Rebuilding - no spam score.

[David Jones]

On 11/17/2017 05:49 AM, Richard Mealing wrote:
> Hi all, happy Friday!
> 
> Not sure if this is a bug or not, but I’ve noticed on occasion some 
> emails just get through our scanners with no score at all.
> 
> When checking mailwatch I can see in the SA Score is just says ‘Rebuilding’.
> 
> A while ago I disabled Bayes as it was causing too many problems. I am 
> filtering 100’s of domains, so I find it difficult to make it work 
> properly (tips welcome).
> 

Definitely enable a global Bayes.  Control your ham/spam training and 
don't let users determine the classification -- they think everything 
unwanted at the time is spam but that is not true.

I setup an iRedmail server VM and tell MailScanner to send copies of 
email to an internal-only domain hosted on that iRedmail box.  Then I 
use inbox rules to move mail with certain rule hits into "Ham" and 
"Spam" folders.  After a quick check to verify the classification based 
on a quick subject scan, I mark the folders as read.  A nightly script 
runs to training my Bayes from the maildir "cur" directories in each ham 
and spam directories.

Initially you can start out by simply dragging and dropping into your 
ham and spam folders just to get going.  Later you will start seeing 
patterns in SpamAssassin rule hits that help classification with inbox 
rules.  Very high/low scores can be used as the primary pre-sorting rules.

I am using Redis storage for my Bayes DB so I can easily share across 8 
MailScanner filters and the iRedMail training instance.  Each 
MailScanner filter can also train Bayes from the MailWatch web interface 
if I come across something with an incorrect BAYES_ rule hit.  This used 
to be often but now it's pretty accurate.

> I noticed in the maillog that MailScanner rebuilt Bayes just before this 
> message ID, so I have now changed -
> 
> Rebuild Bayes Every = 7200
> 
> To this –
> 
> Rebuild Bayes Every = 0
> 

My setting is 0 since I am using Redis which automatically handles 
expiration of tokens.

> I think this has fixed it, but I am not 100% sure. I haven’t seen a 
> problem since making this change.
> 
> Why does MailScanner let the email through without SA scoring it? Maybe 
> it is because I disabled Bayes, but likely there is a code problem.
> 
> I am running this on FreeBSD, so since there are no new builds that work 
> with my OS, I am using 4.85.2.
> 
> Thanks,
> 
> Rich
> 

Check your MailScanner.conf for:

Max Spam Check Size = 1200k

The default is much lower than my setting above.

Spam is typically small so it can be sent out as fast as possible but 
sometimes you will see a large attachment or something which makes it 
large possible to get pass SpamAssassin's default setting.

When this happens it should be logged and the score is 0.0.

-- 
David Jones