Hi,
Last day it produced much more than usual, and much more than
acceptable amount of false-negative (more than 50% of this spam type
remained unidentified).
May I miss some configuration option which can solve this? I use
3.6.8, as it is in the official Debian.
How could we possibly know, unless you submit your configuration?
"grep '^[^#]' dspam.conf".
Actually, someone who had the same problem, and managed to solve it,
could have helped me without the config. But here you are:
Home /var/spool/dspam
StorageDriver /usr/lib/dspam/libhash_drv.so
DeliveryHost /var/run/cyrus/socket/lmtp
DeliveryIdent metacortex
DeliveryProto LMTP
OnFail unlearn
Trust root
Trust dspam
Trust cyrus
TrainingMode teft
TestConditionalTraining on
Feature chained
Feature whitelist
Algorithm graham burton
PValue graham
Preference "spamAction=tag"
Preference "signatureLocation=headers" # 'message' or 'headers'
Preference "showFactors=on"
AllowOverride trainingMode
AllowOverride spamAction spamSubject
AllowOverride statisticalSedation
AllowOverride enableBNR
AllowOverride enableWhitelist
AllowOverride signatureLocation
AllowOverride showFactors
AllowOverride optIn optOut
AllowOverride whitelistThreshold
HashRecMax 98317
HashAutoExtend on
HashMaxExtents 0
HashExtentSize 49157
HashMaxSeek 100
HashConnectionCache 10
Notifications off
PurgeSignatures 14 # Stale signatures
PurgeNeutral 90 # Tokens with neutralish probabilities
PurgeUnused 90 # Unused tokens
PurgeHapaxes 30 # Tokens with less than 5 hits (hapaxes)
PurgeHits1S 15 # Tokens with only 1 spam hit
PurgeHits1I 15 # Tokens with only 1 innocent hit
LocalMX 127.0.0.1
SystemLog on
UserLog on
Opt in
ServerMode standard
ServerParameters "--deliver=innocent,spam"
ServerIdent "metacortex.hu"
ServerDomainSocketPath "/var/run/dspam.sock"
ProcessorBias on
I hope you can spot some difference between this and yours, and so I may
try something to do. Actually it doesn't show any progress on learning
this kind of spams (while no has no problem with "ordinary" spam for 6
month now), and by the way, it could be really difficult, as the content
of the spam is only a base64 encoded pdf or zip file, nothing else.
(Which in turn is quite near to noise...)
So I guess, if anything could solve the case, than it has to do
something with training mode, or features, am I right?
Thank you,
Peter
