On Apr 30, 2007, at 11:47 PM, Simon wrote:
On 5/1/07, kirstin penelope rhys <[EMAIL PROTECTED]> wrote:
On Monday 30 April 2007 16:44, Simon wrote:
> Update on this:
>
> On 4/30/07, Simon <[EMAIL PROTECTED]> wrote:
> > He has been retraining for a while. A little strange. What do i do
> > here? Is there some way of "resetting" for this user?
> >
> > The preferences for this user are set to "on every message",
bounce
> > spams and quarantine the message.
>
> Further to this, i updated the users uid in the tables, reset his
> preferences and backed-up then deleted the physical folder with the
> log etc for the user. This has reset everything back to 0 again. (I
> have the Filter sensitivity set high - catch more spam).
>
> So i tested by sending from my address, and it DSPAM let it thru.
So i
> sent one from my gmail account and it let it thru - so i classed it
as
> spam. kept doing this 5 times, but DSPAM still classes my gmail
> account as not spam. Any suggestions here?
How exactly is the user reclassifying? Is his mail client capable of
bouncing
correctly? What do you mean by "updated the users uid"?
They reclassify there email by using the standard dspam control panels
Quarantine and History pages. DSPAM in this case acts as a front end
to their exchange server. So we are doing:
postfix(AV/SA) > dspam > postfix(2nd instance) > exchange
As for the uid, we are storing all user prefs/etc and token data etc
in mysql. So every user has a uid that i have changed in order to
reset everything for this user.
Well, I guess that takes care of the obvious. (Although, personally,
when I need to reset a user's dspam training, I just delete all the
records associated with their uid from the dspam_signature_data,
dspam_stats, and dspam_token_data tables, and delete their log, hence
my question, but your method should work fine.)
Have you tried setting showFactors on? And taken a look at the raw
sources of the successive, almost identical emails to see if there is
any learning going on? It's possible it may just take some time, if
your user's ham is particularly similar to their spam.
If they remain identical, then you will have managed to narrow the
problem down to retraining. At which point you should tail the postfix
log along with dspam's system.log to make sure that the retraining
really is going on.
Sorry if that's not more helpful.
best,
kirstin
--
sig.
honeypot: [EMAIL PROTECTED]
