Michael Beckmann wrote:
Greetings!
In the past few weeks, I have noticed significant amounts of spam
passing through my filter. It is reaching a level that annoys me. I use
Spamassassin 3.1.7.
I used to get maybe one or two spam messages a day earlier this year
with 200+ spams filtered. Now I get 10 to 20 spams per day that are not
automatically filtered (while something like 300+ are filtered.) Did
anybody else notice this? Are spammers becoming more effective in
working around SpamAssassin?
I examined the spam, and it seems that the majority of the messages
score BAYES_99 and nothing or hardly anything else. BAYES_99 is not
enough to filter the messages. I use the standard threshold of 5.
I have been tempted to increase the BAYES_99 score to 5. I have seen
that only very few ham messages of the newsletter type ever score
BAYES_99 in my inbox.
Do others make similar observations? How do you deal with this?
It all depends on YOUR setup, but i'll be the first to say that after
months of observations at my facility here (a hospital) i have increased
my BAYES_99 to 5.2 running with a 5.0 threshold. This is obviously
risky but we have had great results with no reported (i cant check
*every* piece of mail myself) false positives.
Others may suggest you lower your threshold but I feel this is the wrong
way to deal with this type of situation. Generally, you want to
increase the gap between spam scores and ham scores, not lower the
threshold. The way to do this is add on rules, network tests, bayes,
etc. If you are already using all of these and still have poor
accuracy, i'd say go for it (WRT jacking the BAYES_99 score) and monitor
the results.
-Jim
