Hi SA User List,
Here's my case: postfix + amavisd-new + SpamAssassin 2.64
working on a Gentoo Linux box, serving as a mail server for
serveral virtual domains.
Some SpamAssassin details: Bayes learning activated recently,
based on about 300 spam mails and 200 ham mails, which accumulate
in IMAP folders and are scanned using sa-learn via cron job three
times a day.
It all seems to work, but I see SA passing through some obvious spam,
so I decided to look. And what I dicovered was very surprising for me:
SA computes the score well, but suddenly lowers it significantly
exactly before returning an answer to amavisd.
Here an examples:
.
.
debug: running raw-body-text per-line regexp tests; score so far=4.166
debug: running uri tests; score so far=4.166
debug: uri tests: Done uriRE
debug: running full-text regexp tests; score so far=4.166
debug: all '*From' addrs: [EMAIL PROTECTED]
debug: all '*To' addrs: [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
[EMAIL PROTECTED] [EMAIL PROTECTED] ydamian
[EMAIL PROTECTED]
debug: forged-HELO: from=media-c.local helo=troyer.co.at by=media-c.de
debug: forged-HELO: mismatch on HELO: 'troyer.co.at' != 'media-c.local'
debug: forged-HELO: from=wanadoo.fr helo= by=troyer.co.at
debug: forged-HELO: mismatch on from: 'media-c.local' != 'troyer.co.at'
debug: running meta tests; score so far=5.53
debug: auto-learn? ham=0.2, spam=8, body-hits=4.166, head-hits=1.364
debug: auto-learn: currently using scoreset 2. recomputing score based on
scoreset 0.
debug: Score set 0 chosen.
debug: auto-learn: original score: 5.53, recomputed score: 4.922
debug: Score set 2 chosen.
debug: auto-learn? no: inside auto-learn thresholds
debug: is spam? score=0.629 required=6.8
tests=BAYES_00,DATE_IN_PAST_12_24,SARE_ADULT2,SARE_OBFUPORNO
Then the message is tagged "X-Spam-Status: No, hits=0.6".
This is an obvious adult site adv. and SARE rules do a good job. But why the
score
is lowered at the end?
If I use spamassassin command line tool for the SAME message, I get very good
result:
# spamassassin <
1102684670.M621242P31174V0000000000006210I00006396_0.prodo,S=1996:2,S
X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on prodo.media-c.local
X-Spam-Level: ******
X-Spam-Status: No, hits=6.5 required=6.8 tests=BEST_PORN,DATE_IN_PAST_12_24,
SARE_ADULT2,SARE_OBFUPORNO autolearn=no version=2.64
-- cut here ------------------------
As is not difficult to gues, I would like to have THESE scores, non-lowered!
I suspected the bayesian learning to be blamed... but when checking the learning
sesssions logs, everyhting is correct, spam and ham are perfectly sorted and
learning is conducted as appropriate. So I am stuck.
Why does this mailfunction appear? Suggestions for fixing?
Any help would greatly appreciated.
Yassen
P.S. Please find below enclosed some configs as
/etc/mail/spamassassin/local.cf,
and others.
--
Yassen Damyanov
phone: +359-32-968-903
email: [EMAIL PROTECTED]
ICQ# : 169382108
web : www.troyer-is.com
# cat /etc/mail/spamassassin/local.cf | sed -n -e '/^[\t ]*#\|^[\t ]*$/!p'
trusted_networks 127.0.0.
required_hits 6.8
rewrite_subject 1
subject_tag [SPAM?]
report_safe 1
use_terse_report 0
use_bayes 1
auto_learn 1
skip_rbl_checks 0
use_razor2 1
use_dcc 1
use_pyzor 1
ok_languages de en
ok_locales de en
# cat /etc/amavisd.conf | sed -n -e '/^[\t ]*#\|^[\t ]*$/!p'
# -- Relevant Sections Only --
$MYHOME = '/var/run/amavis'; # (default is '/var/amavis')
$spam_quarantine_to = new_RE(
[qr'^([EMAIL PROTECTED])@([EMAIL PROTECTED])$'i =>
'/var/virtual/hosts/${2}/home/${1}/.maildir/.Junk/new'],
[qr/.*/ => 'spam-quarantine'] );
$X_HEADER_TAG = 'X-Virus-Scanned';
$X_HEADER_LINE = "by amavisd-new-20030616:clamav-0.80 at prodo.media-c.de";
$undecipherable_subject_tag = '[UNCHECKED] ';
$remove_existing_x_scanned_headers = 0;
$remove_existing_spam_headers = 0;
$sa_local_tests_only = 1;
$sa_timeout = 30;
$sa_mail_body_size_limit = 150*1024;
$sa_tag_level_deflt = -99.0;
$sa_tag2_level_deflt = 4.2;
$sa_kill_level_deflt = 5.8;
$sa_dsn_cutoff_level = 10.0;
$sa_spam_subject_tag = '[SPAM?] ';
$sa_debug = 1;
When running sa-learning, I use
