This is my approach, stored in /etc/cron.hourly. It's very new, so I'm still testing it.
The goal is to learn HAM massages only if they are a day old, so that I can manually remove SPAM that slipped through. Mails tagged from Spamassassin are sorted automatically into the "Junk.Spam" mailbox and learned after 12 hours. I manually move any missed SPAM into the .Junk mailbox, so I'm sure there are no wrongly tagged messages there, so I can learn those messages as soon as they are found by cron. /etc/cron.hourly/sa-learn: #!/bin/sh umask 022 # Learn HAM messages which were roughly received between 24 and 25 hours ago find \ /var/vmail/fkware.de/frank.kintrup/Maildir/ \ -path '/var/vmail/fkware.de/frank.kintrup/Maildir/.Junk*' -prune -o \ -path '/var/vmail/fkware.de/frank.kintrup/Maildir/.Sent' -prune -o \ -path '/var/vmail/fkware.de/frank.kintrup/Maildir/.Trash' -prune -o \ -path '/var/vmail/fkware.de/frank.kintrup/Maildir/.Draft' -prune -o \ -iname '*server.fkware.de*' -type f -mmin +1435 -mmin -1505 \ -execdir sa-learn --username=vmail --no-sync --ham {} \; \ /dev/nul 2>/dev/nul # Learn and delete SPAM messages which were manually moved to the Junk folder find \ /var/vmail/fkware.de/frank.kintrup/Maildir/.Junk/ \ -iname '*server.fkware.de*' -type f \ -execdir sa-learn --username=vmail --no-sync --spam {} \; \ -execdir rm {} \; \ >/dev/nul 2>/dev/nul # Learn and delete SPAM messages which were received more than 12 hours ago # and automatically put into the Junk.Spam folder find \ /var/vmail/fkware.de/frank.kintrup/Maildir/.Junk.Spam/ \ -iname '*server.fkware.de*' -type f -mmin +720 \ -execdir sa-learn --username=vmail --no-sync --spam {} \; \ -execdir rm {} \; \ >/dev/nul 2>/dev/nul sa-learn --username=vmail --sync >/dev/nul exit 0