Well its just under the spam score of 5,<div><br></div><div>Apart from the uri-bl entries its not hitting many rules so perhaps dropping the spam (full headers as well ) so people can run on their systems and see what rules hit</div>
<div><br></div><div>Are you running sa-update every so often for rule updates to be applied</div><div><br></div><div>Also worth looking at the 'getting the most out of spamassin' section of the wiki. The extra rulesets mentioned there are a little outdated but i think the other suggestions are worthwhile</div>
<div><br></div><div>Oh and 6000 spam isnt much, i was looking at that an hour a few years ago on one of my systems :-)</div><div><br></div><div>Martin<span></span><br><br>On Wednesday, 14 November 2012, Max Kipness wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal">Hello -<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I set up a new MailScanner system with the latest software, version of SpamAssassin with Bayes, etc. a couple of month ago. It was working really well for a while, but in the last week we’ve started getting bombed with loan, medicine spam, etc. The most prevalent spam email of late is the one that has wide but short image that tries to present itself at the top of the email. All the images look the same size across different spam topics and different senders, but of course Outlook blocks the image with a red x.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Well when I look at the score, most have a fairly high score except for the Bayes which will usually be at 50%. So this causes it to be considered non spam. I send tons of these for learning, but no change. The next one will come in with a 50% bayes score. At this point is this considered Bayes Poisoning? Should I start over on Bayes? I manage the system, so I also have an IMAP account to the MS system and created a program that grabs the email out of my IMAP spam folder, sends it for learning, and then saves it in an mbox file. So I have every spam message I’ve ever sent. So would the best course at this point be to start clean on Bayes and then feed all the spam back in?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">FYI, this MS system does filter tons of spam. Yesterday’s count was 6,702 spam caught. But I’ve seen an increase from 1 or 2 a day personally to about 10 - 20, some of them going to Outlook Junk.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">As I’m writing this I just got another one of those image spams about medicate. Here is the score. If my Bayes was reporting right, it would have been considered spam.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">not spam, SpamAssassin (not cached,<u></u><u></u></p><p class="MsoNormal"> score=4.733, required 5, BAYES_50 0.80, HTML_MESSAGE 0.00,<u></u><u></u></p>
<p class="MsoNormal"> RDNS_DYNAMIC 0.98, URIBL_DBL_SPAM 1.70, URIBL_JP_SURBL 1.25)<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Thanks,<u></u><u></u></p><p class="MsoNormal">
Max<u></u><u></u></p></div></div></blockquote></div><br><br>-- <br>-- <br>Martin Hepworth, CISSP<br>Oxford, UK<br>