>Is your server up 24/7?
yes
>Is the zmtrainsa script being run overnight?
I don't know, how can see this?
>What happens if you move that message to the junk folder and run zmtrainsa manually?
$ zmtrainsa
[] INFO: Total messages processed: 14
[] INFO: Total messages processed: 0
config: could not find site rules directory
Learned from 14 message(s) (14 message(s) examined).
config: could not find site rules directory
archive-iterator: readdir found no mail in '/tmp/ham.15307' directory
Learned from 0 message(s) (0 message(s) examined).
config: could not find site rules directory
bayes: synced databases from journal in 0 seconds: 1907 unique entries (2412 total entries)
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
command: '/opt/zimbra/dspam-3.6.2/bin/dspam' --class=spam --source=corpus --user 'zimbra' --mode=teft --feature=chained,noise
/opt/zimbra/dspam/bin/dspam_corpus: 1 messages, 00:00:01 elapsed, 1.00 msgs./sec.
>Have you updated your rules tests recently?
no  |