Quoting Karsten Bräckelmann <guent...@rudersport.de>:
If I'm reading that correctly less then 50% of mail is actually
being filtered (seems like it should be higher then that). Those stats
Actually, the numbers you gave for the "last couple days" are even
lower. About one third, <15k out of 45k do have a BAYES_xx hit and thus
are scanned by SA.
I told you how to train your Bayes, if you're not satisfied with the
result. Whether you like it not, there really isn't an other way. FWIW,
blocking the obvious offenders early seems like a proper explanation for
Bayes not showing a lot of high hitters.
Yes you did and I'm going to set something up to make a copy of the
messages that trigger BAYES_20 through BAYES_80 into a separate
mailbox that I can then inspect periodically for a while (while still
letting the message be delivered to the user)
Anyway, considering the back and forth -- IMHO, you *first* should get a
clear picture how exactly your mail is being processed. I don't feel
like stabbing in the dark.
And I don't expect you to take a stab in the dark. The 45K messages
was the total processed inbound and outbound which I didn't think
about that outbound is not funneled through SA and so would not be
seen in BAYES. So I admit, it was a poor analysis on my part.
Maybe I'm worried about nothing but given some of the spam that I get
forwarded that gets through (some very obvious spam) and then to see
what rules it hits just makes me think that something isn't quite right.
Forwarded -- as in reports by your users, or forwarded from external MXs
to yours? In the latter case, the obvious thing to check is your
internal and trusted network settings.
Forwarded from internal users asking how it got through the spam
filters. I rarely get reports to our abuse/postmaster addresses (with
the exception of AOL users who mark messages as spam when they clearly
are not spam).
