spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From David Jones <djo...@ena.com>
Subject Re: Question about BAYES_999
Date Thu, 04 Jan 2018 16:40:49 GMT
On 01/04/2018 10:04 AM, RW wrote:
> On Thu, 4 Jan 2018 08:02:48 -0600
> David Jones wrote:
> 
>> On 01/04/2018 04:46 AM, Matus UHLAR - fantomas wrote:
>>>> On 2 Jan 2018, at 07:17, David Jones djones@ena.com> wrote:
>>>>> I haven't redefined these rules from what I can tell by searching
>>>>> my local rules.  I would think that if I had done this, then
>>>>> there would be consistent non-hits of BAYES_99 with BAYES_999 all
>>>>> of the time.  This is only happening a small percentage of the
>>>>> time.
>>>
>>> On 02.01.18 15:39, @lbutlr wrote:
>>>> Checking my mail I see an incidence rate of this of about 0.5%,
>>>> which matches the rate you posted earlier.
>>>
>>> amavis?
>>>    
>>
>> I am seeing this problem on my MailScanner filters as well:
>>
>> # grep BAYES_999 maillog-20171231 | wc -l
>> 9172
>> # grep BAYES_999 maillog-20171231 | grep -v "BAYES_99 " | wc -l
>> 4
> 
> Are you sure that's right? It's a radically different frequency from
> 0.5% and 0.8%. IIWY I'd look at the 4 and check they are what you think
> they are and not something like
> 

My production MailScanner instance has a highly tuned MTA in front of it 
so SA doesn't see as much spam.  The amavis instance is intentionally 
open to more spam to collect for the nightly masscheck processing.

> ... rules: meta test FOO has dependency 'BAYES_999' with a zero score
> 

If I had BAYES_99 set to a zero score, it would never show up in my logs.

> I get some bogus warnings like this.
> 
> You need something to make sure it's a result line and some  boundary
> checks like \bBAYES_99\b might help too.
> 

MailScanner log output looks like this:

Dec 31 07:30:46 smtp2i.ena.net MailScanner[26137]: Message 
8902A148068E.ACC23 from 106.10.241.143 (novak5450@att.net) to k12tn.net 
is spam, SpamAssassin (not cached, score=35.679, required 4, 
autolearn=spam, BAYES_99 5.20, BAYES_999 0.20, DCC_CHECK 2.20, 
DIGEST_MULTIPLE 0.29, DKIM_SIGNED 0.10, DKIM_VALID -0.10, DKIM_VALID_AU 
-0.10, DMARC_NONE 0.01, ...

Pretty sure my grep'ing above is good.

> 
> I can't reproduce the problem using spamc/spamd  from 3.4.1 with perl
> 5.24.3 on FreeBSD 11.1 with  Berkeley DB.
> 
> I don't have any missing BAYES_99 hits in my corpus headers and to
> check it's not a recent bug I rescanned ~5k spams and checked the logs.
> 

I appreciate you checking to help us determine how widespread this issue 
is and possibly narrow it down.

Here is my SA setup that is common to both my amavis and MailScanner:

SA 3.4.1
Shared Bayes DB in Redis
Share the same local configs for custom rules

Since we have at least one other person on this list reporting the same 
problem, I don't think my local custom rules are the problem.

-- 
David Jones

Mime
View raw message