spam issues

[silver_2000]

from http://www.configserver.com/techfaq/faq ... =51&page=5

running
sa-learn --force-expire
results in
sa-learn: command not found

Maybe thats why Im seeing increase in spam ?

All input and ideas welcome

[Sarah]

You now need to use the full path for sa-learn:

Code: Select all

/usr/local/cpanel/3rdparty/bin/sa-learn

I'll update the faq.

[silver_2000]

thanks
Ive now run the command correctly but the journal date still shows 1969
"Wed, 31 Dec 1969 18:00:00 -0600"


"In MailWatch, click on Tools/Links and then Bayes Database Information. The date for the Last Journal Sync and Last Expiry should be within the last day or two."

I guess Ill delete the database but its a new server so Im assuming the database cat have grown "too large " already

[Sarah]

You can manually sync the database:

Code: Select all

/usr/local/cpanel/3rdparty/bin/sa-learn --sync

[silver_2000]

I deleted the database right after my last post here and this morning the Journal still shows a 1969 date
I ran the '/usr/local/cpanel/3rdparty/bin/sa-learn --sync "
just now
it didnt instantly fix the journal date - should it ?

Code: Select all

Bayes Database Information
Number of Spam Messages:	145
Number of Ham Messages:	312
Number of Tokens:	78,610
Oldest Token:	Wed, 05 Mar 2014 16:37:29 -0600
Newest Token:	Thu, 06 Mar 2014 09:13:03 -0600
Last Journal Sync:	Wed, 31 Dec 1969 18:00:00 -0600
Last Expiry:	Wed, 05 Mar 2014 16:38:46 -0600
Last Expiry Reduction Count:	0 tokens

[Sarah]

I have seen cases where running a manual journal sync does not actually seem to do anything.

In this case I think the problem may be that there aren't enough spam messages:

Code: Select all

Number of Spam Messages:   145

The Bayes database won't do anything until there are 200 spam and 200 ham.

Regards,
Sarah

[silver_2000]

Code: Select all

Bayes Database Information
Number of Spam Messages:	211
Number of Ham Messages:	398
Number of Tokens:	95,468
Oldest Token:	Wed, 05 Mar 2014 16:37:29 -0600
Newest Token:	Thu, 06 Mar 2014 11:37:38 -0600
Last Journal Sync:	Wed, 31 Dec 1969 18:00:00 -0600
Last Expiry:	Wed, 05 Mar 2014 16:38:46 -0600
Last Expiry Reduction Count:	0 tokens

Here is the problem Im trying to solve
I recent moved servers - the old server was running your tools and we paid to have the same tools running on the new server
The new server is OVERRUN with spam that we didnt have on the old one. The spam started almost immediately after the move.
Obvious repeated spam thats not getting classified correctly
Ive set the thresholds for one account at 3 and 7 and yet I still get 30-100 spam messages per hour. Most of those aren't even tagged as spam.

So thinking Ive missed some setting or tweak I started going through all the various FAQs etc
One of your FAQs says that the jornal sync should show a date within the last 48 hours

Im not sure what the Journal does or doesn't do but Im simply trying to address ANY and ALL issues that would keep the system from filtering spam like it used to.

[Sarah]

I would wait and see if the bayes filtering starts working and there is any reduction in the amount of spam getting through. Other than that, I'm afraid we have no further suggestions beyond what is in the FAQ you referred to.

[Sarah]

If you've just recently had a service package or mailscanner install from us within the last week or two, please log a ticket on the helpdesk and we'll see if there is anything else we can suggest.

[silver_2000]

It was CM12168 from Early Feb
I waited a few weeks for the bayes database to build and improve
Didnt seem to help

The Journal date is now updated -

My hope is that something wasnt quite right initially and these changes / updates will help

A recent example is a Email with the subject of "Dr oz reveals 1 tip To perfect skin" from Dr. Oz Skin Secret [Dr.OzSkinSecret@tarahon.eu]
It only received a score of 4.8

Code: Select all

X-pmail-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
	score=4.886, required 3, AC_HTML_NONSENSE_TAGS 0.00, BAYES_50 0.80,
	DCC_CHECK 1.10, HTML_MESSAGE 0.00, MIME_HTML_ONLY 0.72,
	RCVD_IN_BRBL_LASTEXT 1.45, RDNS_NONE 0.79, SPF_PASS -0.00,
	T_HK_NAME_DR 0.01, T_REMOTE_IMAGE 0.01)

This is clearly spam - the email only contains a single link to "Dr oz reveals 1 tip To perfect skin" And 2 images. Classic - obvious spam
If you download the images It has 2 different unsubscribe lines / links

my account has received hundreds of "Dr OZ " emails in the last few weeks so the system has had plenty of time to "learn"