HELP? Spamassassin is scoring lower than normal the last couple of weeks.

[Scott Silva]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Joe Young spake the following on 11/3/2005 1:52 PM:
> Scott,
> 
> 	Thank you for your reply. I had Steve Swaney from FSL set up the
> filter servers with RulesDuJour. Steve said that BAYES should learn from
> Spamassassin. However, BAYES has now learned that some of the spam emails
> are ham mails. I will review my spamassassin scores. Thanks. By the way. My
> Spamassassin is at version 3.0.4. In the next couple of weeks, I will be
> upgrading to 3.1.
> 
> Thank you,
> 
> Joe Young
> 
>  
> 
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
> Of Scott Silva
> Sent: Thursday, November 03, 2005 10:24 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: HELP? Spamassassin is scoring lower than normal the last couple
> of weeks.
> 
> Joe Young spake the following on 11/3/2005 8:09 AM:
> 
>> 
>>Help,
>>
>>	I am running on CentOS release 4.0 (Final) with Perl version
>>5.008005 (5.8.5) and MailScanner version 4.42.9.  Spamassassin has 
>>been scoring lower than normal for the last couple of weeks. Most of 
>>the untagged spam has been the geocities link spam and the emails that 
>>contain mostly images. Almost all of the spam emails are scored with 
>>BAYES_00 -2.60. What are some possible steps to change the bayes score
> 
> without feeding it spam?
> 
>>Thank you,
>>
>>Joe Young
>>
> 
> In your spam.assassin.prefs.conf file you can change the score to closer to
> zero, otherwise it will keep poisoning the bayes cache.
> 
> You could try score BAYES_00 -1.00, or add some more rules to help bump the
> scores up.
> The RulesDuJour setup at Fortress Systems (www.fsl.com/support) Is an
> excellent addition to an excellent product.
> There are also some rules floating around the list archives for the
> geocities url junk.
> 
> Do the e-mails with mostly images score as such?
> You could bump the scores on those.
> It should hit either  HTML_IMAGE_ONLY_* or  HTML_IMAGE_RATIO_*.
> The scores on the latter are fairly low.
> Look at http://spamassassin.apache.org/tests_3_1_x.html
> for the default scores in 3.1.0
> If you haven't moved up yet, you might just want to find some time.
> 
> 
> 

Are you using Mailwatch?
It makes it easy to get bayes to forget some mails. I archive everything
for 2 weeks, and that way I can reverse any weird auto learned stuff.

Here is something I added to my spam.assassin.prefs.conf file for the
Geocities spam.



uri PROLO_GEO_CHECK1 /^http:\/\/.*\.geocities\.com\//
describe PROLO_GEO_CHECK1 PROLO_GEO_CHECK1, Body
score PROLO_GEO_CHECK1  5.0


Got it from the list, and modified it to hit all geocities, and not just
uk and italy. Change the score to suit your situation.


-- 

/-----------------------\           |~~\_____/~~\__  |
| MailScanner; The best |___________ \N1____====== )-+
| protection on the net!|                   ~~~|/~~  |
\-----------------------/                      ()

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!