Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » Bayes not working
  •  
RPC_Admin

Messages: 128
Karma: 0
Send a private message to this user
It seems as many emails as my staff marks as SPAM it never seems to make a difference. The SPAM we tend to see seem to be the same message over and over, and I will mark it as spam 4 or 5 times, but yet the next time it comes through it still isn't picked up by the spam filter.

My impression is that the Bayes would "learn" from the messages we marked as spam. I have been running this server for ~4 years and still the bayes just doesn't seem to work for us.

Any tips or suggestions?

Thanks!
  •  
freakinvibe

Messages: 1553
Karma: 62
Send a private message to this user
In KMS Management Console, on the Spam Assassin screen, you find some statistics:

Filter status:
Messages learned as spam:
Messages learned as not spam:

What are the values in your case?

Also, in the mail header, what Bayes scores do you see?

Dexion AG - The Blackberry Specialists in Switzerland
https://dexionag.ch
  •  
sgongola

Messages: 109
Karma: 0
Send a private message to this user
What mail client and protocol are you using. If it is pop, most likely marking it as spam will not affect the kerio bayes filtering. Also, make sure you are using the other anti spam features,
  •  
RPC_Admin

Messages: 128
Karma: 0
Send a private message to this user
Sorry for the lack of detail in my post.

Our mailserver POPs to my host to DL our email. From there my clients all use outlook with the KOFF. Does my server POPing my mail from my host not use bayes?

As for question 1,

Messages learned as spam:19495
Messages learned as not spam:74152

I used to write custom rules, but that got tedious and I don't anymore.

My tag score is 5.0 and my block is 9.9. These repetitive spams I am talking about are not even tagged.

Any suggestions are welcome. Thanks!
  •  
freakinvibe

Messages: 1553
Karma: 62
Send a private message to this user
If you use KMS to download mails from another mail host, you lose anti-spam functionality. You can't use blacklists like spamhaus or you can't use spam repellent.

It is important that the host which KMS gets the mail from has anti-spam features in place.

Or you can use KMS as host, directly facing the internet. The you don't need the POP3 download and you can use all the anti-spam features.

Dexion AG - The Blackberry Specialists in Switzerland
https://dexionag.ch
  •  
sgongola

Messages: 109
Karma: 0
Send a private message to this user
If you use pop to download emails, flagging emails as spam only affects the way outlook identifies spam and has no affect on what kerio does.

If you use the outlook connecter (at least for KOC not sure about KOFF), you are using MAPI and what you do does affect kerio. The also holds true for using IMAP.

BTW, you may want to look at the related topic "Still too much spam getting through" in this forum.
  •  
RPC_Admin

Messages: 128
Karma: 0
Send a private message to this user
I am watching the other topic.

I feel as though I may be getting some errored information here. My impression is that KMS will apply bayes filtering to all email it recieves.

I am told that POP email makes bayes not work, is that if I POP KMS or is that if KMS pops email from another server? I could see that bayes filtering wouldn't work if I POP'd from KMS, but it doesn't make sense to me that it wouldn't work if the email is POP'd to KMS. Can someone clarify this?

FYI, I have KMS POP from my host because we are a small ORG and don't want to host servers unless we have to, it also provides me with a backup mailserver, if KMS goes down my host will still collect my mail for me. I understand this disables my ability to use some of the other spam functions, but it shouldn't effect bayes.
  •  
sgongola

Messages: 109
Karma: 0
Send a private message to this user
Spamassassin can only identify things that look like spam based on what it learns and by what is in its tables. It is no secret and spammers are good at figuring out what spammassassin is capable of doing and creating emails that get around it. It is a great package but not all powerful. You lose a lot by not being able to take advantage of dns blacklists, spf and callerid. They all contribute to reducing your spam flood. Email is identified by both its contents and where it came from even though the contents may look legitimate to spam assassin.

My latest stats show (all rounded number) 140K incoming email connections. 18K were lost connections (i think because of spam repellent), 91k were stopped as a result of blacklists. Of the remaining 30k messages, 1000 were rejected/quarantined, 1500 tagged as spam and got through to go into the recipient junk mail folders.
  •  
RPC_Admin

Messages: 128
Karma: 0
Send a private message to this user
Thank you I understand the value of what I lose by not exposing my mailserver to direct mx connections. Honestly spam isn't all that big a deal for us. My question seems to have gotten lost a little here.

My impression is that the "Spam/No Spam" buttons added to Outlook by KOFF help KMS bayes filter to learn about the spam we are getting. I have used other bayesian filters before and if you marked a email as spam that had made it in eventually the bayes filter would learn to pickup an email type. Hitting the Spam/No Spam button from KOFF seems to do nothing for me, is that the case with others? Is that because it is part of a function I am losing by keeping my server from direct connections?

For example recently we have had a flood of SPAM that is from my "Drs office... please click here". I get maybe 3 a day, as do several of my users. We all click "SPAM" on each one, yet the filter never seems to catch the one that will come tomorrow. Should it?

Thanks
  •  
freakinvibe

Messages: 1553
Karma: 62
Send a private message to this user
To find that out, just check your mail headers, you should see something like:
Quote:

X-Spam-Status: Yes, hits=5.7 required=5.0
tests=BAYES_99: 4.07,HTML_MESSAGE: 0.001,URIBL_SBL: 1.639,
TOTAL_SCORE: 5.710
X-Spam-Flag: YES
X-Spam-Level: *****


You can see that Bayes is scoring 4.07. You should see something similar.

Dexion AG - The Blackberry Specialists in Switzerland
https://dexionag.ch
  •  
sgongola

Messages: 109
Karma: 0
Send a private message to this user
B74ubba wrote on Fri, 13 March 2009 14:54

My impression is that the "Spam/No Spam" buttons added to Outlook by KOFF help KMS bayes filter to learn about the spam we are getting.
.......
we have had a flood of SPAM that is from my "Drs office... please click here". I get maybe 3 a day, as do several of my users. We all click "SPAM" on each one, yet the filter never seems to catch the one that will come tomorrow. Should it?


Marking a message as spam teaches spamassassin to process the message and extract information from it to identify spam. You can't really control what it learns from it. Marking the same email as spam more than once does nothing since it has already learned that it is spam. Marking a "similar looking" message as notspam (can undo what was learned about the prior message even if one message is spam and the second isn't. Again, that is why the other antispam features exist. If you continually get the same message as spam, something is making it get through and it should be put it into the custom rules.

Previous Topic: Shared Contacts / Apple Address Book
Next Topic: Entourage 2008: Corrupted databases over and over!
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Wed Nov 22 04:46:33 CET 2017

Total time taken to generate the page: 0.00468 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.