On Mon, 1 Jun 2009, John Hardin wrote:
And I assume you look at the sapm-uncaught file before learning it?
Yes. The messages in there are those I deliberately move there after
they've ended up in my inbox because neither the postfix filters nor the
spamassassin rules caught them.
If some log files got in there and were learned, that could explain the
deterioration.
That seems very reasonable, but I would have had to move them there myself
and I cannot recall doing so. Also, before running sa-learn to classify them
as spam I look over the list. So, it's quite possible that they ended up
classified as spam unintentionally.
Have you kept your spam and ham corpa?
I'm not sure. The spam comes from the spam-uncaught file which is cleared
each time it's run. The ham comes from various mail lists and they grow over
time.
Okay, let's key on that one.
## Call SpamAssassin
: 0fw: spamassassin.lock
* < 256000
| spamassassin
:0 fw: spamassassin.lock
* < 256000
* ! ^TO_abuse@
* ! ^List-Id: .*<?use...@.]spamassassin\.apache\.org>?
* ! ^Received: from salmo\.appl-ecosys\.com \(localhost\.localdomain
\[127\.0\.0\.1\]) by salmo\.appl-ecosys\.com
| /usr/bin/spamc
Using spamc creates less load than launching spamassassin from scratch for
every email, but you do have to manage the daemon (i.e. restart it if the
rules change).
I run spamd:
2978 ? Ss 12:16 /usr/bin/spamd -d --pidfile=/var/run/spamd.pid
3052 ? S 0:04 spamd child
3054 ? S 0:05 spamd child
is this not adequate for a light load?
Are your resources really so limited that you want to serialize all email
delivery? As a middle ground you might consider per-user lockfiles instead,
e.g.:
:0 fw: $HOME/.spamassassin.lock
I'd also suggest upping the size limit a bit, but that's not a big issue.
There are more complex things you can do; you might want to take a look at
http://www.impsec.org/~jhardin/antispam/spamassassin.procmail
There are only two users on this network and a low mail volume for each of
us.
The size limit has been at that value for years without a problem. I'll
keep teaching SA that the log reports are ham and see if that makes a
difference. As I wrote earlier, this is all within the past quarter year,
and it's been a PITA since it's taken time and attention away from my
business.
Thanks,
Rich
