hi all "SA does observe all settings in its configuration file, but not all of them have effect on the mail being checked, as amavisd-new does its own decisions based on spam score (hits) (so for example required_hits has no effect - use tag/tag2/kill amavisd-new settings instead), and does its own header editing, and body is not modified."
"amavisd-new does not modify mail body or lets SA do it (with the exception of defanging, introduced with amavisd-new-2.0). All mail (header) editing is done by amavisd-new and not by SA. Even though SA does observe options in its configuration file to rewrite mail body and modify mail header, the result is purposely not used by amavisd-new. There are two reasons for that: SA is only called once per message regardless of the number of recipients, and secondly, to be able to offer a guarantee the mail body will not be altered, This means the per-recipient handling of mail relaying and header editing needs to be done entirely in amavisd-new, as there are no provisions in SA to analyze mail once and then prepare different modifications for different recipients based on the same spam analysis. It is a tradeoff: speed for multi-recipient mail versus the full per-recipient flexibility. It would make no sense to fully duplicate the spamc/spamd functionality in amavisd-new. If you need such features, just disable calling SA from amavisd-new, and use the spamc/spamd or other back-end interface to SA." the above are excerpts from an article in the Net; i've set in local.cf the following: # Enable the Bayes system use_bayes 1 # Enable Bayes auto-learning bayes_auto_learn 1 but it's no effect so far! how to make SA learn! i still have to find out a way for this; i've got amavisd/SA/spamd combinations; i'd try sanesecurity addons; thanks everybody! On Wed, Feb 11, 2009 at 10:02 AM, <amavis-user-requ...@lists.sourceforge.net > wrote: > Send AMaViS-user mailing list submissions to > amavis-user@lists.sourceforge.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.sourceforge.net/lists/listinfo/amavis-user > or, via email, send a message with subject or body 'help' to > amavis-user-requ...@lists.sourceforge.net > > You can reach the person managing the list at > amavis-user-ow...@lists.sourceforge.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of AMaViS-user digest..." > > > Today's Topics: > > 1. amavisd-learning (bharathan kailath) > 2. Amavis + SpamAsssin local.cf (David Touzeau) > 3. Stomp for Amavis logging (Rajkumar S) > 4. Re: amavisd-learning (Richard Bishop) > 5. Re: amavisd-learning (Patrick Ben Koetter) > 6. Re: amavisd-learning (Noel Jones) > 7. Re: amavisd-learning (Curtis Maurand) > 8. Re: Amavis + SpamAsssin local.cf (Jo Rhett) > 9. Re: Amavis + SpamAsssin local.cf (David Touzeau) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 10 Feb 2009 11:44:42 +0200 > From: bharathan kailath <kbhara...@gmail.com> > Subject: [AMaViS-user] amavisd-learning > To: amavis-user@lists.sourceforge.net > Message-ID: > <bd3f7bf30902100144g11a2a87cjc42a95c2dcbdc...@mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi > > X-Virus-Scanned: amavisd-new at XXXX.XX > X-Spam-Score: 1.914 > X-Spam-Level: * > X-Spam-Status: No, score=1.914 required=5 tests=[ADVANCE_FEE_2=1.234, > ADVANCE_FEE_3=1.432, ADVANCE_FEE_4=0.639, AWL=-0.320, > BAYES_00=-2.599, > MILLION_USD=1.528] > > the above is a header detail of a nigerian spam; how can set amavis to > consider this as spam > help appreicatde > > > ------------------------------ > > Message: 2 > Date: Tue, 10 Feb 2009 12:22:33 +0100 > From: David Touzeau <david.touz...@fr.kaspersky.com> > Subject: [AMaViS-user] Amavis + SpamAsssin local.cf > To: amavis-user@lists.sourceforge.net > Message-ID: <1234264953.14155.5.ca...@pc-touzeau.klf.fr> > Content-Type: text/plain > > Dear > > I would like to know if it is mandatory to personnalize spamassassin > local.cf with amavis ? > > > > > ------------------------------ > > Message: 3 > Date: Tue, 10 Feb 2009 17:31:58 +0530 > From: Rajkumar S <rajkum...@gmail.com> > Subject: [AMaViS-user] Stomp for Amavis logging > To: amavis-user@lists.sourceforge.net > Message-ID: > <64de5c8b0902100401hbaf0617ybc394dbaa9bfb...@mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > I made an ugly patch for Amavis to log via Stomp protocol so that a > message queue like Apache ActiveMQ can be used to process logs. The > log message is sent as json so that there is little or no parsing and > can be put in DB or files as needed. This can also aggregate logs from > multiple amavis and store and process in a central location. My patch > is based on amavisd-new-2.4.2 (20060627). I can update this patch to > latest version after Mark's comment. Though the patch is working fine > for me I am pretty sure the approach is not correct. > > raj > > ------------------------------ > > Message: 4 > Date: Tue, 10 Feb 2009 08:44:41 -0500 > From: Richard Bishop <amavis-u...@uchange.co.uk> > Subject: Re: [AMaViS-user] amavisd-learning > To: amavis-user@lists.sourceforge.net > Message-ID: <5bd52ec4ce3147f242a2dfbdabf1d...@localhost> > Content-Type: text/plain; charset="UTF-8" > > > > > > Hi, > > > On Tue, 10 Feb 2009 11:44:42 +0200, bharathan kailath <kbhara...@gmail.com > > > wrote: > > > X-Spam-Score: 1.914 > > X-Spam-Level: * > > X-Spam-Status: No, score=1.914 required=5 tests=[ADVANCE_FEE_2=1.234, > > ADVANCE_FEE_3=1.432, ADVANCE_FEE_4=0.639, AWL=-0.320, > BAYES_00=-2.599, > > MILLION_USD=1.528] > > > > the above is a header detail of a nigerian spam; how can set amavis to > > consider this as spam > > help appreicatde > > > This question is somewhat inappropriate for the amavisd-new mailing list. > Beneath the hood, amavis-new is essentially spamassassin and a wrapper for > third-party antivirus engines (ClamAV being one of these). You may wish to > repost your question to the Spamassassin list, who will be able to give you > more help and assistance. > > A couple of pointers: > > 1) Run sa-learn against any messages that are incorrectly classified, this > will train the bayes classifier to 'recognise' such emails in the future. > Currently your bayes database is scoring -2.599 for this message (i.e. > bayes thinks this is ham), once it is trained correctly this value should > be positive (i.e. spam). > > 2) Check out the SARE project (http://www.rulesemporium.com/) who provide > a > large number of third-party rulesets for SpamAssassin which can help to > detect these types of spam quite readily. They have their own mailing > lists for support - details on their website. > > 3) Do you have razor and/or pyzor installed and configured? These systems > are very good at identifying and blocking mass-mailed junk such as this - > more information on their respective websites - > http://razor.sourceforge.net/ http://pyzor.sourceforge.net/ > > 4) Read the SpamAssassin wiki (http://wiki.apache.org/spamassassin/), > particularly the pages on 'other tricks for getting rid of spam' > > 5) Also look over the SpamAssassin list archives, there are a lot of > suggestions shared there for other ways to detect and block spam. > > > Regards > > > > Richard > > > > > ------------------------------ > > Message: 5 > Date: Tue, 10 Feb 2009 16:02:56 +0100 > From: Patrick Ben Koetter <p...@state-of-mind.de> > Subject: Re: [AMaViS-user] amavisd-learning > To: amavis-user@lists.sourceforge.net > Message-ID: <20090210150256.gd11...@state-of-mind.de> > Content-Type: text/plain; charset=us-ascii > > * bharathan kailath <kbhara...@gmail.com>: > > Hi > > > > X-Virus-Scanned: amavisd-new at XXXX.XX > > X-Spam-Score: 1.914 > > X-Spam-Level: * > > X-Spam-Status: No, score=1.914 required=5 tests=[ADVANCE_FEE_2=1.234, > > ADVANCE_FEE_3=1.432, ADVANCE_FEE_4=0.639, AWL=-0.320, > BAYES_00=-2.599, > > MILLION_USD=1.528] > > > > the above is a header detail of a nigerian spam; how can set amavis to > > consider this as spam > > You need to train/improve SpamAssassin, not amavisd. > > p...@rick > > -- > The Book of Postfix > <http://www.postfix-book.com> > saslfinger (debugging SMTP AUTH): > <http://postfix.state-of-mind.de/patrick.koetter/saslfinger/> > > > > ------------------------------ > > Message: 6 > Date: Tue, 10 Feb 2009 11:21:15 -0600 > From: Noel Jones <njo...@megan.vbhcs.org> > Subject: Re: [AMaViS-user] amavisd-learning > To: amavis-user@lists.sourceforge.net > Message-ID: <4991b78b.8050...@megan.vbhcs.org> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Patrick Ben Koetter wrote: > > * bharathan kailath <kbhara...@gmail.com>: > >> Hi > >> > >> X-Virus-Scanned: amavisd-new at XXXX.XX > >> X-Spam-Score: 1.914 > >> X-Spam-Level: * > >> X-Spam-Status: No, score=1.914 required=5 tests=[ADVANCE_FEE_2=1.234, > >> ADVANCE_FEE_3=1.432, ADVANCE_FEE_4=0.639, AWL=-0.320, > BAYES_00=-2.599, > >> MILLION_USD=1.528] > >> > >> the above is a header detail of a nigerian spam; how can set amavis to > >> consider this as spam > > > > You need to train/improve SpamAssassin, not amavisd. > > > > Feeding missed spam through sa-learn is a very important step. > Your bayes thinks the message is ham. > > If you're already using clamav with amavisd-new, I would > highly recommend the Sanesecurity add-on signatures. They do > a great job catching phish and scam mail. Here's instructions > on how to get and use them: http://sanesecurity.com/usage.htm > > -- > Noel Jones > > > > ------------------------------ > > Message: 7 > Date: Tue, 10 Feb 2009 13:09:22 -0500 > From: Curtis Maurand <cur...@maurand.com> > Subject: Re: [AMaViS-user] amavisd-learning > To: njo...@megan.vbhcs.org > Cc: amavis-user@lists.sourceforge.net > Message-ID: <4991c2d2.7040...@maurand.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Noel Jones wrote: > > Patrick Ben Koetter wrote: > > > >> * bharathan kailath <kbhara...@gmail.com>: > >> > >>> Hi > >>> > >>> X-Virus-Scanned: amavisd-new at XXXX.XX > >>> X-Spam-Score: 1.914 > >>> X-Spam-Level: * > >>> X-Spam-Status: No, score=1.914 required=5 tests=[ADVANCE_FEE_2=1.234, > >>> ADVANCE_FEE_3=1.432, ADVANCE_FEE_4=0.639, AWL=-0.320, > BAYES_00=-2.599, > >>> MILLION_USD=1.528] > >>> > >>> the above is a header detail of a nigerian spam; how can set amavis to > >>> consider this as spam > >>> > >> You need to train/improve SpamAssassin, not amavisd. > >> > >> > > > > Feeding missed spam through sa-learn is a very important step. > > Your bayes thinks the message is ham. > > > > If you're already using clamav with amavisd-new, I would > > highly recommend the Sanesecurity add-on signatures. They do > > a great job catching phish and scam mail. Here's instructions > > on how to get and use them: http://sanesecurity.com/usage.htm > > > > > What he said. I've installed fuzzyocr and with this along with razor, > etc. spam has been cut dramatically back. > > --Curtis > > > ------------------------------ > > Message: 8 > Date: Tue, 10 Feb 2009 12:04:48 -0800 > From: Jo Rhett <jrh...@netconsonance.com> > Subject: Re: [AMaViS-user] Amavis + SpamAsssin local.cf > To: david.touz...@fr.kaspersky.com > Cc: amavis-user@lists.sourceforge.net > Message-ID: <8d722ccb-433c-4ca9-b908-a916db760...@netconsonance.com> > Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes > > On Feb 10, 2009, at 3:22 AM, David Touzeau wrote: > > I would like to know if it is mandatory to personnalize spamassassin > > local.cf with amavis ? > > > No, but it is quite useful. Amavis doesn't allow you to whitelist by > dkim, spf or source IP on a per-domain basis. SA does. And it's > helpful to tune a lot of the scores higher too ;-) > > -- > Jo Rhett > Net Consonance : consonant endings by net philanthropy, open source > and other randomness > > > > > > ------------------------------ > > Message: 9 > Date: Wed, 11 Feb 2009 09:01:58 +0100 > From: David Touzeau <david.touz...@fr.kaspersky.com> > Subject: Re: [AMaViS-user] Amavis + SpamAsssin local.cf > To: "amavis-user@lists.sourceforge.net" > <amavis-user@lists.sourceforge.net> > Message-ID: <1234339318.16340.0.ca...@pc-touzeau.klf.fr> > Content-Type: text/plain; charset=ISO-8859-15 > > Many thanks > > so have you some examples of local.cf in combination with amavis ? > > > -------- Message initial -------- > De: Jo Rhett <jrh...@netconsonance.com> > ?: david.touz...@fr.kaspersky.com > Cc: amavis-user@lists.sourceforge.net > Sujet: Re: [AMaViS-user] Amavis + SpamAsssin local.cf > Date: Tue, 10 Feb 2009 12:04:48 -0800 > > On Feb 10, 2009, at 3:22 AM, David Touzeau wrote: > > I would like to know if it is mandatory to personnalize spamassassin > > local.cf with amavis ? > > > No, but it is quite useful. Amavis doesn't allow you to whitelist by > dkim, spf or source IP on a per-domain basis. SA does. And it's > helpful to tune a lot of the scores higher too ;-) > > > * > > > > > > > > > > > > > > > > > > > > ------------------------------ > > > ------------------------------------------------------------------------------ > Create and Deploy Rich Internet Apps outside the browser with > Adobe(R)AIR(TM) > software. With Adobe AIR, Ajax developers can use existing skills and code > to > build responsive, highly engaging applications that combine the power of > local > resources and data with the reach of the web. Download the Adobe AIR SDK > and > Ajax docs to start building applications today- > http://p.sf.net/sfu/adobe-com > > ------------------------------ > > _______________________________________________ > AMaViS-user mailing list > AMaViS-user@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/amavis-user > AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3<https://lists.sourceforge.net/lists/listinfo/amavis-user%0AAMaViS-FAQ:http://www.amavis.org/amavis-faq.php3> > > > End of AMaViS-user Digest, Vol 34, Issue 10 > ******************************************* > ------------------------------------------------------------------------------ Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM) software. With Adobe AIR, Ajax developers can use existing skills and code to build responsive, highly engaging applications that combine the power of local resources and data with the reach of the web. Download the Adobe AIR SDK and Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com _______________________________________________ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
