SPAM Problem

Questions and answers about how to do stuff
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

SPAM Problem

Post by telvenes »

Hi,

I use EFA Project for only 20 domains, but i get way 2 much spam. Can anyone help me to adjust it to be bether?
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

Marked with yellow is spam
Attachments
Skjermbilde.JPG
Skjermbilde.JPG (110.6 KiB) Viewed 13479 times
jamerson
Posts: 164
Joined: 19 Aug 2017 18:57
Location: kaaskop

Re: SPAM Problem

Post by jamerson »

the EFA is build to block spam,
if it detect spams means it well configured and you should be happy that it does detect spam
Version eFa 4.0.0 RC1 now available in testing repo. Come join us in advancing eFa!
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: SPAM Problem

Post by pdwalker »

telvenes, do you have the BAYES classifier turned on?

Are you training the classifier with these miss-classified messages?
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

pdwalker wrote: 14 Mar 2018 17:46 telvenes, do you have the BAYES classifier turned on?

Are you training the classifier with these miss-classified messages?

Not sure, how can I check?
Last edited by telvenes on 16 Mar 2018 10:38, edited 1 time in total.
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

jamerson wrote: 14 Mar 2018 15:34 the EFA is build to block spam,
if it detect spams means it well configured and you should be happy that it does detect spam
yes, it doesent block spam so its not well configured then.. :)
henk
Posts: 517
Joined: 14 Dec 2015 22:16
Location: Netherlands
Contact:

Re: SPAM Problem

Post by henk »

About traing bayes. Check in the Gui : Tools and links-
> Spamassasin Bayes database info
SpamAssassin Bayes Database Info.png
SpamAssassin Bayes Database Info.png (10.97 KiB) Viewed 13445 times
>Spamassassin Lint (test)

Find the next entry: dbg: bayes: corpus size: nspam = 1889, nham = 11701 .This should match the bayes db info of course
Bayes need at least 200 ham and spam to operate.

In the message detail you can train bayes. Since autolearn is : Y for this message a token is already added ( it will add a token only once. )
Message Detail.png
Message Detail.png (37.09 KiB) Viewed 13445 times
So take some time to classify mail. It worth the effort.
“We are stuck with technology when what we really want is just stuff that works.” -Douglas Adams
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: SPAM Problem

Post by pdwalker »

telvenes wrote: 16 Mar 2018 10:18
pdwalker wrote: 14 Mar 2018 17:46 telvenes, do you have the BAYES classifier turned on?

Are you training the classifier with these miss-classified messages?

Not sure, how can I check?
See henk's post above and report back your results.
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

I have changed score to 2 to kill. it helps now but i still get lots of spam.. this is my byes

I have tried to report as spam for many days without help :)
Attachments
Skjermbilde.JPG
Skjermbilde.JPG (45.52 KiB) Viewed 13382 times
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: SPAM Problem

Post by pdwalker »

Can you show us the spam report for a message that was not detected as spam?
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

yellow is not spam
Attachments
Skjermbilde.JPG
Skjermbilde.JPG (264.65 KiB) Viewed 13368 times
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

spam report
Attachments
Skjermbilde.JPG
Skjermbilde.JPG (42.07 KiB) Viewed 13368 times
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

I have disabled greylisting mabey that is the problem?
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

mailwasher first page
Attachments
Skjermbilde.JPG
Skjermbilde.JPG (92.95 KiB) Viewed 13366 times
henk
Posts: 517
Joined: 14 Dec 2015 22:16
Location: Netherlands
Contact:

Re: SPAM Problem

Post by henk »

Before jumping to conclusions, since bayes looks fine and valid mail is valid mail ;)

Just post the complete message details on spam slipping thru ( and hide the personal info)

What is tour EFA version . Post GUI-> Software Versions
I have changed score to 2 to kill. it helps now but i still get lots of spam.
Do you mean the Required SpamAssassin Score?
Do You use Spam List? Like SPAMHAUS SPAMCOP
Virus Scanners? Like clamd sophos

Just check the Mailscanner configuration via Tools->View mailscanner configuration

To get an idea what is going on take a look at:search and reports ->
Post:
1. Total messages by date
2. Top senders by quantity
3. Top sender Domains by quantity
“We are stuck with technology when what we really want is just stuff that works.” -Douglas Adams
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: SPAM Problem

Post by pdwalker »

Hmmm. Those are really low spam scores.

The first thing I notice is the bayes_50. That means the Bayesian analysis doesn’t see it as spam yet, so it’ll need more training on these messages. Also, you should tell the analyzer which messages are “ham” which will help the analyzer distinguish the two.

Greylisting should definitely be left on as it stops a fair amount of spam from coming in in the first place.

Also, is your system properly configured to use the real time dns block lists correctly? I guess not and this may be contributing to your low spam scores.

Would you be willing to send me one of those spam messsages so I could test it against my installation so I could compare the results?
fencepost
Posts: 7
Joined: 11 Oct 2017 16:13

Re: SPAM Problem

Post by fencepost »

Worth noting, you don't have to go into the information page for each message to train it - if you go to the "Search and Reports" page and select "Message Operations" you can specify Spam/Ham/Forget and a checkbox for Release on messages. You don't need to train on all messages, if they were properly classified then just don't select anything for that row.

You can also select for various conditions to clean up the list that you're working from, e.g. if you're only looking for things that weren't properly flagged as spam then set the "is spam" = 0. If you're looking for false positives, set "is spam" > 0 and "is high-scoring spam" = 0.

As for scores, I've found that 4 is a reasonable number for low-scoring spam, and 5 for high-scoring spam. I don't think I'd go below 3 & 4 for those, too much chance of missing email at least if it's for a bunch of users.
henk
Posts: 517
Joined: 14 Dec 2015 22:16
Location: Netherlands
Contact:

Re: SPAM Problem

Post by henk »

fencepost: you are missing the point here.The issue here is: Why is spam slipping thru, not how to train Bayes.
In order to find out why, I would at least take a look at pdwalker's and my previous remarks.
When you are describing your problem, you may think you understand your problem correctly and you may think you are giving the right information necessary to solve your problem. If that were true, then you wouldn't be having a problem.
It's mission impossible to even try to solve this without more meaningfull and useable info.
“We are stuck with technology when what we really want is just stuff that works.” -Douglas Adams
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: SPAM Problem

Post by pdwalker »

Without more information, the best we can manage is a bunch of wild ass guesses.

An initial guess is that the rbl’s are not in use thus lowering the spam scores below the threshold, but it’s just a guess and probably wrong.

A problems that might take a few minutes to solve when logged into the system can take days or weeks to solve when getting the information in a piecemeal fashion.
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

have tried a new installation with default settings, hope this will fix my spam problems.... :|
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

pdwalker wrote: 26 Mar 2018 02:11 Hmmm. Those are really low spam scores.

The first thing I notice is the bayes_50. That means the Bayesian analysis doesn’t see it as spam yet, so it’ll need more training on these messages. Also, you should tell the analyzer which messages are “ham” which will help the analyzer distinguish the two.

Greylisting should definitely be left on as it stops a fair amount of spam from coming in in the first place.

Also, is your system properly configured to use the real time dns block lists correctly? I guess not and this may be contributing to your low spam scores.

Would you be willing to send me one of those spam messsages so I could test it against my installation so I could compare the results?
Hmm, mabey i can filter out an accaunt?
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

henk wrote: 23 Mar 2018 23:25 Before jumping to conclusions, since bayes looks fine and valid mail is valid mail ;)

Just post the complete message details on spam slipping thru ( and hide the personal info)

What is tour EFA version . Post GUI-> Software Versions
I have changed score to 2 to kill. it helps now but i still get lots of spam.
Do you mean the Required SpamAssassin Score?
Do You use Spam List? Like SPAMHAUS SPAMCOP
Virus Scanners? Like clamd sophos

Just check the Mailscanner configuration via Tools->View mailscanner configuration

To get an idea what is going on take a look at:search and reports ->
Post:
1. Total messages by date
2. Top senders by quantity
3. Top sender Domains by quantity


/etc/MailScanner/spam.lists.conf

Code: Select all

# http://barracudacentral.org/rbl
BARRACUDA                       b.barracudacentral.org

# aggregate list - http://www.sorbs.net/using.shtml
SORBS                           dnsbl.sorbs.net

# aggregate list - http://www.spamhaus.org/zen/
SPAMHAUS                        zen.spamhaus.org

# aggregate list - https://www.spamcop.net/bl.shtml
SPAMCOP                         bl.spamcop.net
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

fencepost wrote: 28 Mar 2018 18:39 Worth noting, you don't have to go into the information page for each message to train it - if you go to the "Search and Reports" page and select "Message Operations" you can specify Spam/Ham/Forget and a checkbox for Release on messages. You don't need to train on all messages, if they were properly classified then just don't select anything for that row.
Thanks, that made my life easyer :)
fencepost wrote: 28 Mar 2018 18:39 You can also select for various conditions to clean up the list that you're working from, e.g. if you're only looking for things that weren't properly flagged as spam then set the "is spam" = 0. If you're looking for false positives, set "is spam" > 0 and "is high-scoring spam" = 0.
that i did not understand
telvenes
Posts: 35
Joined: 23 Oct 2016 13:17

Re: SPAM Problem

Post by telvenes »

pdwalker wrote: 29 Mar 2018 13:44 Without more information, the best we can manage is a bunch of wild ass guesses.

An initial guess is that the rbl’s are not in use thus lowering the spam scores below the threshold, but it’s just a guess and probably wrong.

A problems that might take a few minutes to solve when logged into the system can take days or weeks to solve when getting the information in a piecemeal fashion.
Please tell my what i need to post... :)
henk
Posts: 517
Joined: 14 Dec 2015 22:16
Location: Netherlands
Contact:

Re: SPAM Problem

Post by henk »

Long story short: before posting anything ever: read viewtopic.php?f=5&t=2974
Hint: Write down The Benjamin Franklin quote at least 10 times.

Why? viewtopic.php?&p=8019 :drool:

Why do you post the /etc/MailScanner/spam.lists.conf? :doh:
“We are stuck with technology when what we really want is just stuff that works.” -Douglas Adams
Post Reply