Re: Bayes: What am I missing

[comparity]

Luis Hernán Otegui wrote: 2008/2/17, comparity <[EMAIL PROTECTED]>: I have found that in the last few months a lot of mail has been coming through. I believe that the bayes filter isn't working. None of the caught messages include a bayes score. I have dutifully put all of my uncaught spam into a folder for the purposes of learning, and run sa-learn from time to time. Below is some information which may be relevant: I am running spamassassin through procmail SpamAssassin version 3.2.4 spamassassin -D bayes< ... indicates a bayes score local.cf: use_bayes 1 bayes_auto_learn 1 # From http://wiki.apache.org/spamassassin/SiteWideBayesSetup bayes_path /etc/mail/spamassassin/bayes bayes_file_mode 0770 sa-learn --dump magic 0.000 0 3 0 non-token data: bayes db version 0.000 0 14225 0 non-token data: nspam 0.000 0 9037 0 non-token data: nham 0.000 0 168352 0 non-token data: ntokens 0.000 0 1161931609 0 non-token data: oldest atime 0.000 0 1203213840 0 non-token data: newest atime 0.000 0 1203212640 0 non-token data: last journal sync atime 0.000 0 1203212721 0 non-token data: last expiry atime 0.000 0 11059200 0 non-token data: last expire atime delta 0.000 0 77173 0 non-token data: last expire reduction count I have recently (a few months ago ...) cleared out the contents of the uncaught spam folders, reasoning that sa should have learned what it needs already. However, these folders now have hundreds of new spam to learn from. Any ideas? Mark Well, what makes you think that Bayes is missing anything? SA needs to be updated to work properly. I keep all of the capture spam in a folder for examination. Even the worst of the spam gives the following analysis: Content analysis details: (17.0 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.0 EXTRA_MPART_TYPE Header has extraneous Content-type:...type= entry 3.3 TVD_RCVD_IP4 TVD_RCVD_IP4 1.6 TVD_RCVD_IP TVD_RCVD_IP 2.6 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO 0.0 T_TVD_FW_GRAPHIC_ID1 BODY: T_TVD_FW_GRAPHIC_ID1 0.0 HTML_MESSAGE BODY: HTML included in message 1.5 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see <http://www.spamcop.net/bl.shtml?59.92.110.10>] 0.5 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL [59.92.110.10 listed in zen.spamhaus.org] 2.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL 1.2 PART_CID_STOCK Has a spammy image attachment (by Content-ID) 0.0 PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific) 0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS 0.0 STOCK_IMG_HTML Stock spam image part, with distinctive HTML 0.0 STOCK_IMG_HDR_FROM Stock spam image part, with distinctive From line with no mention of bayes. Do you use sa-update? No I don't. However, I have just run it. restarted spamassassin (service spamassassin restart), and I'll see what happens. How about sharing an uncaught message with the list? Then we could have a better idea of what is failing. How about this one: * Pharmacy Meds For You * XamaxCailisValiumVaigra Men's Health Sexual Health Fast Acting S0FTtabs Pain Relief Anti Anxiety WeightL0SS Sleeping Aid Muscle Relaxants Anti Depressants Cholesterol Diabetes Quit Smoking Allergy Relief Heartburn Relief Greatest discount on net, only from us http://falevohe10084.googlepages.com/index.html Regards, Luis Thanks, Mark -- Mark Simon Comparity Net Computer Training & Support Phone/Fax: 1300 726 000 mobile: 0411 246 672 email: [EMAIL PROTECTED] web: http://www.comparity.net Resume: http://mark.manngo.net Calendar: http://www.comparity.net/calendar.php