efa-project.org

pdwalker wrote: ↑14 Mar 2018 17:46 telvenes, do you have the BAYES classifier turned on?

Are you training the classifier with these miss-classified messages?

jamerson wrote: ↑14 Mar 2018 15:34 the EFA is build to block spam,
if it detect spams means it well configured and you should be happy that it does detect spam

telvenes wrote: ↑16 Mar 2018 10:18

pdwalker wrote: ↑14 Mar 2018 17:46 telvenes, do you have the BAYES classifier turned on?

Are you training the classifier with these miss-classified messages?

Not sure, how can I check?

I have changed score to 2 to kill. it helps now but i still get lots of spam.

When you are describing your problem, you may think you understand your problem correctly and you may think you are giving the right information necessary to solve your problem. If that were true, then you wouldn't be having a problem.

pdwalker wrote: ↑26 Mar 2018 02:11 Hmmm. Those are really low spam scores.

The first thing I notice is the bayes_50. That means the Bayesian analysis doesn’t see it as spam yet, so it’ll need more training on these messages. Also, you should tell the analyzer which messages are “ham” which will help the analyzer distinguish the two.

Greylisting should definitely be left on as it stops a fair amount of spam from coming in in the first place.

Also, is your system properly configured to use the real time dns block lists correctly? I guess not and this may be contributing to your low spam scores.

Would you be willing to send me one of those spam messsages so I could test it against my installation so I could compare the results?

henk wrote: ↑23 Mar 2018 23:25 Before jumping to conclusions, since bayes looks fine and valid mail is valid mail

Just post the complete message details on spam slipping thru ( and hide the personal info)

What is tour EFA version . Post GUI-> Software Versions

I have changed score to 2 to kill. it helps now but i still get lots of spam.

Do you mean the Required SpamAssassin Score?
Do You use Spam List? Like SPAMHAUS SPAMCOP
Virus Scanners? Like clamd sophos

Just check the Mailscanner configuration via Tools->View mailscanner configuration

To get an idea what is going on take a look at:search and reports ->
Post:
1. Total messages by date
2. Top senders by quantity
3. Top sender Domains by quantity

# http://barracudacentral.org/rbl
BARRACUDA                       b.barracudacentral.org

# aggregate list - http://www.sorbs.net/using.shtml
SORBS                           dnsbl.sorbs.net

# aggregate list - http://www.spamhaus.org/zen/
SPAMHAUS                        zen.spamhaus.org

# aggregate list - https://www.spamcop.net/bl.shtml
SPAMCOP                         bl.spamcop.net

fencepost wrote: ↑28 Mar 2018 18:39 Worth noting, you don't have to go into the information page for each message to train it - if you go to the "Search and Reports" page and select "Message Operations" you can specify Spam/Ham/Forget and a checkbox for Release on messages. You don't need to train on all messages, if they were properly classified then just don't select anything for that row.

fencepost wrote: ↑28 Mar 2018 18:39 You can also select for various conditions to clean up the list that you're working from, e.g. if you're only looking for things that weren't properly flagged as spam then set the "is spam" = 0. If you're looking for false positives, set "is spam" > 0 and "is high-scoring spam" = 0.

pdwalker wrote: ↑29 Mar 2018 13:44 Without more information, the best we can manage is a bunch of wild ass guesses.

An initial guess is that the rbl’s are not in use thus lowering the spam scores below the threshold, but it’s just a guess and probably wrong.

A problems that might take a few minutes to solve when logged into the system can take days or weeks to solve when getting the information in a piecemeal fashion.