John D. Hardin wrote:
>
> On Mon, 24 Sep 2007, feral wrote:
>
>> RE: training. I don't know. My experience w/ SA is that
>> it just works and I haven't dealt with it at this level yet.
>> What is strange is that SA appeared to be working fine
>> for my client, then all of the sudden this spike in spam
>> occurred... and as I said, 99% of the spams have the
>> sender name same as recipient name (see original post).
>>
>> Below is the result of sa-learn -D --dump magic. I see
>> that "bayes: no dbs present" ... that looks bad. Maybe
>> this SA was not installed properly. Thanks for your help.
>
>> [24475] dbg: bayes: no dbs present, cannot tie DB R/O:
>> /root/.spamassassin/bayes_toks
>> [24475] dbg: config: score set 1 chosen.
>> [24475] dbg: bayes: no dbs present, cannot tie DB R/O:
>> /root/.spamassassin/bayes_toks
>
> This doesn't look like global bayes, and I don't use per-user so my
> advice may be a little inaccurate...
>
> Is there a .spamassassin subdirectory in that user's home directory?
> Does it have bayes_* files?
>
> If so, log in as that user (e.g. "su - mark") and run "sa_learn --dump
> magic" and see what the ham/spam token balance looks like.
>
> You should try to find out how bayes is being trained. I still think
> your problem stems (at least partly) from badly mistrained bayes.
>
> As others have suggested, make sure you are *not* using
> "whitelist_from". That particular option is a last-resort fallback
> option because it's so easy to bypass through forgery. However, as the
> header samples you posted did not say a whitelist rule was hitting,
> and the scores were not large and negative, that's probably not a
> cause of this particular problem.
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
>
There is a .spamassassin subdirectory, but it doesn't have anything in it.
I suspect that SA was not installed properly on this server. I am using
a VPS with Plesk and per-user preferences is selected, so I should be
able to configure SA on a per-user basis. I'm going to bug my server
provider for help on this... it's their responsibility to properly install
SA.
Whatever the case, global bayes or not, or even bayes or not, how could
an email with the obvious porn words in the subject (as in my examples)
NOT get flagged?
thanks
JC
--
View this message in context:
http://www.nabble.com/sender-name-same-as-recipient-name-tf4511807.html#a12884935
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
