Spam Training Isn't Learning

[plan9]

I have an installation in which the spam training appears not to be working.

1. Users mark messages as junk.
2. The Junk folders is cleared out regularly by Zimbra.
3. Messages from the same senders still keep coming through.

I suppose the cron jobs are working because the junk folders are being cleared out. Also, I am able to run zmtrainsa manually. However, the system just doesn't seem to learn.

Where should I look first?

[jholder]

Look at the spamtrain logs in /opt/zimbra/logs

Also, you may need to tweak your spam settings a little.

[sergiumartin]

on of the users observed that he marked an email from an address as junked and two days after he received another email from the same address..

[jholder]

Messages are generally judged upon their message content, and not sender.
To do that, we'll probably implement whitelist/blacklist featuring.

In order to insure that your system is marking messages correctly, you may wish to tweak your settings a little.

You may wish to search the forums/wiki for more information on how to tweak those settings.

[mmorse]

cd /opt/zimbra/log
tail -f mailbox.log
send yourself a test email
you should see:
DATE TIME INFO [Junk-NotJunk-Handler] [] misc - Sent spamreport: acct=address@domain.com mbox=# id=# report=spam

[sergiumartin]

mmorse...done that..didn't got that message ..
i'm running Release 4.5.5_GA_838.SuSEES9 , after a downgrade from NE version
is this strange or unusual ?

[reza225]

Originally Posted by jholder

Look at the spamtrain logs in /opt/zimbra/logs

Also, you may need to tweak your spam settings a little.

I looked at my spam log
http://rndcomputing.com/~reza/work/spamtrain.log
It looks like it's been adding emails slowly but surely, but tons of spam is still getting through. What setting are you talking about editing? I've changed the tag setting down to 25% but left the kill setting at 90%

[reza225]

this is the header from one of the emails that got through in my user's account

X-Quarantine-ID: <TzH42CoMbBHi>
X-Virus-Scanned: amavisd-new at
X-Amavis-Alert: BAD HEADER, Duplicate header field: "Date"
X-Spam-Score: 3.988
X-Spam-Level: ***
X-Spam-Status: No, score=3.988 tagged_above=-10 required=5
tests=[ALL_TRUSTED=-1.8, AWL=1.695, BAYES_05=-1.11,
HTML_MESSAGE=0.001, INVALID_DATE=2.193, MIME_HTML_ONLY=0.001,
URIBL_OB_SURBL=3.008]

she gets about 250 spams a day, and we've marked more than 10 thousand emails from her account alone as junk.

I just ran the zmtrainsa on her Junk box, and here is the following output.
[zimbra@mail ~]$ zmtrainsa dotty@thefeld.com spam Junk
[] INFO: Total messages processed: 11974
Learned from 8208 message(s) (11974 message(s) examined).
bayes: synced databases from journal in 0 seconds: 107 unique entries (114 total entries)

Does the main filter only go through the spam folders once a month? or is it a variable from the admin config for the spam lifetime?

[mmorse]

it's a cron job
see /var/spool/cron/zimbra
zmtrainsa section