<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.0.7">
</HEAD>
<BODY>
This will not be too helpful in solving your problems but it does show that spam detection is working on some systems.<BR>
<BR>
We're running MailScanner SpamAssassin 2.55 and MailScanner-4.22-5 on a Red Hat Enterprise 2.1 system that is a spampot. It gets NOTHING but spam. We have fed a lot of the spam to the Bayesian filter and this has improved our detection rate a bit.<BR>
<BR>
The spam threshold is set to 5 and High Spam is set to 10. A quick look at 1/2 days stats:<BR>
<BR>
<TT>Processed: 5052 24.6Mb <BR>
Spam: 5022 99.4% <BR>
High Scoring Spam: 2737 54.2%<BR>
</TT><BR>
Looks like it's missing .6% of today's junk.<BR>
<BR>
Another interesting static is the average size of a Spam message is 4.869 KB<BR>
<BR>
Steve<BR>
Steve@Swaney.com<BR>
<BR>
On Thu, 2003-07-24 at 17:41, John Rudd wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE><FONT COLOR="#737373"><I>I'm seeing a similar problem. My production machines are running v 2.43
with MailScanner 4.11-1, and got these scores:
X-UCSC-CATS-MailScanner-SpamCheck: spam, SpamAssassin (score=9.3,
required 8,
BIG_FONT, CLICK_BELOW, CLICK_HERE_LINK, CTYPE_JUST_HTML,
FORGED_RCVD_FOUND, HEADER_8BITS, HTML_70_90,
HTML_FONT_COLOR_GRAY,
HTML_FONT_COLOR_UNSAFE, HTML_FONT_COLOR_YELLOW,
LINES_OF_YELLING,
MISSING_MIMEOLE, MSG_ID_ADDED_BY_MTA_2, PRIORITY_NO_NAME,
SPAM_PHRASE_05_08, TO_LOCALPART_EQ_REAL, X_AUTH_WARNING)
The same message, running through SpamAssassin 2.55 and
MailScanner-4.22-5 gives these scores (I'm in the process of upgrading
right now, so my test machines are running these newer versions):
X-UCSC-KZIN-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.6,
required 5, CLICK_BELOW 0.10, HEADER_8BITS 1.18, HTML_70_80
0.51,
HTML_FONT_BIG 0.27, HTML_FONT_COLOR_GRAY 0.10,
HTML_FONT_COLOR_UNSAFE 0.10, HTML_LINK_CLICK_HERE 0.10,
HTML_MESSAGE 0.10, MIME_HTML_ONLY 0.10, MISSING_MIMEOLE 0.50,
MSG_ID_ADDED_BY_MTA_2 0.40, PRIORITY_NO_NAME 0.46,
X_AUTH_WARNING -0.40)
The current Spam Assassin looks like it has assigned 0's to the
LINES_OF_YELLING scores, for example.
(the spam in question, for those scores, was a gold and silver
investment blurb)
I wonder if it has something to do with which SA options mailscanner is
assuming (bayes, etc.), which might not be selecting the best possible
score sets.
> Stephen Swaney wrote:
>
> Sanjay,
>
> I believe that you should be at version 2.55 of SpamAssassin. This
> should make a difference.
>
> Steve
> Steve Swaney
> Steve@Swaney.com
>
> On Thu, 2003-07-24 at 11:38, Sanjay K. Patel wrote:
>
> > Thanks for the response,
> > Here are the headers. I am using version 2.52
> >
> > SpamCheck: not spam, SpamAssassin (score=0.4, required 5,
> > FOR_JUST_SOME_AMT 0.18, HTML_50_60 0.10, HTML_FONT_BIG 0.22,
> > HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_GRAY 0.10,
> > HTML_FONT_COLOR_RED 0.10, HTML_WEB_BUGS 0.10,
> > ORIGINAL_MESSAGE -0.50)
> >
> > This was the normal buy Norton junk. It should have scored higher.
> >
> > SKP
> >
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> > Of Martin Sapsed
> > Sent: Thursday, July 24, 2003 7:23 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: More spam after spamassain upgrade
> >
> >
> > Sanjay K. Patel wrote:
> > > We are seeing more spam getting through after upgrading spam assassin to
> > the
> > > latest version. Even the buy Norton cheap spam is getting through. All the
> > > spam scores below our threshold of 5.
> > >
> > > Have the spammers got smarter or do we need to fine tune something?
> >
> > Can you post the headers for e.g. a "buy Norton cheap" message which got
> > through - the categories SA lists might help us to advise you. Which
> > version do you mean by "the latest version"? What platform? What version
> > of MailScanner etc etc
> >
> > I'm using a copy of 2.60 from a little while ago along with DCC (with
> > it's score raised) and virtually nothing gets passed that.
> >
> > Cheers
> >
> > Martin
> >
> > --
> > Martin Sapsed
> > Information Services "Who do you say I am?"
> > University of Wales, Bangor Jesus of Nazareth
> ></I></FONT></PRE>
</BLOCKQUOTE>
</BODY>
</HTML>