Page 2 of 7 FirstFirst 1234 ... LastLast
Results 11 to 20 of 68

Thread: Improving spam filtering

  1. #11
    KevinH's Avatar
    KevinH is offline Expert Member
    Join Date
    Aug 2005
    Location
    San Mateo, CA
    Posts
    4,789
    Rep Power
    18

    Default

    Quote Originally Posted by inigoml
    We didn't change it. Defaults for zimbra, that is, 6.6/15.
    You are right. Lowering to 5.5 could improve recall, but would damage precision...
    Anyway this is our first week with all company "zimbraed", we will continue adjusting these values.
    For the record we run with 4 so even lower and that works very well. I wonder if you'd get same/better spam protection if you just trained Zimbra a little and then slowly lowered the values.
    Looking for new beta users -> Co-Founder of Acompli. Previously worked at Zimbra (and Yahoo! & VMware) since 2005.

  2. #12
    jholder's Avatar
    jholder is offline Former Zimbran
    Join Date
    Oct 2005
    Location
    Thatcher, AZ
    Posts
    5,606
    Rep Power
    20

    Default

    That's what i did. I subscribed to a SPAM list, and just spent a month training it, rather than having the users train it.

    I get about 150 spam e-mails a day, and only about 1 or 2 end up in my inbox.

  3. #13
    claros's Avatar
    claros is offline Project Contributor
    Join Date
    Mar 2006
    Location
    L'Aquila, ITALIA
    Posts
    59
    Rep Power
    9

    Default Spam training in enough?

    You have english as mother language. Most of the filters have been studied for that language, so works very well. It is very different when you receive the most part of your messages in another language... In my experience, Zimbra SA have failed a lot expecially with phishing messages translted into italian. These messages are not recognized by Clamav as a threat, so simply pass the filter. The great adventage to have a lot of check is a big differece in score between valid messages and spam.

  4. #14
    inigoml's Avatar
    inigoml is offline Project Contributor
    Join Date
    Aug 2006
    Location
    Madrid, Spain
    Posts
    124
    Rep Power
    8

    Default

    Quote Originally Posted by KevinH
    For the record we run with 4 so even lower and that works very well. I wonder if you'd get same/better spam protection if you just trained Zimbra a little and then slowly lowered the values.
    My system has been trained with thousands of spam messages with a set of spam samples, but 4 is very low for us. Too many spam messages would enter without been tagged.
    In fact, I rely more in blacklist than in bayesian filters...

    This is the spam repository I have used. There are hundred of thousand samples...
    http://www.untroubled.org/spam/

    Trained via sa-learn (/opt/zimbra/libexec)

  5. #15
    claros's Avatar
    claros is offline Project Contributor
    Join Date
    Mar 2006
    Location
    L'Aquila, ITALIA
    Posts
    59
    Rep Power
    9

    Default Implementing Whitelist/Blacklist

    It' very simple changing amavis config:

    put in /opt/zimbra/conf/amavis.conf*

    read_hash(\%whitelist_sender, '/etc/zimbra/whitelist');
    read_hash(\%blacklist_sender, '/etc/zimbra/blacklist');
    read_hash(\%spam_lovers, '/etc/zimbra/spamlovers');

    In /etc/zimbra/* put sender address or domain, one per line. Wildcards allowed.
    Eg:
    hotstuff@sexnzen.com
    getassistedgroup.com

    A spamlovers list is for that accounts that always need to receive all messages, even if spam. According to rfc 2822 postmaster, abuse and other account of this kind should be spam lovers.

    Ciao,
    Claudio

  6. #16
    scalper is offline Partner (VAR/HSP)
    Join Date
    Jul 2006
    Location
    KL, Malaysia
    Posts
    123
    Rep Power
    8

    Default

    Quote Originally Posted by inigoml
    My system has been trained with thousands of spam messages with a set of spam samples, but 4 is very low for us. Too many spam messages would enter without been tagged.
    In fact, I rely more in blacklist than in bayesian filters...

    This is the spam repository I have used. There are hundred of thousand samples...
    http://www.untroubled.org/spam/

    Trained via sa-learn (/opt/zimbra/libexec)
    I have downloaded the spam samples, ran sa-learn.. receive these error..

    Code:
    [zimbra@pluto ~]$ /opt/zimbra/libexec/sa-learn --spam /opt/spam/2006/09/
    config: invalid regexp for rule TW_QE: /[-<!\s]\w{0,10}qe[abceghjkmopquwxyz]\w{0,: missing or invalid delimiters
    bayes: expire_old_tokens: locker: safe_lock: cannot create tmp lockfile /opt/zimbra/.spamassassin/bayes.lock.pluto.cnc.net.my.6233 for /opt/zimbra/.spamassassin/bayes.lock: No such file or directory
    is my command incorrect?

    tq

  7. #17
    inigoml's Avatar
    inigoml is offline Project Contributor
    Join Date
    Aug 2006
    Location
    Madrid, Spain
    Posts
    124
    Rep Power
    8

    Smile Training spam from command line

    Your command should be something kile this (zmtrainsa inspired):

    From your spam folder, create a spam index file:
    ls > spam.index

    And then, as zimbra user::
    sa-learn -p /opt/zimbra/conf/salocal.cf --dbpath ${zimbra_home}/amavisd/.spamassassin/ -L --no-sync --spam -f spam.index --shotdots

  8. #18
    scalper is offline Partner (VAR/HSP)
    Join Date
    Jul 2006
    Location
    KL, Malaysia
    Posts
    123
    Rep Power
    8

    Default

    thanx! it worked flawlessly.. is there any way to check the sa/bayes database contents? just to make sure that it learned the messages properly..
    Last edited by scalper; 11-01-2006 at 08:23 AM.

  9. #19
    Klug's Avatar
    Klug is offline Moderator
    Join Date
    Mar 2006
    Location
    Beaucaire, France
    Posts
    2,292
    Rep Power
    13

    Default

    As zimbra user :
    sa-learn --dump magic --dbpath ${zimbra_home}/amavisd/.spamassassin/

  10. #20
    k3rmit is offline Intermediate Member
    Join Date
    Nov 2006
    Posts
    22
    Rep Power
    8

    Default

    thanks for the tips, but at the moment i can't understand if the changes in the configuration in conf/spamassassin/local.cf are considered, since the conf file for SA in zimbra si conf/salocal.cf: how can i determine it? Is there a way to see what's loaded as rules at startup?

    anyway modifying salocal.cf doesn't work since it's recreated at restart from salocal.cf.in . i wanted to touch as little as possible simbra inner workings and yet customize it.

    will w have an administration console interface to handle all amavisd - spamassassin -clamd -freshclam configuration settings? In fact i've modified every freshclam configuration i've found to set the http proxy and make it update definitions but none worked. were am i wrong?

    thanks in advance.


    albe

Page 2 of 7 FirstFirst 1234 ... LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Spam filtering on POP accounts?
    By dwmtractor in forum Administrators
    Replies: 8
    Last Post: 01-09-2009, 10:43 AM
  2. Order of operations - SPAM and filtering
    By SpEnTBoY in forum Administrators
    Replies: 0
    Last Post: 04-24-2007, 06:01 AM
  3. Replies: 2
    Last Post: 12-20-2006, 08:07 AM
  4. suggestion for improving spam controls on zimbra
    By pheonix1t in forum Administrators
    Replies: 2
    Last Post: 11-10-2006, 02:31 PM
  5. Disabling Spam Filtering
    By plan9 in forum Administrators
    Replies: 1
    Last Post: 10-25-2006, 07:10 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •