Bazooka Joe wrote:
more and more i am seeing spam marked as autolearn=ham
I was wondering the best way to correct this?
Depends Really you first need to figure out why it this happened before you
take any action at all.
Can you post a X-Spam-Status header for one of the messages?
Have you modified the required_score, or any of the learning thresholds in your
config?
In general there are only a few rules that can cause a message to be tagged as
spam, but do not count toward the computation of score for learning purposes.
*_IN_BLACKLIST, AWL, BAYES_*, and GTUBE are the most noteworthy ones.

more and more i am seeing spam marked as autolearn=ham

I was wondering the best way to correct this? I was going to delete the
bayes and whitelist files and start over but I thought I would see what you
do when this happens.

my setup

using fc4
sendmail
spamass-milter - one bayes file for all users on server
spamassassin
-chris

*X-Spam-Status:* No, score=1.0 required=3.0 tests=BAYES_60 autolearn=ham
version=3.0.4
*X-Spam-Level:* *
*X-Spam-Checker-Version:* SpamAssassin 3.0.4 (2005-06-05) on agwebinc.com

I have required of 3 which you can see and i have the milter rejecting email
w/ score more than 7

5/10/06, Matt Kettler <mkettler (AT) evi-inc (DOT) comwrote:

Bazooka Joe wrote:
more and more i am seeing spam marked as autolearn=ham

I was wondering the best way to correct this?

Depends Really you first need to figure out why it this happened before
you
take any action at all.

Can you post a X-Spam-Status header for one of the messages?

Have you modified the required_score, or any of the learning thresholds in
your
config?

In general there are only a few rules that can cause a message to be
tagged as
spam, but do not count toward the computation of score for learning
purposes.
*_IN_BLACKLIST, AWL, BAYES_*, and GTUBE are the most noteworthy ones.

Bazooka Joe wrote:

*X-Spam-Status:* No, score=1.0 required=3.0 tests=BAYES_60 autolearn=ham
version=3.0.4
*X-Spam-Level:* *
*X-Spam-Checker-Version:* SpamAssassin 3.0.4 (2005-06-05) on
agwebinc.com <http://agwebinc.com>

As far as the autolearner is concerned, the score of that message is 0.
(BAYES_60 is the only rule matched, and the autolearner doesn't consider BAYES
rule scores to prevent "self-feedback" in the bayes learning).

0 is less than the default ham learning threshold of 0.1, and the existing
training only scores 60 (not strongly known as spam), so it autolearns it as ham.

I would approach this from two angles.

1) why did the spam message fail to match any rules other than bayes? Your SA
version is a little old, you might consider testing it against 3.1.1. You might
also consider some rulesemporium.com add-on rulesets to help detect the
particular spam message.

2) Why did it only rank as BAYES_60. Have you done any manual training?

Bazooka Joe wrote:

*X-Spam-Status:* No, score=1.0 required=3.0 tests=BAYES_60 autolearn=ham
version=3.0.4
*X-Spam-Level:* *
*X-Spam-Checker-Version:* SpamAssassin 3.0.4 (2005-06-05) on
agwebinc.com <http://agwebinc.com>
--
I have required of 3 which you can see and i have the milter rejecting
email w/ score more than 7
--
5/10/06, *Matt Kettler * <mkettler (AT) evi-inc (DOT) com
<mailto:mkettler (AT) evi-inc (DOT) com>wrote:

Bazooka Joe wrote:
more and more i am seeing spam marked as autolearn=ham

I was wondering the best way to correct this?

Depends Really you first need to figure out why it this happened
before you
take any action at all.

Can you post a X-Spam-Status header for one of the messages?

Have you modified the required_score, or any of the learning
thresholds in your
config?

In general there are only a few rules that can cause a message to
be tagged as
spam, but do not count toward the computation of score for
learning purposes.
*_IN_BLACKLIST, AWL, BAYES_*, and GTUBE are the most noteworthy ones.
--
You can set in local.cf to be 0 or a
negative number, then autolearn=ham won't kick in unless it's below a
certain score (not sure if this counts bayes or not). But yes, the real
question is why are no rules triggering Is DNS working? Are you
using the blacklist rules, etc? What does the spam look like?

Jay

the spam

Hi Robar

It is sad but it is true that the large groups of women are unhappy with
the size of there BF is thing. Don't be that guy,

and station, designed been grabbed theorized to artist

Thank you

i run rules

TRUSTED_RULESETS="SARE_STCKS TRIPWIRE SARE_EVILNUMBERS0 SARE_EVILNUMBERS1
BGUSVIRUS SARE_ADULT SARE_FRAUD SARE_BML SARE_SPF SARE_BAYES_PISN_NXM
SAREEM SARE_RANDM SARE_HEA
DER SARE_HTML SARE_SPECIFIC SAREBFU SARE_REDIRECT SARE_GENLSUBJ SARE_UNSUB
SARE_WHITELIST";

on my account I get about 10 spams a day scoring below a 3 out of 50 spams
total (thats a guess)

I will try moving the ham threshold down.

and no I haven't done any bayes training. and dns is working.

some stats for my box for one week

I block using sbl-xbl.spamhaus.org, or spamassass catches, or clamav rejects
about 45,000 emails. "ham" email w/ a score of 3 or less is about 9,000

5/10/06, Jay Lee <jlee (AT) pbu (DOT) eduwrote:

Bazooka Joe wrote:
--
*X-Spam-Status:* No, score=1.0 required=3.0 tests=BAYES_60 autolearn=ham
version=3.0.4
*X-Spam-Level:* *
*X-Spam-Checker-Version:* SpamAssassin 3.0.4 (2005-06-05) on agwebinc.com

I have required of 3 which you can see and i have the milter rejecting
email w/ score more than 7
--
5/10/06, Matt Kettler <mkettler (AT) evi-inc (DOT) comwrote:

Bazooka Joe wrote:
more and more i am seeing spam marked as autolearn=ham

I was wondering the best way to correct this?

Depends Really you first need to figure out why it this happened
before you
take any action at all.

Can you post a X-Spam-Status header for one of the messages?

Have you modified the required_score, or any of the learning thresholds
in your
config?

In general there are only a few rules that can cause a message to be
tagged as
spam, but do not count toward the computation of score for learning
purposes.
*_IN_BLACKLIST, AWL, BAYES_*, and GTUBE are the most noteworthy ones.
--
You can set in local.cf to be 0 or a
negative number, then autolearn=ham won't kick in unless it's below a
certain score (not sure if this counts bayes or not). But yes, the real
question is why are no rules triggering Is DNS working? Are you using
the blacklist rules, etc? What does the spam look like?

Jay

Bazooka Joe wrote:
the spam
<snip>
and no I haven't done any bayes training. and dns is working.

Are you running with SpamAssassin's built-in support for RBLs and URIBLs?

That message text got *TRN UP* by the URIBLs on my system:

X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=15.259, required 5,
HTML_40_50 0.50, HTML_MESSAGE 0.00, INFGREYLIST_NTDELAYED -0.00,
LCAL_FRGED_REFERENCES 0.10, RAZR2_CF_RANGE_51_100 0.50,
RAZR2_CF_RANGE_E8_51_100 1.50, RAZR2_CHECK 0.50, SPF_PASS -0.00,
SURBL_MULTI1 -0.50, SURBL_MULTI2 -0.20, URIBL_BLACK 1.50,
URIBL_BLACKVERLAP -1.00, URIBL_JP_SURBL 4.09, URIBL_SBL 1.64,
URIBL_SC_SURBL 4.50, URIBL_WS_SURBL 2.14)

Check your init.pre and see if the uribl plugin is loaded, also check to make
sure you have Net::DNS installed.

The message you sent directly to me hit the following:

* 0.5 HTML_40_50 BDY: Message is 40% to 50% HTML
* 0.1 HTML_MESSAGE BDY: HTML included in message
* 1.5 RAZR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
* above 50%
* [cf: 100]
* 0.5 RAZR2_CHECK Listed in Razor2 (http://razor.sf.net/)
* 3.5 RAZR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
* [cf: 100]
* 10 URIBL_SBL Contains an URL listed in the SBL blocklist
* [URIs: missusoandforever.org]
* 4.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
* [URIs: missusoandforever.org]

course, the scores are heavily inflated by my own personal rules (I
don't recommend doing this unless you know what you're doing) but the
point is, your SA doesn't seem to be firing on certain things it should,
do you have the DNS BL's working? Are you using Razor or DCC? Are you
on the latest 3.1.1?

Jay