Default SA install is not always as leak proof as one might hope. I was getting several spam a day after upgrading to 2.60.
I then: Installed Razor2 and applied the patch for it -- comes with SA. Sorted out my spam corpus -- ham only in the ham file; spam only in the spam file; no list mail, though this last is not entirely uncontraversial. And manually trained Bayes. Note that I tried auto learning, but seemed to get even more spam, which I attributed to the score set used when Bayes autolearn is on, and network tests are also on -- which of 4 score sets SA uses depends on these two variables. Installed distributed checksum clearing house, DCC (used the dccproc flavor of DCC, though SA will also use the DCC daemon version, both of which come with the DCC distribution). Enable Pyzor -- similar to Razor2, by telling SA, through user_prefs, where to find it on my system. The most marked improvement came from simply turning off auto learning, and manually training Bayes. After that, 1 or 2 spam per day, which I happily fed to Bayes, and reported with razor-report. After adding the rest, well, I've received no spam in several days now -- the other day a couple "slipped" through, but then I realized it was because they came in just as I was uploading one of my procmail recipe files -- you can practically keep time based on the frequency of my spam reception -- all filtered though. Bryan Dragoncrest wrote: > > Hi there. Just wondering something. My little leak of spam is back > again (*sigh* filty spammers.) and I've noticed something I think may > help curtail that once again. In one of my spam messages I noticed > something that said "RCVD_IN_SORBS" and in another it said > "RCVD_IN_DSBL" complete with a score next to it. Obviously these are > points given because the originating mail servers are each listed on one > or several of the various spam blacklists. What I was wondering was if > there's a way to adjust the weight or point scores given to these so > that if any emails come up as orginating from a blacklisted mail server, > I want to automatically give it a score of, oh say 5 or so. In short, > if the server the email originated from is blacklisted, I just want to > toss it into spam. If it's ham, well, that's tough luck for the poor > guy who sent from a blacklisted server. :) > > This might seem harsh, but it's one idea I'm trying to try to plug this > leak again. Now if this is an ongoing issue with SA, has anyone else > found any ways to plug this small leak? It's becoming pesky and annoying. > > ------------------------------------------------------- > This SF.net email is sponsored by: IBM Linux Tutorials. > Become an expert in LINUX or just sharpen your skills. Sign up for IBM's > Free Linux Tutorials. Learn everything from the bash shell to sys admin. > Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click -- As a rule I sit quite still, but whenever I move I make a huge leap to the horror of all those to whom I am bound by the tender bonds of kinship and friendship. - (Soren Kierkegaard - Either/Or) http://www.wecs.com/content.htm This signature file is generated by Pick-a-Tag ! Written by Jeroen van Vaarsel http://www.google.com/search?hl=en&ie=ISO-8859-1&q=pick-a-tag ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
