If you are only correctly classifying 50% of the spam (you said 100 caught
to 100 missed, I htink) then you have SERIOUS problems of some sort. As a
happy 2.63 user that upgraded to 3.04, it too a little minor fiddling, but
by and large things are *much* better now, and they were good before.
I used to have a 4.6 threshhold on 2.6x, but 5.0 is working fine on 3.04.
We did take bayes_99 up to somewhere around 5, and I would probably put it
at at least 4 - 4.5.
However, that can't be anywhere near your whole problem. But you didn't
show a complete list of hits for an FN, so we can only guess. My first
guesses are going to be that you don't have trusted networks set correctly
and so are getting ALL_TRUSTED firing when it shouldn't, or that you aren't
running network tests at all. Or worse, you are configured for network
tests but have a problem that is keeping them from working.
The particular spam you mention is one of the lower-scoring forms currently.
If you don't have net tests, and aren't running some of the SARE rulesets,
then you might be getting a few of these slipping through. Net tests should
be catching the vast majority though.
Also, you mentioned training with 'old spam' and 'new ham'. Presumably you
were talking about bayes training. Really training with new spam,
especially the stuff slipping through, would be the right thing to do. Spam
has changed considerably in character in just the last 6 months.
Suggestion: let us see the full list of SA hits on some of the stuff
slipping through.
Loren
