From: Spam Admin [mailto:[EMAIL PROTECTED]
>
> Last week I upgraded our system from SA v2.63 to v3.1; I am
> pleased at how well the process went. However, I immediately
> began to see a lot of false positives. Primarily, it seems
> that v3.1 has increased the BAYES_00 from -4 to -2.599, and
> there are a lot of additional checks. With v2.63 I had our
> kill_level set at 3.9; I found virtually zero false positives
> and low enough false negatives to where the user community
> rarely barked (in fact, it's been so successful that when a
> VP gets a *single* spam it's like the world has come to an
> end...this, in an environment where we get 14M total SMTP
> connections per year!) So, to temporarily resolve this, I
> bumped our kill_level to 5.9 and am monitoring it; my false
> positives have pretty much disappeared. Of course, I've seen
> a *slight* increase in fasle negatives versus 2.63, so I'll be tuning.
>
> What I'd like to know from the SA group is where did you
> eventually end up in terms of kill levels versus v2.63? Is a
> bump of two points about right? Did you end up removing or
> adding SMTP-level RBLs and/or RDJs during the transition? Any
> other changes I should consider? Our amount of spam has
> increased DRAMATICALLY over the last 2-3 weeks, plus the
> processing times within the box are going skyward (even on
> the secondary box still running v2.63), so any advice is
> sincerely appreciated.
I have been marking spam at the 5.0 level for our customers and at 4.0
on my personal account since SA 2.55. I have not had to make any
changes as I upgraded. If anything, spam scores are a bit higher now.
The first thing to check is if the network checks are working. Make
sure you have the latest version of Net::DNS, as the new versions of
SA require at least version 0.34.
Also, take a look at the v310.pre file and make sure the loadplugin
line for Razor is uncommented. (Also check the AWL, if you use it)
Run SA in debug mode and look for problems. This can be done through
amavisd (not sure of the syntax), or directly through SA as so:
spamassassin -t -D
Bowie
