[opensuse] OT - How to tell spamassassin to "Unlearn" something as spam.
Listmates, Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam? -- David C. Rankin, J.D.,P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Thursday 14 August 2008 15:18:53 David C. Rankin wrote:
Listmates,
Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?
-- David C. Rankin, J.D.,P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com
You should be able to use /usr/bin/sa-learn. I don'tremember the precise syntax, but it should be something like sa-learn --forget file(s) sa-learn --ham file(s) -- Jim
Jim Cunning wrote:
On Thursday 14 August 2008 15:18:53 David C. Rankin wrote:
Listmates,
Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?
-- David C. Rankin, J.D.,P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com
You should be able to use /usr/bin/sa-learn. I don'tremember the precise syntax, but it should be something like
sa-learn --forget file(s) sa-learn --ham file(s)
You could also just whitelist the list serve. /etc/mail/spamassassin/local.cf whitelist_from *@server.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
* David C. Rankin <drankinatty@suddenlinkmail.com> [08-14-08 18:21]:
Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?
man sa-learn and/or whitelist in ~/.spamassassin/user_prefs -- Patrick Shanahan Plainfield, Indiana, USA HOG # US1244711 http://wahoo.no-ip.org Photo Album: http://wahoo.no-ip.org/gallery2 Registered Linux User #207535 @ http://counter.li.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Thu, Aug 14, 2008 at 6:04 PM, Patrick Shanahan <paka@opensuse.org> wrote:
* David C. Rankin <drankinatty@suddenlinkmail.com> [08-14-08 18:21]:
Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?
man sa-learn and/or whitelist in ~/.spamassassin/user_prefs
--
First, I don' think this IS off topic.... Second, David, this will be a reoccurring situation over time. All your users will find false negatives and false positives and you might as well figure out some solution that is easily implemented across all users. We set up two mailboxes on each Imap account (this was one of the issues that got us to Imap in the first place), labled "Missed-Spam" and "Not-Spam" (or what ever). We also have a mailbox called just plain "Spam". Our system wide sieve scripts puts spam there. All our users have to do is move / copy messages that spamassassin falsely tags into the Missed or Not mail boxes. A script on the server then runs sa-learn against those mailboxes every so often. Sa-learn will also do razor-report so you help the community if you do automate this. The script also purges these Missed and Not boxes for each user so that they don't have to manage them. Its worked quite well for us, keeping our SA bayes database up to date, unlearning falsely accused spam (and razor revoke as well). -- ----------JSA--------- Someone stole my tag line, so now I have this rental. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
John Andersen wrote:
On Thu, Aug 14, 2008 at 6:04 PM, Patrick Shanahan <paka@opensuse.org> wrote:
* David C. Rankin <drankinatty@suddenlinkmail.com> [08-14-08 18:21]:
Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?
man sa-learn and/or whitelist in ~/.spamassassin/user_prefs
--
First, I don' think this IS off topic....
Second, David, this will be a reoccurring situation over time. All your users will find false negatives and false positives and you might as well figure out some solution that is easily implemented across all users.
We set up two mailboxes on each Imap account (this was one of the issues that got us to Imap in the first place), labled "Missed-Spam" and "Not-Spam" (or what ever).
We also have a mailbox called just plain "Spam". Our system wide sieve scripts puts spam there.
All our users have to do is move / copy messages that spamassassin falsely tags into the Missed or Not mail boxes.
A script on the server then runs sa-learn against those mailboxes every so often. Sa-learn will also do razor-report so you help the community if you do automate this.
The script also purges these Missed and Not boxes for each user so that they don't have to manage them.
Its worked quite well for us, keeping our SA bayes database up to date, unlearning falsely accused spam (and razor revoke as well).
Thanks John, That's the practical howto I was looking for. We run a similar setup, but have never implemented an unlearn function. I like the default: ~/Mail .. spam spam-learn spam-probably .. setup with suspected spam going to spam-probably, user copy to spam-learn, then an hourly cron job running to have spamassassin learn the messages in spam-learn and then delete them. I think I'll add "spam-unlearn" to the end of the list and add the unlearn features to the cron job. -- David C. Rankin, J.D., P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Thu, Aug 14, 2008 at 8:24 PM, David C. Rankin <drankinatty@suddenlinkmail.com> wrote:
John Andersen wrote:
On Thu, Aug 14, 2008 at 6:04 PM, Patrick Shanahan <paka@opensuse.org> wrote:
* David C. Rankin <drankinatty@suddenlinkmail.com> [08-14-08 18:21]:
Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?
man sa-learn and/or whitelist in ~/.spamassassin/user_prefs
--
First, I don' think this IS off topic....
Second, David, this will be a reoccurring situation over time. All your users will find false negatives and false positives and you might as well figure out some solution that is easily implemented across all users.
We set up two mailboxes on each Imap account (this was one of the issues that got us to Imap in the first place), labled "Missed-Spam" and "Not-Spam" (or what ever).
We also have a mailbox called just plain "Spam". Our system wide sieve scripts puts spam there.
All our users have to do is move / copy messages that spamassassin falsely tags into the Missed or Not mail boxes.
A script on the server then runs sa-learn against those mailboxes every so often. Sa-learn will also do razor-report so you help the community if you do automate this.
The script also purges these Missed and Not boxes for each user so that they don't have to manage them.
Its worked quite well for us, keeping our SA bayes database up to date, unlearning falsely accused spam (and razor revoke as well).
Thanks John,
That's the practical howto I was looking for. We run a similar setup, but have never implemented an unlearn function. I like the default:
~/Mail .. spam spam-learn spam-probably ..
setup with suspected spam going to spam-probably, user copy to spam-learn, then an hourly cron job running to have spamassassin learn the messages in spam-learn and then delete them. I think I'll add "spam-unlearn" to the end of the list and add the unlearn features to the cron job.
-- David C. Rankin, J.D., P.E.
Yes, I can see that we are on the same track there. With opensuse's default setup for Imap (postfix -->amavisd (vscan, spam) -->posfix-again -->cyrus there is only ONE systemwide bayes database. And you have to run every body's imap folder against that database to Learn, unlearn, etc. If you take amavisd out of the picture each user has their own bays database. This is less than Ideal, but I spent a good 8 months training personal databases with spam/ham before I had that forehead smacking "DOH!" moment when I realized amavis only uses a system wide bayes. If you are using Imap I can share my cron script with you for comparison if you wish. Note that I have no "probably" category. I have my spamassassin dev-nul level set around 10, and anything above that just gets dumped by Amavisd. Anything below that gets flagged as spam unless its below my spam threshhold, in which case it passes through. So my Spam category is your Probably category. And your Spam category is my Dev nul. I can afford to do this in my line of work, YMMV. -- ----------JSA--------- Someone stole my tag line, so now I have this rental. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
John Andersen wrote:
We set up two mailboxes on each Imap account (this was one of the issues that got us to Imap in the first place), labled "Missed-Spam" and "Not-Spam" (or what ever).
We also have a mailbox called just plain "Spam". Our system wide sieve scripts puts spam there.
All our users have to do is move / copy messages that spamassassin falsely tags into the Missed or Not mail boxes.
A script on the server then runs sa-learn against those mailboxes every so often. Sa-learn will also do razor-report so you help the community if you do automate this.
The script also purges these Missed and Not boxes for each user so that they don't have to manage them.
Its worked quite well for us, keeping our SA bayes database up to date, unlearning falsely accused spam (and razor revoke as well).
Thanks John,
That's the practical howto I was looking for. We run a similar setup, but have never implemented an unlearn function. I like the default:
~/Mail .. spam spam-learn spam-probably ..
setup with suspected spam going to spam-probably, user copy to spam-learn, then an hourly cron job running to have spamassassin learn the messages in spam-learn and then delete them. I think I'll add "spam-unlearn" to the end of the list and add the unlearn features to the cron job.
The solution turned out to be incredibly simple. All I needed to do was create the "spam-unlearn" mailbox folder and add a single line to the cron script that handles spam. The following is the complete cron script that both learns from spam in the "spam-probably" folder and unlearns the mis-tagged spam in the "spam-unlearn" folder. This is for dovecot with (mail_location = mbox:~/Mail:INBOX=/var/spool/mail/%u) in dovecot.conf. /usr/bin/fetchmail -a -s -n --folder spam-learn -m '/usr/bin/sa-learn --spam' sleep 2 /usr/bin/fetchmail -a -s -n --folder spam-unlearn -m '/usr/bin/sa-learn --ham' If you use UW imap, just change the above lines to "Mail/" before the folder names. (i.e. --folder Mail/spam-unlearn) Thanks for pointing me in the right direction. -- David C. Rankin, J.D., P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
David C. Rankin wrote:
Listmates,
Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?
"unlearn" only applies if you're using Bayes classification - otherwise I would just add some appropriate "whitelist_from_rcvd" exceptions. Possibly also whitelist_from_dkim and whitelist_from_spf. /Per Jessen, Zürich -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Fri, Aug 15, 2008 at 2:32 AM, Per Jessen <per@computer.org> wrote:
David C. Rankin wrote:
Listmates,
Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?
"unlearn" only applies if you're using Bayes classification - otherwise I would just add some appropriate "whitelist_from_rcvd" exceptions. Possibly also whitelist_from_dkim and whitelist_from_spf.
Un-learn also razor-revokes which is equally important. But I have to ask, why wouldn't you use Bayes? Its the most effective portion of SA imho... -- ----------JSA--------- Someone stole my tag line, so now I have this rental. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Per Jessen wrote:
David C. Rankin wrote:
Listmates,
Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?
"unlearn" only applies if you're using Bayes classification - otherwise I would just add some appropriate "whitelist_from_rcvd" exceptions. Possibly also whitelist_from_dkim and whitelist_from_spf.
/Per Jessen, Zürich
Per, John, Now you have raised another question - Since I do maintain my bayes_toks file and move it from box-to-box and install-to-install, would it be better to clean it up with unlearn instead of simply whitelisting? I guess it really doesn't matter as long as other characteristics of the offending tokens are not causing problems with other mails by increasing their score? I don't know enough about the type and number of "tokens" spamassassin takes per message. What are your thoughts? -- David C. Rankin, J.D., P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Sun, Aug 17, 2008 at 10:48 PM, David C. Rankin <drankinatty@suddenlinkmail.com> wrote:
Now you have raised another question - Since I do maintain my bayes_toks file and move it from box-to-box and install-to-install, would it be better to clean it up with unlearn instead of simply whitelisting? I guess it really doesn't matter as long as other characteristics of the offending tokens are not causing problems with other mails by increasing their score? I don't know enough about the type and number of "tokens" spamassassin takes per message. What are your thoughts?
Whitelisting is pretty bullet proof, and essentially bypasses any bayes tests, and is suitable for specific addresses of senders that are not likely to be faked. That said, I've never found a reason to bother using Whitelists. With a properly trained bayes (trained with BOTH spam and ham) its just not a problem. Using the two training mailbox scenario (talked about earlier in this thread), you can train bayes with spam and ham by dragging properly categorized mails into the corresponding box to confirm and enhanse bayes recognition in the future. Example: My airline emails look sort of spammy, but were initially passes as Ham (fairly high scoring ham, but ham never the less). I copied them into the Not Spam folder, which got fed to sa-learn and subsequent to that they scored much lower (more hammy) and I've never had a problem. -- ----------JSA--------- Someone stole my tag line, so now I have this rental. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
participants (6)
-
David C. Rankin -
Jim Cunning -
John Andersen -
Patrick Shanahan -
Per Jessen -
rschwedler