Dspam...always innocent... Again

[imx]

Morning all,

Ok I know there are a few threads floating around for this, but they're old - some will say post to the old, others create a new... So this won't please all

Dspam is always marking mail as innocent...never spam.... I've tried clearing out the spam db and restart, even run zmfixpermissions extended as well. Nothing makes a difference, running latest patch release of 6.0.7:

Jul  4 06:50:02 zcs00 amavis[17614]: (17614-13) SpamControl: cal
ling spam scanner DSPAM
Jul  4 06:50:02 zcs00 amavis[17614]: (17614-13) run_command_cons
umer: [23192] /opt/zimbra/dspam/bin/dspam --stdout --classify --
deliver=innocent,spam --mode=tum --tokenizer=chained,noise --use
r zimbra >&=12 2>&=14
Jul  4 06:50:02 zcs00 amavis[17614]: (17614-13) rx: 112 X-DSPAM-
Result: zimbra; result [...]
Jul  4 06:50:02 zcs00 amavis[17614]: (17614-13) prolong_timer DS
PAM: timer set to 377 s
Jul  4 06:50:02 zcs00 amavis[17614]: (17614-13) DSPAM result: In
nocent, score=0.000, sig=
Jul  4 06:50:02 zcs00 amavis[17614]: (17614-13) DSPAM: suppl att
r: X-DSPAM-Result = 'Innocent'
Jul  4 06:50:02 zcs00 amavis[17614]: (17614-13) header: X-DSPAM-
Result: Innocent\n
Jul  4 06:50:02 zcs00 amavis[17614]: (17614-13) DSPAM: suppl att
r: X-DSPAM-Class = 'Innocent'
Jul  4 06:50:02 zcs00 amavis[17614]: (17614-13) header: X-DSPAM-
Class: Innocent\n
Jul  4 06:50:02 zcs00 amavis[17614]: (17614-13) DSPAM: suppl att
r: X-DSPAM-Confidence = '1.00'

Everything knows it's spam.... Bar dspam..... Any ideas?

Jul 4 11:06:27 zcs00 amavis[1127]: (01127-15) SPAM, <summarilyl@thongtin-online.com> -> <blah@siosis.com>, Yes, score=49.323 tag=-10 tag2=3.4 kill=18 tests=[AV:Sanesecurity.Spam.10955.UNOFFICIAL=0, BAYES_99=10, CLAM_SS=2.5, CTYME_IXHASH=3, FS_WILL_HELP=0.734, GENERIC_IXHASH=3, HTML_MESSAGE=0.001, NIXSPAM_IXHASH=3, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.886, RAZOR2_CHECK=3, RCVD_IN_BL_SPAMCOP_NET=0.5, RCVD_IN_BRBL=1.5, RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_CBL=1.5, RCVD_IN_JMF_BL=1.5, RCVD_IN_MSPIKE_BL=1.5, RCVD_IN_NIX_SPAM=2.5, RCVD_IN_PSBL=1.5, RCVD_IN_RP_RNBL=1.31, RCVD_IN_SEMBLACK=0.5, RCVD_IN_SORBS_WEB=0.01, RCVD_IN_XBL=0.375, SEM_URI=0.5, SEM_URIRED=0.5, T_URIBL_BLACK_OVERLAP=0.01, URIBL_BLACK=1.725, URIBL_DBL_SPAM=1.7, URIBL_JP_SURBL=1.5, URIBL_SBL=1.623, DSPAM:Innocent

Thanks

[garyo]

Have you trained dspam with enough ham/spam yet?
Try /opt/zimbra/dspam/bin/dspam_stats -H and see what TL says. I think until it's trained it thinks everything is innocent.

Actually what I want is a way to change the SA innocent score to 0 (for the first few weeks anyway). Anyone know how to do that? Where is this "DSPAM:Innocent" score defined?

[ewilen]

It seems to be defined in salocal.cf.in:

header DSPAM_HAM X-DSPAM-Result =~ /^Innocent$/
describe DSPAM_HAM DSPAM claims it is ham
score DSPAM_HAM -0.5

However, I thought we came to the conclusion in Enabling DSPAM that the DSPAM score was directly added by amavis (after multiplying by a scaling factor), unless you're using amavis 2.7.0. (Current latest releases of Zimbra use 2.6.4.)