low scoring spam

[Craig Daters]

Cathy, you should look to 'Rules Du Jour' to add SA Rule checks that
would catch a lot of that if you are not already. Then SA-Learn goes
a long way towards catching things like this too once it it trained.

I trained mine real quick when one of our users was receiving so much
spam, that we changed his email address. I turned his old email
address into a 'spam trap'. I have a script written and set up as a
cron job to parse these 'spam trap' accounts daily.

Likewise I have a few 'ham trap' email addresses set up to do the
same, though with the exception of one, I do not auto parse these as
I want to puruse them beforehand to confirm that spam is not slipping
in.

The spam at ourdomain.com and notspam at ourdomain.com are emails that are
set up for our users to bounce messages to that make it through.

Check out the FAQ at
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/275.html

Here is my script and crontab entry:

crontab:

05 0 * * * /usr/local/bin/my_sa_learn.sh

my_sa_learn.sh:

#!/bin/sh

if [ -e /var/mail/spam ]; then
/usr/bin/sa-learn --spam -p /etc/MailScanner/spam.assassin.prefs.conf
--mbox /var/mail/spam
rm /var/mail/spam > /dev/null
fi

if [ -e /var/mail/jet ]; then
/usr/bin/sa-learn --spam -p /etc/MailScanner/spam.assassin.prefs.conf
--mbox /var/mail/jet
rm /var/mail/jet > /dev/null
fi

if [ -e /var/mail/graphics ]; then
/usr/bin/sa-learn --spam -p /etc/MailScanner/spam.assassin.prefs.conf
--mbox /var/mail/graphics
rm /var/mail/graphics > /dev/null
fi

if [ -e /var/mail/notspam ]; then
/usr/bin/sa-learn --ham -p /etc/MailScanner/spam.assassin.prefs.conf
--mbox /var/mail/notspam
rm /var/mail/notspam > /dev/null
fi

/usr/bin/sa-learn --rebuild -p /etc/MailScanner/spam.assassin.prefs.conf

This has really helped to bring our spam problem to
--
--

Craig Daters (craig at westpress.com)
Systems Administrator
West Press Printing
1663 West Grant Road
Tucson, Arizona 85745-1433

Tel: 520-624-4939
Fax: 520-624-2715

www.westpress.com

--