Scoring questions

[Dino Edwards]

Please run amavisd in debug mode.

Stop the service

/etc/init.d/amavis stop

Then start in debug mode:

/etc/init.d/amavis debug

Open another session to your mail server and look at you /var/log/mail.log and you should see the following upon amavisd startup (or similar):

Jan 29 15:30:55.078 mail.domain.tld /usr/sbin/amavisd-new[8330]: initializing Mail::SpamAssassin (0)
Jan 29 15:30:55.078 mail.domain.tld /usr/sbin/amavisd-new[8330]: SpamAssassin debug facilities: info
Jan 29 15:30:55.712 mail.domain.tld /usr/sbin/amavisd-new[8330]: SA info: zoom: able to use 315/360 'body_0' compiled rules (87.5%)
Jan 29 15:30:56.454 mail.domain.tld /usr/sbin/amavisd-new[8330]: SpamAssassin loaded plugins: AskDNS, AutoLearnThreshold, Bayes, BodyEval, Check, DCC, DKIM, DNSEval, FreeMail, HTMLEval, HTTPSMismatch, Hashcash, HeaderEval, ImageInfo, MIMEEval, MIMEHeader, Pyzor, Razor2, RelayEval, ReplaceTags, Rule2XSBody, SPF, SpamCop, URIDNSBL, URIDetail, URIEval, VBounce, WLBLEval, WhiteListSubject
Jan 29 15:30:56.455 mail.domain.tld /usr/sbin/amavisd-new[8330]: SpamControl: init_pre_fork on SpamAssassin done
Jan 29 15:30:56.455 mail.domain.tld /usr/sbin/amavisd-new[8330]: extra modules loaded after daemonizing/chrooting: /usr/lib/perl5/auto/NetAddr/IP/InetBase/inet_n2dx.al, Mail/SpamAssassin/CompiledRegexps/body_0.pm, Mail/SpamAssassin/Plugin/FreeMail.pm, Net/DNS/RR/OPT.pm





From: Computer Bob [mailto:bob at inter-control.com]
Sent: Monday, January 29, 2018 3:24 PM
To: Dino Edwards <dino.edwards at mydirectmail.net>; amavis-users at amavis.org
Subject: Re: Scoring questions

Changes made, amavis restarted.
I have seen the following on all mails, I just was too lazy to include it because I had to blank the server name...skuza..

X-Virus-Scanned: Debian amavisd-new at M1-2.myorganization.org




On 1/29/18 2:15 PM, Dino Edwards wrote:
Please try

$sa_tag_level_deflt = undef;

In

/etc/amavis/conf.d/50-user

Do you see the X-Virus-Scanned header in the emails that amavisd processes?




From: amavis-users [mailto:amavis-users-bounces+dino.edwards=mydirectmail.net at amavis.org] On Behalf Of Computer Bob
Sent: Monday, January 29, 2018 2:40 PM
To: amavis-users at amavis.org<mailto:amavis-users at amavis.org>
Subject: Re: Scoring questions

I also agree that at this point auto learn should be off and cleared as I have done.
But I still continue to get garbage mails through showing headers such as:

X-Spam-Flag: NO

X-Spam-Score: 0.61

X-Spam-Level:

X-Spam-Status: No, score=0.61 tagged_above=-9999 required=5

        tests=[HTML_FONT_LOW_CONTRAST=0.001, HTML_IMAGE_RATIO_04=0.61,

        HTML_MESSAGE=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001,

        T_REMOTE_IMAGE=0.01, T_RP_MATCHES_RCVD=-0.01]

        autolearn=no autolearn_force=no


And as I said, when I run them through SA at the command line they seem to score correctly.
The scores being given in the headers can't be correct as they all are similarly low and wrong.
An interesting note is that if I try and forward one of these received, they get flagged and sent to spam.
Without knowing the intricacies of the amavis procedural steps, or were to start, it is not possible for me to troubleshoot.


On 1/29/18 1:20 PM, Dino Edwards wrote:

I disagree it's bad advice considering it's autolearn that seems to be creating at least some of the problems he's experiencing.



However, I do agree, the AutoLearn Threshold should definitely be set IF you are going to be using autolearn but in my experience auto-learn creates more problems than it solves. I believe that only humans should be be used for training the bayes database. Auto-learning has the tendency to exaggerate issues over time.



Keep it simple for now and train your bayes database and after you've trained it and it's scoring well, then consider using autolearn.











-----Original Message-----

From: amavis-users [mailto:amavis-users-bounces+dino.edwards=mydirectmail.net at amavis.org] On Behalf Of Benny Pedersen

Sent: Monday, January 29, 2018 1:06 PM

To: amavis-users at amavis.org<mailto:amavis-users at amavis.org>

Subject: Re: Re: Scoring questions



Computer Bob skrev den 2018-01-29 18:57:

I assume you mean bayes_auto_learn in local.cf. I set it to 0 from 1

and restarted.



yes its just bad advise, but setting this is what disables autolearn



i suggest see autolearnthreashold instaed



https://spamassassin.apache.org/full/3.3.x/doc/Mail_SpamAssassin_Plugin_AutoLearnThreshold.html



bayes_auto_learn_threshold_nonspam -5

bayes_auto_learn_threshold_spam 7.5



let the spammers win now :)






-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.amavis.org/pipermail/amavis-users/attachments/20180129/840fddd8/attachment.html>