MailScanner and SA auto-learning

[Kai Schaetzl]

Matt Kettler wrote on Tue, 04 Apr 2006 14:34:46 -0400:

> No, it's hard-coded. This is entirely on-purpose, to prevent someone from 
> screwing themselves over by making the autolearner to aggressive. 

Yeah, I know. They said the same thing about the normal autolearning score but 
then added local.cf options for it, anyway.

>  
> The hard-coding is in AutoLearnThreshold.pm. 
> --------- 
>  if ($isspam) { 
>    my $required_body_points = 3; 
>    my $required_head_points = 3; 
> --------- 

Yeah, I remember those. Most of my spam gets around 2 for header when the whole 
score is 10-20 and most of the rest is bayes_99, URIBL or some SARE rule and 
most of them hit on the body. Since most of the spam is caught before 
spamassassin only a small percentage makes it into SA, anyway. I would at least 
like to train on these. At the moment no training seems to take place.
I suppose that minimal score system for header and body is meant to 
countermeasure very high scores put manually in the local.cf f.i. for 
whitelisting certain hosts. I don't do this stuff. It would be nice if SA could 
rethink it's decision based on the other score. So, if the header score is less 
than 3 than require a body score of 10 for autolearning or so. Well, maybe I 
suggest this on satalk.

>  
> If you need to pick up header points, usually the conventional RBL tests do a 
> good job. However, since you're using SURBLs I'm assuming you're using those 
> too. You really should be seeing at least some autolearning. 

No, I use SURBLs because they work great, but I don't use any RBLs in MS or SA. 
My opinion is that I trust in one I can just use it on MTA level. I trust in 
three RBLs and results are very very good.

> Any chance ALL_TRUSTED is misfiring and dragging down the header score?

No, that's working actually very nicely. F.i. it detects the mail that gets 
submitted by clients directly to the machine for relaying and helps to make them 
"non-spammy".

Kai

-- 
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com