Noob on Antispam... How can i really check It's working?

[sapoku]

Hi there.

How can i get a list of email marked as Spam (Marked by users)?

How can i modify that list, lets say remove an email from the spam list (Again, email mark by another user, not me)?

How can i get an efficiency statistic about how much emails are marked as spam by spamassasin VS how many email are marked as spam by users?

Finally, any hint's to a really good zimbra-antispam guide For noobs? (From an administration point of view, not an install guide or teoric paper.)

I'm a total noob on antispam. As far as i know, zimbra by default works with spamassasin. And also as far as i now it shoud be working (All services up and running).

I also now the logic about how it works (Score system, emails tagged as spam moves to another account, etc)


Thank you all for your time!!

[ewilen]

I'd start by searching the forums and looking at Improving Anti-spam system - Zimbra :: Wiki.

About your first question, you could always look in the spam account using the Admin GUI and then "View Mail". Or you could do this:

grep marked\ as\ spam /opt/zimbra/log/mailbox.log

(Optional: substitute any of the other mailbox.log* files for historical info.)

[sapoku]

Thanks for the fast answer.
That command worked perfect.
About the guide, i had already read it, and it's a lot about how to add more anti spam meassures. What i'm really looking for, it's admin information about spamasasin.

A guide with tips just like the one you posted!!.
Now.. how do i find the emails marked as spam by Spamassasin? So i can build the statistic of failure on detection.

[ewilen]

grep SPAM /var/log/zimbra.log

Note that this will include both mails marked SPAM (which are dropped entirely) and mails marked SPAMMY (which end up in the junk folder).

It will not include mails which are dropped at the MTA. For those which are blocked using a DNSRBL at the MTA you could use

grep blocked\ using /var/log/zimbra.log

Some other MTA-level checks probably have other patterns that you could grep for in /var/log/zimbra.log.

[ewilen]

Actually, if you're doing a count by lines, you might want to grep on SPAM, (note the comma) and SPAMMY separately. Otherwise you'll get some additional log lines reporting what happened to the SPAM messages.

[sapoku]

Sorry for the lag on communications. The console commands have work great. But id tried the "view mail" of the spam account, and it was empty.

I'm starting to think thats not normal.

Any ideas on this?

[jrefl5]

Originally Posted by sapoku

Sorry for the lag on communications. The console commands have work great. But id tried the "view mail" of the spam account, and it was empty.

I'm starting to think thats not normal.

Any ideas on this?

The spam account only has in it what your users have marked as spam. it is cleaned out by zimbra, ( one of the cron jobs I think )