<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Palatino Linotype";
panose-1:2 4 5 2 5 5 5 3 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">Put this in your local.cf<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-indent:36.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">score BAYES_99 6.0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">Personally I think 6.0 is a bit high. There is significant risk of false positive if one single rule can give enough points to block the message.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">Are you using network tests (RBL blocklists, etc.)? These are usually very effective. See<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">
<a href="https://wiki.apache.org/spamassassin/UsingNetworkTests">https://wiki.apache.org/spamassassin/UsingNetworkTests</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:windowtext">--<br>
<a href="mailto:Kai.Risku@arrak.fi"><span style="color:blue">Kai.Risku@arrak.fi</span></a> GSM +358-40-767 8282<br>
Oy Arrak Software Ab <a href="http://www.arrak.fi"><span style="color:blue">http://www.arrak.fi</span></a><br>
<br>
<br>
</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"> amavis-users [mailto:amavis-users-bounces+kai.risku=arrak.fi@amavis.org]
<b>On Behalf Of </b>Nikolaos Milas<br>
<b>Sent:</b> Friday, October 14, 2016 8:24 AM<br>
<b>To:</b> amavis-users@amavis.org<br>
<b>Subject:</b> Increase spamassassin bayes99 score<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><tt><span style="font-size:10.0pt">Hello, </span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">After relatively long training of bayes filters, we are consistently getting bayes99 score of 3.5 (on spam mails).
</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">It seems this is the max score assigned to bayes99. How/where can we increase this value?
</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Config files are at: /etc/amavisd.conf and at /etc/mail/spamassassin/local.cf</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Spam mails still get through because a higher total score is needed for them to be auto designated as spam.
</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Here is a typical header of such a mail: </span>
</tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p><tt><span style="font-size:10.0pt">X-Spam-Flag: NO</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>X-Spam-Score: 5.153</tt><br>
<tt>X-Spam-Level: *****</tt><br>
<tt>X-Spam-Status: No, score=5.153 tagged_above=-999 required=5.5</tt><br>
<tt> tests=[BAYES_99=3.5, BAYES_999=0.2, DATE_IN_PAST_12_24=1.049,</tt><br>
<tt> DKIM_ADSP_CUSTOM_MED=0.001, FREEMAIL_FROM=0.001,</tt><br>
<tt> HTML_IMAGE_RATIO_06=0.001, HTML_MESSAGE=0.001, IP_LINK_PLUS=0.012,</tt><br>
<tt> NML_ADSP_CUSTOM_MED=0.9, NORMAL_HTTP_TO_IP=0.001,</tt><br>
<tt> RP_MATCHES_RCVD=-0.313, SPF_HELO_PASS=-0.1, SPF_PASS=-0.1]</tt><br>
<tt> autolearn=disabled</tt></span><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
</blockquote>
<p><tt><span style="font-size:10.0pt">How should I best handle the issue? I think that raising max score from 3.5 to e.g. 6.0 might do the trick. Any other options?</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Some additional data: </span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">$ sa-learn --dbpath '/var/amavis/var/.spamassassin' --dump magic</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>0.000 0 3 0 non-token data: bayes db version</tt><br>
<tt>0.000 0 2063 0 non-token data: nspam</tt><br>
<tt>0.000 0 1010 0 non-token data: nham</tt><br>
<tt>0.000 0 217776 0 non-token data: ntokens</tt><br>
<tt>0.000 0 1219096335 0 non-token data: oldest atime</tt><br>
<tt>0.000 0 1476418883 0 non-token data: newest atime</tt><br>
<tt>0.000 0 1476418900 0 non-token data: last journal sync atime</tt><br>
<tt>0.000 0 1471602636 0 non-token data: last expiry atime</tt><br>
<tt>0.000 0 0 0 non-token data: last expire atime delta</tt><br>
<tt>0.000 0 0 0 non-token data: last expire reduction count</tt></span><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Please advise.</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Thanks in advance,</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>Nick</tt></span><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
</div>
</body>
</html>