Re: FW: spam scores being neutralized by bayes

The change in the scoring helped a lot. Spam is way down. Interestingly, 
when I analyzed the junk folder, the key factor in declaring an email 
spam was without a doubt Bayes. It's been amazingly effective for me. I 
haven't had any ham identified as spam, so now that I set 
RP_MATCHES_RCVD to -0.001, things are working better than I can ever 
remember.

In terms of training Bayes, I run a script every night that goes through 
every junk folder and runs sa-learn --spam against each one (new and 
cur).  At the end of the script, I run sa-learn --sync --force-expire.  
That seems to keep Bayes up to date and not blocking ham.

On 7/15/2015 7:42 AM, Bob wrote:
> Thanks. I've done both. I reloaded the rules immediately, but forgot 
> to restart the service.
>
> Bob
>
> On 7/15/2015 6:30 AM, Ed wrote:
>> Hi,
>>
>> Also make double sure you run load-sa-rules.pl  if you change / add 
>> any scores.
>>
>> --Ed
>>
>>
>> On 07/15/2015 09:19 AM, Blake Hudson wrote:
>>> That is the correct change Bob. I also found that this score was out of
>>> line with my expectations. It's a poor man's SPF and I adjusted the
>>> score similar to a valid SPF record. In my case, setting it to -0.1.
>>>
>>> You might make sure you've restarted amavisd after making the local.cf
>>> change. Also, make sure you're editing the correct local.cf for your
>>> spamassassin installation. Running spamassassin -D as the amavis user
>>> should display the LOCAL_RULES_DIR in the first few lines. This is 
>>> where
>>> my local.cf lives.
>>>
>>> --Blake
>>>
>>>
>>> Bob wrote on 7/14/2015 6:08 PM:
>>>> I've noticed that the problem I have with spam getting through is the
>>>> spamassassin rule RP_MATCHES_RCVD. This rule is set at -1.429 and
>>>> spammers know this. My ham doesn't need this rule. I tried to change
>>>> its value in local.cf (score RP_MATCHES_RCVD 0.01), but it isn't
>>>> working. Is there something I need to do with maia? I know we don't
>>>> use spamd so that can't be it. Any thoughts?
>>>>
>>>> I don't think Bayes is the culprit with me. It's the RP_MATCHES rule
>>>> the spammers are tripping.
>>>>
>>>> Thanks,
>>>> Bob
>>>>
>>>> On 7/14/2015 2:00 AM, Jason Street wrote:
>>>>> Thank you all,
>>>>>
>>>>> Joshua, I think this is the route I'll have to take, bayes just
>>>>> appears to be problematic at this stage.  Any spam actually being
>>>>> caught as spam, removing bayes is not going to do much score wise
>>>>>
>>>>> I have seen a massive increase in spam getting through, all coming
>>>>> from .eu and .xyz addresses and all being allowed through thanks to
>>>>> Bayes  doing a "-1.900 BAYES_00"
>>>>>
>>>>>
>>>>> Although maybe just as worryingly, I've had spam hit the bayes rule
>>>>> *and*  "-2.200 RCVD_IN_IADB_VOUCHED".   Looks like the spammers are
>>>>> getting better...
>>>>>
>>>>> 1.347     RCVD_IN_BL_SPAMCOP_NET     Received via a relay in
>>>>> bl.spamcop.net
>>>>> 0.100     DKIM_SIGNED     Domain Keys Identified Mail: message has a
>>>>> signature
>>>>> 0.010     T_REMOTE_IMAGE     (No description provided)
>>>>> 0.001     HTML_MESSAGE     HTML included in message
>>>>> -0.001     SPF_PASS     SPF: sender matches SPF record
>>>>> -0.001     RCVD_IN_IADB_LISTED     Participates in the IADB system
>>>>> -0.001     RCVD_IN_IADB_SENDERID     IADB: Sender publishes Sender ID
>>>>> record
>>>>> -0.010     T_RP_MATCHES_RCVD     Envelope sender domain matches
>>>>> handover relay domain
>>>>> -0.059     RCVD_IN_IADB_SPF     IADB: Sender publishes SPF record
>>>>> -0.100     DKIM_VALID     Message has at least one valid DKIM or DK
>>>>> signature
>>>>> -0.235     RCVD_IN_IADB_RDNS     IADB: Sender has reverse DNS record
>>>>> -1.470     RCVD_IN_IADB_OPTIN     IADB: All mailing list mail is 
>>>>> opt-in
>>>>> -1.900     BAYES_00     Bayesian spam probability is 0 to 1%
>>>>> -2.200     RCVD_IN_IADB_VOUCHED     ISIPP IADB lists as vouched-for
>>>>> sender
>>>>>
>>>>>
>>>>>
>>>>> ¬¬JS
>>>>>
>>>>>
>>>>> On 2015-07-08 23:13, Joshua Small wrote:
>>>>>> Your point below was always my issue with Bayes. The whole "you just
>>>>>> need to train it" argument might be fine for users of this list, but
>>>>>> the customers running these products are comparing them to 
>>>>>> everything
>>>>>> else on the market, which "just works".
>>>>>>
>>>>>> Given I pretty much never saw Bayes trained correctly, I've only 
>>>>>> ever
>>>>>> seen bayes fall into these categories: Spam flagged as spam that 
>>>>>> would
>>>>>> have been captured by other rules anyway, spam that would have been
>>>>>> flagged and quarantined if not for an incorrect negative bayes 
>>>>>> score,
>>>>>> and mail flagged as spam by Bayes that was a false positive. In 
>>>>>> short,
>>>>>> I disabled bayes on all my environments.
>>>>>>
>>>>>> -----Original Message-----
>>>>>> From: Maia-users [mailto:[email protected]] On 
>>>>>> Behalf
>>>>>> Of Jason Street
>>>>>> Sent: Wednesday, 8 July 2015 9:13 PM
>>>>>> To: Blake Hudson
>>>>>> Cc: [email protected]
>>>>>> Subject: Re: [Maia-users] spam scores being neutralized by bayes
>>>>>>
>>>>>> On 2015-07-07 15:23, Blake Hudson wrote:
>>>>>>> Jason, it sounds like your Bayes database has learned SPAM. This 
>>>>>>> could
>>>>>>> be from incorrect user reports (messages were reported as NOT SPAM
>>>>>>> when they were SPAM) or from auto learning.
>>>>>>
>>>>>> Potentially but the users are pretty hands off and ignore their 
>>>>>> cache
>>>>>> contents in the web interface, except for checking the spam cache 
>>>>>> for
>>>>>> anything valid caught.
>>>>>>
>>>>>> For the most occasion "non-spam cache" is ignored and left to be
>>>>>> auto cleared.
>>>>>>
>>>>>>> My suggestion is to turn off auto learning (bayes_auto_learn 0 in
>>>>>>> local.cf) and use Maia's digest function to confirm HAM/SPAM 
>>>>>>> daily in
>>>>>>> order to train bayes. To help speed up the learning you may want to
>>>>>>> clear out your current bayes db. You can do this with the
>>>>>>> maiadbtool.pl script and the --clear-bayes option.
>>>>>>
>>>>>> Forgive me ignorance  but how do I do the digest function you 
>>>>>> suggest?
>>>>>>
>>>>>> _______________________________________________
>>>>>> Maia-users mailing list
>>>>>> [email protected]
>>>>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>>>>> _______________________________________________
>>>>>> Maia-users mailing list
>>>>>> [email protected]
>>>>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>>>>
>>>>> _______________________________________________
>>>>> Maia-users mailing list
>>>>> [email protected]
>>>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>>>
>>>> _______________________________________________
>>>> Maia-users mailing list
>>>> [email protected]
>>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>>
>>> _______________________________________________
>>> Maia-users mailing list
>>> [email protected]
>>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>>
>
> _______________________________________________
> Maia-users mailing list
> [email protected]
> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users