Zimbra Open Source 6.0.2 + DSPAM, always innocent?

[imx]

Hi,

Ive just enabled DSPAM on a 6.0.2 open source version server, however when i run zmtrainsa it always seems to see the mail is not spam? Even though i have classed it as spam in the webgui, and it picks up the mail as being in the spam dir (because it processes it):

20091028201449 Starting dspam training
Taking Snapshot...
zimbra TP: 0 TN: 0 FP: 0 FN: 5 SC: 0 NC: 0
Training /tmp/ham.Xfl5184 / /tmp/spam.xxs5183 corpora...
[test: spam ] 1249cc93506-0 result: FAIL (Innocent)
[fn] Subject: Attractive aged mother videos
[test: spam ] 1249cc93506-1 result: FAIL (Innocent)
[fn] Subject: The only real Virgin pussy website on the Net!
TRAINING COMPLETE

Any ideas?!

Also, if i try to run it manually against my spam box for a specific user it appears to hang?

zimbra@mambo:~$ zmtrainsa blah@blah.com spam Junk
20091028201653 Starting spamassassin spam training for blah@blah.com using folder Junk
[] INFO: Total messages processed: 92
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
Learned tokens from 64 message(s) (92 message(s) examined)
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
20091028201701 Finished spamassassin spam training for blah@blah.com using folder Junk
20091028201701 Starting dspam spam training for blah@blah.com using folder Junk
13145: [10/28/2009 20:17:01] No such feature 'chained'

Any one seen these issues?

Thanks, iMx

[bolderbast]

Looks like I have a similar problem.

All of the e-mail I got in the last couple of weeks is tagged "Innocent" by DSPAM, even though I receive a lot of spam.

I've been searching for a DSPAM logfile, but I cannot seem to find one. I also cannot find a config file to enable logging.

Can anyone point me in a direction on how to troubleshoot this issue?

[veronica]

I generally keep dspam disabled.

[bolderbast]

Just upgraded to

Release 6.0.3_GA_1915.UBUNTU8_64 UBUNTU8_64 FOSS edition.

And DSPAM seems to work now (at least, I get some mails with DSPAM +10.000).

Still a lot of false positives and false negatives though... But I trust that will get better as it gets trained...

[phoenix]

Originally Posted by bolderbast

Still a lot of false positives and false negatives though...

What are your kill/tag percentages?

[bolderbast]

Kill: 100%
Tag: 33%

But I believe the percentages are applied to the total score of all Antispam checks, right? The other checks are fine, only DSPAM gets it wrong a lot. And because of the weight DSPAM puts in, it only sporadicly gets compensated by the other checks.

Example of a False Positive (mail is tagged as spam by DSPAM, though it isn't):

X-DSPAM-Result: Spam
X-DSPAM-Class: Spam
X-DSPAM-Confidence: 0.54
X-DSPAM-Probability: 0.9159
X-DSPAM-Signature: N/A
X-Virus-Scanned: amavisd-new at <domainname>
X-Spam-Flag: YES
X-Spam-Score: 7.401
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.401 tagged_above=-10 required=6.6
	tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, SPF_PASS=-0.001,
	DSPAM:Spam=10.000] autolearn=ham

Example of a fale negative (mail is not classified as spam by DSPAM, though it is):

X-DSPAM-Result: Innocent
X-DSPAM-Class: Innocent
X-DSPAM-Confidence: 0.56
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: N/A
X-Virus-Scanned: amavisd-new at <domainname>
X-Spam-Flag: YES
X-Spam-Score: 14.066
X-Spam-Level: **************
X-Spam-Status: Yes, score=14.066 tagged_above=-10 required=6.6
	tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001,
	MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5,
	RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=2.5, RCVD_IN_PBL=0.905,
	RCVD_IN_SORBS_WEB=0.619, URIBL_BLACK=1.955, URIBL_OB_SURBL=1.5,
	URIBL_RHS_DOB=1.083, URIBL_SBL=1.499, DSPAM:Innocent=-1.000]
	autolearn=spam

Thanks for helping!

[phoenix]

Originally Posted by bolderbast

Kill: 100%
Tag: 33%

The setting of 100% for the Kill percentage will allow all spam through the system and never reject any valid spam, I'd suggest you reduce those setting to 66/25 for kill/tag and see if that improves your current problem. Have you implemented any of the suggestions in the wiki (or the forums) for improving the anti-spam system and if so, which ones?

[bolderbast]

Hi Bill,

A Kill percentage of 66 would actually DELETE incoming mail if the score is 13.200 (total of all checks), or am I mistaken.

My policy is to NEVER automatically delete e-mail messages, I just want to have them put in the Junk folder. A Kill percentage of 100 is what comes closest to that, that is why I set it to 100. I'd rather be able to set it to 101 or so, to make sure that even messages with a total score of 20.000 are not automatically deleted.

I am currently running Zimbra at home, but for a lot of organizations I believe it is not even permitted to auto-delete messages because of compliance reasons.

Spam improving that I applied are SPF, Razor2 and Pyzor as described in Improving Anti-spam system - Zimbra :: Wiki

Anyway, aren't we getting very off-topic now? The topic is about only the DSPAM component not working (or in my case: not working reliable). Other AntiSpam options (Razor2, Pyzor, etc.) are working perfectly!

Cheers,
Patrick

[kazooless]

This person says they fixed the feature chained issue in this thread:

Enabling DSPAM