Hi, > As Kai said, check your Bayes is actually working. I've been seeing dozens > of these daily for what seems like ages, and Bayes now has no trouble > nailing them although it understandably missed them when they first started > arriving.
If I try to learn the same message again, sa-learn says it's already learned, so I think it's okay, as RW also commented. However, searching through the quarantine to see how many with a similar pattern have been caught, I see there are a large number of emails with BAYES_00. Is this a sure sign of a problem with bayes? If so, can I pull the messages out, unlearn them, then re-learn them as spam instead? Here's what my bayes db looks like: 0.000 0 3 0 non-token data: bayes db version 0.000 0 1030165 0 non-token data: nspam 0.000 0 450175 0 non-token data: nham 0.000 0 1073825 0 non-token data: ntokens 0.000 0 1267658532 0 non-token data: oldest atime 0.000 0 1267843908 0 non-token data: newest atime 0.000 0 1267843863 0 non-token data: last journal sync atime 0.000 0 1267831433 0 non-token data: last expiry atime 0.000 0 172800 0 non-token data: last expire atime delta 0.000 0 348834 0 non-token data: last expire reduction count Henrik's comment about the bayes debugging was great, thanks. > The common factor I see with these is that they're from hotmail and contain > a common URI so I use a meta rule hitting on __FROM_HOTMAIL_COM and any > number of common URIs such as digg.com in your example (inc. digg, youtube, > google, blogspot, tripod, lycos etc). I'll have to do some more analysis of the messages in the quarantine before I'm ready to say that any mail from hotmail that contains a common URI like you've listed should be tagged. I think it would be helpful to find out what the score of the messages in the quarantine with a similar fingerprint have, and working from there. Thanks, Alex
