Training: importing mbox files of spam?

[Baylink]

I have, on my old mail server from which I'm transitioning, half a dozen *really* big (ca 25k messages each or more) mbox format files full of spam.

I know they're spam because, while the usernames are valid on that box, the *mailbox names* were not; there are only 3 valid addresses on the domain and one of them is 'postmaster'. :-)

So, is there any easy way I can feed those raw mbox files into something that will allow Zimbra to train its underlying spam detection mechanisms on them, secure in the knowledge that there is no ham in the bunch?

(Just so I'm clear, the only practical way I see to do this is from the Linux command line on the Z server itself; anything requiring individual handling of the messages is a non-starter due to volume.)

[uxbod]

Well you could try something like

su - zimbra
sa-learn --spam --mbox -C <path_to_zimbra_sa_prefs> -f <path_to_your_mbox_files>

Never tried this so thinking out loud. Definitely take a backup first!

Hmmm, another alternative would be to use migrating from mbox :: Wiki into a dummy account, and ZCS will process these via its current bayes. Any that do get missed will be in the Inbox of that dummy account so you can then just highlight them and mark as Junk.

[Baylink]

Ok, I'll take a look at that.

In related news, I do have 2 mailboxes from that domain, also as mbox, that are live mail, left over from the old MX feed. Can I use the same commandline to pull them in and get them delivered, in light of the fact that they've already *been* through a destination MTA once?

Or will it get confused?

[uxbod]

Well it seems to strip the headers so should be okay. What I would suggest is creating a replica mbox directory, move a couple of messages in, and the try the script.

[Baylink]

So, you're saying, cut out half a dozen messages, and feed them to it, first?

Yeah, that was my plan.

[uxbod]

Indeed, far better that processing 1000's and find it does not work

[Baylink]

Oh, sure; I was just looking for an opinion that you thought it was a suitable approach.

On looking back, though, I suspect "sa-learn" is not actually the right approach for injecting real ham mail into mailboxes; is it?

[uxbod]

sa-learn cannot inject the email into a mailbox, it is purely for learning either ham/spam from the command line.

[Baylink]

So the proper approach there is just to find a SMTP sender that will read an mbox file and spray it in?