case, setting it to -0.1.
>
> You might make sure you've restarted amavisd after making the local.cf
> change. Also, make sure you're editing the correct local.cf for your
> spamassassin installation. Running spamassassin -D as the amavis user
> should display the LOCAL_RULES_DIR in the first few lines. This is where
> my local.cf lives.
>
> --Blake
>
>
> Bob wrote on 7/14/2015 6:08 PM:
>> I've noticed that the problem I have with spam getting through is the
>> spamassassin rule RP_MATCHES_RCVD. This rule is set at -1.429 and
>> spammers know this. My ham doesn't need this rule. I tried to change
>> its value in local.cf (score RP_MATCHES_RCVD 0.01), but it isn't
>> working. Is there something I need to do with maia? I know we don't
>> use spamd so that can't be it. Any thoughts?
>>
>> I don't think Bayes is the culprit with me. It's the RP_MATCHES rule
>> the spammers are tripping.
>>
>> Thanks,
>> Bob
>>
>> On 7/14/2015 2:00 AM, Jason Street wrote:
>>> Thank you all,
>>>
>>> Joshua, I think this is the route I'll have to take, bayes just
>>> appears to be problematic at this stage.  Any spam actually being
>>> caught as spam, removing bayes is not going to do much score wise
>>>
>>> I have seen a massive increase in spam getting through, all coming
>>> from .eu and .xyz addresses and all being allowed through thanks to
>>> Bayes  doing a "-1.900 BAYES_00"
>>>
>>>
>>> Although maybe just as worryingly, I've had spam hit the bayes rule
>>> *and*  "-2.200 RCVD_IN_IADB_VOUCHED".   Looks like the spammers are
>>> getting better...
>>>
>>> 1.347     RCVD_IN_BL_SPAMCOP_NET     Received via a relay in
>>> bl.spamcop.net
>>> 0.100     DKIM_SIGNED     Domain Keys Identified Mail: message has a
>>> signature
>>> 0.010     T_REMOTE_IMAGE     (No description provided)
>>> 0.001     HTML_MESSAGE     HTML included in message
>>> -0.001     SPF_PASS     SPF: sender matches SPF record
>>> -0.001     RCVD_IN_IADB_LISTED     Participates in the IADB system
>>> -0.001     RCVD_IN_IADB_SENDERID     IADB: Sender publishes Sender ID
>>> record
>>> -0.010     T_RP_MATCHES_RCVD     Envelope sender domain matches
>>> handover relay domain
>>> -0.059     RCVD_IN_IADB_SPF     IADB: Sender publishes SPF record
>>> -0.100     DKIM_VALID     Message has at least one valid DKIM or DK
>>> signature
>>> -0.235     RCVD_IN_IADB_RDNS     IADB: Sender has reverse DNS record
>>> -1.470     RCVD_IN_IADB_OPTIN     IADB: All mailing list mail is opt-in
>>> -1.900     BAYES_00     Bayesian spam probability is 0 to 1%
>>> -2.200     RCVD_IN_IADB_VOUCHED     ISIPP IADB lists as vouched-for
>>> sender
>>>
>>>
>>>
>>> ¬¬JS
>>>
>>>
>>> On 2015-07-08 23:13, Joshua Small wrote:
>>>> Your point below was always my issue with Bayes. The whole "you just
>>>> need to train it" argument might be fine for users of this list, but
>>>> the customers running these products are comparing them to everything
>>>> else on the market, which "just works".
>>>>
>>>> Given I pretty much never saw Bayes trained correctly, I've only ever
>>>> seen bayes fall into these categories: Spam flagged as spam that would
>>>> have been captured by other rules anyway, spam that would have been
>>>> flagged and quarantined if not for an incorrect negative bayes score,
>>>> and mail flagged as spam by Bayes that was a false positive. In short,
>>>> I disabled bayes on all my environments.
>>>>
>>>> -----Original Message-----
>>>> From: Maia-users [mailto:[email protected]] On Behalf
>>>> Of Jason Street
>>>> Sent: Wednesday, 8 July 2015 9:13 PM
>>>> To: Blake Hudson
>>>> Cc: [email protected]
>>>> Subject: Re: [Maia-users] spam scores being neutralized by bayes
>>>>
>>>> On 2015-07-07 15:23, Blake Hudson wrote:
>>>>> Jason, it sounds like your Bayes database has learned SPAM. This could
>>>>> be from incorrect user reports (messages were reported as NOT SPAM
>>>>> when they were SPAM) or from auto learning.
>>>>
>>>> Potentially but the users are pretty hands off and ignore their cache
>>>> contents in the web interface, except for checking the spam cache for
>>>> anything valid caught.
>>>>
>>>> For the most occasion "non-spam cache" is ignored and left to be
>>>> auto cleared.
>>>>
>>>>> My suggestion is to turn off auto learning (bayes_auto_learn 0 in
>>>>> local.cf) and use Maia's digest function to confirm HAM/SPAM daily in
>>>>> order to train bayes. To help speed up the learning you may want to
>>>>> clear out your current bayes db. You can do this with the
>>>>> maiadbtool.pl script and the --clear-bayes option.
>>>>
>>>> Forgive me ignorance  but how do I do the digest function you suggest?
>>>>
>>>> _______________________________________________
>>>> Maia-users mailing list
>>>> [email protected]
>>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>>> _______________________________________________
>>>> Maia-users mailing list
>>>> [email protected]
>>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>>
>>> _______________________________________________
>>> Maia-users mailing list
>>> [email protected]
>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>
>> _______________________________________________
>> Maia-users mailing list
>> [email protected]
>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>
> _______________________________________________
> Maia-users mailing list
> [email protected]
> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

-- 
-----------------------------------------------------------
EAS Enterprises LLC
World Class Web and Email Hosting Solutions
IPv6 ready today for your needs of tomorrow!
Ask us about dual-stacking your site
www.easent.net
_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users