Increase spamassassin bayes99 score

[Dino Edwards]

Yasou NiKo,

There are a few things that might be going on here. What is the average score of the ham e-mails that you are getting through. The reason I’m asking is can you possibly bring down your required=5.5 score? Every installation is different but our required= score is set to  3.6 and that seems to work very well. The required = score would be set in your amavis config file as follows (the parameter below is probably how it’s set in your amavis):

$sa_tag2_level_deflt = 3.6;

If your spam filter is trained properly, you should be able to bring that score down and not have to worry about false positives. Alternatively, if you really want to raise the bayes_99 score you would set it in /etc/spamasassain/local.cf as follows:

#override bayes default scores
score BAYES_99 5

But, in the grand scheme of things, your spamfilter is your very last line of defense against spam. Are you doing all you can to prevent spam from ever reaching your spam filter? Things like RBL blocking on the MTA level, graylisting etc?

Thanks

Dino
--
[hermes_logo3]
Hermes Secure Email Gateway
Hermes Secure Email Gateway combines Open Source technologies such as Postfix, Apache SpamAssassin, ClamAV, Amavisd-new, MySQL and CipherMail under one unified web based Web GUI for easy administration and management of your incoming and ougoing email for your organization. Anti-spam, anti-virus and anti-malware protection, encrypted S/MIME, encrypted PDF and SMTP TLS support, built-in email archiving, end-user self-service web gui.

Download the free open-source appliance at:
http://www.deeztek.com/hermes-secure-email-gateway/

From: amavis-users [mailto:amavis-users-bounces+dino.edwards=mydirectmail.net at amavis.org] On Behalf Of Nikolaos Milas
Sent: Friday, October 14, 2016 1:24 AM
To: amavis-users at amavis.org
Subject: Increase spamassassin bayes99 score


Hello,

After relatively long training of bayes filters, we are consistently getting bayes99 score of 3.5 (on spam mails).

It seems this is the max score assigned to bayes99. How/where can we increase this value?

Config files are at: /etc/amavisd.conf and at /etc/mail/spamassassin/local.cf

Spam mails still get through because a higher total score is needed for them to be auto designated as spam.

Here is a typical header of such a mail:

X-Spam-Flag: NO
X-Spam-Score: 5.153
X-Spam-Level: *****
X-Spam-Status: No, score=5.153 tagged_above=-999 required=5.5
    tests=[BAYES_99=3.5, BAYES_999=0.2, DATE_IN_PAST_12_24=1.049,
    DKIM_ADSP_CUSTOM_MED=0.001, FREEMAIL_FROM=0.001,
    HTML_IMAGE_RATIO_06=0.001, HTML_MESSAGE=0.001, IP_LINK_PLUS=0.012,
    NML_ADSP_CUSTOM_MED=0.9, NORMAL_HTTP_TO_IP=0.001,
    RP_MATCHES_RCVD=-0.313, SPF_HELO_PASS=-0.1, SPF_PASS=-0.1]
    autolearn=disabled

How should I best handle the issue? I think that raising max score from 3.5 to e.g. 6.0 might do the trick. Any other options?

Some additional data:

$ sa-learn --dbpath '/var/amavis/var/.spamassassin' --dump magic
0.000          0          3          0  non-token data: bayes db version
0.000          0       2063          0  non-token data: nspam
0.000          0       1010          0  non-token data: nham
0.000          0     217776          0  non-token data: ntokens
0.000          0 1219096335          0  non-token data: oldest atime
0.000          0 1476418883          0  non-token data: newest atime
0.000          0 1476418900          0  non-token data: last journal sync atime
0.000          0 1471602636          0  non-token data: last expiry atime
0.000          0          0          0  non-token data: last expire atime delta
0.000          0          0          0  non-token data: last expire reduction count

Please advise.

Thanks in advance,
Nick
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.amavis.org/pipermail/amavis-users/attachments/20161014/98b2395f/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.jpg
Type: image/jpeg
Size: 1921 bytes
Desc: image003.jpg
URL: <http://lists.amavis.org/pipermail/amavis-users/attachments/20161014/98b2395f/attachment.jpg>