On 01/01/2018 07:08 PM, Reindl Harald wrote:
Am 02.01.2018 um 01:59 schrieb David Jones:
On 01/01/2018 06:52 PM, David Jones wrote:
On 01/01/2018 06:47 PM, Reindl Harald wrote:
Am 02.01.2018 um 01:18 schrieb David Jones:
I just had a spam message hit BAYES_999 but not BAYES_99. Based on
BAYES_999 default score of 0.2, I thought that it was always
supposed to complement the BAYES_99 rule and both would trigger
when BAYES_999 hit.
https://pastebin.com/QsVgXwdC
If they are independent, then it would seem logical to bump up the
default score higher than BAYES_99
never ever seen that and since bayes is based on a number between 0
and 1 this should be technically impossible at all
with BAYES_00 that message has [score: 0.0003]
I checked my logs and I am seeing both together when BAYES_999 hits
except for a few times. Is this a bug? Should I open a bug issue?
I am not sure how to reproduce the problem unless others also see the
same thing with that message.
Sorry. Not thinking clearly. Others would have to have the same
Bayes DB to get that message to do the same thing. I was able to
reproduce the same results on another SA platform running MailScanner
using the same Bayes DB in redis.
If others could check their mail logs to see if they are hitting
BAYES_999 without BAYES_99 on the same message, please let me know
[sa-milt@mail-gw:/var/log]$ xzcat maillog-2017*.xz | grep "BAYES_999," |
wc -l
9125
[sa-milt@mail-gw:/var/log]$ xzcat maillog-2017*.xz | grep "BAYES_999," |
grep "BAYES_99," | wc -l
9125
[sa-milt@mail-gw:/var/log]$ xzcat maillog-2017*.xz | grep "BAYES_999," |
grep -v "BAYES_99," | wc -l
0
Since yesterday morning:
# grep "BAYES_999=" /var/log/maillog | grep "BAYES_99=" | wc -l
8006
# grep "BAYES_999=" /var/log/maillog | wc -l
8092
# grep "BAYES_999=" /var/log/maillog | grep -v "BAYES_99=" | wc -l
86
Last week:
# grep "BAYES_999=" /var/log/maillog-20171231 | grep "BAYES_99=" | wc -l
43753
# grep "BAYES_999=" /var/log/maillog-20171231 | wc -l
44108
# grep "BAYES_999=" /var/log/maillog-20171231 | grep -v "BAYES_99=" | wc -l
355
--
David Jones
