Announcement

Collapse
No announcement yet.

SpamAssassin Not Working Well

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Justec
    started a topic SpamAssassin Not Working Well

    SpamAssassin Not Working Well

    Is there any updates coming for this? One of my personal email account I have on my hosting server just get obliterated with spam every day.

    So far since 9AM EST today till 3PM EST now I have had 12 emails go to the spam box and 25 spams go to my inbox. That 25 number will be higher by the end of the day for sure.
    I've been doing my manual learn ham / spam training, but doesn't seem to help. I also have my spam threshold set so low that I usually have 2 or 3 message a day go to spam that shouldn't be going.

    Not sure what options other iworx users use? 3rd party server that filters email before getting to the Iworx box? Doing a custom setup and replacing SpamAssassin?
    Last edited by Justec; 11-07-2014, 03:19 PM.

  • newmind
    replied
    Yeah, Bayes is useless without training, and users give up after awhile if a significant reduction in spam does not occur.

    As a result I've turned off Bayes entirely and am focusing on tuning SA (via available plugins and tweaking rule scoring from the defaults). I'll revisit Bayes once I'm confident SA is reasonably tuned with respect to default config.

    Personally my own email accounts are 10-15 years old, but they've never been publicly displayed (i.e. not discoverable by scrapers). I get 1 or 2 spams a day, if that. Some clients on the other hand have heavily trafficked sites where the primary email address was exposed early on and is/has been in spammer databases for many years. These users just get hammered with spam, despite SA blocking the majority of it.

    Right now we're down to the nonsense messages with subject lines like, "Trump's Plan to help Americans Earn More" with random garbled message body text, or 1 liners like "Hi, how are you? click here to [some scammer site]". It's the volume that's the problem, users don't care that the majority is getting blocked when the trickle is itself a daily time consuming process of deleting spam from one's inbox.

    Leave a comment:


  • webnexus
    replied
    I feel I should call this out for you guys complaining about decreased detection over time. SA has an autolearn feature which is actually not good to have turned on unless you have been submitting your email to the Learn* directories constantly. What the autolearn will end up doing is that "well, it got through 10 times without report so that must be a valid email address and syntax..." It does also make it harder for spam to get through if it's trained, but.... see the added caveat of the below individual bayes DBs

    I didn't realize that right away. After about a year I started seeing obvious spam with "auto-whitelist" up scoring. The only way you can clear that is by nuking your database. The way I did that is below.

    Also, by default Interworx is set to individual bayes databases, I switched it to server wide (which ignored/deleted the old stuff but did make me start from scratch) so all will benefit from the activities of the few and I've been hearing good results from it.

    So unless the majority of your users are actively training, turn off auto learn and you'll probably get better results for all if you have it on server wide. I'm attached to all my accounts via IMAP so I just move them as they come up and call it a day. After that switch for email addresses that are 15+ years old I'm getting 0-5 spam messages a day.

    Leave a comment:


  • IWorx-Nathan
    replied
    I wanted to let you guys know I submitted a feature request to the development team to incorporate the sa-update -D command in our cron process.

    Leave a comment:


  • d2d4j
    replied
    Hi newmind

    I concur it would be an idea either to have SA updates preset as a cron or perhaps to have a message appear at the side of SA in nodeworx, alerting you to setup a cron job. However, there are numerous posts about SA updates on here.

    I would think myself most if not nearly all issues are raised, and therefore covered. I do know IW very regularly check the forums, and where I see an actual issue which has not been raised to IW, I send an email with the post link to alert them

    I feel also that it might be best to remind users I do not work for IW, so my onions and or advice is not biased and are my own.

    Many thanks

    John

    Leave a comment:


  • newmind
    replied
    Isn't the purpose of having a control panel so you don't have to do things manually like this
    Agreed, guess since SA is an opt-in service they don't implement auto-update. Unfortunate this topic isn't covered in the docs, much pain to be had in not keeping SA up-to-date.

    Anyway, nightly cron job gets things back on track.

    I wonder what else might be lagging on the auto update front...

    Leave a comment:


  • d2d4j
    replied
    Hi staxed

    I fully understand what your saying, and I realised early on that it was not auto updated.

    You can set a cron job to auto update and restart service as I posted

    There are other features connected with SA which are not installed, but can be turned on, which will not work unless you have installed them, such as phyzor I think it's called, which again helps with spam.

    Many thanks

    John

    Leave a comment:


  • Staxed
    replied
    Originally posted by d2d4j View Post
    Hi newmind

    Have you updated SA rules

    If not, to save you time researching, ssh into server, under root access sa-update -D; service spamassasin restart

    You may want to set this as a cron

    Sorry if you already update SA

    Many thanks

    John
    Originally posted by newmind View Post
    Thanks, assumed SA would be updated as part of the control panel (i.e. if the service is enabled then rules would update automatically).
    I've been using Interworx for a while now as well, and never realized that SA isn't updated by the control panel either. Isn't the purpose of having a control panel so you don't have to do things manually like this? For something as imperative as spam handling, logging into SSH to update it seems like an oversight.

    Leave a comment:


  • newmind
    replied
    Thanks, assumed SA would be updated as part of the control panel (i.e. if the service is enabled then rules would update automatically).

    Leave a comment:


  • d2d4j
    replied
    Hi newmind

    Have you updated SA rules

    If not, to save you time researching, ssh into server, under root access sa-update -D; service spamassasin restart

    You may want to set this as a cron

    Sorry if you already update SA

    Many thanks

    John

    Leave a comment:


  • newmind
    replied
    Nothing has changed on this front AFAICT, SA allows through much more spam than in years past (iworx user for over 10 years).

    Some clients are getting hammered with spam, 100+ per day making it to through to their inbox with SMTP level scanning enabled and 2.3 threshold score. As Justec mentioned some valid emails wind up in the user's spam folder. Really not ideal, is there anything iworx users can do to improve the spam filtering situation??

    I actually disabled Bayes scanning as it seems to do nothing, actually worse than nothing as EVERY message got tagged with a positive spam score (can't remember the flag) that put the vast majority of mail over the threshold, thus resulting in either valid messages being straight deleted or sent to user's spam folder.

    Basically it seems that SA's a bit of mess currently. There must be a way to right the ship.

    Feedback appreciated.

    Leave a comment:


  • d2d4j
    replied
    Hi webnexus

    IW are aware of the special folders for spam, and please can you open a support ticket with IW so they can implement the fix.

    Please state the special spam folders disappeared when opening ticket.

    I believe the fix is been rolled out on next update.

    I hope that helps

    Many thanks

    John

    Leave a comment:


  • webnexus
    replied
    While doing a quick search I found this thread and it seems as though this may be relevant information

    • I have notice a considerable decrease in spam detection
    • I've also noticed that the .Learn Spam and .Learn Ham directories are on occasion having the cur directory deleted
    • No longer seeing spam learning reports on a daily basis
    • Auto White listing had somehow been enabled, I disabled that many years ago... assuming a patch got that one


    This is definitely a bit of a bug an update somewhere along the way and whatever handler is managing the sa-learn process probably has a typo in it that's nuking the entire path rather than what is in the path when it does its cleanup.

    Leave a comment:


  • Justec
    replied
    No, the inbox is running exactly as it should. I have a Spam folder setup which the maildrop script properly put into the spam folder if SA marks it as such. I also have learn ham/spam folders which I have been using for the last month trying to curb the increase of spam going to inbox.

    There are some spams which are going to the spam folder as they should, it's just out of 50 spam in a day maybe 15 go to spam and the rest go to inbox.

    Leave a comment:


  • d2d4j
    replied
    Hi justec

    Sorry, a thought which us easy to answer but may explain something in your last post re spam emails

    If you access webmail, do you have the learn spam and ham folders.

    If not, please contact IW support to have this fixed.

    I'm thinking after reading your post, it maybe if these are missing, it's passing spam straight through to inbox

    If I'm wrong sorry

    Many thanks

    John

    Leave a comment:

Working...
X