Re: FW: spam scores being neutralized by bayes

Thanks. I've done both. I reloaded the rules immediately, but forgot to 
restart the service.

Bob

On 7/15/2015 6:30 AM, Ed wrote:
> Hi,
>
> Also make double sure you run load-sa-rules.pl  if you change / add 
> any scores.
>
> --Ed
>
>
> On 07/15/2015 09:19 AM, Blake Hudson wrote:
>> That is the correct change Bob. I also found that this score was out of
>> line with my expectations. It's a poor man's SPF and I adjusted the
>> score similar to a valid SPF record. In my case, setting it to -0.1.
>>
>> You might make sure you've restarted amavisd after making the local.cf
>> change. Also, make sure you're editing the correct local.cf for your
>> spamassassin installation. Running spamassassin -D as the amavis user
>> should display the LOCAL_RULES_DIR in the first few lines. This is where
>> my local.cf lives.
>>
>> --Blake
>>
>>
>> Bob wrote on 7/14/2015 6:08 PM:
>>> I've noticed that the problem I have with spam getting through is the
>>> spamassassin rule RP_MATCHES_RCVD. This rule is set at -1.429 and
>>> spammers know this. My ham doesn't need this rule. I tried to change
>>> its value in local.cf (score RP_MATCHES_RCVD 0.01), but it isn't
>>> working. Is there something I need to do with maia? I know we don't
>>> use spamd so that can't be it. Any thoughts?
>>>
>>> I don't think Bayes is the culprit with me. It's the RP_MATCHES rule
>>> the spammers are tripping.
>>>
>>> Thanks,
>>> Bob
>>>
>>> On 7/14/2015 2:00 AM, Jason Street wrote:
>>>> Thank you all,
>>>>
>>>> Joshua, I think this is the route I'll have to take, bayes just
>>>> appears to be problematic at this stage.  Any spam actually being
>>>> caught as spam, removing bayes is not going to do much score wise
>>>>
>>>> I have seen a massive increase in spam getting through, all coming
>>>> from .eu and .xyz addresses and all being allowed through thanks to
>>>> Bayes  doing a "-1.900 BAYES_00"
>>>>
>>>>
>>>> Although maybe just as worryingly, I've had spam hit the bayes rule
>>>> *and*  "-2.200 RCVD_IN_IADB_VOUCHED".   Looks like the spammers are
>>>> getting better...
>>>>
>>>> 1.347     RCVD_IN_BL_SPAMCOP_NET     Received via a relay in
>>>> bl.spamcop.net
>>>> 0.100     DKIM_SIGNED     Domain Keys Identified Mail: message has a
>>>> signature
>>>> 0.010     T_REMOTE_IMAGE     (No description provided)
>>>> 0.001     HTML_MESSAGE     HTML included in message
>>>> -0.001     SPF_PASS     SPF: sender matches SPF record
>>>> -0.001     RCVD_IN_IADB_LISTED     Participates in the IADB system
>>>> -0.001     RCVD_IN_IADB_SENDERID     IADB: Sender publishes Sender ID
>>>> record
>>>> -0.010     T_RP_MATCHES_RCVD     Envelope sender domain matches
>>>> handover relay domain
>>>> -0.059     RCVD_IN_IADB_SPF     IADB: Sender publishes SPF record
>>>> -0.100     DKIM_VALID     Message has at least one valid DKIM or DK
>>>> signature
>>>> -0.235     RCVD_IN_IADB_RDNS     IADB: Sender has reverse DNS record
>>>> -1.470     RCVD_IN_IADB_OPTIN     IADB: All mailing list mail is 
>>>> opt-in
>>>> -1.900     BAYES_00     Bayesian spam probability is 0 to 1%
>>>> -2.200     RCVD_IN_IADB_VOUCHED     ISIPP IADB lists as vouched-for
>>>> sender
>>>>
>>>>
>>>>
>>>> ¬¬JS
>>>>
>>>>
>>>> On 2015-07-08 23:13, Joshua Small wrote:
>>>>> Your point below was always my issue with Bayes. The whole "you just
>>>>> need to train it" argument might be fine for users of this list, but
>>>>> the customers running these products are comparing them to everything
>>>>> else on the market, which "just works".
>>>>>
>>>>> Given I pretty much never saw Bayes trained correctly, I've only ever
>>>>> seen bayes fall into these categories: Spam flagged as spam that 
>>>>> would
>>>>> have been captured by other rules anyway, spam that would have been
>>>>> flagged and quarantined if not for an incorrect negative bayes score,
>>>>> and mail flagged as spam by Bayes that was a false positive. In 
>>>>> short,
>>>>> I disabled bayes on all my environments.
>>>>>
>>>>> -----Original Message-----
>>>>> From: Maia-users [mailto:[email protected]] On Behalf
>>>>> Of Jason Street
>>>>> Sent: Wednesday, 8 July 2015 9:13 PM
>>>>> To: Blake Hudson
>>>>> Cc: [email protected]
>>>>> Subject: Re: [Maia-users] spam scores being neutralized by bayes
>>>>>
>>>>> On 2015-07-07 15:23, Blake Hudson wrote:
>>>>>> Jason, it sounds like your Bayes database has learned SPAM. This 
>>>>>> could
>>>>>> be from incorrect user reports (messages were reported as NOT SPAM
>>>>>> when they were SPAM) or from auto learning.
>>>>>
>>>>> Potentially but the users are pretty hands off and ignore their cache
>>>>> contents in the web interface, except for checking the spam cache for
>>>>> anything valid caught.
>>>>>
>>>>> For the most occasion "non-spam cache" is ignored and left to be
>>>>> auto cleared.
>>>>>
>>>>>> My suggestion is to turn off auto learning (bayes_auto_learn 0 in
>>>>>> local.cf) and use Maia's digest function to confirm HAM/SPAM 
>>>>>> daily in
>>>>>> order to train bayes. To help speed up the learning you may want to
>>>>>> clear out your current bayes db. You can do this with the
>>>>>> maiadbtool.pl script and the --clear-bayes option.
>>>>>
>>>>> Forgive me ignorance  but how do I do the digest function you 
>>>>> suggest?
>>>>>
>>>>> _______________________________________________
>>>>> Maia-users mailing list
>>>>> [email protected]
>>>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>>>> _______________________________________________
>>>>> Maia-users mailing list
>>>>> [email protected]
>>>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>>>
>>>> _______________________________________________
>>>> Maia-users mailing list
>>>> [email protected]
>>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>>
>>> _______________________________________________
>>> Maia-users mailing list
>>> [email protected]
>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>
>> _______________________________________________
>> Maia-users mailing list
>> [email protected]
>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users