-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Bernd,
Saturday, September 13, 2003, 5:34:11 PM, you wrote: BK> since I am not the only having this problem according to some other BK> newsgroup I would like to ask why the Bayes filter does not help. I'm not one of the most technically advanced SA-heavies on the list, but since nobody else has answered yet, I'll do my best. BK> Ok, the long story: Since yesterday I am bombarded with spam. Those BK> mails look like bounces of mails I sent, but I didnīt. In other words, they LOOK as if they're proper emails, being sent to you by other systems because of some intelligible reason? BK> As To: adress is some random name + my domain name. The mails get BK> caught by my catchall function which I changed some minutes ago BK> hoping this will direct those spam in the right box. Good. These are completely random names, emails which are not published on any web site, and have not been used to post to Usenet or such? My experience then may be slightly different -- the hundreds of emails I've received have all been to published email addresses, those we post on our web site so customers and vendors can reach us for specific purposes (eg: [EMAIL PROTECTED]). We never send out email from these addresses, so we know the bounces are bogus. BK> My real question is, I tried to put all of those mails, which seam to BK> have the same attachment (containing some HTML code and an URL which BK> shows the v***** ad), into the bayes_db with sa-learn, but this seams BK> not to work. BK> I issued the sa-learn command which I used frequently in 2.55 on a BK> spam-filled mbox-file but as a result I get this: BK> Learned from 0 message(s) (0 message(s) examined). That would imply to me that these messages all have the same message id. Can you confirm whether that's the case? BK> Debug shows no error messages. My setup is Linux with Perl 5.8.0. BK> The command I used is: sa-learn --spam --showdots -D --mbox ./Spam Have you tried it without the -D and/or without the --showdots? I think I read on the list some time back that the -D option caused problems with some sa-learn executions. And for under 100 messages, --showdots is unimportant. BK> I am sure that the mbox is valid, for test purposes I created a new BK> mbox with mailutil from the uw-imap2002e package and got the same BK> result. Should be OK. I do the same with an export from my email client. BK> The bayes_db itself is approx. 5MB in size: BK> -rw------- 1 exim exim 630784 Sep 14 02:16 bayes_seen BK> -rw------- 1 exim exim 5287936 Sep 14 02:16 bayes_toks That's about the same size as one of my databases, so that should be OK too. Do you run your sa-learn as user exim? That's the only userid that has read/update access to the database. BK> I read that there are standard values limiting the size so I put BK> bayes_expiry_min_db_size 1000000 BK> bayes_expiry_scan_count 50000 BK> into user_prefs but it seems not to help. Deleting the old bayes_db BK> and the creation of a new one through sa-learn makes also no BK> difference. I wouldn't think so. I have never bothered with these on my system. BK> What can I do to bring those mails into the bayes_db? Check http://www.exit0.us/index.php/VirusBounceRules for some ideas. On my system I've created rules that specifically test for email addresses from which we do not send out emails, and I include that in meta rules which identify these types of problem emails. Also, since BK> ... all of those mails, which seam to have the same attachment BK> (containing some HTML code and an URL which shows the v***** ad), ... is that URL consistent? If so, you should be able to trap them using an intelligent URI rule. See http://www.exit0.us/index.php/SaUriCustomRules for some ideas. Bob Menschel -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBP2PuBZebK8E4qh1HEQI6fACfTVg0ZBFh0fgR+tqvr5TAZNAc3c4AoJkT ISZ2AasRHct6hoLhy4DpvFUG =ytTj -----END PGP SIGNATURE----- ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
