Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » No Bayes in X-Spam-Status on spam that gets through (Spam )
  •  
mynamewastolen

Messages: 2
Karma: 0
Send a private message to this user
We've been tracking down complaints form our staff about excessive quantities of spam and noticed that some messages don't have a Bayes result in the test portion of X-Spam-Status. Our server has been trained and operational for sometime and some messages do include Bayes results. It doesn't appear, from the error log and debug tools, that SpamAssassin is failing. Often we will see two virtually identical spam messages from two different sources where one will include a Bayes result and the other won't. For instance, here is the relevant X-Spam-Status from one message:

X-Spam-Status: Yes, hits=8.4 required=5.0
	tests=BAYES_99: 4.07,HTML_IMAGE_ONLY_28: 1.404,HTML_IMAGE_RATIO_04: 0.556,
	HTML_MESSAGE: 0.001,HTML_TAG_BALANCE_BODY: 1.157,MIME_HTML_ONLY: 0.001,
	T_URIBL_SEM_FRESH: 0.01,T_URIBL_SEM_FRESH_10: 0.01,T_URIBL_SEM_FRESH_15: 0.01,
	UNPARSEABLE_RELAY: 0.001,URIBL_JP_SURBL: 1.25,TOTAL_SCORE: 8.470,autolearn=no


And, the X-Spam-Status from an identical email:

X-Spam-Status: No, hits=3.1 required=5.0
	tests=AWL: 0.000,HTML_IMAGE_ONLY_28: 1.404,HTML_IMAGE_RATIO_04: 0.556,
	HTML_MESSAGE: 0.001,HTML_TAG_BALANCE_BODY: 1.157,MIME_HTML_ONLY: 0.001,
	UNPARSEABLE_RELAY: 0.001,TOTAL_SCORE: 3.120,autolearn=no


I'm not clear why autolearn is no. Regardless, the Bayes result was sufficient in conjunction with other measures to mark the first message as spam. The samples are chronological, i.e. the first is the first message, but that shouldn't matter.

Unfortunately, the Kerio Admin console doesn't really offer much in the way of modifying SpamAssassin and all the documentation/blogs/forums imply that modifying the configs is a bad idea. Additionally, I think writing rules will be pointless since the Bayes test works when it runs, and it looks like it just doesn't run every time, after all it should minimally report as BAYES_00.

Here's some additional information:

Kerio Version: 8.4.0 (3525)
OS: CentOS release 5.10 (Final), x86
SpamAssassin version 3.3.1
Bayes.db is 54M.

There are two pending updates to Kerio, but the changes don't indicate anything about Bayes or SpamAssassin.

I can post the source code of the spam messages if desired. They are identical except that they link to different URIs. Additionally, I have other Spam messages with a URIBL_JP_SURBL score that also lack any Bayes score.

[Updated on: Tue, 27 January 2015 15:54]

  •  
irow

Messages: 56
Karma: 4
Send a private message to this user
I see this is an old thread, and I hope you have found your answer by now. I cannot answer why bayes is scoring some messages and not others. I can give you insight on the auto learn question.

The default auto learn threshold for learning spam is 12. That means that a message will need to score at least 12 in order for it to be learned as spam; also the message but have a header score of at least 3 and a body score of at least 3. On the ham side, the message must have a score of 0.1 to be learned as ham.

The auto learn threshold can be configured, but Kerio does not support those modifications. The defaults that Kerio has specified are generally acceptable for most users. I had modified the auto learn for ham because I want a message to have a negative score (-0.001) before auto learn considers it ham, it's not enough for it to be neutral. That means the message must have at least some indication of being ham before it will be learned. I have also adjusted by auto learn threshold to 10 because I found that it is very difficult for a message to hit 12 using my scoring system (which includes custom rules).

There are a few threads about using a custom .cf file in Kerio if you are interested, but I strongly suggest spending a bit of time learning about SpamAssassin from other sources first. It is a complex system and small changes can have big consequences. Begin with custom rules and overriding scores before you change other things. Kerio's built in system can be very effective with just a few small tweaks.

For what it's worth if you are continuing to search for help on this, the Spam Assassin version built into Kerio 3.3, which is no longer supported by the developers. The version has not been updated in any 8.X releases.
Previous Topic: Public Calendars
Next Topic: Kerio Connect 8.5.2
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Wed Nov 22 21:28:28 CET 2017

Total time taken to generate the page: 0.00343 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.