zmtrainsa not functioning

[brainocide]

I tested sending email from yahoo and gmail acc to zimbra acc. I received that both email and through zimbra webclient i mark it as junk & automaticly will forward the email to junk folder.

Then i run /opt/zimbra/bin/zmtrainsa manually or automaticly (crontab).

I tested it again from yahoo & gmail acc with same email address but still receive it in inbox.

I thought when we mark junk to any email, we will never receive that email again or at least that email get into junk folder & not into inbox. But it doesnt happen.

So need help to solve this problem.

Tq.

spamtrain.log when run zmtrainsa
=========================
20090712230002 Starting spam/ham extraction from system accounts.
[] INFO: Total messages processed: 6
[] INFO: Total messages processed: 0
20090712230007 Finished extracting spam/ham from system accounts.
20090712230007 Starting spamassassin training.
netset: cannot include 127.0.0.0/8 as it has already been included
Learned tokens from 5 message(s) (5 message(s) examined)
netset: cannot include 127.0.0.0/8 as it has already been included
Learned tokens from 0 message(s) (0 message(s) examined)
netset: cannot include 127.0.0.0/8 as it has already been included
20090712230011 Finished spamassassin training.
20090712234501 Starting spam/ham cleanup
[] INFO: Total messages processed: 6
[] INFO: Total messages processed: 0
20090712234505 Finished spam/ham cleanup

[brainocide]

in zmprov gacf, zimbraSpamCheckEnabled: FALSE. What is that mean?

[brian]

zimbraSpamCheckEnabled is a deprecated attribute.

zimbraServiceEnabled antispam is the replacement setting.

[brainocide]

Originally Posted by brian

zimbraSpamCheckEnabled is a deprecated attribute.

zimbraServiceEnabled antispam is the replacement setting.

How? U mean replace in zmprov? zimbraSpamCheckEnabled replace with zimbraServiceEnabled ? how about true/false?

[uxbod]

su - zimbra
zmprov gacf zimbraServiceEnabled

It would be helpful if you were to post the headers from one of the emails marked as SPAM so we can see which checks it has hit. You could also update /opt/zimbra/conf/amavisd.conf.in and change the log_level to 2 and then restart ZCS. This would provide more information in /var/opt/zimbra.log of what is happening to the email.

[brainocide]

Originally Posted by uxbod

su - zimbra
zmprov gacf zimbraServiceEnabled

It would be helpful if you were to post the headers from one of the emails marked as SPAM so we can see which checks it has hit. You could also update /opt/zimbra/conf/amavisd.conf.in and change the log_level to 2 and then restart ZCS. This would provide more information in /var/opt/zimbra.log of what is happening to the email.

there is no zmprov gacf zimbraServiceEnabled that i can find

====message header=======

Return-Path: johnmukhabe63@yahoo.in
Received: from smtp.example.com (LHLO smtp.example.com) (202.aaa.bbb.ccc)
by mbs1.example.com with LMTP; Tue, 14 Jul 2009 06:18:21 +0800 (MYT)
Received: from localhost (localhost.localdomain [127.0.0.1])
by smtp.example.com (Postfix) with ESMTP id 85C814728087
for <azahar@example.com>; Tue, 14 Jul 2009 06:20:52 +0800 (MYT)
X-Virus-Scanned: amavisd-new at example.com
X-Spam-Flag: YES
X-Spam-Score: 14.988
X-Spam-Level: **************
X-Spam-Status: Yes, score=14.988 tagged_above=-10 required=6.6
tests=[ADVANCE_FEE_2=1.234, ADVANCE_FEE_3=1.432, ADVANCE_FEE_4=0.639,
BAYES_99=3.5, DEAR_SOMETHING=1.605, FAKE_REPLY_C=2.012,
FORGED_MUA_OUTLOOK=3.116, MSOE_MID_WRONG_CASE=0.82, US_DOLLARS_3=0.63]
Received: from smtp.example.com ([127.0.0.1])
by localhost (smtp.example.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 3iCxEVfp5f8P for <azahar@example.com>;
Tue, 14 Jul 2009 06:20:48 +0800 (MYT)
Received: from mail.fcvnet.net (mail.fcvnet.net [213.151.164.20])
by smtp.example.com (Postfix) with ESMTP id EEAFB4728081
for <azahar@example.com>; Tue, 14 Jul 2009 06:20:46 +0800 (MYT)
Received: from User (unknown [59.161.112.13])
by mail.fcvnet.net (Postfix) with ESMTP id 42B2939404C;
Tue, 14 Jul 2009 00:15:50 +0200 (CEST)
Reply-To: <j.mukhabe23@sify.com>
From: "Mr John Mukhabe"<johnmukhabe63@yahoo.in>
Subject: Re: Business Partnership offer
Date: Tue, 14 Jul 2009 03:46:14 +0530
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20090713221550.42B2939404C@mail.fcvnet.net>
To: undisclosed-recipients:;

===============

[uxbod]

[ADVANCE_FEE_2=1.234, ADVANCE_FEE_3=1.432, ADVANCE_FEE_4=0.639,
BAYES_99=3.5, DEAR_SOMETHING=1.605, FAKE_REPLY_C=2.012,
FORGED_MUA_OUTLOOK=3.116, MSOE_MID_WRONG_CASE=0.82, US_DOLLARS_3=0.63]

Well that email is hitting lots of SA rules When training the only thing that is effected is the BAYES_ rule. If these are valid emails then you should either whitelist the address or create your own SA rule to lower the scoring.

[dwmtractor]

This line

X-Spam-Status: Yes, score=14.988 tagged_above=-10 required=6.6

means that Zimbra is tagging your message as junk. If this message did not land in your junk folder, but rather in your inbox, something else is wrong. Are you checking it on the Zimbra web client, or perhaps another mail client?

Classifying a message as Junk, as uxbod has said, merely increases the Bayesian scoring, and your header's score of "BAYES_99=3.5" means that it already has the highest possible Bayesian spam score. You can increase the point value for Bayesian filtering as described here, but that won't help in a message that already exceeds the 6.6 point threshold.

We still have to figure out why something with a score of 14.998 isn't landing in your junk folder. I wonder if perhaps you have some kind of filter overriding the spamassassin process?

[brainocide]

ok ok. Let start back from begining. Lot of missunderstanding here.

I want to block message from email address abc@yahoo.com or def@gmail or any other email from getting in my inbox. So i mark that email message as junk in zimbra webclient.

Even i mark certain message as junk through zimbra webclient (and automaticly move to junk) but still receive message from the same email address in my zimbra webclient inbox. I run zmtrainsa also nothing happen, never block & never move the message to junk folder.

Message with X-Spam-Flag:YES still get inside in junk folder. No problem & right now no issue about that.

My conclusion, JUNK button or zmtrainsa not functioning. Spamtrain.log also no error ( ... i think).

[uxbod]

Nothing wrong with what the Junk button or zmtrainsa does. As we have already said that just trains the SA bayes database. If you wish to permanently block those email address then you should look at implementing a Wiki :: Blacklist.