efa-project.org

OK, so it would be wise to add "daily" in:
/etc/logrotate.d/rsyslog

Like this:
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
missingok
sharedscripts
daily
postrotate
/usr/bin/systemctl -s HUP kill rsyslog.service >/dev/null 2>&1 || true
endscript ...

Hi

Tested on one instance and now bayes result is consistant in 5 or 10 tests. I also have bayes_00 score which I havent had before this change.
So far it looks very promising.

Thanks man!

Hi.

Disabled selinux and rebooted.
Same result.

Ran test command 6 times:

1. Content analysis details: (9.8 points, 5.0 required) - NO BAYES
2. Content analysis details: (9.8 points, 5.0 required) - NO BAYES
3. Content analysis details: (9.8 points, 5.0 required) - BAYES_40
4. Content analysis ...

Lol

I ran it 3 times...

First run:
Nov 8 16:37:06.578 [2580347] dbg: bayes: cannot use bayes on this message; not enough usable tokens found

Second run:
-0.5 BAYES_20

Third run:
1.5 BAYES_40

sudo su - postfix -s /bin/sh -c "spamassassin -D -t < /var/spool/MailScanner/quarantine/20241106/nonspam ...

When doing spamassassin -D test I can see BAYES_XX is added there on SAME mail that mailscanner did NOT add BAYES_XX score.

Nov 6 14:21:26.964 [1036654] dbg: bayes: tokenized body: 2737 tokens
Nov 6 14:21:26.965 [1036654] dbg: bayes: tokenized uri: 120 tokens
Nov 6 14:21:26.965 [1036654] dbg ...

Hi again.

I really would like to understand this behavior why identical mail (we received 2) is treated different in regards to BAYES filtering, see below:

BAYES is MISSING

To: name.surname@domain.com
Subject: - Obnovite svoj kadrovski sertifikat
From: UniCredit <support@chuon.co.jp>
MIME ...

I had BAYES_20 scored as "0" lol so my bad here.

But still there is no bayes_95 or bayes_05 so lower and upper are missing...
It really is different in 4.0.1

Queries are like this (DB MAILSCANNER):

SELECT id from `maillog` where messageid='<dfgdfgfd3d928a7874dsfdfs89f9afdeac38d6@domain.com>' and to_address LIKE '%user123@otherdomain.com%' LIMIT 1

Hi.
When I reboot efa it takes a lot of time for mariadb to settle down and relay info is missing.

Is there a task to RE-parse relay info and insert it to db?

What will happen after lets say 1 year of usage? Will reboot make mariadb go crazy for a long time to re-read relay info?
Thanks!

Also this:

Rule Description Score Total Ham Col6 Spam Col8
BAYES_40 Bayes spam probability is 20 to 40&percnt; 0.00 2,784 2,721 97.7 63 2.3
BAYES_50 Bayes spam probability is 40 to 60&percnt; 0.80 126 93 73.8 33 26.2
BAYES_60 Bayes spam probability is 60 to 80&percnt; 1.50 437 127 29.1 310 70.9 ...

Or maybe because bayes storage is SQL based?

I posted this on mailing list as well...

I think we need to open bug for this?


Hi again.


In V4 there is something wrong with bayes...


I received 3 identical mails (1 external sender, 3 internal recipients) and scores are like this:


2 X like:

0.00 ARC_SIGNED Message has a ARC signature
-0 ...

Yeah, guilty

It was really bothering me why same exported training data when imported to SA V4 behaved completely different.

I got my answer, maybe it will help others.

And yeah, autolearn I will turn it off for sure, it will do more harm than good anyways...

Done

Done

One more thing...
Some mails even dont have BAYES added in score list, confirmed on 2 installs (one new and other migrate from v4)

Score Matching Rule Description
1.95 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
1.10 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
0 ...

Hi.

Created new efa appliance on Rocky.

Configured it, all is good, except for bayes. It IS working, it IS learning but when it classifies mail it is really not so decisive as it was in V3 and V4 of Efa.

I have:
dbg: bayes: corpus size: nspam = 1190, nham = 12441
dbg: bayes: DB expiry: tokens in ...

Hi.
Sometimes we need .EML file for various reasons... So we copied it over sftp, webmin etc...

So I had enough and wrote simple EML downloader, it is not pretty but it does job well.
Can it be included in next efa version?

How I did it:

Create file: /var/www/html/mailscanner/dl_mail.php
<?php ...

Hi.
Installed efa V5 and when I go to: "Search and reports" --> Virus report (mailscanner/rep_viruses.php)
ESETSEFS is not displayed correctly, in fact it does not work at all.

Solution:

Add:

case 'esetsefs':
$scanner[$vscanner]['name'] = 'ESET';
$scanner[$vscanner]['regexp'] = "/found (?P ...

Found the culprit...

Outlook from O365 apps decided to include SCRIPT tag in outgoing mails since 2 days ago.
DKIM was signed but then mailscanner removed/disarmed script tag and thus corrupted DKIM body signature and sent it out.

So I disabled script tag disarming and voila, job done.

And no ...

Hi all.

So I had my dkim working just fine until today...

For some reason, mail sent from my account from Outlook client and with image pasted in email results in body hash failure.

If I send same mail from OWA or phone client, DKIM is just fine.
Also plain text mail is just fine or html mail ...

I agree...

Thats why we remove the server under maintenance from dns for duration of servicing...

No...

In my case: exch-dag.domain.local resolves to both exchange servers in dag...

Why not like this:

mydomain.com smtp:[exch-dag.domain.local]

Add above host into hosts file and thats it

Hi.

Just a question...
Will we be able to use it on Ubuntu aswell?