<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Palatino Linotype";
panose-1:2 4 5 2 5 5 5 3 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Yasou NiKo,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">There are a few things that might be going on here. What is the average score of the ham e-mails that you are getting through. The reason I’m asking is can you
possibly bring down your </span><tt><span style="font-size:10.0pt">required=5.5 score? Every installation is different but our required= score is set to 3.6 and that seems to work very well. The required = score would be set in your amavis config file as
follows (the parameter below is probably how it’s set in your amavis):<o:p></o:p></span></tt></p>
<p class="MsoNormal"><tt><span style="font-size:10.0pt"><o:p> </o:p></span></tt></p>
<p class="MsoNormal"><tt><span style="font-size:10.0pt">$sa_tag2_level_deflt = 3.6;<o:p></o:p></span></tt></p>
<p class="MsoNormal"><tt><span style="font-size:10.0pt"><o:p> </o:p></span></tt></p>
<p class="MsoNormal"><tt><span style="font-size:10.0pt">If your spam filter is trained properly, you should be able to bring that score down and not have to worry about false positives. Alternatively, if you really want to raise the bayes_99 score you would
set it in /etc/spamasassain/local.cf as follows:<o:p></o:p></span></tt></p>
<p class="MsoNormal"><tt><span style="font-size:10.0pt"><o:p> </o:p></span></tt></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">#override bayes default scores<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">score BAYES_99 5<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">But, in the grand scheme of things, your spamfilter is your very last line of defense against spam. Are you doing all you can to prevent spam from ever reaching
your spam filter? Things like RBL blocking on the MTA level, graylisting etc?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Dino<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">--<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><img width="132" height="49" id="Picture_x0020_1" src="cid:image003.jpg@01D225F1.DE896CE0" alt="hermes_logo3"><o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">Hermes Secure Email Gateway<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#333333;background:white">Hermes Secure Email Gateway combines Open Source technologies such as Postfix, Apache SpamAssassin, ClamAV, Amavisd-new, MySQL and CipherMail under
one unified web based Web GUI for easy administration and management of your incoming and ougoing email for your organization. Anti-spam, anti-virus and anti-malware protection, encrypted S/MIME, encrypted PDF and SMTP TLS support, built-in email archiving,
end-user self-service web gui.</span><span style="font-size:10.0pt;font-family:"Courier New";color:#333333;background:white"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">Download the free open-source appliance at:<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><a href="http://www.deeztek.com/hermes-secure-email-gateway/">http://www.deeztek.com/hermes-secure-email-gateway/</a><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"> amavis-users [mailto:amavis-users-bounces+dino.edwards=mydirectmail.net@amavis.org]
<b>On Behalf Of </b>Nikolaos Milas<br>
<b>Sent:</b> Friday, October 14, 2016 1:24 AM<br>
<b>To:</b> amavis-users@amavis.org<br>
<b>Subject:</b> Increase spamassassin bayes99 score<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><tt><span style="font-size:10.0pt">Hello, </span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">After relatively long training of bayes filters, we are consistently getting bayes99 score of 3.5 (on spam mails).
</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">It seems this is the max score assigned to bayes99. How/where can we increase this value?
</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Config files are at: /etc/amavisd.conf and at /etc/mail/spamassassin/local.cf</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Spam mails still get through because a higher total score is needed for them to be auto designated as spam.
</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Here is a typical header of such a mail: </span>
</tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p><tt><span style="font-size:10.0pt">X-Spam-Flag: NO</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>X-Spam-Score: 5.153</tt><br>
<tt>X-Spam-Level: *****</tt><br>
<tt>X-Spam-Status: No, score=5.153 tagged_above=-999 required=5.5</tt><br>
<tt> tests=[BAYES_99=3.5, BAYES_999=0.2, DATE_IN_PAST_12_24=1.049,</tt><br>
<tt> DKIM_ADSP_CUSTOM_MED=0.001, FREEMAIL_FROM=0.001,</tt><br>
<tt> HTML_IMAGE_RATIO_06=0.001, HTML_MESSAGE=0.001, IP_LINK_PLUS=0.012,</tt><br>
<tt> NML_ADSP_CUSTOM_MED=0.9, NORMAL_HTTP_TO_IP=0.001,</tt><br>
<tt> RP_MATCHES_RCVD=-0.313, SPF_HELO_PASS=-0.1, SPF_PASS=-0.1]</tt><br>
<tt> autolearn=disabled</tt></span><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
</blockquote>
<p><tt><span style="font-size:10.0pt">How should I best handle the issue? I think that raising max score from 3.5 to e.g. 6.0 might do the trick. Any other options?</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Some additional data: </span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">$ sa-learn --dbpath '/var/amavis/var/.spamassassin' --dump magic</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>0.000 0 3 0 non-token data: bayes db version</tt><br>
<tt>0.000 0 2063 0 non-token data: nspam</tt><br>
<tt>0.000 0 1010 0 non-token data: nham</tt><br>
<tt>0.000 0 217776 0 non-token data: ntokens</tt><br>
<tt>0.000 0 1219096335 0 non-token data: oldest atime</tt><br>
<tt>0.000 0 1476418883 0 non-token data: newest atime</tt><br>
<tt>0.000 0 1476418900 0 non-token data: last journal sync atime</tt><br>
<tt>0.000 0 1471602636 0 non-token data: last expiry atime</tt><br>
<tt>0.000 0 0 0 non-token data: last expire atime delta</tt><br>
<tt>0.000 0 0 0 non-token data: last expire reduction count</tt></span><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Please advise.</span></tt><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
<p><tt><span style="font-size:10.0pt">Thanks in advance,</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>Nick</tt></span><span style="font-size:10.0pt;font-family:"Palatino Linotype",serif"><o:p></o:p></span></p>
</div>
</div>
</body>
</html>