RE: [AMaViS-user] How to use sa-learn to manually train?

[Lynn D. <ly...@fu...>]

 

> -----Original Message-----
> From: ama...@li... 
Scott,

> So my understanding on this is that I have to remove all the 
> headers that amavisd-new/sa added before I feed them back to 
> sa-learn? Is that a correct assumption? (I have sendmail/sa 
> 2.63 / amavisd-new-p9 setup.
> Clients access their mail using pop3 clients only)
> 

My memory does not serve me too well but this section from an earlier
version of Scott Vintinner's document "Fairly-Secure Anti-SPAM Gateway Using
OpenBSD, Postfix, Amavisd-new, SpamAssassin, Razor and DCC" is what I've
based allot of my understanding on. Note that the latest version of this
document does not include any information on this subject.  The final
paragraph probably explains why.  I also remember reading that the X-Spam
headers are ignored but the "***SPAM***" addition to the subject line should
be removed for more accurate learning.

The latest version of this document can be found at
http://www.flakshack.com/anti-spam/ .  This section however is no longer
included as part of the document.  This section was taken from a 6/3/2003
version. 

- - begin - -
IMPORTANT NOTE: the sa-learn program needs to see the full headers of the
original message in order for this to work correctly. Unfortunately if a
user simply forwards a message to spam or notspam, these headers will
usually be discarded by the email client. The workaround for this is
dependant on the email client you are using. For Outlook 2000 or higher
clients, instead of forwarding the message they need to follow this
procedure:

1. Open the message.
2. From the message window's menu, choose Actions...Resend This Message.
3. Remove all of the original FROM, TO and CC lines. If you can't see the
From field, you can turn it on by using the View...From Field menu action.
4. In the TO line, enter either sp...@re... or
no...@re....

Also keep in mind that, the bayesian database won't get used until it has at
least 200 entries.

FYI: At my company we ended up not using this even though I'd set it up. The
auto-learn function seemed to be working very well (the system seems to stop
~90% of spam) without it. We weren't really sure if the 50 or so messages
per day that users would probably forward would make any difference in the
bayes database when the system was already auto-learning 10,000 messages per
day. Using this method would probably affect the AWL, but again the benefit
of that seemed marginal. In the end, management decided it was just easier
to tell the users to delete any spam that makes it past the system rather
than teaching them the 6 step process to resend a message.
- - End - -

At first I had users forward as attachments to me and then I would use the 4
step process to resend to the spam/ham learning accounts.  Of course I have
less than 50 mail users.

After a while I was able to adjust the tag levels so that very few had the
added "***SPAM***" in the subject and most just had the added header info.
Those could be filter into a separate folder and forwarded as attachments
for learning.  Your own domain should already be whitelisted so the header
information added by being forwarded should not be a problem.  In my case my
Spam filter system is not the final destination.  I use an account on the
subdomain ly...@re... instead of ly...@do... and send to
sp...@re... and no...@re... so it's not an issue for
me.

Hope this helps


L. A. Duerksen
Technical Manager
Futureware Distributing, Inc
OpenBSD 3.4
amavisd-new
spamassassin
postfix
ClamAV version 0.70