On Thu, 2009-03-26 at 18:43 -0700, the same anonymous Nabble user wrote: > But the problem is I know that the email is absolutely spam. It should > identify it as spam. And for some spam emails, it gives low scores like 1.8, > 0.3. Should I accept them as false negatives?
Now this is an entirely different question than your original post. Anyway, if (a) you wonder about the scoring difference for subsequent runs, do as I said and provide at the very least the SA headers for both runs. And if (b) you are actually asking how to identify those missed spam, then do paste some full, raw samples to a pastebin or put them up a web-server and provide the link. Please do not paste or attach them directly to a message sent to the list. Without the samples, we can't tell you whether there are things to tweak to catch them. -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}