[SPAM] Analyze and reality disagree

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

[SPAM] Analyze and reality disagree

JR Dalrymple
My new ASSP install is doing a pretty OK job of blocking SPAM for my clients. Still more is getting through than I'm accustomed to from my prior install of 1.x. I did a fresh install so the spamdb did indeed start clean, however the volume here is such that it should have rebuilt pretty quick, and did I think. The interesting thing is that an E-mail analyze in the UI does indicate that I should be seeing good results, however reality isn't working out that way. An example mail indicates a lot of the normal suspects:

 # URIBL check: 'failed'
 # domain mail.corpolfo.us (in Mail From: , Return-Path) has no valid MX record
 # domain corpolfo.us (in From , Reply-To) has no valid MX record
 # domainMX has no valid A record

And perhaps most important:

 # Bayesian Spam Probability: confident SPAM
 # Hidden-Markov-Model Spam Probability: confident SPAM

But yet this is what that particular mail has in the maillog:

 # ...HMM Check [monitoring] - Prob: 0.00000 => ham
 # ...Bayesian Check [scoring] - Prob: 0.00000 => ham
 # ...to: [hidden email] message ok

One other clue perhaps is that not a single one of my Bayesian scores is a decimal, they are all either 1.00000 or 0.00000.

ASSP version is 2.5.5. Nothing is in test mode or disabled, clearly I'm doing something wrong though. Where should I be looking?

If it can be of any use my last run results of rebuildspamdb can be seen here: 

Thanks

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Assp-user mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/assp-user
Reply | Threaded
Open this post in threaded view
|

Re: [SPAM] Analyze and reality disagree

Thomas Eckardt/eck
The analyzer shows the 'just in time' result - and this may differ from a hours before processed mail.
The analyzer shows also all possible results - even the same mail processed while it is received, may skip checks.

>
they are all either 1.00000 or 0.00000.

Have a look in to the rebuildrun.txt file.

Thomas


DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no known virus in this email!
*******************************************************


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Assp-user mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/assp-user