Steven Dickenson wrote on Friday, June 10, 2005:
>James Bucanek wrote:
>> Greetings, As you can see, the Bayes filter has nailed it as spam,
>> but it still only gets a score of 3.6.
>
>Bayes scores are really quite low in SA v3 - 3.0.2. You may want to
>upgrade to 3.0.3 to get the newer Bayes scores, or revert to the v2.6x
>scores in your local.cf. We've done the later here with no ill effect,
>by putting the following block in our local.cf.
>
>score BAYES_00 0 0 -1.665 -2.599
>score BAYES_05 0 0 -0.925 -0.413
>score BAYES_20 0 0 -0.730 -1.951
>score BAYES_40 0 0 -0.276 -1.096
>score BAYES_50 0 0 1.567 0.001
>score BAYES_60 0 0 3.515 1.372
>score BAYES_80 0 0 3.608 2.087
>score BAYES_95 0 0 3.514 3.063
>score BAYES_99 0 0 4.070 4.886
Thanks Steven. It's the weekend, so it's time for me to get on the server and
start wrecking things.
I'm going to start by upping the Bayes scores as you have suggested. This has
alwasy been a consistent suggestion from others, and it's an easy first step.
>> I currently have my threshold set to 7.0. I've been considering
>> lowering it again (maybe to 5.0), but am paranoid about false
>> positives. I can go through my mailbox and see ham that has scores
>> of 3 or even 4.
>
>I only tag my personal/family accounts, so FP's, while annoying, are
>only a folder away (I tag at 4, everyone else at 5). However, I've only
>had 2 FP in the last year, and both were from mortgage companies when I
>was going through a refi. Would you mind posting some of your
>higher-scoring ham, with headers? It's possible you have a
>misconfiguration in some of your settings.
It's possible. Here's an example. Note that I don't have too many ham
messages that get a score of more than 1 or even 2, but I'd still hate to lose
them. ;)
From [EMAIL PROTECTED] Sun Jun 5 17:24:23 2005
Return-Path: <[EMAIL PROTECTED]>
Received: from murder ([unix socket])
by twilightandbarking.com (Cyrus v2.2.12-OS X 10.3) with LMTPA;
Sun, 05 Jun 2005 10:24:23 -0700
X-Sieve: CMU Sieve 2.2
Received: by mail.twilightandbarking.com (Postfix, from userid -2)
id 1150C27DC807; Sun, 5 Jun 2005 10:24:23 -0700 (MST)
Received: from phxamgw02.aexp.com (phxamgw02.aexp.com [193.32.34.74])
by mail.twilightandbarking.com (Postfix) with ESMTP id 59B5627DC805
for <[EMAIL PROTECTED]>; Sun, 5 Jun 2005 10:24:22 -0700 (MST)
Received: by phxamgw02.aexp.com; id KAA18183; Sun, 5 Jun 2005 10:23:46 -0700
(MST)
Date: Sun, 5 Jun 2005 10:23:46 -0700 (MST)
Message-Id: <[EMAIL PROTECTED]>
Received: from unknown(148.173.240.35) by phxamgw02.aexp.com via smap (V5.5)
id xmapb7017; Sun, 5 Jun 05 09:42:53 -0700
To: [EMAIL PROTECTED]
Reply-To: "\"American Express\"<American Express" <[EMAIL PROTECTED]>
From: "American Express" <[EMAIL PROTECTED]>
Mime-Version: 1.0
Subject: Alert: Payment Reminder
Message-Source: ENG-ALERTS
Content-Type:
multipart/alternative;boundary="0__=85256B8B0056C1C08f9e8a93df938690918c85256B8B0056C1C0"
X-Spam-Level: ***
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on
twilightandbarking.com
X-Spam-Status: No, score=3.1 required=7.0 tests=BAYES_99,HTML_90_100,
HTML_FONT_BIG,HTML_FONT_TINY,HTML_MESSAGE,MSGID_FROM_MTA_HEADER
autolearn=no version=3.0.2
As you can see, this one got pegged as SPAM by Bayes. Which is what makes me
nervous about raising the Bayes scores. I'll run these all through my
learn-ham script and see if the scores don't improve (i.e. get lower).
>> I was previously using a client-side Bayes filtering system and was
>> getting 99.8+% spam identification rates. SA has been, so far, a bit
>> of a disappointment and I'm sure it's my fault. :)
>
>My home account probably gets a 5 9's identification rate, with a near
>zero FP rate. SARE rulesets, network tests, and a well trained Bayes
>database make a huge difference in the performance of SA. Make sure
>your trusted_networks are set correct and enable network tests, URIBL
>tests, and Razor/Pyzor. Check out the CustomRuleset section of the wiki
>for info on SARE and other rulesets.
I'm still so confused about how to set up Razor, that I haven't even looked at
it since I downloaded and compiled it. Maybe I'll take a stab at Razor again
next weekend.
--
James Bucanek <mailto:[EMAIL PROTECTED]>
