On Wed, 2009-05-20 at 11:46 +1200, Kate wrote:
> Karsten Bräckelmann wrote:
> > On Wed, 2009-05-20 at 09:42 +1200, Kate wrote:
> > > I had to up the score as they were all still getting through due to
> > > bayes_00 (score -3)
> >
> > That is a *custom* score. You should NOT arbitrarily adjust scores,
> > unless you know what you're doing, watch the impact closely and can
> > trust the rule.
> >
> > Clearly, you can NOT trust your Bayes to that extent.
>
> I don't generally adjust scores it was just in this case i had run
> sa-learn on lots of these emails and the bayes wan't changing and I
> really had to stop the spam coming through.
Wait, you got that wrong. When talking about adjusting scores, I was not
about the MIME_IMAGE_ONLY score, which appears sensible to catch them.
I was talking about your adjustment, lowering of the BAYES_00 score.
Which obviously badly hits on these image-only spams. That one was a bad
decision.
> > SA will not auto-learn them for various reasons. First of all, the
> > total score is not above your auto-learn spam threshold. Secondly,
> > header and body rules are unlikely to exceed a score of 3 each, which is
> > another constraint. And then there's you're -3.0 for Bayes, which will
> > result in the message NEVER being auto-learned as spam.
> >
> > As Lu already said -- sa-learn is what you need.
> I will need to go and investigate more thoroughly how our system is
> using the Bayes and what its thresholds are etc.
Probably the default ones, so pretty much what I mentioned. Some details
can be found in the appropriately named man pages / POD. No link. I'm
sorry, but I first want to ensure you are *not* going to adjust these
settings.
Instead, do train manually. IMHO there's no way at this point anyway for
you to have 'em auto-learned. Since they are generally scoring quite low
(less than 15 in my book), the odds for auto-learning are bad in any
case, not specific to your results.
> Is that all set in MailScanner.conf?
Don't know about MailScanner, but as long as it doesn't overrule almost
all settings it's probably in the SA conf.
guenther
--
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
