SpamAssassin Not Working Well

Is there any updates coming for this? One of my personal email account I have on my hosting server just get obliterated with spam every day.

So far since 9AM EST today till 3PM EST now I have had 12 emails go to the spam box and 25 spams go to my inbox. That 25 number will be higher by the end of the day for sure.
I’ve been doing my manual learn ham / spam training, but doesn’t seem to help. I also have my spam threshold set so low that I usually have 2 or 3 message a day go to spam that shouldn’t be going.

Not sure what options other iworx users use? 3rd party server that filters email before getting to the Iworx box? Doing a custom setup and replacing SpamAssassin?

SpamAssassin will be updated in the next release, which should help mitigate that. We’re also making a system to auto-build updates to 3rd party tools like SpamAssassin, so following the next release (5.1), updates those tools should be much more timely.

5.1 is a big release, though – will be at least a couple weeks before it hits the beta channel.

Hi justec

Spam has and always will be a issue, not least because one person spam is not another’s

Have you seen this post to mitigate your spam better, by creating new rules which content block etc…

http://forums.interworx.com/showpost.php?p=25514

Also, you may want to look at spamdyke, which helps with stopping spam before it is accepted.

Looking forward to 5.1 though

Many thanks

John

You could go to: /nodeworx/mail/spam

And put this as the SMTP Spam Score Threshold: [B]4

[/B]After I used that on InterWorx a year ago, I’ve not got any spam and only the emails I need. If you don’t want to be that strict you could use a 6 or 7.

Hi mike

I think that’s a good adjustment point, but once set, is usually never touched.

Sorry, think you mean nodeworx/system settings, mail/spam

Many thanks

John

[QUOTE=d2d4j;26643]Hi mike

I think that’s a good adjustment point, but once set, is usually never touched.

Sorry, think you mean nodeworx/system settings, mail/spam

Many thanks

John[/QUOTE]

Yeah :slight_smile: you can set it in siteworx too if they don’t like that either. I was lazy haha and put the url :smiley:

For siteworx user can go to Administration > Mail options > Spam settings :slight_smile:

Thanks for the update Brett.

For the email account in question I’ve lower my score threshold to 1.8! This is why I say I usually have 2 or 3 good emails going into the Spam folder. Just crazy that real emails getting marked above 1.8 and spammy ones coming in just fine.

I understand the amount of spam anyone gets can vary, but the percentage of spam going into my inbox vs spam folder isn’t good. Most of them aren’t even kind of spammy, but blatant spam and the same emails over and over that I have added to Learn Spam. So it sounds like a new version might just help with scoring messages better.

Also, thanks for the other ideas / links. For now I’m not going to worry about it and will wait for the new update in the coming month or so.

Hi justec

Sorry, a thought which us easy to answer but may explain something in your last post re spam emails

If you access webmail, do you have the learn spam and ham folders.

If not, please contact IW support to have this fixed.

I’m thinking after reading your post, it maybe if these are missing, it’s passing spam straight through to inbox

If I’m wrong sorry

Many thanks

John

No, the inbox is running exactly as it should. I have a Spam folder setup which the maildrop script properly put into the spam folder if SA marks it as such. I also have learn ham/spam folders which I have been using for the last month trying to curb the increase of spam going to inbox.

There are some spams which are going to the spam folder as they should, it’s just out of 50 spam in a day maybe 15 go to spam and the rest go to inbox.

While doing a quick search I found this thread and it seems as though this may be relevant information

  • I have notice a considerable decrease in spam detection
  • I've also noticed that the .Learn Spam and .Learn Ham directories are on occasion having the cur directory deleted
  • No longer seeing spam learning reports on a daily basis
  • Auto White listing had somehow been enabled, I disabled that many years ago... assuming a patch got that one

This is definitely a bit of a bug an update somewhere along the way and whatever handler is managing the sa-learn process probably has a typo in it that’s nuking the entire path rather than what is in the path when it does its cleanup.

Hi webnexus

IW are aware of the special folders for spam, and please can you open a support ticket with IW so they can implement the fix.

Please state the special spam folders disappeared when opening ticket.

I believe the fix is been rolled out on next update.

I hope that helps

Many thanks

John

Nothing has changed on this front AFAICT, SA allows through much more spam than in years past (iworx user for over 10 years).

Some clients are getting hammered with spam, 100+ per day making it to through to their inbox with SMTP level scanning enabled and 2.3 threshold score. As Justec mentioned some valid emails wind up in the user’s spam folder. Really not ideal, is there anything iworx users can do to improve the spam filtering situation??

I actually disabled Bayes scanning as it seems to do nothing, actually worse than nothing as EVERY message got tagged with a positive spam score (can’t remember the flag) that put the vast majority of mail over the threshold, thus resulting in either valid messages being straight deleted or sent to user’s spam folder.

Basically it seems that SA’s a bit of mess currently. There must be a way to right the ship.

Feedback appreciated.

Hi newmind

Have you updated SA rules

If not, to save you time researching, ssh into server, under root access sa-update -D; service spamassasin restart

You may want to set this as a cron

Sorry if you already update SA

Many thanks

John

Thanks, assumed SA would be updated as part of the control panel (i.e. if the service is enabled then rules would update automatically).

[QUOTE=d2d4j;28153]Hi newmind

Have you updated SA rules

If not, to save you time researching, ssh into server, under root access sa-update -D; service spamassasin restart

You may want to set this as a cron

Sorry if you already update SA

Many thanks

John[/QUOTE]

I’ve been using Interworx for a while now as well, and never realized that SA isn’t updated by the control panel either. Isn’t the purpose of having a control panel so you don’t have to do things manually like this? For something as imperative as spam handling, logging into SSH to update it seems like an oversight.

Hi staxed

I fully understand what your saying, and I realised early on that it was not auto updated.

You can set a cron job to auto update and restart service as I posted

There are other features connected with SA which are not installed, but can be turned on, which will not work unless you have installed them, such as phyzor I think it’s called, which again helps with spam.

Many thanks

John

Isn’t the purpose of having a control panel so you don’t have to do things manually like this

Agreed, guess since SA is an opt-in service they don’t implement auto-update. Unfortunate this topic isn’t covered in the docs, much pain to be had in not keeping SA up-to-date.

Anyway, nightly cron job gets things back on track.

I wonder what else might be lagging on the auto update front…

Hi newmind

I concur it would be an idea either to have SA updates preset as a cron or perhaps to have a message appear at the side of SA in nodeworx, alerting you to setup a cron job. However, there are numerous posts about SA updates on here.

I would think myself most if not nearly all issues are raised, and therefore covered. I do know IW very regularly check the forums, and where I see an actual issue which has not been raised to IW, I send an email with the post link to alert them

I feel also that it might be best to remind users I do not work for IW, so my onions and or advice is not biased and are my own.

Many thanks

John

I wanted to let you guys know I submitted a feature request to the development team to incorporate the sa-update -D command in our cron process.

I feel I should call this out for you guys complaining about decreased detection over time. SA has an autolearn feature which is actually not good to have turned on unless you have been submitting your email to the Learn* directories constantly. What the autolearn will end up doing is that “well, it got through 10 times without report so that must be a valid email address and syntax…” It does also make it harder for spam to get through if it’s trained, but… see the added caveat of the below individual bayes DBs

I didn’t realize that right away. After about a year I started seeing obvious spam with “auto-whitelist” up scoring. The only way you can clear that is by nuking your database. The way I did that is below.

Also, by default Interworx is set to individual bayes databases, I switched it to server wide (which ignored/deleted the old stuff but did make me start from scratch) so all will benefit from the activities of the few and I’ve been hearing good results from it.

So unless the majority of your users are actively training, turn off auto learn and you’ll probably get better results for all if you have it on server wide. I’m attached to all my accounts via IMAP so I just move them as they come up and call it a day. After that switch for email addresses that are 15+ years old I’m getting 0-5 spam messages a day.