Karsten Bräckelmann wrote:
On Wed, 2009-05-20 at 09:42 +1200, Kate wrote:
I recently implemented a rule kindly provided by John Hardin -
MIME_IMAGE_ONLY
I watched it carefully and it only caught spam YAY
It is very unlikely to ever catch ham -- unless, maybe, you are using
fax by email systems or other similar auto-generated stuff. Probably
dead easy to exclude, though, if any
I had to up the score as they were all still getting through due to
bayes_00 (score -3)
That is a *custom* score. You should NOT arbitrarily adjust scores,
unless you know what you're doing, watch the impact closely and can
trust the rule.
Clearly, you can NOT trust your Bayes to that extent.
I don't generally adjust scores it was just in this case i had run
sa-learn on lots of these emails and the bayes wan't changing and I
really had to stop the spam coming through.
Having done that it is all now getting blocked which is great but my
question is should they system now be 'learning' these and thus changing
the bayes_00 to bayes_50 etc
If not, what is the best method to go about 'learning' these spam.
SA will not auto-learn them for various reasons. First of all, the
total score is not above your auto-learn spam threshold. Secondly,
header and body rules are unlikely to exceed a score of 3 each, which is
another constraint. And then there's you're -3.0 for Bayes, which will
result in the message NEVER being auto-learned as spam.
As Lu already said -- sa-learn is what you need.
You really need to manually learn them, to correct that bad Bayes
result. Probably you'd even need to forget previously learned spam like
these, whether automatically or manually trained
FWIW, these image-only spams are always triggering a high Bayes score
here. Yes, I do care about my Bayes. ;)
I will need to go and investigate more thoroughly how our system is
using the Bayes and what its thresholds are etc.
Is that all set in MailScanner.conf?
