John Andersen wrote:

On Thu, Aug 14, 2008 at 6:04 PM, Patrick Shanahan wrote:

...

* David C. Rankin [08-14-08 18:21]:

...

Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?

man sa-learn and/or whitelist in ~/.spamassassin/user_prefs

--

First, I don' think this IS off topic....

Second, David, this will be a reoccurring situation over time. All your users will find false negatives and false positives and you might as well figure out some solution that is easily implemented across all users.

We set up two mailboxes on each Imap account (this was one of the issues that got us to Imap in the first place), labled "Missed-Spam" and "Not-Spam" (or what ever).

We also have a mailbox called just plain "Spam". Our system wide sieve scripts puts spam there.

All our users have to do is move / copy messages that spamassassin falsely tags into the Missed or Not mail boxes.

A script on the server then runs sa-learn against those mailboxes every so often. Sa-learn will also do razor-report so you help the community if you do automate this.

The script also purges these Missed and Not boxes for each user so that they don't have to manage them.

Its worked quite well for us, keeping our SA bayes database up to date, unlearning falsely accused spam (and razor revoke as well).

Thanks John, That's the practical howto I was looking for. We run a similar setup, but have never implemented an unlearn function. I like the default: ~/Mail .. spam spam-learn spam-probably .. setup with suspected spam going to spam-probably, user copy to spam-learn, then an hourly cron job running to have spamassassin learn the messages in spam-learn and then delete them. I think I'll add "spam-unlearn" to the end of the list and add the unlearn features to the cron job. -- David C. Rankin, J.D., P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

John Andersen wrote:

...

...

We set up two mailboxes on each Imap account (this was one of the issues that got us to Imap in the first place), labled "Missed-Spam" and "Not-Spam" (or what ever).

We also have a mailbox called just plain "Spam". Our system wide sieve scripts puts spam there.

All our users have to do is move / copy messages that spamassassin falsely tags into the Missed or Not mail boxes.

A script on the server then runs sa-learn against those mailboxes every so often. Sa-learn will also do razor-report so you help the community if you do automate this.

The script also purges these Missed and Not boxes for each user so that they don't have to manage them.

Its worked quite well for us, keeping our SA bayes database up to date, unlearning falsely accused spam (and razor revoke as well).

Thanks John,

That's the practical howto I was looking for. We run a similar setup, but have never implemented an unlearn function. I like the default:

~/Mail .. spam spam-learn spam-probably ..

setup with suspected spam going to spam-probably, user copy to spam-learn, then an hourly cron job running to have spamassassin learn the messages in spam-learn and then delete them. I think I'll add "spam-unlearn" to the end of the list and add the unlearn features to the cron job.

The solution turned out to be incredibly simple. All I needed to do was create the "spam-unlearn" mailbox folder and add a single line to the cron script that handles spam. The following is the complete cron script that both learns from spam in the "spam-probably" folder and unlearns the mis-tagged spam in the "spam-unlearn" folder. This is for dovecot with (mail_location = mbox:~/Mail:INBOX=/var/spool/mail/%u) in dovecot.conf. /usr/bin/fetchmail -a -s -n --folder spam-learn -m '/usr/bin/sa-learn --spam' sleep 2 /usr/bin/fetchmail -a -s -n --folder spam-unlearn -m '/usr/bin/sa-learn --ham' If you use UW imap, just change the above lines to "Mail/" before the folder names. (i.e. --folder Mail/spam-unlearn) Thanks for pointing me in the right direction. -- David C. Rankin, J.D., P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Fri, Aug 15, 2008 at 2:32 AM, Per Jessen wrote:

David C. Rankin wrote:

...

Listmates,

Spamassassin has decided that several of my list serve messages are spam. How do I tell spamassassin to unlearn the messages as spam so that they are not-spam?

"unlearn" only applies if you're using Bayes classification - otherwise I would just add some appropriate "whitelist_from_rcvd" exceptions. Possibly also whitelist_from_dkim and whitelist_from_spf.

Un-learn also razor-revokes which is equally important. But I have to ask, why wouldn't you use Bayes? Its the most effective portion of SA imho... -- ----------JSA--------- Someone stole my tag line, so now I have this rental. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Sun, Aug 17, 2008 at 10:48 PM, David C. Rankin wrote:

Now you have raised another question - Since I do maintain my bayes_toks file and move it from box-to-box and install-to-install, would it be better to clean it up with unlearn instead of simply whitelisting? I guess it really doesn't matter as long as other characteristics of the offending tokens are not causing problems with other mails by increasing their score? I don't know enough about the type and number of "tokens" spamassassin takes per message. What are your thoughts?

Whitelisting is pretty bullet proof, and essentially bypasses any bayes tests, and is suitable for specific addresses of senders that are not likely to be faked. That said, I've never found a reason to bother using Whitelists. With a properly trained bayes (trained with BOTH spam and ham) its just not a problem. Using the two training mailbox scenario (talked about earlier in this thread), you can train bayes with spam and ham by dragging properly categorized mails into the corresponding box to confirm and enhanse bayes recognition in the future. Example: My airline emails look sort of spammy, but were initially passes as Ham (fairly high scoring ham, but ham never the less). I copied them into the Not Spam folder, which got fed to sa-learn and subsequent to that they scored much lower (more hammy) and I've never had a problem. -- ----------JSA--------- Someone stole my tag line, so now I have this rental. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org