Hello SuSE people Having a problem making Spamassassin learn. Using the command "sa-learn --spam --mbox /home/bob/Mail/spamin This is the mailbox I use to file all the spam in. After the command I get the reply " 0 messages learned" Also, once I finally get this working, how/where does Spamassassin put the identified spam mail? I use kmail. Do I need to create a folder in Kmail and tell Spamassassin? Bob S
On Saturday 20 December 2003 22:13, Bob S. wrote:
Hello SuSE people
Having a problem making Spamassassin learn. Using the command "sa-learn --spam --mbox /home/bob/Mail/spamin This is the mailbox I use to file all the spam in.
After the command I get the reply " 0 messages learned"
Also, once I finally get this working, how/where does Spamassassin put the identified spam mail? I use kmail. Do I need to create a folder in Kmail and tell Spamassassin?
Bob S
Typically I think most folks install sa system wide, and then let each user decide what to do with it. So you would typically let Kmail filter on the headers, usually by checking for the number of asterisks on the spam-status header. As for the learn, are you sure its a mbox format? Looks more like maildir to me. -- _____________________________________ John Andersen
On Monday 22 December 2003 12:05 am, John Andersen wrote:
On Saturday 20 December 2003 22:13, Bob S. wrote:
Hello SuSE people
Having a problem making Spamassassin learn. Using the command "sa-learn --spam --mbox /home/bob/Mail/spamin This is the mailbox I use to file all the spam in.
After the command I get the reply " 0 messages learned"
Also, once I finally get this working, how/where does Spamassassin put the identified spam mail? I use kmail. Do I need to create a folder in Kmail and tell Spamassassin?
Bob S
Typically I think most folks install sa system wide, and then let each user decide what to do with it. So you would typically let Kmail filter on the headers, usually by checking for the number of asterisks on the spam-status header.
Thanks for replying so rapidly John. But, you have lost me. Filter on the headers by checking the asteriks? How does one know that? An output from some command to Spamassassin?
As for the learn, are you sure its a mbox format? Looks more like maildir to me.
OK .....If I do a --dir command I get a reply that it learned from one message. I have over 300 spam mails in the "spamin" directory. Bob S.
-- _____________________________________ John Andersen
On Sunday 21 December 2003 20:36, Bob S. wrote:
On Monday 22 December 2003 12:05 am, John Andersen wrote:
On Saturday 20 December 2003 22:13, Bob S. wrote:
Hello SuSE people
Having a problem making Spamassassin learn. Using the command "sa-learn --spam --mbox /home/bob/Mail/spamin This is the mailbox I use to file all the spam in.
After the command I get the reply " 0 messages learned"
Also, once I finally get this working, how/where does Spamassassin put the identified spam mail? I use kmail. Do I need to create a folder in Kmail and tell Spamassassin?
Bob S
Typically I think most folks install sa system wide, and then let each user decide what to do with it. So you would typically let Kmail filter on the headers, usually by checking for the number of asterisks on the spam-status header.
Thanks for replying so rapidly John. But, you have lost me. Filter on the headers by checking the asteriks? How does one know that? An output from some command to Spamassassin?
As for the learn, are you sure its a mbox format? Looks more like maildir to me.
OK .....If I do a --dir command I get a reply that it learned from one message. I have over 300 spam mails in the "spamin" directory.
Ok, here's the headers from your Mailing list posting (only the ones of intrest: (In kmail, right click a message and choose Show Source...) X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on pen.homeip.net X-Spam-Level: X-Spam-Status: No, hits=-4.2 required=3.9 tests=AWL,BAYES_00 autolearn=ham version=2.61 ------------- See that header called X-Spam-Level: ? That will have asterisks after it when it is spam. Example from my trash bin I look at the headers of one arbitrarily trashed message and I see this: X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on pen.homeip.net X-Spam-Level: ******* X-Spam-Status: Yes, hits=7.4 required=3.9 tests=BAYES_70,HTML_20_30, HTML_IMAGE_ONLY_08,HTML_MESSAGE autolearn=no version=2.61 ---------- So I right click on any spam message in my inbox, and say creat a filter, on headers, and enter "X-Spam-Level: ****" (without quotes) as the header I want to filter on. So I might see a few messages that are still spam (those with only 3 or 4 asterisks, (as a safety feature) but the rest go striaight to trash. -- _____________________________________ John Andersen
On Monday 22 December 2003 12:49 am, John Andersen wrote: <snip all previous stuff>
Ok, here's the headers from your Mailing list posting (only the ones of intrest: (In kmail, right click a message and choose Show Source...)
OK John. Please excuse me for being real dumb/stupid. When I right-click a message in kmail I don't get a "Show Source" .
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on pen.homeip.net X-Spam-Level: X-Spam-Status: No, hits=-4.2 required=3.9 tests=AWL,BAYES_00 autolearn=ham version=2.61 ------------- See that header called X-Spam-Level: ? That will have asterisks after it when it is spam. Example from my trash bin I look at the headers of one arbitrarily trashed message and I see this:
Again, please excuse me for being dumb/stupid. I don't see the header X-Spam-Level : with the asterisks
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on pen.homeip.net X-Spam-Level: ******* X-Spam-Status: Yes, hits=7.4 required=3.9 tests=BAYES_70,HTML_20_30, HTML_IMAGE_ONLY_08,HTML_MESSAGE autolearn=no version=2.61
So I right click on any spam message in my inbox, and say creat a filter, on headers, and enter "X-Spam-Level: ****" (without quotes) as the header I want to filter on.
Are you saying that now that I have taught Spamassassin what is spam, that now as each new message comes in that I have to create a filter for each new message? Evidently I am missing the whole procedural thing about setting up Spamassasin.
So I might see a few messages that are still spam (those with only 3 or 4 asterisks, (as a safety feature) but the rest go striaight to trash.
OK, I understand the concept. It's the mechanics to do that which is throwing me. Bob S.
On Tue December 23 2003 03:06 am, Bob S. wrote:
On Monday 22 December 2003 12:49 am, John Andersen wrote:
<snip all previous stuff>
Ok, here's the headers from your Mailing list posting (only the ones of intrest: (In kmail, right click a message and choose Show Source...)
OK John. Please excuse me for being real dumb/stupid. When I right-click a message in kmail I don't get a "Show Source" .
Use view---> headers --> all
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on pen.homeip.net X-Spam-Level: X-Spam-Status: No, hits=-4.2 required=3.9 tests=AWL,BAYES_00 autolearn=ham version=2.61 ------------- See that header called X-Spam-Level: ? That will have asterisks after it when it is spam. Example from my trash bin I look at the headers of one arbitrarily trashed message and I see this:
Again, please excuse me for being dumb/stupid. I don't see the header X-Spam-Level : with the asterisks
I prefer to look for: X-Spam-Flag: YES in the filter. But I think you'd do better to run procmail and do your filtering there. I have procmail throw everything with a 'hit level' greater than 10 into / dev/null. Everything 4 or higher goes into a special folder. (to be checked for false hits) Everything 4 and below are treated as normal mail. Works for me.
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp)
on pen.homeip.net X-Spam-Level: ******* X-Spam-Status: Yes, hits=7.4 required=3.9 tests=BAYES_70,HTML_20_30, HTML_IMAGE_ONLY_08,HTML_MESSAGE autolearn=no version=2.61 ----------
So I right click on any spam message in my inbox, and say creat a filter, on headers, and enter "X-Spam-Level: ****" (without quotes) as the header I want to filter on.
Are you saying that now that I have taught Spamassassin what is spam, that now as each new message comes in that I have to create a filter for each new message? Evidently I am missing the whole procedural thing about setting up Spamassasin.
So I might see a few messages that are still spam (those with only 3 or 4 asterisks, (as a safety feature) but the rest go striaight to trash.
OK, I understand the concept. It's the mechanics to do that which is throwing me.
Bob S.
-- +----------------------------------------------------------------------------+ + Bruce S. Marshall bmarsh@bmarsh.com Bellaire, MI 12/23/03 09:48 + +----------------------------------------------------------------------------+ "Change is inevitable, except from a vending machine"
On Tuesday 23 December 2003 05:51, Bruce Marshall wrote:
I prefer to look for:
X-Spam-Flag: YES
in the filter. But I think you'd do better to run procmail and do your filtering there.
I have procmail throw everything with a 'hit level' greater than 10 into / dev/null.
Everything 4 or higher goes into a special folder. (to be checked for false hits)
Everything 4 and below are treated as normal mail.
Cool, can you post your procmailrc ? -- _____________________________________ John Andersen
On Wed December 24 2003 05:45 am, John Andersen wrote:
On Tuesday 23 December 2003 05:51, Bruce Marshall wrote:
I prefer to look for:
X-Spam-Flag: YES
in the filter. But I think you'd do better to run procmail and do your filtering there.
I have procmail throw everything with a 'hit level' greater than 10 into / dev/null.
Everything 4 or higher goes into a special folder. (to be checked for false hits)
Everything 4 and below are treated as normal mail.
Cool, can you post your procmailrc ?
Here are the pertinent parts: (using spamc and spamd to get better performance) The 'cntspam' is a small program I wrote to count the number of spams sent to /dev/null. It can be deleted. The procmailrc setup below sends emails with a 'hit count' of 10 or above to / dev/null. 4 or above go into the folder: /var/spool/mail/highspam
#get rid of spammers
:0fw | spamc :0e { EXITCODE=$? } :0 * ^X-Spam-Status:.*hits=[1-9][0-9] { :0 c | /usr/local/bin/cntspam :0 /dev/null } :0:hispam.lock * ^X-Spam-Status:.*hits=[4-9][\ \.] /var/spool/mail/highspam # At this point, go on and distribute the mail to other folders as normal. -- +----------------------------------------------------------------------------+ + Bruce S. Marshall bmarsh@bmarsh.com Bellaire, MI 12/24/03 09:58 + +----------------------------------------------------------------------------+ "Time is just nature's way of preventing everything from happening at once."
On Wed, 2003-12-24 at 10:03, Bruce Marshall wrote:
Here are the pertinent parts:
(using spamc and spamd to get better performance) The 'cntspam' is a small program I wrote to count the number of spams sent to /dev/null. It can be deleted.
The procmailrc setup below sends emails with a 'hit count' of 10 or above to / dev/null. 4 or above go into the folder: /var/spool/mail/highspam
#get rid of spammers
:0fw | spamc
:0e { EXITCODE=$? }
:0 * ^X-Spam-Status:.*hits=[1-9][0-9] { :0 c | /usr/local/bin/cntspam
:0 /dev/null }
:0:hispam.lock * ^X-Spam-Status:.*hits=[4-9][\ \.] /var/spool/mail/highspam
# At this point, go on and distribute the mail to other folders as normal.
Now this is what most people on this list appreciate (at least I do). An answer with some meat to it showing a real world example. Since you will find a lot of newbies on this list this is more helpful than just saying it should/could work. Thanks Bruce, -- Ken Schneider unix user since 1989 linux user since 1994 SuSE user since 1998 (5.2)
On Wed, 24 Dec 2003 01:45:36 -0900 John Andersen <jsa@pen.homeip.net> wrote:
Cool, can you post your procmailrc ?
#you've to define SPAM similar to #MAILDIR=${HOME}/Mail #SPAM=${MAILDIR}/SPAM #beware of the missing : #:0 #* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*+ #/dev/null :0: * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*+ ${SPAM}/SPAM-SPAM # it could be better \*\{n,\} but I didn't check if it works :0: * ^X-Spam-Flag: YES ${SPAM}/SPAM-potential
That makes sence. It seems my ISP does some marking for me X-Smite-Info: SmiteCRC Oct 10 2003 X-SpamDetect: ***: 3.295000 Suspicious tags-to-text X-SpamDetect-Info: This message may be spam see http://www.smitespam.com for more information all I have to do is detect the specific headder and the contents. I dont know if this one is better or worse than SA but its free of setup issues. Ill get SA later. CWSIV On Tue, 2003-12-23 at 06:51, Bruce Marshall
I have procmail throw everything with a 'hit level' greater than 10 into /
dev/null.
Everything 4 or higher goes into a special folder. (to be checked for false hits)
Everything 4 and below are treated as normal mail.
Works for me.
The Tuesday 2003-12-23 at 03:06 -0500, Bob S. wrote:
Again, please excuse me for being dumb/stupid. I don't see the header X-Spam-Level : with the asterisks
Are you sure your email is passing through SpamAssassin? It is not automatic, you have to set it up. A not-spam email (yours, for example) has these hidden headers: |> X-Spam-Status: No, hits=-6.8 required=5.0 |> tests=AWL,BAYES_01,EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT, |> REFERENCES,REPLY_WITH_QUOTES,USER_AGENT_KMAIL |> autolearn=ham version=2.55 |> X-Spam-Level: Another email that is spam has instead: |> X-Spam-Flag: YES |> X-Spam-Status: Yes, hits=8.8 required=5.0 |> tests=BAYES_90,FROM_ENDS_IN_NUMS,NIGERIAN_BODY,SUBJ_ALL_CAPS, |> UPPERCASE_75_100,US_DOLLARS,US_DOLLARS_3 |> version=2.55 |> X-Spam-Level: ******** |> X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) So I filter on the "X-Spam-Flag: YES" header line (spam level >= 5)
Are you saying that now that I have taught Spamassassin what is spam, that now as each new message comes in that I have to create a filter for each new message? Evidently I am missing the whole procedural thing about setting up Spamassasin.
Of course not - only one filter. :-) -- Cheers, Carlos Robinson
To ALL: If you are using Linux, then you have to be using a Mozilla based browser. On that browser is the JUNK function subprogram, which will do just about all the spam removal, if not all, you want. The rest is easily removed by DELETE. :-) -- Old Sarge, prefer using voice dictation because of my arthritis!
On Wed, Dec 24, 2003 at 02:40:54PM -0800, Old Sarge wrote:
To ALL: If you are using Linux, then you have to be using a Mozilla based browser. On that browser is the JUNK function subprogram, which will do just about all the spam removal, if not all, you want. The rest is easily removed by DELETE. :-)
I thought Linux was all about choice. If I want to be told what software to use I might as well use Windows. Besides I don't read my mail in a browser, but assuming I did then could I use this "Mozilla based browser" from the console? I can with my current mail program (mutt). Merry Christmas. -- Steve Crane http://craniac.afraid.org
* Old Sarge (jboyle@harbornet.com) [031224 14:39]:
To ALL: If you are using Linux, then you have to be using a Mozilla based browser. On that browser is the JUNK function subprogram, which will do just about all the spam removal, if not all, you want. The rest is easily removed by DELETE. :-)
And in your expert opinion what should those of us who use Mutt+Fetchmail+procmail use? :) I believe spamassassin works just fine if setup correctly. The person runs the email/shell server I use has it running just fine and it catchs 9-10 spam messages I recieve. :) -- Ben Rosenberg ---===--- #147972 ---===--- mailto:ben@whack.org -- Why do we bother with a suicide watch when someone is on death row? " Keep an eye on this guy. We're gonna kill him, and we don't want him to hurt himself."
Bob S. said:
Hello SuSE people
Having a problem making Spamassassin learn. Using the command "sa-learn --spam --mbox /home/bob/Mail/spamin This is the mailbox I use to file all the spam in.
After the command I get the reply " 0 messages learned"
That simply means that this time, sa-learn learnt nothing new about the messages in the mbox. If you put some fresh spam in there, you'll likely see a message about how many messages it learned.
Also, once I finally get this working, how/where does Spamassassin put the identified spam mail? I use kmail. Do I need to create a folder in Kmail and tell Spamassassin?
If you look in your .spamassassin directory, you'll see some files. These are the tokens and other data used by the Bayesian spamclassifier to identify spam. They're added to when you run the sa-learn program. I use spamassassin as an external shell program in an Evolution filter. If the program returns 0, the message is good; if it returns anything else, it's spam, and gets moved to the Junk folder. I've not had a false positive (i.e. bona fide mail classified as spam) yet. What I do with missed spam is move it to a "training" local maildir folder and then periodically run "sa-learn --spam --dir /training" or somesuch. If I was organised and stuff, I'd schedule a cron job, or put it in my .bash_profile or something. Festive regards, Peter. -- Peter Whysall || peter.whysall@ntlworld.com The IWETHEY Project : http://z.iwethey.org The Collaborative Media Foundation : http://www.collaborativemedia.org
On Sun, 2003-12-21 at 08:13, Bob S. wrote:
Hello SuSE people
Having a problem making Spamassassin learn. Using the command "sa-learn --spam --mbox /home/bob/Mail/spamin This is the mailbox I use to file all the spam in.
After the command I get the reply " 0 messages learned"
Also, once I finally get this working, how/where does Spamassassin put the identified spam mail? I use kmail. Do I need to create a folder in Kmail and tell Spamassassin?
Bob S Are you using fetchmail and then procmail before you pick up you mail or do you pick it straight up from your ISP. If you use procmail before delivering it to your local mail box then you can use this in .procmailrc # Catch SPAM DROPPRIVS=yes :0fw | spamassassin
:0: * ^X-Spam-Level: (.*\<)?\*\*\*\*\*\*\*\*\* $PMDIR/Spam/Filtered :0: * ^X-Spam-Status:(.*\<)?Yes $PMDIR/Spam/Probable Ian -- Freedom is not worth having if it does not include the freedom to make mistakes. Mahatma Gandhi
On Sat, 2003-12-20 at 23:13, Bob S. wrote:
Hello SuSE people
Having a problem making Spamassassin learn. Using the command "sa-learn --spam --mbox /home/bob/Mail/spamin This is the mailbox I use to file all the spam in.
After the command I get the reply " 0 messages learned"
Also, once I finally get this working, how/where does Spamassassin put the identified spam mail? I use kmail. Do I need to create a folder in Kmail and tell Spamassassin?
Bob S
So, I ran the above command and got the following. I run fetchmail and postfix on an imap server. Any thoughts? mailserver:/var/spool/imap/user/tom/SPAM # sa-learn --spam --mbox /var/spool/imap/user/to m/Tom Failed to create default user preference file /root/.spamassassin/user_prefs Learned from 0 messages. Thanks, Tom -- Tom Nielsen Neuro Logic Systems 805.389.5435 x18 www.neuro-logic.com
On Sun, Dec 21, 2003 at 02:13:35AM -0500, Bob S. wrote:
Having a problem making Spamassassin learn. Using the command "sa-learn --spam --mbox /home/bob/Mail/spamin This is the mailbox I use to file all the spam in.
I set SpamAssassin up a few months ago but have never bothered to try getting it to learn what is and isn't spam. It seems to do a passable job as it stands but does miss quite a few spam mails. When this thread came up I read it with interest, hoping that I could make use of the info given here. However I was quickly dissapointed when I discovered that I do not have sa-learn. Is it a standard feature of SpamAssassin or soemthing one must add? Perhaps it was added in a later version of SpamAssassin, I have version 2.31. Thanks. -- Steve Crane http://craniac.afraid.org
Quoting Steve Crane <sjc@cidev.com>: [snip]
When this thread came up I read it with interest, hoping that I could make use of the info given here. However I was quickly dissapointed when I discovered that I do not have sa-learn. Is it a standard feature of SpamAssassin or soemthing one must add? Perhaps it was added in a later version of SpamAssassin, I have version 2.31.
Thanks.
sa-learn and Bayesian filtering were added around 2.54. SA is up to at least 2.60. HTH, Jeffrey
On Wed December 24 2003 12:39 pm, Jeffrey L. Taylor wrote:
Quoting Steve Crane <sjc@cidev.com>: [snip]
When this thread came up I read it with interest, hoping that I could make use of the info given here. However I was quickly dissapointed when I discovered that I do not have sa-learn. Is it a standard feature of SpamAssassin or soemthing one must add? Perhaps it was added in a later version of SpamAssassin, I have version 2.31.
Thanks.
sa-learn and Bayesian filtering were added around 2.54. SA is up to at least 2.60.
HTH, Jeffrey
SA is up to 2.70. To get the latest SA (should be/is) easy: I do the following: 1) Make a directory for the new version in /usr/local 2) CD to the new directory. 3) Run the small script below. (when it asks for a password, hit ENTER) 4) run: make 5) If no errors, run: make install Changes to scores and other settings can be made in /etc/mail/spamassassin/ local.cf #!/bin/bash cd /usr/local cvs -d :pserver:anonymous@cvs.spamassassin.sourceforge.net:/cvsroot/ spamassassin login cvs -d :pserver:anonymous@cvs.spamassassin.sourceforge.net:/cvsroot/ spamassassin co spamassassin cd /usr/local/spamassassin -- +----------------------------------------------------------------------------+ + Bruce S. Marshall bmarsh@bmarsh.com Bellaire, MI 12/24/03 12:43 + +----------------------------------------------------------------------------+ "Who's General Failure & why's he reading my disk?"
On Wed, Dec 24, 2003 at 12:47:07PM -0500, Bruce Marshall wrote:
On Wed December 24 2003 12:39 pm, Jeffrey L. Taylor wrote:
sa-learn and Bayesian filtering were added around 2.54. SA is up to at least 2.60. SA is up to 2.70.
To get the latest SA (should be/is) easy:
Thanks guys. -- Steve Crane http://craniac.afraid.org
participants (14)
-
Ben Rosenberg -
Bob S. -
Bruce Marshall -
Carl William Spitzer IV -
Carlos E. R. -
Ian David Laws -
Ivan Sergio Borgonovo -
Jeffrey L. Taylor -
John Andersen -
Kenneth Schneider -
Old Sarge -
Peter Whysall -
Steve Crane -
Tom Nielsen