Good morning, Tu,
On Fri, 7 May 2004, Pham, Tu wrote:
> I my SA has blocked a lot of the precription medicine and viagra spam
> mails. However, it is starting to spam alot of legitimate emails. How
> can I improve its scoring system. We've taught the ham through it. Some
> people are starting to get frustrated with SA because its spam too many
You've got the right idea. Whenever SA misclassifies a message as
spam, feed it back into the bayesian database as ham.
The command I use on a mailbox of messages I'm sure are ham is:
sa-learn --showdots --mbox --ham "$MailDir/$OneFolder"
(Actually, I do this over an ssh connection to multiple mail
servers I manage; take a look at
http:/www.stearns.org/spamassassin/learn-spam for the script I use)
The important part here is to learn _why_ the messages are beng
misclassified. Take a look at the X-Spam-Report section to see what
criteria classified this as spam. Which rules fired? Focus on the ones
with the highest score; is there some rbl that's constantly calling your
mail spam? Is the bayesian classifier always up at >5 for some reason?
Are your users sending html mail, lots of exclamation points, or mail
without their real names in the from: address? Do you have a really
spammy sounding disclaimer at the bottom? Has some business partner's
mail server been classiied as an open relay?
Once you found a rule or two that seems to be misfiring, change
its score down to a small number, or to 0 if you don't want to use it at
all.
> of their emails. People have begun to send me their contact lists. Does
> SA performance decrease when the whitelisting list becomes quite large?
You _can_ manually whitelist the senders, but a much better
approach is to use the automatic whitelist database (AWL). Do you have
this turned on already?
This is a more intelligent approach because it takes into account
not only the sender email address but also the class B network from which
the mail came.
> I'm currently running SA 2.63 on Red Hat 7.2. Tried to install Razor but
> had problems with it because of our firewall but I am considering trying
> it again.
Razor, if anything, will drive your scores even higher. Let's
focus on getting the basic scores right first.
Cheers,
- Bill
---------------------------------------------------------------------------
"The Arkansas legislature passed a law that states that the
Arkansas River can rise no higher than to the Main Street bridge in
Little Rock."
(Courtesy of slashdot.org)
--------------------------------------------------------------------------
William Stearns ([EMAIL PROTECTED]). Mason, Buildkernel, freedups, p0f,
rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org
--------------------------------------------------------------------------
