Results 1 to 7 of 7

Thread: Spamtraining gone bad?

  1. #1
    Join Date
    Feb 2008
    Location
    Norway
    Posts
    59
    Rep Power
    7

    Default Spamtraining gone bad?

    Any pointers in how to troubleshoot this one?

    For some reason it seems like training of the spamfilter doesnt work anymore..
    I receive quite similar e-mails with announcement for a website, I keep via webclient marking the mails as spam, but the mails keep coming to my inbox...

    1st mail example:
    Mail:
    "Hi Helgekrister

    These other guys just arent as much fun. Come on over:

    LiveTeen - Live Teen Cams!

    We can play around like we used to.

    See u soon.

    Kisses Lara."

    2nd mail example:
    "Hi Helgekrister

    These other guys just arent as much fun. Come on over:

    LiveTeen - Live Teen Cams!

    We can play around like we used to.

    See u soon.

    Kisses Janie."

    and similar, headers even after about 20 mails like this marked as spam (and yes I can see the numbers of new spam mails are correct when I run the zmtrainsa command..):

    1st mail example:
    "X-DSPAM-Result: Innocent
    X-DSPAM-Confidence: 0.8499
    X-DSPAM-Probability: 0.0000
    X-DSPAM-Signature: 48b00b10297769175320940
    X-DSPAM-Factors: 27,
    X-Virus-Scanned: amavisd-new at
    X-Spam-Flag: NO
    X-Spam-Score: -0.598
    X-Spam-Level:
    X-Spam-Status: No, score=-0.598 tagged_above=-10 required=5
    tests=[BAYES_00=-2.599, DSPAM_HAM=-0.5, HTML_MESSAGE=0.001,
    RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5,
    RAZOR2_CHECK=0.5]"

    2nd mail example:
    "X-DSPAM-Result: Innocent
    X-DSPAM-Confidence: 0.9744
    X-DSPAM-Probability: 0.0000
    X-DSPAM-Signature: 48af8164113841156014651
    X-DSPAM-Factors: 27,
    X-Virus-Scanned: amavisd-new at
    X-Spam-Flag: NO
    X-Spam-Score: -2.598
    X-Spam-Level:
    X-Spam-Status: No, score=-2.598 tagged_above=-10 required=5
    tests=[BAYES_00=-2.599, DSPAM_HAM=-0.5, HTML_MESSAGE=0.001,
    RAZOR2_CHECK=0.5]"
    Release 5.0.8_GA_2462.RHEL5_20080709170039 RHEL5 FOSS edition

  2. #2
    Join Date
    Aug 2007
    Location
    Pune, India
    Posts
    46
    Rep Power
    8

    Default

    Do u see any errors in zmtrainsa? You might want to look at /opt/zimbra/log/spamtrain.log

    If those emails are coming from identical domains, you can blacklist them.
    - Irfan




  3. #3
    Join Date
    Feb 2008
    Location
    Norway
    Posts
    59
    Rep Power
    7

    Default

    zmtrainsa doesnt throw any errors, it says it examined XX amount of e-mails and total 16xx mails in db, so all there looks good.

    Yes I could of course add the domain for blacklist, and also create a rule with spamscore 10 for the domain these "girls" refers to. However, this shows me that something is wrong with my system and I rather resolve it and see that when I train the spamfilter with the next 10 mails of this kind it actually ends up in junk mail automaticly
    Release 5.0.8_GA_2462.RHEL5_20080709170039 RHEL5 FOSS edition

  4. #4
    Join Date
    Feb 2008
    Location
    Norway
    Posts
    59
    Rep Power
    7

    Default

    Btw, could this be related to recent upgrade I did from 5.0.2 to 5.0.8? Should I have done things to preserve the spam db?
    Release 5.0.8_GA_2462.RHEL5_20080709170039 RHEL5 FOSS edition

  5. #5
    Join Date
    Aug 2007
    Location
    Pune, India
    Posts
    46
    Rep Power
    8

    Default

    Not sure if that can cause it. I never seen that upgrade deletes the spam database.

    If you wish, you can rebuilt/re-initialize the spam db. Following are the steps:

    su - zimbra
    Disable the antivirus service to allow mail delivery
    zmprov ms `zmhostname` -- -zimbraServiceEnabled antivirus
    mkdir /tmp/clamdb
    mv /opt/zimbra/clamav/db/* /tmp/clamdb
    zmprov ms `zmhostname` +zimbraServiceEnabled antivirus
    /opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf
    zmamavisdctl stop
    zmamavidsctl start
    - Irfan




  6. #6
    Join Date
    Aug 2006
    Posts
    122
    Rep Power
    9

    Default

    I've recently fought the same battle - with our 120 accounts, it's difficult to train if only 25-50% of your people are contributing to the junk collection, as junk left in the inbox seems to counteract the bayes scoring for junk marked as junk. I manually (as the administrator) took it upon myself to "assist" people in marking junk as junk - slightly before the cron of zmtrainsa. I did this for about 3 nights in a row and our spam filter began working much better. I also highly recommend reviewing dwmtractor's tips and bayes scoring modifications, they will help quite a bit as well
    Work
    8.0.3 UBUNTU10_04 UBUNTU10_04 NETWORK

    Home
    8.0.3 UBUNTU10_04 UBUNTU10_04 FOSS

  7. #7
    Join Date
    Feb 2008
    Location
    Norway
    Posts
    59
    Rep Power
    7

    Default

    Quote Originally Posted by irfan View Post
    Not sure if that can cause it. I never seen that upgrade deletes the spam database.

    If you wish, you can rebuilt/re-initialize the spam db. Following are the steps:

    su - zimbra
    Disable the antivirus service to allow mail delivery
    zmprov ms `zmhostname` -- -zimbraServiceEnabled antivirus
    mkdir /tmp/clamdb
    mv /opt/zimbra/clamav/db/* /tmp/clamdb
    zmprov ms `zmhostname` +zimbraServiceEnabled antivirus
    /opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf
    zmamavisdctl stop
    zmamavidsctl start
    Hmm, wanted to try this, but this doesnt work.. /opt/zimbra/clamav/db/ doesnt have any files at all.. but is this where the spam is stored? shouldnt it be a subdir of some spamassassin dir?
    Release 5.0.8_GA_2462.RHEL5_20080709170039 RHEL5 FOSS edition

Similar Threads

  1. Bad file descriptor?
    By emx in forum Installation
    Replies: 11
    Last Post: 10-14-2008, 04:01 AM
  2. [Installation] Zimbra Desktop - Ubuntu 8.04 Hardy
    By kaltera in forum Installation Help
    Replies: 1
    Last Post: 06-18-2008, 05:43 AM
  3. mobile calender Internal Server Error
    By padraig in forum Administrators
    Replies: 19
    Last Post: 04-24-2008, 09:04 AM
  4. Antivirus is blocking emails in deffered queue
    By sergiumartin in forum Administrators
    Replies: 15
    Last Post: 07-14-2007, 04:04 PM
  5. zcs 4.0.3 amavisd gives bad file descriptor
    By Storm16 in forum Developers
    Replies: 0
    Last Post: 11-07-2006, 11:27 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •