On Sat, 2006-01-14 at 18:17 -0500, Eben King wrote:
> On Sat, 14 Jan 2006, Mike Branda wrote:
>
> > On Sat, 2006-01-14 at 12:01 -0500, Eben King wrote:
> >
> > > > [eben@pc eben]$ sa-learn --ham --mbox mbox
> > > > Learned from 37 message(s) (63 message(s) examined).
> > > > [eben@pc eben]$ sa-learn --ham --mbox mail/linux
> > > > Learned from 537 message(s) (695 message(s) examined).
> > > > [eben@pc eben]$ sa-learn --ham --mbox mail/{bugtraq,sent-mail,sent-mail-nov-2005}
> > > > Learned from 421 message(s) (423 message(s) examined).
> > > >
> > > > Cool, I'll see how it acts now.
> > >
> > > OK, did that over 4 weeks ago (the middle of December). It's not better; in
> > > fact it's worse -- 4-week rolling average at 28% of spam caught, 1-week at
> > > 18%. Still no false positives, which I guess is a Good Thing. How do I see
> > > what SA thinks is going on? It doesn't appear to be learning (and I've been
> > > running every spam through "sa-learn --spam" and every non-spam through
> > > "sa-learn --ham"), as I plotted cumulative non-spam received (after manually
> > > removing the spam and rubbing SA's nose in them), and its R^2 on a linear
> > > best-fit line is 0.9864.
> >
> > Can you post your local.cf and your user_prefs from the etc spamassassin
> > dir? (In SuSE /etc/mail/spamassassin)
>
> Stock; I haven't modified it. (Maybe that's the problem?)
>
> # This is the right place to customize your installation of SpamAssassin.
> #
> # See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
> # tweaked.
> #
> ###########################################################################
> #
> # rewrite_header Subject *****SPAM*****
> # report_safe 1
> # trusted_networks 212.17.35.
> # lock_method flock
>
> > Did you run spamassassin -D --lint?
>
> Lots of output.
>
> > There should be some sections referring to bayes (debug: bayes:)
>
> debug: bayes: 24691 tie-ing to DB file R/O /home/eben/.spamassassin/bayes_toks
> debug: bayes: 24691 tie-ing to DB file R/O /home/eben/.spamassassin/bayes_seen
> debug: bayes: found bayes db version 3
> debug: bayes corpus size: nspam = 787, nham = 7777
> debug: bayes token 'H*Ad:D*org' => 0.0110971454944889
> debug: bayes token 'somewhat' => 0.0835362783803756
> debug: bayes: score = 0.358256516621614
> debug: bayes: 24691 untie-ing
> debug: bayes: 24691 untie-ing db_toks
> debug: bayes: 24691 untie-ing db_seen
>
Two things I did....
set in local.cf: (which was there in that file but commented out)
use_bayes 1
although the docs say it's in/on by default.
and in user_prefs (home or etc):
# How many hits before a mail is considered spam. Default is 5.
required_hits 3
which is depreciated in newer versions of SA but still works. The
replacement parameter is required_score. I bumped that down which
helped too. 5 was too high. Hopefully you are just dropping maybe-spam
to a different box and not dev/nulling it right? If not, you might want
to until you get this straight. Look at the full headers of mail in
your Inbox and see what SA inserts after the X-Spam-Status. You might
see what it put there on both spam that got through and on legitimate
mail. There should be something about the required hits and bayes
including what rules it hit on.
Obviously it looks in some order at local.cf, user_prefs (etc dir) and
user_prefs (user dir). Logically I would think the user dir prefs file
is the final authority but I didn't research that.
I'm using version:
perl-spamassassin-3.0.4-4.2.
The only other question is how are you calling SA? Procmail? Daemon?
Some special feature of pine or mutt?
Mike Branda Jr.
-----------------------------------------------------------------------
This list is provided as an unmoderated internet service by Networked
Knowledge Systems (NKS). Views and opinions expressed in messages
posted are those of the author and do not necessarily reflect the
official policy or position of NKS or any of its employees.
This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 16:30:04 EDT