Results 1 to 6 of 6

Thread: autolearn=ham is defeating me (I think)

  1. #1
    scott.serr is offline Intermediate Member
    Join Date
    Aug 2009
    Posts
    18
    Rep Power
    6

    Default autolearn=ham is defeating me (I think)

    I start out with a clean spamassassin database. I train with known spam and ham right away. Spamassassin works reasonably well. I leave everything alone and let the spam/ham accounts work as designed. 3-4 days later the amount of spam being detected is way way down. I repeat, and the same behavior occurs.

    I've noticed that several inactive accounts get a lot of spam. There is no one logging in to help train.

    So, after a bunch of looking, I think I'm convinced that a few spams get delivered in these inboxes (aren't detected as spam) and are auto-learned as ham. This starts to snowball, renforcing the training that "hey that type of message is ham." Pretty soon, a bunch of messages that would have been detected as spam are not.

    I suspect many of us have this experience if I do. Does anyone have counter-measures? (I have ideas, but I don't want to lead a reader in any direction right now.)

    Thanks!
    -Scott

  2. #2
    sdproit is offline Intermediate Member
    Join Date
    Dec 2013
    Location
    San Diego
    Posts
    24
    Rep Power
    1

    Default

    Read up on enabling RBL's in Zimbra - Real Time Blacklisting. Depending on your server volume, this can block >40% of spam before spamassasin needs to deal with it.

  3. #3
    scott.serr is offline Intermediate Member
    Join Date
    Aug 2009
    Posts
    18
    Rep Power
    6

    Default

    Quote Originally Posted by sdproit View Post
    Read up on enabling RBL's in Zimbra - Real Time Blacklisting. Depending on your server volume, this can block >40% of spam before spamassasin needs to deal with it.
    I have enabled these, they are great. But, I had to disable spamcop though, as it was rejecting Outlook.com servers.

  4. #4
    scott.serr is offline Intermediate Member
    Join Date
    Aug 2009
    Posts
    18
    Rep Power
    6

    Default

    Trying the easy stuff first...

    in /opt/zimbra/conf/sa/sauser.cf

    bayes_auto_learn_threshold_nonspam -1.0
    bayes_auto_learn_threshold_spam 8.0

    This has no effect. in /opt/zimbra/conf/spamassassin/

    10_default_prefs.cf:bayes_auto_learn_threshold_non spam 0.1
    10_default_prefs.cf:bayes_auto_learn_threshold_spa m 12.0

    I have not changed these system values, as you aren't supposed to... but maybe I'll try that. Any ideas on why the settings in my sauser.cf are not used?

    Thanks,
    Scott

  5. #5
    scott.serr is offline Intermediate Member
    Join Date
    Aug 2009
    Posts
    18
    Rep Power
    6

    Default

    Quote Originally Posted by scott.serr View Post
    Trying the easy stuff first...

    in /opt/zimbra/conf/sa/sauser.cf

    bayes_auto_learn_threshold_nonspam -1.0
    bayes_auto_learn_threshold_spam 8.0

    This has no effect. in /opt/zimbra/conf/spamassassin/

    10_default_prefs.cf:bayes_auto_learn_threshold_non spam 0.1
    10_default_prefs.cf:bayes_auto_learn_threshold_spa m 12.0

    I have not changed these system values, as you aren't supposed to... but maybe I'll try that. Any ideas on why the settings in my sauser.cf are not used?

    Thanks,
    Scott
    I modified /opt/zimbra/conf/spamassassin/10_default_prefs.cf
    bayes_auto_learn_threshold_nonspam -1
    bayes_auto_learn_threshold_spam 7.5

    But still, doesn't seem to have taken:

    Code:
    cat /var/log/zimbra.log | tail -2500 | sed -n 's/.*\(score=[^ ]*\).*\(autolearn=[^ ]*\).*/\1 \2/p'
    score=-0.556 autolearn=no
    score=1.303 autolearn=no
    score=1.72 autolearn=no
    score=0.811 autolearn=no
    score=-0.001 autolearn=no
    score=9.458 autolearn=no
    score=-0.768 autolearn=no
    score=11.634 autolearn=no
    score=11.634 autolearn=no
    score=1.633 autolearn=no
    score=13.517 autolearn=no
    score=13.508 autolearn=spam
    score=2.116 autolearn=no
    score=0.981 autolearn=no
    score=1.134 autolearn=no
    score=-4.683 autolearn=ham
    score=13.091 autolearn=no
    score=3.069 autolearn=no
    score=13.237 autolearn=no
    score=2.86 autolearn=no
    score=12.785 autolearn=no
    score=1.1 autolearn=no
    score=12.399 autolearn=no
    score=12.785 autolearn=no
    score=12.785 autolearn=no
    score=12.785 autolearn=no
    score=10.985 autolearn=no
    score=12.785 autolearn=no
    score=-1.582 autolearn=no
    score=12.785 autolearn=no
    score=-0.78 autolearn=no
    score=12.25 autolearn=no
    score=5.138 autolearn=no
    score=10.933 autolearn=no
    score=10.933 autolearn=no
    score=5.91 autolearn=no
    score=6.999 autolearn=no
    Note, autolearn doesn't seem to be based on score. Does it not "autolearn" if it detects it already learned that message? If I can't modify the way that autolearn works, then I'll have to fight it in a non-elegant way.

  6. #6
    scott.serr is offline Intermediate Member
    Join Date
    Aug 2009
    Posts
    18
    Rep Power
    6

    Default

    This seems to have really helped:

    old

    spamassassin/10_default_prefs.cf~:bayes_auto_learn_threshold_no nspam 0.1
    spamassassin/10_default_prefs.cf~:bayes_auto_learn_threshold_sp am 12.0

    new

    spamassassin/10_default_prefs.cf:bayes_auto_learn_threshold_non spam -1
    spamassassin/10_default_prefs.cf:bayes_auto_learn_threshold_spa m 7.5


    It's surprising no one is interested in this. I should note that I've pumped up BAYES_99 a bit and lowered the spam threshhold to have 6.5. Works for me.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. autolearn=ham. Why? Bayes was 50. ???
    By kazooless in forum Administrators
    Replies: 0
    Last Post: 07-10-2011, 08:09 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •