MS/SA occasionally not calling Bayes?

[David Lee]

(Redhat 7.3; sendmail; MS 4.26.8; SA 2.63; configs left at defaults where
reasonably possible, but adding a few other SA rulesets.  University; many
thousand users.)

The systems (MS/SA/Bayes/DCC) seem to work reasonably well at spam
detection. Each handles around 80,000 emails per day, tagging about 30,000
as spam (threshold 6).

Assuming that my own inbound email is reasonably typical of that for our
other users, each day I check my spam folder to check for false positives,
and also to check how the SA rules are behaving.

Most spams include, as expected, a "BAYES_nn=ii" in the score, and often
of course these are "BAYES_99".  Fine so far.  Sometimes the values are
lower, including BAYES_50=0.0 and BAYES_44=-0.0 values.  This latter point
demonstrates that at least Bayes has been has been invoked.  Again, fine.
But occasionally a spam will fail to include any such score, as if it has
somehow bypassed SA/Bayes (or been ignored by it, or similar).

Of course, there's the chance that these might be sneaking through when
the Bayes database is being rebuilt.  But I have:
   Wait During Bayes Rebuild = yes

so that ought not to happen.  And when I cross-check the timestamp on the
"Received:" (as it passes through the relevant MS/SA/Bayes machine) with
the "SpamAssassin Bayes database rebuild ..." messages in the log, there
is no coincidence (i.e. this problem does not coincide with database
rebuilds every four hours).

Any thoughts?

I also see occasional false negatives (to my mind clearly spam, but
getting into my ordinary INBOX.  I suspect that these, too, will have
somehow bypassed the SA/Bayes, and so may share the same underlying cause.
(On hams, we don't include the SA scores, so this is difficult to
confirm.)


(I've checked the MAQ and couldn't find reference to this.  But if I've
missed it, let me know!)

--

:  David Lee                                I.T. Service          :
:  Systems Programmer                       Computer Centre       :
:                                           University of Durham  :
:  http://www.dur.ac.uk/t.d.lee/            South Road            :
:                                           Durham                :
:  Phone: +44 191 334 2752                  U.K.                  :

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html