How do I add HAM / SPAM to the virtual users configuration

Discussion in 'HOWTO-Related Questions' started by jrv116psu, Nov 29, 2006.

  1. jrv116psu

    jrv116psu New Member

    Quick question,

    I want to add baysian filtering to your virtual mailbox howto on
    howtoforge.. I see that bayes is on by default but I need to train
    spamassassin with spam and ham.. I assume I need to do the training as the
    user that's running the vmail is this correct??

    What user would I use to do this? ?I tried running the sa-learn commands as
    root but it doesn't seem to affect the mail (I didn't see Bayesian ever
    coming up as affecting the score).. would I su to vmail first?? Or perhaps
    amavis? How would I get the vmail solution to learn the spam and ham in order to have it start affecting scores?

    Jesse Vaughan
     
    Last edited: Nov 30, 2006
  2. falko

    falko Super Moderator Howtoforge Staff

    It doesn't matter under which user you run the sa-learn command (as long as it has the permission to run sa-learn).
     
  3. edge

    edge Active Member Moderator

    This has always boggled me.

    How do I use sa-learn?

    Do I cd to the /var/mail directory, and just run "sa-learn --spam" ?
    If so.. Will it learn all the messages as spam? Even the good emails?
     
    Last edited: Nov 30, 2006
  4. jrv116psu

    jrv116psu New Member

    This cant be right..

    HTML:
    I dont think this can be right.. here's my reasoning:
    
    In my inbox this morning I got this mail:
    
    
    Super pick!  Get this winner early tomorrow November, 30th!
    
    In today's energy sector alternative fuels is THE place to be.  Our next 
    feature is a pioneer in the field and is coming out with an astounding 
    revelation!
    
    Heartland Energy Group
    Sym: HEGP
    Currrently trrading at $0.25 (+8.70%)
    Vollume : around 3,000,000
    
    We are expecting this one to reach $0.80 in the short-term.  We could see 
    long-term levels of up to $2.50.  Do not underestimate the power of this 
    upcoming announcement!
    ......
    ....
    
    
    It goes on, but you get the general idea... The header is normal, with no added spam tags meaning the default amavisd setup decided it had a score less than 2 and shouldnt be tagged.   It also was not moved into a spam folder and was left in my general inbox
    
    Then I moved it into a separate folder and ran :
    spamassassin -t /the new foldername/cur   
    
    and here's what spam assassin scored it as:
    
    
    Content analysis details:   (8.3 points, 5.0 required)
    
     pts rule name              description
    ---- ---------------------- --------------------------------------------------
     0.3 IP_NOT_FRIENDLY        IP_NOT_FRIENDLY
     0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
     0.2 FUZZY_VLIUM            BODY: Attempt to obfuscate words in spam
     3.5 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                                [score: 0.9978]
     0.5 RAZOR2_CHECK           Listed in Razor2 ([url]http://razor.sf.net/[/url])
     1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
                                above 50%
                                [cf: 100]
     0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                                [cf: 100]
     1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
                 [Blocked - see <http://www.spamcop.net/bl.shtml?209.152.125.144>]
    
    
    ========================================================
    
    So in other words: spam assassin scored it as an 8.3 but amavis scored it as <2  this doesnt match!!  Also if amavis is using bayes, why doesn't "BAYES_99"       show up in the header when amaivisd runs... is there any way to prove whether or not it's actually running- because I REALLY dont think it is..
    
    Jesse Vaughan
     
  5. jrv116psu

    jrv116psu New Member

    Eureka moment!! think I figured it out..

    Ok..I solved the problem and it DOES matter who you run sa-learn as...

    I found a website that said to stop the amavisd service ..and then run it in bayes debug mode...

    (i did this by running amavisd -d bayes debug)

    When I did this I noticed it said there were only 74 messages in it's database...Odd since when I scanned my spam folder I had over 400...

    sooo... I copied the contents of my /root/.spamassassin directory to /var/spool/amavisd/.spamassassin

    and voilla it now says there are 400+ items in the spam database... So it seems to have worked.. and would explain why it wasnt using bayes before to check messages.. I then stopped debug mode and started amavisd up normally.. so now all I need is a bunch of spam to verify it's working correctly..

    Jesse
     

Share This Page