Trying to understand Zimbra's anti-spam system

[TaskMaster]

Is the mail in each users Junk folder processed automatically each day?

If so, should it also be removed from the Junk folder automatically?

[phoenix]

Spam is already processed and dropped into the spam training folder if it meets the kill percent, the mail that's in the Junk folder doesn't meet that test and is sent to that folder so you can check if it's a false positive. You can change the period that it's cleared out, look in the admin UI. Read the documentation and the wiki for an overview of how Zimbra works.

[TaskMaster]

I have read the documentation and am reading it again, right now.

It doesn't really give a good description of what is suppose to happen.

I just want to understand it.

Situation 1:

I receive an email that I believe is spam. I highlight it and click the Junk button, and the mail gets moved to my Junk folder.

Now, at this point, has it been copied to the spam user account already? Now I can just delete it out of my Junk folder and it will get trained when training happens next time? Or does it need to stay in my JUnk folder until traning happens next time?

Is the mail ever removed from the Junk mail folder automatically or do I need to delete it at some point?

Situation 2:

I receive mail in my Junk folder. This means that the system believes it is spam, but it did not score high enough to get automatically deleted. At this point, I should just delete it, it will get trained? Or do I leave it in my Junk folder until the next time training occurs?

Situation 3:

I receive mail in my Junk folder that the system thinks is spam. But I decide it isn't spam. I click the not junk button. This spam will now automatically be untrained from the spam filter (or it hasn't been trained yet?) and it will be trained as ham?

I am just trying to understand what the users interaction to the process is.

Thanks for any help.

[TaskMaster]

OK, sorry. Found it buried in an admin setting.

I think I have an understanding now.

There is an admin setting that states how long messages sit in the Junk folder before being purged. So, I am guessing that the instant the message is sent to the Junk folder it is passed to the spam user account. And if it is removed from the junk folder, then it is passed to the ham account.

I do still have one more question. Does it also work if the message is dragged in/out of the Junk folder, or does the user have to hit the Junk/Not Junk buttons?

Thanks for your patience.

[phoenix]

You need to hit the Junk button on an email for it to also go to the spam folder, obviously the reverse is true for a message in the junk folder - you must hit the Not Junk for it to get trained as ham. The drag/drop doesn't have the same function.

[TaskMaster]

Thank you for that answer. I will make sure my users understand that.

[roteri]

Where is that setting? I looked an can not find it.

Originally Posted by TaskMaster

OK, sorry. Found it buried in an admin setting.

I think I have an understanding now.

There is an admin setting that states how long messages sit in the Junk folder before being purged. So, I am guessing that the instant the message is sent to the Junk folder it is passed to the spam user account. And if it is removed from the junk folder, then it is passed to the ham account.

I do still have one more question. Does it also work if the message is dragged in/out of the Junk folder, or does the user have to hit the Junk/Not Junk buttons?

Thanks for your patience.

[mmorse]

admin console > COS > whateverCOS(default etc) > advanced tab > spam message lifetime last option on page just beneith trashed message lifetime

While your there becarefull setting 'email message lifetime' the defualt is 0 (which is don't delete) if u set this-mail will be deleted-no matter which folder after x days.

[mmorse]

Best description: and solution near bottom for massive training of spam if you have a bunch saved else where in a folder

Anti-Spam Training Filters

When ZCS is installed, the automated spam training filter is enabled and two feedback mailboxes are created to receive mail notification.
•
Spam Training User to receive mail notification about mail that was not marked as junk, but should be.
•
Non-spam (HAM) training user to receive mail notification about mail that was marked as junk, but should not have been.

For these training accounts, the mailbox quota is disabled (i.e. set to 0) and attachment indexing is disabled. Disabling quotas prevents bouncing messages when the mailbox is full.

How well the anti-spam filter works depends on recognizing what is considered spam or not considered spam. The SpamAssassin filter can learn what is spam and what is not spam from messages that users specifically mark as Junk from their web client toolbar or Not Junk from the web client Junk folder. A copy of these marked messages is sent to the appropriate spam training mailbox.The Zimbra spam training tool, zmtrainsa, is configured to automatically retrieve these messages and train the spam filter.

The zmtrainsa script is enabled through a cron job to feed mail that has been classified as spam or as non-spam to the SpamAssassin application, allowing SpamAssassin to ‘learn’ what signs are likely to mean spam or ham. The zmtrainsa script empties these mailboxes each day.

By default all users can give feedback in this way. If you do not want users to train the spam filter, you can modify the global configuration attributes, zimbraSpamIsSpamAccount and zimbraSpamIsNotSpamAccount, and remove the spam/ham account addresses from the attributes. To remove, type as:

zmprov mcf <attribute> ‘’
Restart the Zimbra services, type zmcontrol stop and then zmcontrol start.
When these attributes are modified, messages marked as junk or not junk are not copied to the spam training mailboxes.

Initially, you may want to train the spam filter manually to quickly build a database of spam and non-spam tokens, words, or short character sequences that are commonly found in spam or ham. To do this, you can manually forward messages as message/rfc822 attachments to the spam and non-spam mailboxes. When zmtrainsa runs, these messages are used to teach the spam filter. Make sure you add a large enough sampling of messages to these mailboxes. In order to get accurate scores to determine whether to mark messages as spam at least 200 known spams and 200 known hams must be identified.

The zmtrainsa command can be run manually to forward any folder from any mailbox to the spam training mailboxes. To send a folder to the spam training mailbox, type the command as:

zmtrainsa <server> <user> <password> spam [foldername]
To send the to the non-spam training mailbox, type:

zmtrainsa <server> <user> <password> ham [foldername]

http://wiki.zimbra.com/index.php?title=Zimbra_MTA

[mmorse]

Therefore I suggest not to set the minimum below 2 days for junk mail purge.