On Mon, 24 Sep 2007, feral wrote: > RE: training. I don't know. My experience w/ SA is that > it just works and I haven't dealt with it at this level yet. > What is strange is that SA appeared to be working fine > for my client, then all of the sudden this spike in spam > occurred... and as I said, 99% of the spams have the > sender name same as recipient name (see original post). > > Below is the result of sa-learn -D --dump magic. I see > that "bayes: no dbs present" ... that looks bad. Maybe > this SA was not installed properly. Thanks for your help.
> [24475] dbg: bayes: no dbs present, cannot tie DB R/O: > /root/.spamassassin/bayes_toks > [24475] dbg: config: score set 1 chosen. > [24475] dbg: bayes: no dbs present, cannot tie DB R/O: > /root/.spamassassin/bayes_toks This doesn't look like global bayes, and I don't use per-user so my advice may be a little inaccurate... Is there a .spamassassin subdirectory in that user's home directory? Does it have bayes_* files? If so, log in as that user (e.g. "su - mark") and run "sa_learn --dump magic" and see what the ham/spam token balance looks like. You should try to find out how bayes is being trained. I still think your problem stems (at least partly) from badly mistrained bayes. As others have suggested, make sure you are *not* using "whitelist_from". That particular option is a last-resort fallback option because it's so easy to bypass through forgery. However, as the header samples you posted did not say a whitelist rule was hitting, and the scores were not large and negative, that's probably not a cause of this particular problem. -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- Pelley: Will you pledge not to test a nuclear weapon? Ahmadeinejad: CIA! Secret prison in Europe! Abu Ghraib! -- Mahmoud Ahmadeinejad clumsily dodges a question (60 minutes interview, 9/20/2007) ----------------------------------------------------------------------- 243 days until the Mars Phoenix lander arrives at Mars
