Some SPAM still getting in

[hansvdmerwe]

Hi, we are successfully running latest Zimbra on OpenSUSE 10.3.
We have the SPAM filter learned and most spam are tagged, but daily about 2-4 obvious (I mean its basically direct wording ***ually explicit) SPAM gets through.
Anyone know how I can solve this. Where do I begin?

[ewilen]

Try searching the forum. There are two threads on tuning the antispam system on the front page of the Administrators forum right now.

[phoenix]

Originally Posted by hansvdmerwe

Hi, we are successfully running latest Zimbra on OpenSUSE 10.3.

Just for your information, there will be no support (nor any builds provided) for any openSUSE version of Zimbra from release 6 onwards so you might want to consider changing operating systems sometime.

[bradb21]

NO spam filter is going to be 100% effective. Spam is a constant cat and mouse game, and spam will always get through and good messages may get flagged as spam. I don't personally use the anti-spam features in Zimbra and use another filter in front of my Zimbra server, but if you find a filter that is 100% effective please let me know because I'd like to buy it.

[ewilen]

All that is true, but the original poster is looking for help in improving anti-spam efficiency. This is a realizable goal while perfection isn't. But as I noted, there are already a few good threads to start with.

[uxbod]

If you are getting a few through then we would need to see one of them so we can determine which rules you should look at using. Here are a few threads to get you started :-

SpamAssassin Additional Rules :: Botnet Plugin
SpamAssassin Additional Rules
[SOLVED] SaneSecurity ClamAV or FuzzyOCR SpamAssassin Plugins

[bradb21]

Originally Posted by ewilen

All that is true, but the original poster is looking for help in improving anti-spam efficiency. This is a realizable goal while perfection isn't. But as I noted, there are already a few good threads to start with.

True, but the OP talks of 2-4 emails getting in per day. To me that's looking for perfection (100% catch rate).

OP,
The messages may contain explicit words, but the spammers carefully craft the text of their messages to subtract points and not get caught by the bayesian analysis. You could write your own SA rules with a list of explicit words that you could add 100 points to which would cause immediate flagging of the message. This could also block legit emails that contain explicit wording. I share in your frustration, but it's the world we live in. In less all spammers suddenly drop dead it's a problem we'll be dealing with for a long time.

[hansvdmerwe]

My main concern was not to be 100% effective. I have a problem of obvious spam getting though. These ones are full blown ***ual invitations to **** sites. I just found it strange that all those words got through.
BTW can see more obscure mails being blocked?
How can I monitor the spam tagging process? More detail that is passed in the email header?

Thanks

[uxbod]

Increase the logging by changing /opt/zimbra/conf/amavisd.conf.in and set log_level=2. Once that is done run zmamavisdctl restart as the zimbra user.

[hansvdmerwe]

Perfect, thanks, that was what I was after.

(btw, about openSUSE is a shame, but if I have to change, to what distro do you suggest? my other machines run ArchLinux, but I guess its also not supported)