Re: [Assp-user] HMM-Check has given less than 6 results - using monitoring mode only

[Dossy S. <do...@pa...>]

I'm seeing it in cases where neither of two things are true:

Jan-31-16 12:01:01 m1-59661-00321 [Worker_1] [TLS-in] 208.118.235.17
<lil...@gn...> Message-Score: added
-10 (tlsValencePB) for SSL-TLS-connection-OK, total score for this
message is now -10
Jan-31-16 12:01:01 m1-59661-00321 [Worker_1] [TLS-in] [DKIM]
208.118.235.17 <lil...@gn...> to:
do...@pa... [scoring] DKIM domain mismatch - gnu.org found in
DKIMCache, but no DKIM-Signature found in mail header (Cache)
Jan-31-16 12:01:01 m1-59661-00321 [Worker_1] [TLS-in] 208.118.235.17
<lil...@gn...> to:
do...@pa... Message-Score: added 15 (dkimValencePB) for DKIM
domain mismatch - gnu.org found in DKIMCache, but no DKIM-Signature
found in mail header, total score for this message is now 5
Jan-31-16 12:01:02 m1-59661-00321 [Worker_1] [TLS-in] 208.118.235.17
<lil...@gn...> to:
do...@pa... info: remove IP-score from 208.118.235.17 - this mail
passed the SPF check
Jan-31-16 12:01:02 m1-59661-00321 [Worker_1] [TLS-in] 208.118.235.17
<lil...@gn...> to:
do...@pa... Message-Score: added -10 (spfpValencePB) for SPF
pass, total score for this message is now -5
Jan-31-16 12:01:03 m1-59661-00321 [Worker_1] [TLS-in] 208.118.235.17
<lil...@gn...> to:
do...@pa... HMM-Check has given less than 6 results - using
monitoring mode only
Jan-31-16 12:01:03 m1-59661-00321 [Worker_1] [TLS-in] [MessageOK]
208.118.235.17 <lil...@gn...> to:
do...@pa... message ok [lilypond user Digest Vol 158 Issue 188]
Jan-31-16 12:01:03 m1-59661-00321 [Worker_1] [TLS-in] 208.118.235.17
<lil...@gn...> to:
do...@pa... info: PB-IP-Score for '208.118.235.0' is 0, added 5
in this session

This is a message digest from a mailing list.  The email itself
including full headers contained 537 lines, 2,059 words for a total of
19,111 bytes.  What exactly is ASSP's definition of "too short"?

I receive emails from this mailing list regularly, so a similar message
has been seen daily for months now.  I just checked the notspam folder,
and I don't see any messages from the list appearing in the notspam
folder.  Is that what you mean by "similar"?

Regardless, I still have BayesAfterHMM set blank, so why isn't it doing
any Bayesian scoring (I have DoBayesian set to "score").

I have AddSpamProbHeader and AddConfidenceHeader enabled.

Here are the ASSP headers of the email in question:

X-Assp-ID: ASSP.nospam m1-59661-00321
X-Assp-Session: 7F0C0F4B5D28 (mail 1)
X-Assp-Envelope-From: lil...@gn...
X-Assp-Intended-For: do...@pa...
X-Assp-Version: 2.4.7(16004) on ASSP.nospam
X-Assp-Client-TLS: yes
X-Assp-Message-Score: -10 (SSL-TLS-connection-OK)
X-Assp-IP-Score: -10 (SSL-TLS-connection-OK)
X-Assp-Delay: not delayed (auto accepted); 31 Jan 2016 12:01:01 -0500
X-Assp-Message-Score: 15 (DKIM domain mismatch - gnu.org found in
    DKIMCache, but no DKIM-Signature found in mail header)
X-Assp-IP-Score: 15 (DKIM domain mismatch - gnu.org found in DKIMCache, but
    no DKIM-Signature found in mail header)
X-Original-Authentication-Results: ASSP.nospam; spf=pass
X-Assp-Message-Score: -10 (SPF pass)
X-Assp-IP-Score: -10 (SPF pass)
X-Assp-Detected-URI: gnu.org(22), github.com(1), uminho.pt(8),
    mail.de(6)



On 1/31/16 8:57 AM, Thomas Eckardt wrote:
> HMM may give less than 6 results, if the mail is too short, or a similar 
> was never seen.

-- 
Dossy Shiobara         |      "He realized the fastest way to change
do...@pa...     |   is to laugh at your own folly -- then you
http://panoptic.com/   |   can let go and quickly move on." (p. 70) 
  * WordPress * jQuery * MySQL * Security * Business Continuity *