wiki,spam training account log in?

[tiarra]

Can we login to the accounts wiki@domain.com, spam trraining account etc which get created during installation by default. Thanks

[phoenix]

You don't need to login to that account, why would you want to do that?

[tiarra]

I just wanted to clarify on it as am not clear with the purpose of those accounts expecially the wiki@domain.com. WOuld be thankful if you could brief it out.

[phoenix]

The ham/spam training account are where mail that you mark as Junk or Not Junk is moved to, they are scanned on a daily basis and update the anti-spam system in Zimbra. The wiki account is used as the basis for the Documents system. They are 'system' accounts and you will never need to login to them.

[swrightsls]

Originally Posted by phoenix

The ham/spam training account are where mail is moved that you mark as Junk or Not Junk is moved to, they are scanned on a daily basis and update the anti-spam system in Zimbra. The wiki account is used as the basis fro the Documents system. They are 'system' accounts and you will never need to login to them.

Note: you can login from the admin console using the 'view mail' function. I used this to confirm the messages I was forwarding were appearing correctly. (spam/ham needs to be attached with content type message/rfc822).

We have just migrated from a system using ASSP and noticed a large increase in spam. Because ASSP maintained a corpus for spam/ham, I decided to try forwarding some of these (about 600 of each) to the ZCS spam/ham accounts, then ran zmtrainsa. It seemed to work, and indicated it was updating the SA db. But quite a lot of spam is still coming in, much more than with ASSP.

I keep reading posts here with users asking how to train/monitor/tune the ZCS spam system, and most of them end with the suggestion to search the forums, as if there is single obvious post which answers all the questions, but I have yet to find this post... so if there is a complete post on how to manage SA with ZCS, could someone please point it out? I would rather avoid making hacks that won't survive upgrades - I just want to understand the ZCS system better, but the docs are very thin in this area.

Thanks.

[phoenix]

With the web client you just need to highlight a message and hit the Junk button to get it trained. Have you enabled DSPAM on your system? Have you modified the Kill/Tag percentages?

The problem is that you're not actually giving much information about what, if anything, you've done to your anti-spam system to improve it's effectiveness. You've also not given any indication of which of the forums threads you've followed for nor is there any details of what type of spam is getting through and there's also no headers from this spam. There are many threads in the forums that cover different aspects of what can be done to improve the anti-spam system and there is no one 'magic bullet' for catching spam.

Without specifics there's not much advice that can be given.

[swrightsls]

Thanks for the reply. I have not enabled DSPAM as the only somewhat official looking document seemed to suggest it may not safe or stable - see the first line here:

Using DSPAM for Spam Filtering - Zimbra :: Wiki

I have done nothing with SA except to attempt to train it using spam/ham from our old system, and increase the kill percent to 100 so I could see all the spam being caught. I have also added all of the DNSBL entries suggested in the docs, and the dnsblcount script shows this for hits:

cbl.abuseat.org 10801
dnsbl.sorbs.net 1411
bl.spamcop.net 288
dnsbl.njabl.org 133
sbl.spamhaus.org 4
=================================
Total DNSBL rejections: 12637

I am about to install postfix-logwatch and amavis-logwatch to attempt to see more stats and get an idea of how things are working, as right now it is just a seat of the pants measurement.

We have only been live for one week, so I realize things will take time, but also don't wish to spend a lot of time on this. Should I consider feeding more spam/ham from our old system while it is still reasonably fresh? I have sent 600 of each, but have 8000 on hand...

[dwmtractor]

Feeding more spam/ham is not a bad idea, but you also need to look at the scores and headers to see what's getting through. The default scoring is not good enough to catch it all.

You might want to have a look at the following thread:

zmtrainsa not functioning

It shows some customer frustration, so it's not just sweetness and light; however, I and at least one other user posted detailed recommendations there for spam settings that work fairly well.

[swrightsls]

Thanks for the tip - I will try some of the suggestions from that thread.