Results 1 to 6 of 6

Thread: Spam at weekend

  1. #1
    padraig's Avatar
    padraig is offline Elite Member
    Join Date
    Jul 2006
    Location
    ireland
    Posts
    388
    Rep Power
    9

    Question Spam at weekend

    Our spam seems to really increase at weekend. Has anyone else noticed this & if so did u manage to reduce it.

  2. #2
    dwmtractor's Avatar
    dwmtractor is offline Moderator
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Default

    Quote Originally Posted by padraig View Post
    Our spam seems to really increase at weekend. Has anyone else noticed this & if so did u manage to reduce it.
    Maybe I don't understand your question. . .the increase in spams has mostly to do with the bad guys firing off their servers, doesn't it?

    If you mean that the spam getting through your filters increases in the weekend, we need to examine your filters and the headers of stuff that's getting thru to find out why. I have not observed that the Zimbra spam filters take the weekend off. . .

    I think you've been part of threads on this before, but at the risk of repeating the obvious, take a look at this wiki for a whole lot of pointers for tightening up your spam filtering.

    Dan

  3. #3
    padraig's Avatar
    padraig is offline Elite Member
    Join Date
    Jul 2006
    Location
    ireland
    Posts
    388
    Rep Power
    9

    Thumbs up Thanks Dan

    Thanks Dan,

    Yes i have adjusted my BAYES filters and our SPAM has really improved (i.e. 98/99% goes to junk folder) but some users have commented they noticed an increase in spam at weekend (in the INBOX).

    I guess your right the bad guys seem to fire off more SPAM at weekend but i wondered if anyone else notice this trend.

  4. #4
    dwmtractor's Avatar
    dwmtractor is offline Moderator
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Default

    Quote Originally Posted by padraig View Post
    I guess your right the bad guys seem to fire off more SPAM at weekend but i wondered if anyone else notice this trend.
    Take a look at the graphs for the spam your server DOES catch. During the week I seem to run about 2/3 good stuff to 1/3 junk; on the weekend it goes to close to 80% junk. I can't say why that's true--maybe the spammers have day jobs?

    Glad to know Bayes is catching so much, but remember that Bayes can only filter on what it has seen before (to a certain extent). Therefore a truly new pattern will always get at least one bite at the apple before your users can class it as spam and train the filter. That's why RBLs and some of the other rules in spamassassin are also critical.

    My rule of thumb whenever somebody reports a false positive to me, is to check out the headers and see if there's an obvious fix that, if in place, would have changed the scoring of that email. Many times there isn't, but sometimes there is. That's how I discovered the bonded sender program a few weeks ago.

    It's an arms race--no question about it!

    Happy hunting!

    Dan

  5. #5
    padraig's Avatar
    padraig is offline Elite Member
    Join Date
    Jul 2006
    Location
    ireland
    Posts
    388
    Rep Power
    9

    Lightbulb sa-update

    have you tried to enable sa updates using:
    /etc/cron.d/sa-update i'm not sure if this is compatible with zimbra
    but according to the docs it will help catch the latest spam see:
    RuleUpdates - Spamassassin Wiki

  6. #6
    dwmtractor's Avatar
    dwmtractor is offline Moderator
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Default

    I haven't. Since Zimbra installs Spamassassin in non-default directories I'm not entirely sure if it'd work. I've looked around the file structure a bit and I can't find where the various SpamAssassin binaries are installed; I don't believe the update and other sa files are even there (see this thread). It might require a fair amount of tweaking the Zimbra install to even get these SA utilities to work, and if it does, you'll have to manually re-configure them every time you install a Zimbra update.

    This thread shows an alternative method of getting the "rules du jour" updated on SpamAssassin. I haven't tried it myself and can't confirm that it does or doesn't work, but it'd be worth an experiment to see how it performs for you.

    Let us know what you find. Remember the proof of the pudding is (1) seeing your spam go down, and (2) seeing evidence in the headers of detected spam, that the filters you adjusted had something to do with (1).

    Cheers,

    Dan

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Spam/Ham training under Outlook/Thunderbird/etc.
    By chuckm in forum Administrators
    Replies: 23
    Last Post: 03-18-2009, 11:01 AM
  2. Trying to understand Zimbra's anti-spam system
    By TaskMaster in forum Users
    Replies: 11
    Last Post: 01-25-2008, 09:59 AM
  3. Spam being scored with BAYES_00
    By flyerguybham in forum Administrators
    Replies: 6
    Last Post: 04-24-2007, 12:07 PM
  4. Training spam and ham
    By Justin in forum Developers
    Replies: 2
    Last Post: 10-31-2006, 03:39 PM
  5. Spam questions 3.11
    By cdyer in forum Administrators
    Replies: 10
    Last Post: 05-22-2006, 10:14 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •