MailScanner and SA auto-learning

[Kai Schaetzl]

Martin Hepworth wrote on Wed, 5 Apr 2006 12:41:05 +0100:

> Hmm is MailScanner running as a non-root user and can that user write to all 
> bayes files/directory?

Martin, thanks for your help, but you are really following the wrong course ;-)
I get too few header hits. So, SA is working by design. It's not many spam that 
gets thru to SA and most of those are caught my numerous SURBL, SARE hits and 
Bayes, but too few header hits. Lets see if I can find an example. Ok, that one 
just arrived, these are the hits. As you see there's only 0.53 for header hits. 
There's nothing I can do to change this unless I change the SA code. Learning 
it would actually be quite nice and I do it manually for this one now. As you 
see BAYES wasn't clear about it.

0.53 ADDRESS_IN_SUBJECT To: address appears in Subject 
0.00 BAYES_50 Bayesian spam probability is 40 to 60% 
1.16 HTML_IMAGE_ONLY_20 HTML: images with 1600-2000 bytes of words 
0.46 HTML_IMAGE_RATIO_02 HTML has a low ratio of text to image area 
0.00 HTML_MESSAGE HTML included in message 
0.88 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image 
0.12 HTML_TEXT_AFTER_BODY HTML contains text after BODY close tag 
0.38 MAILTO_TO_REMOVE Includes a 'remove' email address 
0.00 MIME_HTML_ONLY Message only has text/html MIME parts 
-0.00 SPF_HELO_PASS SPF: HELO matches SPF record 
-0.00 SPF_PASS SPF: sender matches SPF record 
3.00 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist 
3.21 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist 
1.50 URIBL_SBL Contains an URL listed in the SBL blocklist 
4.00 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist 
2.00 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist 


Kai

-- 
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com