How do I add HAM / SPAM to the virtual users configuration

[jrv116psu]

Quick question,

I want to add baysian filtering to your virtual mailbox howto on
howtoforge.. I see that bayes is on by default but I need to train
spamassassin with spam and ham.. I assume I need to do the training as the
user that's running the vmail is this correct??

What user would I use to do this? ?I tried running the sa-learn commands as
root but it doesn't seem to affect the mail (I didn't see Bayesian ever
coming up as affecting the score).. would I su to vmail first?? Or perhaps
amavis? How would I get the vmail solution to learn the spam and ham in order to have it start affecting scores?

Jesse Vaughan

[falko]

It doesn't matter under which user you run the sa-learn command (as long as it has the permission to run sa-learn).

[edge]

This has always boggled me.

How do I use sa-learn?

Do I cd to the /var/mail directory, and just run "sa-learn --spam" ?
If so.. Will it learn all the messages as spam? Even the good emails?

[jrv116psu]

[HTML]
I dont think this can be right.. here's my reasoning:

In my inbox this morning I got this mail:


Super pick! Get this winner early tomorrow November, 30th!

In today's energy sector alternative fuels is THE place to be. Our next
feature is a pioneer in the field and is coming out with an astounding
revelation!

Heartland Energy Group
Sym: HEGP
Currrently trrading at $0.25 (+8.70%)
Vollume : around 3,000,000

We are expecting this one to reach $0.80 in the short-term. We could see
long-term levels of up to $2.50. Do not underestimate the power of this
upcoming announcement!
......
....


It goes on, but you get the general idea... The header is normal, with no added spam tags meaning the default amavisd setup decided it had a score less than 2 and shouldnt be tagged. It also was not moved into a spam folder and was left in my general inbox

Then I moved it into a separate folder and ran :
spamassassin -t /the new foldername/cur

and here's what spam assassin scored it as:


Content analysis details: (8.3 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
0.3 IP_NOT_FRIENDLY IP_NOT_FRIENDLY
0.1 FORGED_RCVD_HELO Received: contains a forged HELO
0.2 FUZZY_VLIUM BODY: Attempt to obfuscate words in spam
3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 0.9978]
0.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
above 50%
[cf: 100]
0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
[cf: 100]
1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?209.152.125.144>]


================================================== ======

So in other words: spam assassin scored it as an 8.3 but amavis scored it as <2 this doesnt match!! Also if amavis is using bayes, why doesn't "BAYES_99" show up in the header when amaivisd runs... is there any way to prove whether or not it's actually running- because I REALLY dont think it is..

Jesse Vaughan

[jrv116psu]

Ok..I solved the problem and it DOES matter who you run sa-learn as...

I found a website that said to stop the amavisd service ..and then run it in bayes debug mode...

(i did this by running amavisd -d bayes debug)

When I did this I noticed it said there were only 74 messages in it's database...Odd since when I scanned my spam folder I had over 400...

sooo... I copied the contents of my /root/.spamassassin directory to /var/spool/amavisd/.spamassassin

and voilla it now says there are 400+ items in the spam database... So it seems to have worked.. and would explain why it wasnt using bayes before to check messages.. I then stopped debug mode and started amavisd up normally.. so now all I need is a bunch of spam to verify it's working correctly..

Jesse