false negatives

[Alex Neuman van der Hans]

Seems your Bayes is the problem. BAYES_00 means the probability of this
message being spam because of its wording is quite low. You may want to
regenerate your Bayes database.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Kevin Miller
Sent: Thursday, April 28, 2005 4:26 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: false negatives

I'm seeing a bit of spam slipping through that I'd have thought would get
caught.  It looks pretty spammy, and here's the SpamCheck results:

X-CBJ-MailScanner-SpamCheck: not spam, SpamAssassin (score=2.309, required
5,
        BAYES_00 -4.90, DRUGS_ERECTILE 1.00, DRUGS_ERECTILE_OBFU 1.50,
        HTML_50_60 0.10, HTML_FONT_BIG 0.27, HTML_MESSAGE 0.10,
        MSGID_FROM_MTA_SHORT 3.03, PRIORITY_NO_NAME 1.21)

This is just one example, I also see the odd mortgage pitch, or a 419 scam,
etc. every now and then.  Strange thing is, sometimes I'll see a spam
message slipping through and an identical (but different recipient) one
getting caught.  Didn't think to compare the headers at the time though.
Doh.

On about all the stuff that slips throuhg I see the first test, BAYES_00
-4.90.  Would this indicate that I'm suffering from a case of bayes
poisoning?  Should I dump the bayes database and start over using the
starter kit on Fortress' site, or are there other, better options?

TIA...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!