What is the best High SpamAssassin Score

[Randal, Phil]

In my /etc/MailScanner/MailScanner.conf:

# This replaces the SpamAssassin configuration value 'required_hits'.
# If a message achieves a SpamAssassin score higher than this value,
# it is spam. See also the High SpamAssassin Score configuration option.
# This can also be the filename of a ruleset, so the SpamAssassin
# required_hits value can be set to different values for different messages.
Required SpamAssassin Score = 4.75

# If a message achieves a SpamAssassin score higher than this value,
# then the "High Scoring Spam Actions" are used. You may want to use
# this to deliver moderate scores, while deleting very high scoring
messsages.
# This can also be the filename of a ruleset.
High SpamAssassin Score = 10.25

Spamassassin needs to learn 200 spam before auto-learning kicks in, if I
recall correctly.  I used Steve Freegard's MailWatch
(http://mailwatch.sf.net) and fed spam to sa-learn from there.  Once Bayes
is trained, it makes quite a difference.

Cheers,

Phil

---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Drew Marshall
> Sent: 23 February 2004 11:13
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: What is the best High SpamAssassin Score
>
>
> Having only just realised that by running the latest stable SA I have
> automatic Bayes, I am just starting to play. So how do I change the
> autolearn thresholds? I am very lucky with the amount of spam
> that hits
> the server (Postfix does some RBL at SMTP stage) but I have
> just enabled a
> couple of addresses that I used to use with Usenet which are being
> contantly spammed so I can get bayes to autolearn. Off the
> back of that I
> read last week that bayes wants 200 messages before it will start
> 'processing'. Now is that just 200 messages, in my instance
> autolearnt or
> do I also have to find it 200 ham messages? If so does it
> matter what or
> can I just pick 200 legitimate messages and feed the hungry beast?
>
> Drew (Feeling stupid this morning)
>
> Randal, Phil said:
> > My threshold is 4.75 for low, 10.25 for high, autolearning
> at 9, with
> > loads
> > of rules, razor, pyzor, dcc.  Bayes has been well-trained.
> >
> > A couple of spammers have tried to send us spam in batches
> of 100+ at a
> > time, so they've been blacklisted.
> >
> > I found one (disputable) false positive in that high range
> in the last 3
> > months.
> >
> > We still get a few false negatives, but new rules and Bayes
> usually catch
> > them.
> >
> > Now, if ownly we could persuade our users not to subscriber
> to spammers'
> > mailing lists.  You know the ones, special deals and offers
> lists, nothing
> > to do with work at all, and indistinguishable from the
> unsolicited stuff
> > :-(
> > Grrrrr.
> >
> > Cheers,
> >
> > Phil
> > ---------------------------------------------
> > Phil Randal
> > Network Engineer
> > Herefordshire Council
> > Hereford, UK
> >
> >> -----Original Message-----
> >> From: MailScanner mailing list
[mailto:MAILSCANNER at JISCMAIL.AC.UK]On
>> Behalf Of Chris Yuzik
>> Sent: 22 February 2004 16:35
>> To: MAILSCANNER at JISCMAIL.AC.UK
>> Subject: Re: What is the best High SpamAssassin Score
>>
>>
>> Stuart Clark wrote:
>>
>> >What is the best High SpamAssassin Score?
>> >
>> >Without getting complaints from customers
>> >
>> Stuart,
>>
>> Unfortunately, the answer is not that simple--the "best" score depends
>> on a number of factors. Spamassassin has quite a few options
>> and can be
>> tweaked like crazy. If you have Bayes running, that can increase the
>> score of spam. Also, DCC and Razor are great too. Perhaps even more
>> significantly, if you have added any additional rule sets, such as
>> BigEvil.cf, you catch more spam and will increase the scores
>> of spam as
>> well. (get it and others from
>> http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm)
> . It also
> depends on what you're going to do with your high spam--are you just
> tagging it and delivering it too? Or, if are you deleting it altogether,
> in which case you would want to be a bit more catious.
>
> On my server, I have bayes, Razor, and DCC running along with with a few
> custom rulesets. I am also using BigEvil.cf, popcorn.cf, weeds.cf, and a
> few others that I cannot remember right now.
>
> My thresholds are 5 points for spam and 15 points for high spam. I
> deliver spam as an attachment, but quarantine high spam for a couple of
> weeks; the user doesn't receive any notification of high-spam.
>
> Cheers,
> Chris
>


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy