| Welcome to the Zimbra :: Forums! | |
Welcome, if you would like to post a comment please register.
We also encourage you to explore all things Zimbra with our team and members of the community.
|  | 
10-28-2009, 02:22 PM
| | Special Member | |
Posts: 131
| | Zimbra Open Source 6.0.2 + DSPAM, always innocent? Hi,
Ive just enabled DSPAM on a 6.0.2 open source version server, however when i run zmtrainsa it always seems to see the mail is not spam? Even though i have classed it as spam in the webgui, and it picks up the mail as being in the spam dir (because it processes it): Quote:
20091028201449 Starting dspam training
Taking Snapshot...
zimbra TP: 0 TN: 0 FP: 0 FN: 5 SC: 0 NC: 0
Training /tmp/ham.Xfl5184 / /tmp/spam.xxs5183 corpora...
[test: spam ] 1249cc93506-0 result: FAIL (Innocent)
[fn] Subject: Attractive aged mother videos
[test: spam ] 1249cc93506-1 result: FAIL (Innocent)
[fn] Subject: The only real Virgin pussy website on the Net!
TRAINING COMPLETE
| Any ideas?!
Also, if i try to run it manually against my spam box for a specific user it appears to hang? Quote:
zimbra@mambo:~$ zmtrainsa blah@blah.com spam Junk
20091028201653 Starting spamassassin spam training for blah@blah.com using folder Junk
[] INFO: Total messages processed: 92
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
Learned tokens from 64 message(s) (92 message(s) examined)
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 127.0.0.0/8 as it has already been included
20091028201701 Finished spamassassin spam training for blah@blah.com using folder Junk
20091028201701 Starting dspam spam training for blah@blah.com using folder Junk
13145: [10/28/2009 20:17:01] No such feature 'chained'
| Any one seen these issues?
Thanks, iMx | 
11-29-2009, 02:26 PM
| | | Looks like I have a similar problem.
All of the e-mail I got in the last couple of weeks is tagged "Innocent" by DSPAM, even though I receive a lot of spam.
I've been searching for a DSPAM logfile, but I cannot seem to find one. I also cannot find a config file to enable logging.
Can anyone point me in a direction on how to troubleshoot this issue? | 
12-01-2009, 02:16 AM
| | Outstanding Member | |
Posts: 593
| | I generally keep dspam disabled. | 
12-01-2009, 02:31 AM
| | | Just upgraded to
Release 6.0.3_GA_1915.UBUNTU8_64 UBUNTU8_64 FOSS edition.
And DSPAM seems to work now (at least, I get some mails with DSPAM +10.000).
Still a lot of false positives and false negatives though... But I trust that will get better as it gets trained... | 
12-01-2009, 04:26 AM
| | Zimbra Consultant & Moderator | |
Posts: 19,639
| | Quote:
Originally Posted by bolderbast Still a lot of false positives and false negatives though... | What are your kill/tag percentages?
__________________
Regards
Bill
| 
12-01-2009, 04:50 AM
| | | Kill: 100%
Tag: 33%
But I believe the percentages are applied to the total score of all Antispam checks, right? The other checks are fine, only DSPAM gets it wrong a lot. And because of the weight DSPAM puts in, it only sporadicly gets compensated by the other checks.
Example of a False Positive (mail is tagged as spam by DSPAM, though it isn't): Code: X-DSPAM-Result: Spam
X-DSPAM-Class: Spam
X-DSPAM-Confidence: 0.54
X-DSPAM-Probability: 0.9159
X-DSPAM-Signature: N/A
X-Virus-Scanned: amavisd-new at <domainname>
X-Spam-Flag: YES
X-Spam-Score: 7.401
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.401 tagged_above=-10 required=6.6
tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, SPF_PASS=-0.001,
DSPAM:Spam=10.000] autolearn=ham Example of a fale negative (mail is not classified as spam by DSPAM, though it is): Code: X-DSPAM-Result: Innocent
X-DSPAM-Class: Innocent
X-DSPAM-Confidence: 0.56
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: N/A
X-Virus-Scanned: amavisd-new at <domainname>
X-Spam-Flag: YES
X-Spam-Score: 14.066
X-Spam-Level: **************
X-Spam-Status: Yes, score=14.066 tagged_above=-10 required=6.6
tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001,
MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5,
RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=2.5, RCVD_IN_PBL=0.905,
RCVD_IN_SORBS_WEB=0.619, URIBL_BLACK=1.955, URIBL_OB_SURBL=1.5,
URIBL_RHS_DOB=1.083, URIBL_SBL=1.499, DSPAM:Innocent=-1.000]
autolearn=spam Thanks for helping! | 
12-01-2009, 04:53 AM
| | Zimbra Consultant & Moderator | |
Posts: 19,639
| | Quote:
Originally Posted by bolderbast Kill: 100%
Tag: 33% | The setting of 100% for the Kill percentage will allow all spam through the system and never reject any valid spam, I'd suggest you reduce those setting to 66/25 for kill/tag and see if that improves your current problem. Have you implemented any of the suggestions in the wiki (or the forums) for improving the anti-spam system and if so, which ones?
__________________
Regards
Bill
| 
12-01-2009, 06:00 AM
| | | Hi Bill,
A Kill percentage of 66 would actually DELETE incoming mail if the score is 13.200 (total of all checks), or am I mistaken.
My policy is to NEVER automatically delete e-mail messages, I just want to have them put in the Junk folder. A Kill percentage of 100 is what comes closest to that, that is why I set it to 100. I'd rather be able to set it to 101 or so, to make sure that even messages with a total score of 20.000 are not automatically deleted.
I am currently running Zimbra at home, but for a lot of organizations I believe it is not even permitted to auto-delete messages because of compliance reasons.
Spam improving that I applied are SPF, Razor2 and Pyzor as described in Improving Anti-spam system - Zimbra :: Wiki
Anyway, aren't we getting very off-topic now? The topic is about only the DSPAM component not working (or in my case: not working reliable). Other AntiSpam options (Razor2, Pyzor, etc.) are working perfectly!
Cheers,
Patrick | 
12-01-2009, 09:19 PM
| | | no feature chained fixed here maybe.. This person says they fixed the feature chained issue in this thread: Enabling DSPAM | | Thread Tools | Search this Thread | | | | | Display Modes | Linear Mode | | Why Join? Registering let's you ask questions, makes it easier to search, displays any files attached to posts, and notifies you about replies.  |