Results 1 to 9 of 9

Thread: Zimbra Open Source 6.0.2 + DSPAM, always innocent?

  1. #1
    Join Date
    Jun 2009
    Posts
    131
    Rep Power
    6

    Default Zimbra Open Source 6.0.2 + DSPAM, always innocent?

    Hi,

    Ive just enabled DSPAM on a 6.0.2 open source version server, however when i run zmtrainsa it always seems to see the mail is not spam? Even though i have classed it as spam in the webgui, and it picks up the mail as being in the spam dir (because it processes it):

    20091028201449 Starting dspam training
    Taking Snapshot...
    zimbra TP: 0 TN: 0 FP: 0 FN: 5 SC: 0 NC: 0
    Training /tmp/ham.Xfl5184 / /tmp/spam.xxs5183 corpora...
    [test: spam ] 1249cc93506-0 result: FAIL (Innocent)
    [fn] Subject: Attractive aged mother videos
    [test: spam ] 1249cc93506-1 result: FAIL (Innocent)
    [fn] Subject: The only real Virgin pussy website on the Net!
    TRAINING COMPLETE
    Any ideas?!

    Also, if i try to run it manually against my spam box for a specific user it appears to hang?

    zimbra@mambo:~$ zmtrainsa blah@blah.com spam Junk
    20091028201653 Starting spamassassin spam training for blah@blah.com using folder Junk
    [] INFO: Total messages processed: 92
    netset: cannot include 127.0.0.0/8 as it has already been included
    netset: cannot include 127.0.0.0/8 as it has already been included
    netset: cannot include 127.0.0.0/8 as it has already been included
    Learned tokens from 64 message(s) (92 message(s) examined)
    netset: cannot include 127.0.0.0/8 as it has already been included
    netset: cannot include 127.0.0.0/8 as it has already been included
    netset: cannot include 127.0.0.0/8 as it has already been included
    20091028201701 Finished spamassassin spam training for blah@blah.com using folder Junk
    20091028201701 Starting dspam spam training for blah@blah.com using folder Junk
    13145: [10/28/2009 20:17:01] No such feature 'chained'
    Any one seen these issues?

    Thanks, iMx

  2. #2
    Join Date
    Nov 2009
    Posts
    13
    Rep Power
    6

    Default

    Looks like I have a similar problem.

    All of the e-mail I got in the last couple of weeks is tagged "Innocent" by DSPAM, even though I receive a lot of spam.

    I've been searching for a DSPAM logfile, but I cannot seem to find one. I also cannot find a config file to enable logging.

    Can anyone point me in a direction on how to troubleshoot this issue?

  3. #3
    Join Date
    Jun 2008
    Posts
    594
    Rep Power
    8

    Default

    I generally keep dspam disabled.

  4. #4
    Join Date
    Nov 2009
    Posts
    13
    Rep Power
    6

    Default

    Just upgraded to

    Release 6.0.3_GA_1915.UBUNTU8_64 UBUNTU8_64 FOSS edition.

    And DSPAM seems to work now (at least, I get some mails with DSPAM +10.000).

    Still a lot of false positives and false negatives though... But I trust that will get better as it gets trained...

  5. #5
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,587
    Rep Power
    58

    Default

    Quote Originally Posted by bolderbast View Post
    Still a lot of false positives and false negatives though...
    What are your kill/tag percentages?
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  6. #6
    Join Date
    Nov 2009
    Posts
    13
    Rep Power
    6

    Default

    Kill: 100%
    Tag: 33%

    But I believe the percentages are applied to the total score of all Antispam checks, right? The other checks are fine, only DSPAM gets it wrong a lot. And because of the weight DSPAM puts in, it only sporadicly gets compensated by the other checks.

    Example of a False Positive (mail is tagged as spam by DSPAM, though it isn't):

    Code:
    X-DSPAM-Result: Spam
    X-DSPAM-Class: Spam
    X-DSPAM-Confidence: 0.54
    X-DSPAM-Probability: 0.9159
    X-DSPAM-Signature: N/A
    X-Virus-Scanned: amavisd-new at <domainname>
    X-Spam-Flag: YES
    X-Spam-Score: 7.401
    X-Spam-Level: *******
    X-Spam-Status: Yes, score=7.401 tagged_above=-10 required=6.6
    	tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, SPF_PASS=-0.001,
    	DSPAM:Spam=10.000] autolearn=ham
    Example of a fale negative (mail is not classified as spam by DSPAM, though it is):

    Code:
    X-DSPAM-Result: Innocent
    X-DSPAM-Class: Innocent
    X-DSPAM-Confidence: 0.56
    X-DSPAM-Probability: 0.0000
    X-DSPAM-Signature: N/A
    X-Virus-Scanned: amavisd-new at <domainname>
    X-Spam-Flag: YES
    X-Spam-Score: 14.066
    X-Spam-Level: **************
    X-Spam-Status: Yes, score=14.066 tagged_above=-10 required=6.6
    	tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001,
    	MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5,
    	RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=2.5, RCVD_IN_PBL=0.905,
    	RCVD_IN_SORBS_WEB=0.619, URIBL_BLACK=1.955, URIBL_OB_SURBL=1.5,
    	URIBL_RHS_DOB=1.083, URIBL_SBL=1.499, DSPAM:Innocent=-1.000]
    	autolearn=spam
    Thanks for helping!

  7. #7
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,587
    Rep Power
    58

    Default

    Quote Originally Posted by bolderbast View Post
    Kill: 100&#37;
    Tag: 33%
    The setting of 100% for the Kill percentage will allow all spam through the system and never reject any valid spam, I'd suggest you reduce those setting to 66/25 for kill/tag and see if that improves your current problem. Have you implemented any of the suggestions in the wiki (or the forums) for improving the anti-spam system and if so, which ones?
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  8. #8
    Join Date
    Nov 2009
    Posts
    13
    Rep Power
    6

    Default

    Hi Bill,

    A Kill percentage of 66 would actually DELETE incoming mail if the score is 13.200 (total of all checks), or am I mistaken.

    My policy is to NEVER automatically delete e-mail messages, I just want to have them put in the Junk folder. A Kill percentage of 100 is what comes closest to that, that is why I set it to 100. I'd rather be able to set it to 101 or so, to make sure that even messages with a total score of 20.000 are not automatically deleted.

    I am currently running Zimbra at home, but for a lot of organizations I believe it is not even permitted to auto-delete messages because of compliance reasons.

    Spam improving that I applied are SPF, Razor2 and Pyzor as described in Improving Anti-spam system - Zimbra :: Wiki

    Anyway, aren't we getting very off-topic now? The topic is about only the DSPAM component not working (or in my case: not working reliable). Other AntiSpam options (Razor2, Pyzor, etc.) are working perfectly!

    Cheers,
    Patrick

  9. #9
    Join Date
    Mar 2009
    Posts
    91
    Rep Power
    6

    Default no feature chained fixed here maybe..

    This person says they fixed the feature chained issue in this thread:

    http://www.zimbra.com/forums/adminis...tml#post158307

Similar Threads

  1. Zimbra + Funambol Sync4j Code
    By KevinH in forum Mobility
    Replies: 563
    Last Post: 01-16-2010, 02:20 AM
  2. slapd message error
    By smoke in forum Administrators
    Replies: 7
    Last Post: 04-27-2008, 04:23 PM
  3. Big Fubar on 5 FOSS GA Upgrade
    By uxbod in forum Administrators
    Replies: 24
    Last Post: 01-21-2008, 03:37 AM
  4. Replies: 22
    Last Post: 12-02-2007, 05:05 PM
  5. zmtlsctl give LDAP error
    By sourcehound in forum Administrators
    Replies: 5
    Last Post: 03-11-2007, 04:48 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •