We get a small percentage of SPAM being tagged by SA as well due to most of it being caught by the rblsmtpd option in tcpserver.
What does your qmail config file look like? I say not to look at just your spamd logs but also your smtp(d) logs. You might see more of what's being tagged/blocked there. Thomas J. Raef e-Based Security, LLC www.ebasedsecurity.com 1-866-838-6108 "You're either hardened, or you're hacked!" > -----Original Message----- > From: Tarak Ranjan [mailto:[EMAIL PROTECTED] > Sent: Tuesday, September 25, 2007 4:43 AM > To: Spamassassin > Subject: SPAM FILTERING RATE > > hi, > as i have installed qmrtg . so it's giving me the details of > everything QUEUE, SMTP, POP3, SPAM.... > here i'm getting the the graph that out of 100, 57.8% is spam and > only 8.6% is cleaned by SPAMASSASSIN. > can anyone assist me to increase the effectiveness on > SPAMASSASSIN in my Qmail server. > here is my local.cf > required_hits 4 > report_safe 0 > rewrite_header Subject [***SPAM***] > skip_rbl_checks 0 > use_razor2 1 > use_dcc 1 > use_pyzor 1 > use_bayes 1 > bayes_auto_learn 1 > body NO_VIAGRA /viagra/i > score NO_VIAGRA 10 > > rawbody BECAUSE_OPTIN /saveup to/i > score BECAUSE_OPTIN 5.0 > > rawbody BECAUSE_OPTIN /Low Price Guarantee/i > score BECAUSE_OPTIN 10 > > rawbody DEALSMINUTE /dealsbytheminute/i > score DEALSMINUTE 10 > > score SUBJ_FREE_CAP 4 > > > log for spamd: > Sep 25 14:59:03 mail spamd[4892]: spamd: connection from > localhost.localdomain [127.0.0.1] at port 36274 > Sep 25 14:59:03 mail spamd[4892]: spamd: checking message > <[EMAIL PROTECTED]> for qscand:513 > Sep 25 14:59:04 mail spamd[4892]: spamd: clean message (-2.6/4.0) for > qscand:513 in 1.3 seconds, 17439 bytes. > Sep 25 14:59:04 mail spamd[4892]: spamd: result: . -2 - > BAYES_00,HTML_MESSAGE,RCVD_IN_IADB_LISTED,RCVD_IN_IADB_OPTIN,RCVD_IN_IAD B_ > RDNS,RCVD_IN_IADB_SPF,URI_REDIRECTOR > scantime=1.3,size=17439,user=qscand,uid=513,required_score=4.0,rhost=loc al > host.localdomain,raddr=127.0.0.1,rport=36274,mid=<1101822893466.11014602 51 > [EMAIL PROTECTED]>,bayes=1.11022302462516e-16,autolearn=ham > > Sep 25 14:59:04 mail spamd[29446]: prefork: child states: II > Sep 25 14:59:06 mail spamd[4892]: spamd: connection from > localhost.localdomain [127.0.0.1] at port 36275 > Sep 25 14:59:06 mail spamd[4892]: spamd: checking message > <[EMAIL PROTECTED]> for qscand:513 > Sep 25 14:59:09 mail spamd[4892]: spamd: clean message (3.1/4.0) for > qscand:513 in 2.4 seconds, 1441 bytes. > Sep 25 14:59:09 mail spamd[4892]: spamd: result: . 3 - > BAYES_50,DATE_IN_PAST_12_24,TVD_STOCK1 > scantime=2.4,size=1441,user=qscand,uid=513,required_score=4.0,rhost=loca lh > ost.localdomain,raddr=127.0.0.1,rport=36275,mid=<001001c7fea7$66cc5850$0 b5 > [EMAIL PROTECTED]>,bayes=0.499983898885655,autolearn=no > > Sep 25 14:59:09 mail spamd[29446]: prefork: child states: II > Sep 25 14:59:34 mail spamd[4892]: spamd: connection from > localhost.localdomain [127.0.0.1] at port 36279 > Sep 25 14:59:34 mail spamd[4892]: spamd: checking message > <[EMAIL PROTECTED]> for qscand:513 > Sep 25 14:59:38 mail spamd[4892]: spamd: identified spam (21.3/4.0) for > qscand:513 in 4.4 seconds, 829 bytes. > Sep 25 14:59:38 mail spamd[4892]: spamd: result: Y 21 - > BAYES_99,URIBL_AB_SURBL,URIBL_BLACK,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_ SB > L,URIBL_SC_SURBL,URIBL_WS_SURBL > scantime=4.4,size=829,user=qscand,uid=513,required_score=4.0,rhost=local ho > st.localdomain,raddr=127.0.0.1,rport=36279,mid=<388127736388.18806771891 3@ > autoshopholland.nl>,bayes=0.999826777960067,autolearn=no > > Sep 25 14:59:38 mail spamd[29446]: prefork: child states: II > > > -- > > > Thanks & Regards, > Tarak > ______________ > Tarak Ranjan Mukherjee > > > www.liqwidkrystal.com > > "It is possible to fail in many ways... > while to succeed is possible only in one way."
