Byteplant Forum

Home » CleanMail Support » CleanMail SpamAssassin Filter » Display score of spam
Display score of spam [message #339] Wed, 16 June 2004 10:07
InforMed Direct
Messages: 59
Registered: May 2004
Member
Is it possible to display the score of *any* message? For some of the messages that get through the filter, I'd like to display what score they did get. It was obviously above the threshold but I want to know how much they scored?

I'm guessing a command line option...

More importantly, to see the scores from the individual rules to give an idea if one of the rules needs increasing.

Thanks, Rob.

Re: Display score of spam [message #340 is a reply to message #339] Wed, 16 June 2004 17:37 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
> Is it possible to display the score of *any* message? For
> some of the messages that get through the filter, I'd like to
> display what score they did get. It was obviously above the
> threshold but I want to know how much they scored?
>
> I'm guessing a command line option...
>
> More importantly, to see the scores from the individual rules
> to give an idea if one of the rules needs increasing.

By default each mail processed by SpamAssassin contains the
"X-Spam-Level" and "X-Spam-Status" headers which indicate the spam score.



Customer Support
Byteplant GmbH
Re: Display score of spam [message #341 is a reply to message #340] Wed, 30 June 2004 18:38 Go to previous message
bhealy
Messages: 7
Registered: June 2004
Junior Member
I've been looking at the spam that does get through and can't find the X-Spam-Level or X-Spam-Status headers. My No Spam Today! daily report is showing that it is intercepting about half of my users' total messages as spam. Also, the spam that I analyzed is not very large so I don't think that it's not being checked because of size.

Any ideas?

Bill Healy
Re: Display score of spam [message #342 is a reply to message #341] Thu, 01 July 2004 10:25 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
> I've been looking at the spam that does get through and can't
> find the X-Spam-Level or X-Spam-Status headers. My No Spam
> Today! daily report is showing that it is intercepting about
> half of my users' total messages as spam. Also, the spam that I
> analyzed is not very large so I don't think that it's not being
> checked because of size.

Check if NoSpamToday!'s Received: header is present. If it isn't, NoSpamToday! did not see this mail. In this case, maybe the secondary MX (if you have one configured) was used.

Another possibility is that the license count was exceeded. Check the log or the admin mails if this was the case.



Customer Support
Byteplant GmbH
Re: Display score of spam [message #343 is a reply to message #342] Tue, 17 August 2004 17:06 Go to previous message
bhealy
Messages: 7
Registered: June 2004
Junior Member
I found the following header in a spam message which got through:

----------------------------------

X-Spam-Status: No, hits=6.0 required=6.5 tests=BAYES_56,HTML_60_70,
HTML_IMAGE_ONLY_02,HTML_MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,
NORMAL_HTTP_TO_IP,SPAMCOP_URI_RBL autolearn=no version=2.63

-------------------------------------


I've run the admin wizard and set the threashold to 3.5 in an attempt to eliminate more spam. Unfortuanately, about half of the spam is still getting through. Does the "required=6.5" part of the above line mean that my threashold is set at 6.5?
Re: Display score of spam [message #344 is a reply to message #343] Tue, 17 August 2004 17:18 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
> I've run the admin wizard and set the threashold to 3.5 in an
> attempt to eliminate more spam. Unfortuanately, about half of
> the spam is still getting through. Does the "required=6.5" part
> of the above line mean that my threashold is set at 6.5?

Yes.
Be sure to install the SpamCopURI option, and enable the RBL checks (SpamCopURI requires the RBL checks to be enabled).
SpamCopURI seems to be very effective in eliminating spam.



Customer Support
Byteplant GmbH
Re: Display score of spam [message #345 is a reply to message #344] Tue, 17 August 2004 17:29 Go to previous message
bhealy
Messages: 7
Registered: June 2004
Junior Member
I don't see SpamCopURI anywhere in the admin wizard. Also, if I enable RLB checks which DNS servers should I list in the text box? Do I list my DNS servers?
Re: Display score of spam [message #346 is a reply to message #345] Tue, 17 August 2004 22:13 Go to previous message
bhealy
Messages: 7
Registered: June 2004
Junior Member
I downloaded and installed the latest version of NST Proxy. I made sure to check the SpamCopURI and specified my DNS servers in the RBL text box. When I look at a message header for a mail that got through I still see:


-------------------------------------------
X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on
spectrum-kocrcq.spectrumengbr.com
X-Spam-Status: No, hits=-2.9 required=6.5 tests=BAYES_00,NO_REAL_NAME,PORN_4
autolearn=no version=2.64

-------------------------------------------


Does this indicate that my threashold for spam is 6.5? I have it set for 3.5 in the NST admin wizard. Also, should I have autolearn set on and if so how to I go about doing that?
Re: Display score of spam [message #347 is a reply to message #346] Wed, 18 August 2004 09:57 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
> X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on
> spectrum-kocrcq.spectrumengbr.com
> X-Spam-Status: No, hits=-2.9 required=6.5
> tests=BAYES_00,NO_REAL_NAME,PORN_4
> autolearn=no version=2.64
> Does this indicate that my threashold for spam is 6.5? I have
> it set for 3.5 in the NST admin wizard. Also, should I have
> autolearn set on and if so how to I go about doing that?

Yes, the required_hits score is still 6.5. Maybe something in your local.cf file is broken. Installing a new version of NoSPamToday! keeps the local.cf file from the previous installation, so your problem might be solved if you try a new, "clean" local.cf file. For this, copy local.cf.sample over local.cf, and start the admin wizard again to change your settings.

The following FAQ might help you to validate spamassassin rules changes you made with a text editor:

http://www.byteplant.com/support/nospamtoday/server/faq.html#490

Moreover, the Bayes database is quite sure that this mail is not spam (spam probability is about 0%). This can happen for example if you receive a spam mail from a whitelisted sender. So in the end this mail has a negative score.

Learn this mail with sa-learn as spam. There is an example batch file you can adapt in the NoSpamToday! installation directory. How to supply the message to learn in a format suitable for learning, depends on the mail server you use, this howto might help:

http://www.byteplant.com/support/nospamtoday/howtolearnexchange.html

If you feel that your database is not worth keeping, replace it with the database in the installation package.



Customer Support
Byteplant GmbH
Re: Display score of spam [message #348 is a reply to message #344] Fri, 03 June 2005 00:54 Go to previous message
RandallRash
Messages: 23
Registered: March 2005
Junior Member
I'm running SMTP proxy 2.0.6.2. How do I install the SpamCopURI plugin?
Re: Display score of spam [message #349 is a reply to message #348] Fri, 03 June 2005 01:15 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
RandallRash wrote:

> I'm running SMTP proxy 2.0.6.2. How do I install the
> SpamCopURI plugin?

NoSpamToday! version 2.x or later uses SpamAssassin 3, which has the SpamCopURI plugin already integrated.



Customer Support
Byteplant GmbH
Previous Topic: sa learn
Next Topic: Testing new rulesets with --lint
Goto Forum:
  


Current Time: Sat Oct 01 03:30:15 CEST 2016