Amavis going crazy with flagging

[mrjohnsen]

Hi,
In the last weeks we have had an problem with Amavis that it suddently flags non-spam mails as spam for many of our users. The "spam"-mails is from trusted domains and Zimbra has received a lot of mails from these different trusted domains before without flagging them as spam.

I have a supportcase waiting for this, but i'm interested to know if any others out there have had the same problem. This also happends to me now, and this mailheader is from a trusted domain which I have mailed alot with before from the same zimbra server:

X-DSPAM-Result: Spam
X-DSPAM-Class: Spam
X-DSPAM-Confidence: 0.57
X-DSPAM-Probability: 1.0000
X-DSPAM-Signature: N/A
X-Virus-Scanned: amavisd-new at our.zimbra.server
X-Spam-Flag: YES
X-Spam-Score: 7.487
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.487 tagged_above=-10 required=6.6
tests=[AWL=0.086, BAYES_00=-2.599, DSPAM:Spam=10.000] autolearn=ham

And this is from a customer with the same problem. Trusted domains suddently get flagged:
X-DSPAM-Result: Spam
X-DSPAM-Class: Spam
X-DSPAM-Confidence: 0.49
X-DSPAM-Probability: 1.0000
X-DSPAM-Signature: N/A
X-Virus-Scanned: amavisd-new at our.zimbra.server
X-Spam-Flag: YES
X-Spam-Score: 8.379
X-Spam-Level: ********
X-Spam-Status: Yes, score=8.379 tagged_above=-10 required=6.6
tests=[AWL=-0.419, BAYES_00=-2.599, HTML_MESSAGE=0.001,
MIME_QP_LONG_LINE=1.396, DSPAM:Spam=10.000] autolearn=no

I noticed that this has autolearn set to no. Why is that?

We had some file owner problems with DPAM after upgrade 6.0.2 -> 6.0.3. Had to change owner on /opt/zimbra/dspam/bin/*back to zimbra instead of root. Related?
[SOLVED] All mail deferred after upgrade

[ArcaneMagus]

Only thing I can say is it isn't amavis that is causing your problem but DSPAM, notice that for both those headers it is the 10.00 from DSPAM that causes the messages to be flagged. You should look into the DSPAM config for whatever is causing it to make these false positives.

[mrjohnsen]

Thank you for your answer. Yes, I agree I with that, but do you know why autolearn is set to 'no' in the header? Shouldn't it be HAM?

[ArcaneMagus]

See AutolearningNotWorking - Spamassassin Wiki for more detail, but basically that just means that amavis didn't use that particular message for ham/spam training.

[mrjohnsen]

Thank you.

I'm having some problems disabling DSPAM. I have done this:
#zmlocalconfig |grep dspam
amavis_dspam_enabled = false

And restarted the zimbra service but DSPAM is still in the mailheader of new incoming mails.

[imx]

Did you solve the whole DSpam score of 10 thing? Ive tried pretty much everything i can think of, clearing out its db by force and still i gets a bl**dy score of 10, even when set lower in a cf file.

Im sure youve already sorted your last problem posted, you just need to set FALSE - note the caps, this was a bug.

iMx

[stegbth]

Hi mrjohnson,

we have a similar problem since one week. Many eMails get flagged as spam. But running 5.0.18 on Ubuntu8.04 X86_64. We upgraded to 5.0.22, but still no change. Many eMails go to spam incorrectly as false positives.

I have also to investigate further if it happens cause dspam.

best regards
thomas

[mrjohnsen]

Hi,
Our solution was to disable DSPAM. And yes, false had to be in CAPS

[stegbth]

hi,

currently the wiki seems to be down, i get mostly only white pages.

what is the correct command to disable dspam?
zmlocalconfig -e amavis_dspam_enabled=FALSE

best regards
thomas

[uxbod]

Originally Posted by stegbth

Hi mrjohnson,

we have a similar problem since one week. Many eMails get flagged as spam. But running 5.0.18 on Ubuntu8.04 X86_64. We upgraded to 5.0.22, but still no change. Many eMails go to spam incorrectly as false positives.

I have also to investigate further if it happens cause dspam.

best regards
thomas

Unless we see the headers from one of the emails then it would be very difficult to say. Have you fixed the known issue [SOLVED] FH_DATE_PAST_20XX - Spamassassin bug - incorrect tagging from Jan 1, 2010 on ?