Help dealing with spam

[KevinH]

PNE good point. I missed that. The training should be automatic though.. we run zmsatrain each night to collect junk mail. If you've only got a few users and none are using the web client to mark mail as junk you might want run it manually on those who have lots of mail in the Junk folder.

[cutigersfan]

Nope, all users are using the web. You'll see several posts with me asking about Thunderbird, but that's just b/c I use multiple identities. Other users don't need that and I've educated them on the web ui and the junk button.

I'm running the debian beta build (couldn't get FC4 to run). What do I need to do get that extra spam checking enabled? I guess this could be a bug in the debian build as I don't "believe" I've messed with the spam algorithms.

I looked at /opt/zimbra/conf/spamassassin/local.cf and every command in there is commented out. Should I just uncomment the 'use_bayes' and 'bayes_auto_learn' lines?

Thanks,

[PNE]

No, zimbra spamassassin config file is /opt/zimbra/conf/salocal.cf.in.

[cutigersfan]

I tried adding the 'use_bayes' command to those files (seemed like the only thing missing) and restarted zimbra, but there didn't seem to be any effect. My salocal.cf.in file looks like:

header DSPAM_SPAM X-DSPAM-Result =~ /^Spam$/
describe DSPAM_SPAM DSPAM claims it is spam
score DSPAM_SPAM 0.5

header DSPAM_HAM X-DSPAM-Result =~ /^Innocent$/
describe DSPAM_HAM DSPAM claims it is ham
score DSPAM_HAM -0.1

%%uncomment VAR:zimbraMtaMyNetworks%%trusted_networks %%zimbraMtaMyNetworks%%

rewrite_header Subject *SPAM* _STARS(*)_
use_bayes 1
bayes_auto_learn 1
bayes_min_spam_num 60
bayes_min_ham_num 60
clear_headers
add_header spam Flag _YESNOCAPS_
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_
add_header all Level _STARS(*)_
add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) on _HOSTNAME_

A test message showed:

X-DSPAM-Result: Innocent
X-DSPAM-Processed: Thu May 11 12:47:10 2006
X-DSPAM-Confidence: 0.9992
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: 44636a8e179947068311703
X-DSPAM-Factors: 27,
X-Virus-Scanned: amavisd-new at 
X-Spam-Status: No, score=0.505 tagged_above=-10 required=4 autolearn=no
 tests=[AWL=-0.025, DSPAM_HAM=-0.1, HTML_MESSAGE=0.001,
 HTML_SHORT_LENGTH=0.629]
X-Spam-Score: 0.505

X-Spam-Level:

[PNE]

If this is a new installation, maybe bayes did not activate yet. See http://spamassassin.apache.org/tmp/r..._spam_num.html. There is only 60 messages of each spam/ham needed in zimbra config. Is this condition met?

I don't know how exactly works zimbra's automated bayes training, but if it is based on junk/not junk feature only, it may not be quite sufficient. You need to feed bayes with lot of spam and ham to learn it, it's just a statistics and with small database will not work good.

[cutigersfan]

Yes, this is a relatively new install. I'd think that I'd have more than 200 spams send in.. In fact I'm sure of it. Ham though, I'm not sure how the ham account gets fed, so that might be met. Is there a way to find out for sure?

[KevinH]

Do you have the two spam/ham accounts created? I've seen some people delete these accounts which will break the automatic training.

[cutigersfan]

Yep, they are there. I renamed them so that I wouldn't forget what they are. I think I called them 'trainham' and 'trainspam'. That shouldn't matter should it?

[cutigersfan]

Is there any way to tell if bayes is just waiting for critical mass to build? I continue to get more spam and would welcome the extra scruitiny.

[KevinH]

Yep, they are there. I renamed them so that I wouldn't forget what they are. I think I called them 'trainham' and 'trainspam'. That shouldn't matter should it?

Did you change the LDAP attrs that ref these? If not that broke support for the Junk/Not Junk buttons.