Rebuilding - no spam score.
djones at ena.com
Fri Nov 17 12:13:40 UTC 2017
On 11/17/2017 05:49 AM, Richard Mealing wrote:
> Hi all, happy Friday!
> Not sure if this is a bug or not, but I’ve noticed on occasion some
> emails just get through our scanners with no score at all.
> When checking mailwatch I can see in the SA Score is just says ‘Rebuilding’.
> A while ago I disabled Bayes as it was causing too many problems. I am
> filtering 100’s of domains, so I find it difficult to make it work
> properly (tips welcome).
Definitely enable a global Bayes. Control your ham/spam training and
don't let users determine the classification -- they think everything
unwanted at the time is spam but that is not true.
I setup an iRedmail server VM and tell MailScanner to send copies of
email to an internal-only domain hosted on that iRedmail box. Then I
use inbox rules to move mail with certain rule hits into "Ham" and
"Spam" folders. After a quick check to verify the classification based
on a quick subject scan, I mark the folders as read. A nightly script
runs to training my Bayes from the maildir "cur" directories in each ham
and spam directories.
Initially you can start out by simply dragging and dropping into your
ham and spam folders just to get going. Later you will start seeing
patterns in SpamAssassin rule hits that help classification with inbox
rules. Very high/low scores can be used as the primary pre-sorting rules.
I am using Redis storage for my Bayes DB so I can easily share across 8
MailScanner filters and the iRedMail training instance. Each
MailScanner filter can also train Bayes from the MailWatch web interface
if I come across something with an incorrect BAYES_ rule hit. This used
to be often but now it's pretty accurate.
> I noticed in the maillog that MailScanner rebuilt Bayes just before this
> message ID, so I have now changed -
> Rebuild Bayes Every = 7200
> To this –
> Rebuild Bayes Every = 0
My setting is 0 since I am using Redis which automatically handles
expiration of tokens.
> I think this has fixed it, but I am not 100% sure. I haven’t seen a
> problem since making this change.
> Why does MailScanner let the email through without SA scoring it? Maybe
> it is because I disabled Bayes, but likely there is a code problem.
> I am running this on FreeBSD, so since there are no new builds that work
> with my OS, I am using 4.85.2.
Check your MailScanner.conf for:
Max Spam Check Size = 1200k
The default is much lower than my setting above.
Spam is typically small so it can be sent out as fast as possible but
sometimes you will see a large attachment or something which makes it
large possible to get pass SpamAssassin's default setting.
When this happens it should be logged and the score is 0.0.
More information about the MailScanner