On 06/07/2013 01:55 PM, Jim Shupert wrote:
>>
> I'd be more concerned about the BAYES_99 hit than the FRT_PRICE. If
this mail
> is not spam then bayes shouldn't be tripping on it.
>
> You can run these messages through the bayes training process to get
the bayes
> score lowered.
>
> You could also make a whitelist_from_rcvd entry in local.cf
>
>
> Brent Gardner
that is interesting. I saw that but interpeted what I was looking at as
the BAYES_99 added a score of 1 , where as the FRT_PRICE added 3.n.
Actually, the points added for hitting BAYES_99 was 3.5. Look at this:
* 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
This is from your first post.
The 3.5 is the score for the BAYES_99 rule. This rule hits for any
message that has a bayes spam probability of 99% or higher. In the case
of the message you were referring to, bayes gave it a probability of
100%, indicated by [score: 1.0000].
so by the 'bayes training process' you are referring to the
[email protected] &
[email protected]
yes?
If you have your system set to train spam and ham sent to those
addresses, yes.
so an action step would be to have mr. price forward the `good' but
marked
***SPAM*** email to
the account [email protected].
Correct.
regarding your suggestion: " whitelist_from_rcvd entry in local.cf "
i would put in my /etc/mail/spamassassin/local.cf
a line like
whitelist_from_rcvd *@thatOutsideDom.com
yes?
Actually, whitelist_from_rcvd requires the server that the messages come
from, as well as the sender's address.
From your posted message example, it would look something like:
whitelist_from_rcvd *@outside.com outside.com
Although it's hard to give a good example using your samples because the
rdns info was shown to be 'unknown':
Received: from unknown (HELO outside.com) (198.63.36.143)
Whitelist_from_rcvd is preferred over a simple whitelist_from.
Whitelist_from only checks against the sender's addressm which is easily
spoofable. Whitelist_from_rcvd also checks the rdns of the last server
the message passes through before getting to your server.
More info about whitelist_from_rcvd:
http://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Conf.html
Do you have any thoughts of why InsidePerson_1 can volley emails back
and forth
with OutsidePerson without a ***SPAM*** but as soon as
InsidePerson_1 emails
to OutsidePerson with InsidePerson_2 it is tagged ***SPAM***
( and only this one account - InsidePerson_2 is Mr. Price )
that is so challenging to me.
could there be something about his account?
could the AWL be corrupt?
It's hard to say without knowing a lot more about your setup and the
contents of the messages, but if your two samples are from this
exchange, the fact that bayes jumped from 60ish% (BAYES_60) to 100%
suggests that bayes may need some additional training.
Ham usually scores 50% or lower.
Thanks for all the input , it is always rewarding to share & hear from
others.
jS
Glad to help
I see talk of "running a message through SA with debugging turned on"
but I have not found how one does that.
Copy the message somewhere, ex: /home/vpopmail/message.eml
Then run spamassassin like this:
spamassassin -D -t < /home/vpopmail/message.eml 2>&1 | less
You need to run it in the context of the user that spamassassin normally
runs under so that your test gets the same environment that regular
spamassassin gets. On toasters, that is the 'vpopmail' user.
On my toasters, I always log in as an unprivileged user and then use
sudo to do important stuff, so when I test a message, my command line
looks like this:
sudo -u vpopmail -H spamassassin -D -t < message.txt 2>&1 | less
I'm not sure how to do this if you log in as root.
ps
I found this - which does not get "me" any closer to a solution
0 down vote accepted
BAYES_99 is a statistical component of SpamAssasin. It is using some
sort/variation of Naive Bayes
<http://en.wikipedia.org/wiki/Naive_Bayes_classifier> which has (to
keep it
simple) some sort of probability saying that some word/token is likely
to be
spam or not to be spam.
In "math" these could be expressed like this:
|P(Class_Spam | Email)
P(NotClass_Spam | Email)
|
Transformations lead to e.g. this equation:
enter image description here
Yikes ; I am just trying to admin a mail server not build a time
machine :)
Bayesian filtering is a powerful antispam tool. I find that with any
powerful tool, there's a bit of a learning curve. Just make sure you're
training spam as spam and ham as ham and it should be OK. The
SpamAssassin devs have taken care of all the crazy maths. ;)
Be sure when training to run the training process as the vpopmail user.
Bayes is a part of spamassassin. Pretty much anything you do with
spamassassin needs to be done in teh context of the vpopmail user.
Brent Gardner
---------------------------------------------------------------------
