spam learning on gateway

[Chris Connell]

Thanks - sounds good. Could you give me an idea on the spec of your gateway
and number of messages processed? Also how many mails have you fed the bayes
engine- I read you need 1k + to be effective. I guess the more you feed it
the more cpu is used. I found that when I switched on bayes the cpu went
through the roof and spamassassin kept timing out.

Im running ours on a Sun Ultra 5(not very good by todays standards),
blocking around 24k spams per day and processing about 40k+ messages.
I think I would need quite a meaty machine to use bayes as well so am
currently asking for an upgrade.



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of James Gray
Sent: 13 April 2004 23:02
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: spam learning on gateway

Chris Connell wrote:
> Hi
> We are running spamassassin with mailscanner on our email gateway (solaris
> 9). Some spams are getting through past spamassassin, although it catches
> most of them. The users forward me the spam to block. (Local users are on
ms
> exchange)
>
> I thought of an idea to use the bayes learning feature in spamassassin as
> follows
>
> - users would forward the spam mail they get to a folder on the gateway
> - I would run sa-learn on the folder every hour.

We use the auto-learn feature in SpamAssassin to teach the Bayesian
engine about our mail.  Anything that scores >=10 is learnt as spam and
anything that score <=-2 is learnt as ham.  We've been running this way
for about a year and its proved very effective.

I also run a bunch of RBL's and custom rules to assist (see
http://files.grayonline.id.au/).  Our combined false +/-ve rate for the
last 6 months is <0.5%.  :)

Yesterday I installed the SpamCopURI SpamAssassin plug-in and added the
SpamCopURI RBL and SURBL (http://surbl.org) and this pair looks VERY
good so far - no false +ve's or -ve's in the last 24hrs from over 20,000
messages processed.  Anything that helps cant be bad right?

Cheers,

James

This communication is from IS Solutions Plc, Windmill House, 91-93 Windmill
Road, Sunbury on Thames, Middlesex, England. This email (including any
attachments) is intended only for the recipient(s) named above. It may
contain confidential or privileged information. If you are not the intended
recipient, please do not read, distribute, copy or otherwise use this
communication or the information in it. Any views or opinions expressed in
this email may be solely those of the author and are not necessarily those
of IS Solutions Plc. Any pricing quoted in this email is offered to the
recipient on a best estimate time and materials basis only. If you have
received this communication in error, please notify us by email
(helpdesk at issolutions.co.uk) or by telephone (+44 (0)1932 893444) and then
delete the email and any copies of it.