« Return to Thread: sender name same as recipient name
Re: sender name same as recipient name
by John Hardin
::
Rate this Message:
On Mon, 24 Sep 2007, feral wrote:
> RE: training. I don't know. My experience w/ SA is that
> it just works and I haven't dealt with it at this level yet.
> What is strange is that SA appeared to be working fine
> for my client, then all of the sudden this spike in spam
> occurred... and as I said, 99% of the spams have the
> sender name same as recipient name (see original post).
>
> Below is the result of sa-learn -D --dump magic. I see
> that "bayes: no dbs present" ... that looks bad. Maybe
> this SA was not installed properly. Thanks for your help.
> [24475] dbg: bayes: no dbs present, cannot tie DB R/O:
> /root/.spamassassin/bayes_toks
> [24475] dbg: config: score set 1 chosen.
> [24475] dbg: bayes: no dbs present, cannot tie DB R/O:
> /root/.spamassassin/bayes_toks
This doesn't look like global bayes, and I don't use per-user so my
advice may be a little inaccurate...
Is there a .spamassassin subdirectory in that user's home directory?
Does it have bayes_* files?
If so, log in as that user (e.g. "su - mark") and run "sa_learn --dump
magic" and see what the ham/spam token balance looks like.
You should try to find out how bayes is being trained. I still think
your problem stems (at least partly) from badly mistrained bayes.
As others have suggested, make sure you are *not* using
"whitelist_from". That particular option is a last-resort fallback
option because it's so easy to bypass through forgery. However, as the
header samples you posted did not say a whitelist rule was hitting,
and the scores were not large and negative, that's probably not a
cause of this particular problem.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@... FALaholic #11174 pgpk -a jhardin@...
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Pelley: Will you pledge not to test a nuclear weapon?
Ahmadeinejad: CIA! Secret prison in Europe! Abu Ghraib!
-- Mahmoud Ahmadeinejad clumsily dodges a question
(60 minutes interview, 9/20/2007)
-----------------------------------------------------------------------
243 days until the Mars Phoenix lander arrives at Mars
> RE: training. I don't know. My experience w/ SA is that
> it just works and I haven't dealt with it at this level yet.
> What is strange is that SA appeared to be working fine
> for my client, then all of the sudden this spike in spam
> occurred... and as I said, 99% of the spams have the
> sender name same as recipient name (see original post).
>
> Below is the result of sa-learn -D --dump magic. I see
> that "bayes: no dbs present" ... that looks bad. Maybe
> this SA was not installed properly. Thanks for your help.
> [24475] dbg: bayes: no dbs present, cannot tie DB R/O:
> /root/.spamassassin/bayes_toks
> [24475] dbg: config: score set 1 chosen.
> [24475] dbg: bayes: no dbs present, cannot tie DB R/O:
> /root/.spamassassin/bayes_toks
This doesn't look like global bayes, and I don't use per-user so my
advice may be a little inaccurate...
Is there a .spamassassin subdirectory in that user's home directory?
Does it have bayes_* files?
If so, log in as that user (e.g. "su - mark") and run "sa_learn --dump
magic" and see what the ham/spam token balance looks like.
You should try to find out how bayes is being trained. I still think
your problem stems (at least partly) from badly mistrained bayes.
As others have suggested, make sure you are *not* using
"whitelist_from". That particular option is a last-resort fallback
option because it's so easy to bypass through forgery. However, as the
header samples you posted did not say a whitelist rule was hitting,
and the scores were not large and negative, that's probably not a
cause of this particular problem.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@... FALaholic #11174 pgpk -a jhardin@...
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Pelley: Will you pledge not to test a nuclear weapon?
Ahmadeinejad: CIA! Secret prison in Europe! Abu Ghraib!
-- Mahmoud Ahmadeinejad clumsily dodges a question
(60 minutes interview, 9/20/2007)
-----------------------------------------------------------------------
243 days until the Mars Phoenix lander arrives at Mars
« Return to Thread: sender name same as recipient name
| Free embeddable forum powered by Nabble | Forum Help |
