I am trying to understand zmtrainsa. After searching the forums I seem to have answered my questions with more questions.


First, the log file /opt/zimbra/log/spamtrain.log would be so much more useful with Date/Time Stamps!

I may have to add a cronjob to root to echo date >> these logs every 30 minutes.

----
3 commands in zimbra crontab relate to zmtrainsa
crontab -lu zimbra

45 23 * * * /opt/zimbra/bin/zmtrainsa --cleanup >> /opt/zimbra/log/spamtrain.log 2>&1

0 23 * * * /opt/zimbra/bin/zmtrainsa >> /opt/zimbra/log/spamtrain.log 2>&1

20 23 * * * /opt/zimbra/libexec/sa-learn --force-expire --sync > /dev/null 2>&1

----
First command
/opt/zimbra/bin/zmtrainsa --cleanup

Is this command supposed to empty

1) All messages from spam.weirdrandomnoisehere
or
2) Only messages learned from and recently added to the DB

My system has message dating back a number of days.
When I run this on the command line, it empties the Inbox of my spam user. Why does it not empty every night?

----
Second command
/opt/zimbra/bin/zmtrainsa

This command checks the Inbox of
spam.weirdrandomnoisehere

Reads the spam user Inbox and adds to bayes DB of SA

Why do my logs report?
Learned from 41 message(s) (72 message(s) examined)

I want to understand the messages "NOT Learned from"
Errors like no attachment?
bayes DB does not need to learn from this message/The bayes DB already knows about this sort of SPAM?
Do these message stay behind to be learned from at a latter time when the final SPAM training crontab command runs??

----
Final command
/opt/zimbra/libexec/sa-learn --force-expire --sync

This I understand is keeping the bayes DB fresh and of manageable size. Are we useing the default SpamAssassin values??

I see in my logs a very large change in size for what I am interpreting to be the bayes DB? Not sure I like seeing my SA training DB drop from 21,000 to 127

bayes: synced databases from journal in 2 seconds: 15627 unique entries (15937 total entries)
bayes: synced databases from journal in 1 seconds: 7431 unique entries (9021 total entries)
bayes: synced databases from journal in 0 seconds: 3583 unique entries (3583 total entries)
bayes: synced databases from journal in 2 seconds: 16042 unique entries (16946 total entries)
bayes: synced databases from journal in 3 seconds: 19467 unique entries (21159 total entries)
bayes: synced databases from journal in 0 seconds: 116 unique entries (127 total entries)