I found useful to put in cron a little script like this
Each minute cron launch this script that takes messages of last minute reading from maillog database
Then it search in filesysten related message and learn as ham
So words that come from our company are good classified when someone resend
In this example i use the ip of my Exchange server to learn ham but it can be everithing
# learn.local.ham.sh
# It learn HAM from messages sent from internal network in latest minute
# Put in cron every 1 minute
# * * * * * /batch/learn.local.ham.sh
# Variables
Q="/var/spool/MailScanner/quarantine" # Quarantine folder
L="/usr/bin/sa-learn --ham --no-sync" # Message learn command
# START
vsql="SELECT id FROM maillog WHERE clientip = '10.1.1.126' AND timestamp > DATE_SUB(now(), INTERVAL 1 MINUTE);"
m=( $( echo $vsql | mysql -N -u root -p<MYPWD> -D mailscanner ) )
# Scan array and learn ham
for i in ${m[@]}; do
echo $i
ii=$(find $Q -type f -name $i)
check=${#ii}
if [ $check -gt 1 ] ; then
echo $ii
$L $ii
fi
done
~
~