SA Scoring

[Matt Kettler]

uxbod at splatnix.net wrote:

> 
> When I get these I train using sa-learn, but after reading this will only
> happen if a minumum of three criteria are met.

Eh? The multi-critera only applies to automatic learning. Manual training ALWAYS
applies.

However, one thing to be careful of is to make sure you're training the right
bayes database.

Newer versions of MailScanner set the bayes_path using mailscanner.cf, however
older versions did not have this. In those older versions, any manual training
would go to a different bayes DB than the one MailScanner uses at run-time.

> 
> How are you all handling messages like this ?

Personally, my system tears most of these up, assuming you're talking about the
recent wave of pill-spams with just a single line of text and a URL. The URIBL
tests are tearing them to shreds:

X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=40.403, required 5,
	autolearn=spam, BAYES_99 3.50, HELO_DYNAMIC_HCC 4.10,
	HELO_DYNAMIC_IPADDR2 3.82, INFO_GREYLIST_DELAYED 0.40,
	RAZOR2_CF_RANGE_51_100 0.50, RAZOR2_CF_RANGE_E8_51_100 1.50,
	RAZOR2_CHECK 0.50, RCVD_IN_BL_SPAMCOP_NET 1.56,
	RCVD_IN_SORBS_DUL 2.05, RCVD_IN_XBL 3.90, SURBL_MULTI1 -0.50,
	SURBL_MULTI2 -0.20, SURBL_MULTI3 -0.20, SURBL_MULTI4 -0.20,
	URIBL_AB_SURBL 3.81, URIBL_BLACK 1.50, URIBL_BLACK_OVERLAP -1.00,
	URIBL_JP_SURBL 4.09, URIBL_OB_SURBL 3.01, URIBL_SBL 1.64,
	URIBL_SC_SURBL 4.50, URIBL_WS_SURBL 2.14)


What version of SA are you using? are you using any add-ons?

Do you have Net::DNS installed, and have network checks enabled?

Do you have the uribl plugin loaded in your init.pre?


> 
> Thanks,
> 
>