MS/SA occasionally not calling Bayes?

[David While]

Correct me if I am wrong (I am sure you will!) but SA will only include
the BAYES_??=xx score if it actually finds a hit similar to all the
other SA rules - so it is perfectly possible to get Spam without a BAYES
score - it doesn't mean that SA hasn't consulted the Bayes DB it simply
means it didn't find a hit.

-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
Behalf Of David Lee
Sent: 06 May 2004 10:10
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: MS/SA occasionally not calling Bayes?


(Redhat 7.3; sendmail; MS 4.26.8; SA 2.63; configs left at defaults
where
reasonably possible, but adding a few other SA rulesets.  University;
many
thousand users.)

The systems (MS/SA/Bayes/DCC) seem to work reasonably well at spam
detection. Each handles around 80,000 emails per day, tagging about
30,000
as spam (threshold 6).

Assuming that my own inbound email is reasonably typical of that for our
other users, each day I check my spam folder to check for false
positives,
and also to check how the SA rules are behaving.

Most spams include, as expected, a "BAYES_nn=ii" in the score, and often
of course these are "BAYES_99".  Fine so far.  Sometimes the values are
lower, including BAYES_50=0.0 and BAYES_44=-0.0 values.  This latter
point
demonstrates that at least Bayes has been has been invoked.  Again,
fine.
But occasionally a spam will fail to include any such score, as if it
has
somehow bypassed SA/Bayes (or been ignored by it, or similar).

Of course, there's the chance that these might be sneaking through when
the Bayes database is being rebuilt.  But I have:
   Wait During Bayes Rebuild = yes

so that ought not to happen.  And when I cross-check the timestamp on
the
"Received:" (as it passes through the relevant MS/SA/Bayes machine) with
the "SpamAssassin Bayes database rebuild ..." messages in the log, there
is no coincidence (i.e. this problem does not coincide with database
rebuilds every four hours).

Any thoughts?

I also see occasional false negatives (to my mind clearly spam, but
getting into my ordinary INBOX.  I suspect that these, too, will have
somehow bypassed the SA/Bayes, and so may share the same underlying
cause.
(On hams, we don't include the SA scores, so this is difficult to
confirm.)


(I've checked the MAQ and couldn't find reference to this.  But if I've
missed it, let me know!)

--

:  David Lee                                I.T. Service          :
:  Systems Programmer                       Computer Centre       :
:                                           University of Durham  :
:  http://www.dur.ac.uk/t.d.lee/            South Road            :
:                                           Durham                :
:  Phone: +44 191 334 2752                  U.K.                  :

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html