I have a problem related to spamassassin-3.0.2 which i have packged for my use. I have installed all rpms of spam-3.0.2 on my FC2 box. and then i have sent spam mail message to check whether its working properly or not on my box. Its able to grab the spam and giving header info as spam i.e. X-spam-status: yes etc but in its header information its giving """ autolearn=ham """ which should not be the case when its spam. rather it should be autolearn=spam. so can anybody of you help me in identifying where is the things wrong , i have not packged properly or i need to change something in some configuration file.
On Tue, March 1, 2005 10:53 pm, crisppy fernandes said:
I have a problem related to spamassassin-3.0.2 which i have packged for my use. I have installed all rpms of spam-3.0.2 on my FC2 box. and then i have sent spam mail message to check whether its working properly or not on my box. Its able to grab the spam and giving header info as spam i.e. X-spam-status: yes etc but in its header information its giving """ autolearn=ham """ which should not be the case when its spam. rather it should be autolearn=spam. so can anybody of you help me in identifying where is the things wrong , i have not packged properly or i need to change something in some configuration file. -- Crisppy Fernandes
What was the score that SA gave the message? Default score for it to be marked as spam is 5.0. If the score was below this, then it makes sense that it was labled as ham. Anyway, don't fret. If it's a new setup, you still have to train Bayes with at least 100 ham/spam for it to even begin working. Also, the message you sent, was it already examined by SA on another computer? Did you simply forward the message to the box, or did you bounce it? (forwarding alters several headers and could be the cause of the error)
If your message was trained as ham and it should be spam, simply run: sa-learn --spam --showdots /mail/folder/here
Check http://spamassassin.apache.org/ for further details
You can also save the message as a file...be sure all headers are preserved and then run:
spamassassin -D < /path/to/file
The above command will run a verbose report on the message.
crisppy fernandes wrote:
I have a problem related to spamassassin-3.0.2 which i have packged for my use. I have installed all rpms of spam-3.0.2 on my FC2 box. and then i have sent spam mail message to check whether its working properly or not on my box. Its able to grab the spam and giving header info as spam i.e. X-spam-status: yes etc but in its header information its giving """ autolearn=ham """ which should not be the case when its spam. rather it should be autolearn=spam. so can anybody of you help me in identifying where is the things wrong , i have not packged properly or i need to change something in some configuration file.
It is possible the message was learned as ham.
When deciding if message should be learned as ham or spam, some tests are ignored, as described in Mail::SpamAssassin::Conf manual page:
- rules with tflags set to 'learn' - rules with tflags set to 'userconf' - rules with tflags set to 'noautolearn'
For example, if you used GTUBE spam example for your "spam mail" (sample-spam.txt file distributed with SpamAssassin), than it will most likely be learned as ham. GTUBE rule has tflags set to "userconf noautolearn", and will be ignored when deciding should email be learned as ham or spam. After all, GTUBE spam example isn't really a spam... Try testing with some real piece of spam.
I have a problem related to spamassassin-3.0.2 which i have packged for my use. I have installed all rpms of spam-3.0.2 on my FC2 box. and then i have sent spam mail message to check whether its working properly or not on my box. Its able to grab the spam and giving header info as spam i.e. X-spam-status: yes etc but in its header information its giving """ autolearn=ham """ which should not be the case when its spam. rather it should be autolearn=spam. so can anybody of you help me in identifying where is the things wrong , i have not packged properly or i need to change something in some configuration file.
It is possible the message was learned as ham.
When deciding if message should be learned as ham or spam, some tests are ignored, as described in Mail::SpamAssassin::Conf manual page:
- rules with tflags set to 'learn'
- rules with tflags set to 'userconf'
- rules with tflags set to 'noautolearn'
For example, if you used GTUBE spam example for your "spam mail" (sample-spam.txt file distributed with SpamAssassin), than it will most likely be learned as ham. GTUBE rule has tflags set to "userconf noautolearn", and will be ignored when deciding should email be learned as ham or spam. After all, GTUBE spam example isn't really a spam... Try testing with some real piece of spam.
--
In my case spamassassin-3.0.2 is catching sample-spam mail but not able to catch any other spam mail. entries in my local.cf are:
rewrite_header Subject *****SPAM***** report_safe 1
--------------------------------------------
spamassassin -D < /path/to/file
this does not seem to be wrking. as giving nothing as output.
and
sa-learn --spam --showdots /mail/folder/here
is wrking fine and giving output 1 message learned. etc.
i dont know if i am missing something in some configuration file.
thanxs for any help
On Thu, 2005-03-03 at 04:17, crisppy fernandes wrote:
In my case spamassassin-3.0.2 is catching sample-spam mail but not able to catch any other spam mail. entries in my local.cf are:
rewrite_header Subject *****SPAM***** report_safe 1
spamassassin -D < /path/to/file
this does not seem to be wrking. as giving nothing as output.
and
sa-learn --spam --showdots /mail/folder/here
is wrking fine and giving output 1 message learned. etc.
i dont know if i am missing something in some configuration file.
thanxs for any help
-- Crisppy Fernandes
Several things to remember about spamassassin. Bayes will not be used until it has learned 200 spam and 200 ham messages. If you are below that threshold it does not use bayes to compute the score.
Also it will not autolearn spam unless the score is over a certain threshold for both header and message rules ( I think the default is 10).
You can use sa-learn --dump to get the stats on how many spam and ham have been learned.
The default rules that come with spamassassin are fairly good. However you may want to check out the rulesemporium for additional rule sets that can help boost the score on spam which makes it easier to separate spam from ham.
* Scot L. Harris webid@cfl.rr.com [03-03-2005 16:23]:
Several things to remember about spamassassin. Bayes will not be used until it has learned 200 spam and 200 ham messages. If you are below that threshold it does not use bayes to compute the score.
Slight correction, it's 100 each of spam and ham for Bayes to activate. (200 total)
Also it will not autolearn spam unless the score is over a certain threshold for both header and message rules ( I think the default is 10).
Default threshold for spam is 5.0.
See wiki page below.
http://wiki.apache.org/spamassassin/AutolearningNotWorking
"Finally, SpamAssassin requires at least 3 points from the header and 3 points from the body, to auto-learn as spam. If either section contributes fewer points, the message will not be auto-learned."
On Thu, 2005-03-03 at 13:55 -0800, Matt Florido wrote:
"Finally, SpamAssassin requires at least 3 points from the header and 3 points from the body, to auto-learn as spam. If either section contributes fewer points, the message will not be auto-learned."
I want SpamAssassin to be trained with all my mail. I tried to do this by having SpamAssassin auto-learn from all mail, so I would only have to retrain it with those messages that it gets wrong (which I can do with Evolution's Junk/Not Junk buttons). This can't be done, due to what is quoted above. I think there's a similar issue with auto-learning ham.
I accomplished this by putting the following in my .procmailrc (the same thing could be done with filters in a mail reader if it downloads mail directly):
:0 fw | /usr/bin/spamc
:0 wc: * ^X-Spam-Flag: YES | sa-learn --spam
:0 Ewc: | sa-learn --ham
On Thu, 2005-03-03 at 17:19, Brian Mury wrote:
On Thu, 2005-03-03 at 13:55 -0800, Matt Florido wrote:
"Finally, SpamAssassin requires at least 3 points from the header and 3 points from the body, to auto-learn as spam. If either section contributes fewer points, the message will not be auto-learned."
I want SpamAssassin to be trained with all my mail. I tried to do this by having SpamAssassin auto-learn from all mail, so I would only have to retrain it with those messages that it gets wrong (which I can do with Evolution's Junk/Not Junk buttons). This can't be done, due to what is quoted above. I think there's a similar issue with auto-learning ham.
The way this is handle usually is to manually run sa-learn on batches of ham and spam email. If this is done with a good sample in the first week or two of starting to use spamassassin you normally get a good base line and get very good results. Occasional training sessions will maintain things. About every two weeks I run a script that processes all spam I received. I run my inbox through less often. By manually doing this I get a chance to do a quick review looking for false positives. Anymore I don't spend much time on spam.
And if you are running your own MTA server you can eliminate 99% of your spam before every having to invoke spamassassin by implementing greylisting.
Seriously, it works that well.
On Thu, 2005-03-03 at 22:07 -0500, Scot L. Harris wrote:
I want SpamAssassin to be trained with all my mail. I tried to do this by having SpamAssassin auto-learn from all mail, so I would only have to retrain it with those messages that it gets wrong (which I can do with Evolution's Junk/Not Junk buttons). This can't be done, due to what is quoted above. I think there's a similar issue with auto-learning ham.
The way this is handle usually is to manually run sa-learn on batches of ham and spam email. If this is done with a good sample in the first week or two of starting to use spamassassin you normally get a good base line and get very good results. Occasional training sessions will maintain things. About every two weeks I run a script that processes all spam I received. I run my inbox through less often. By manually doing this I get a chance to do a quick review looking for false positives. Anymore I don't spend much time on spam.
And if you are running your own MTA server you can eliminate 99% of your spam before every having to invoke spamassassin by implementing greylisting.
Seriously, it works that well.
Around here I create a "Spam", "Whitelist" and "Blacklist" folder for the users. When spam is manually caught, all you have to do is drag it over to "Blacklist" where the server will pick it up, about every hour or so, and learn it as such. The reverse is true for things that get caught, and you want to keep those mails coming.
Funny thing, though: I can't remember ever having a 'keeper' getting marked as spam (false positive).
If you (or anyone else) wants this simple little script, I'd be happy to send it to you, just let me know. It runs on the server side and has been updated to work with SA 3.0.2.
And that way you get the same effect as the 'junk' mechanism in Evolution, no matter what client you're using!
On Thu, 2005-03-03 at 23:06, Brian Fahrlander wrote:
On Thu, 2005-03-03 at 22:07 -0500, Scot L. Harris wrote:
The way this is handle usually is to manually run sa-learn on batches of ham and spam email. If this is done with a good sample in the first week or two of starting to use spamassassin you normally get a good base line and get very good results. Occasional training sessions will maintain things. About every two weeks I run a script that processes all spam I received. I run my inbox through less often. By manually doing this I get a chance to do a quick review looking for false positives. Anymore I don't spend much time on spam.
And if you are running your own MTA server you can eliminate 99% of your spam before every having to invoke spamassassin by implementing greylisting.
Seriously, it works that well.
Around here I create a "Spam", "Whitelist" and "Blacklist" folder
for the users. When spam is manually caught, all you have to do is drag it over to "Blacklist" where the server will pick it up, about every hour or so, and learn it as such. The reverse is true for things that get caught, and you want to keep those mails coming.
Funny thing, though: I can't remember ever having a 'keeper' getting marked as spam (false positive).
If you (or anyone else) wants this simple little script, I'd be
happy to send it to you, just let me know. It runs on the server side and has been updated to work with SA 3.0.2.
And that way you get the same effect as the 'junk' mechanism in
Evolution, no matter what client you're using!
In over two years I have only seen 2 false positives. I see 5 or 6 missed spam each week. If I was able to run greylisting on the ISPs mail server I would probably not even see those. And I would not see the hundreds of spam that spamassassin catches each week either.
Try running: spamassassin -D --lint Tell me if you get any output.
-- Matt
spamassassin -D --lint not showing anything.
Also it will not autolearn spam unless the score is over a certain threshold for both header and message rules ( I think the default is 10).
then how to train them for so many spams and hams i have tried sa-learn --spam / --ham file but it learns one file only once not more then one.
Funny thing, though: I can't remember ever having a 'keeper' getting marked as spam (false positive).
If you (or anyone else) wants this simple little script, I'd be happy to send it to you, just let me know. It runs on the server side and has been updated to work with SA 3.0.2.
And that way you get the same effect as the 'junk' mechanism in Evolution, no matter what client you're using!
->-
Brian Fahrländer Christian, Conservative, and Technomad Evansville, IN http://www.fahrlander.net
Right now any help welcome to make it wrk.
On Fri, 2005-03-04 at 12:07 +0530, crisppy fernandes wrote:
If you (or anyone else) wants this simple little script, I'd be happy to send it to you, just let me know. It runs on the server side and has been updated to work with SA 3.0.2.
And that way you get the same effect as the 'junk' mechanism in Evolution, no matter what client you're using!
Right now any help welcome to make it wrk.
Ok, two things: I installed from RPMS originally, and somehow it didn't make me aware it required a couple of perl modules. Keep an eye on /var/log/maillog because that's where I noticed it wasn't running baysean tests because the modules weren't loaded.
The other is this script.
------------------------------------------------------------------------- # Program to search and learn from Black/Whitelist folders for i in `ls -d /home/*`; do #echo "Processing " $i; if ([ -f `echo $i'/mail/Blacklist'` ]) then USERNAME=`basename $i` MAILBOX=`echo $i'/mail/'`
#echo $USERNAME ": " $MAILBOX if ( [ -s ${MAILBOX}Blacklist ] ) then sudo -H -u $USERNAME sa-learn --spam --no-sync --mbox $MAILBOX/Blacklist 2>&1 >> /var/log/learnspam && cp /dev/null $MAILBOX/Blacklist sudo -H -u $USERNAME sa-learn --ham --no-sync --mbox $MAILBOX/Whitelist 2>&1 >> /var/log/learnspam && cp /dev/null $MAILBOX/Whitelist fi fi done
# Once they're all loaded, rebuild en-masse: sa-learn --sync -------------------------------------------------------------------------
Every hour or so this script is called to go looking for users that have "Blacklist" and/or "Whitelist" folders, and if there's anything there, it processes it. One process for spam, one for ham. Note that it's looking for "Blacklist" and not "bLackList" or somesuch; the folder name has to be right.
If this still doesn't have you running happily, send me a copy of your /var/log/maillog off-list and I'll take a peek at it for you.
Enjoy!
* crisppy fernandes crisppyf@gmail.com [03-03-2005 14:47]:
I have a problem related to spamassassin-3.0.2 which i have packged for my use. I have installed all rpms of spam-3.0.2 on my FC2 box. and then i have
Wondering why you installed the rpms manually instead of using yum to install. On FC3, SA is 3.0.1 so it's not quite up to date, but it's sufficient. Not quite sure what's available on FC2.
[...]
In my case spamassassin-3.0.2 is catching sample-spam mail but not able to catch any other spam mail. entries in my local.cf are:
rewrite_header Subject *****SPAM***** report_safe 1
You should also have: required_hits 5
spamassassin -D < /path/to/file
this does not seem to be wrking. as giving nothing as output.
Try running: spamassassin -D --lint Tell me if you get any output.