On Mon, 1 Jun 2009, John Hardin wrote:
If these are system-generated messages, something is improperly training
SA that they are spam. Do you use autolearn?
John,
No. Once a week or so I run sa-learn specifying spam on the spam-uncaught
mbox file. Less frequently I run it on mail list files specifying them as
ham.
Primarily I'd suggest you exclude locally-generated emails from SA
completely. If you'd post the Received: headers from such a message and
the procmail stanza where you pass messages to SA for scoring I could
suggest something.
Here are all headers from the mail log summary:
From r...@salmo.appl-ecosys.com Mon Jun 1 11:25:44 2009
Return-Path: <r...@salmo.appl-ecosys.com>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5-ph20040310.0 (2008-06-10) on
salmo.appl-ecosys.com
X-Spam-Level: ****
X-Spam-Status: Yes, score=4.9 required=4.0 tests=ALL_TRUSTED,AWL,BAYES_99,
EMPTY_BODY,NORMAL_HTTP_TO_IP,NUMERIC_HTTP_ADDR,URI_HEX,URI_NOVOWEL
autolearn=no version=3.2.5-ph20040310.0
X-Spam-Report:
* -1.3 ALL_TRUSTED Passed through trusted hosts only via SMTP
* 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 2.5 EMPTY_BODY BODY: Message has subject but no body
* 0.0 NORMAL_HTTP_TO_IP URI: Uses a dotted-decimal IP address in URL
* 0.4 URI_HEX URI: URI hostname has long hexadecimal sequence
* 0.0 NUMERIC_HTTP_ADDR URI: Uses a numeric IP address in URL
* 1.6 URI_NOVOWEL URI: URI hostname has long non-vowel sequence
* -1.8 AWL AWL: From: address is in the auto white-list
X-Original-To: rshep...@appl-ecosys.com
Delivered-To: rshep...@appl-ecosys.com
Received: from salmo.appl-ecosys.com (localhost.localdomain [127.0.0.1])
by salmo.appl-ecosys.com (Postfix) with ESMTP id 8DA0F1026
for <rshep...@appl-ecosys.com>; Mon, 1 Jun 2009 11:25:44 -0700 (PDT)
Received: (from r...@localhost)
by salmo.appl-ecosys.com (8.14.3/8.14.2/Submit) id n51IPibx030133;
Mon, 1 Jun 2009 11:25:44 -0700
Date: Mon, 1 Jun 2009 11:25:44 -0700
From: r...@salmo.appl-ecosys.com
Message-Id: <200906011825.n51ipibx030...@salmo.appl-ecosys.com>
To: rshep...@appl-ecosys.com
Subject: *****SPAM***** salmo Daily Mail Report for Monday, 01 June 2009
X-Spam-Prev-Subject: salmo Daily Mail Report for Monday, 01 June 2009
Report based on information in /var/log/maillog
And this is from ~/procmail/recipes.rc:
## Call SpamAssassin
:0fw: spamassassin.lock
* < 256000
| spamassassin
Thanks,
Rich
