Manual Train Spam

[Ray P]

Hi There,

Any official guide for sa-learn? There sill some spam coming through with SPF and DKIM valid. So guess we need to train it manually. Suggestion on better solutions?

Thanks!

 

[heutger]

See my advancing thread and forget SPF and DKIM, they both don't really work against spam. Against phishing maybe, although SPF then is still broken by design.

sa-learn see https://spamassassin.apache.org/full/3.2.x/doc/sa-learn.html, sa-learn --spam and as-learn --ham are the calls you need.

 

[sb-jw]

You can use this Script to train the last 6 Months of Mails from http://artinvoice.hu/spams/

The Script ist directly from the Site, a little bit modified for easier usage:

#! /bin/bash

# Key times in seconds
sixmonths=$(( 60 * 60 * 24 * 31 * 6 ))
oneday=$(( 60 * 60 * 24 ))
CURRENTSECS=`/bin/date +%s --date=-2day`
STARTDATEINSECS=$(( $CURRENTSECS - $sixmonths ))

i=$STARTDATEINSECS
while [ $i -le $CURRENTSECS ]
do
    DATE=`/bin/date -d @$i +"%Y-%m-%d"`
    
    spamfile=spam--$DATE.gz
    spamfile_unpacked=spam--$DATE
    wget http://artinvoice.hu/spams/$spamfile
    gunzip $spamfile
    sa-learn --mbox --spam --progress $spamfile_unpacked
    rm -rf $spamfile $spamfile_unpacked
    
    i=$(( $i + $oneday ))
done

systemctl restart pmg-smtp-filter
exit 0

 

[heutger]

You can use this Script to train the last 6 Months of Mails from http://artinvoice.hu/spams/

The Script ist directly from the Site, a little bit modified for easier usage:

#! /bin/bash

# Key times in seconds
sixmonths=$(( 60 * 60 * 24 * 31 * 6 ))
oneday=$(( 60 * 60 * 24 ))
CURRENTSECS=`/bin/date +%s --date=-2day`
STARTDATEINSECS=$(( $CURRENTSECS - $sixmonths ))

i=$STARTDATEINSECS
while [ $i -le $CURRENTSECS ]
do
    DATE=`/bin/date -d @$i +"%Y-%m-%d"`
   
    spamfile=spam--$DATE.gz
    spamfile_unpacked=spam--$DATE
    wget http://artinvoice.hu/spams/$spamfile
    gunzip $spamfile
    sa-learn --mbox --spam --progress $spamfile_unpacked
    rm -rf $spamfile $spamfile_unpacked
   
    i=$(( $i + $oneday ))
done

systemctl restart pmg-smtp-filter
exit 0

I strongly recommend not to do so. I recently did the same, but it result in bayes score doesn’t help at all as it’s their spam and not yours, so legit mail, which are similar to mails they got as spam will be scored as spam and spam similar to their ham will be scored as ham. You will be frustrated and only solution is then to reset the bayes database and restart from the scratch.

 

[sb-jw]

I strongly recommend not to do so.

For me it was extremly helpfull. The Spam is worldwide not really different. Who does not know the "I'm 19 years old russian" Mails, or "I have some money for you" or any other basic Spamshit who send to everyone wordwide.

So in my opinion i can strongly recommend to do this. I have a few Spam Mails which are getting through but many other which directly blocked or send to quarantine. I have no false positive after i pushed in the Signatures. We have no complaints from our Customer. I check the Tracking Center very often and check which mails are blocked and which not. So i can't really see any Problem about this.

At the end everyone must decide it by his own.

 

[heutger]

For me it was extremly helpfull. The Spam is worldwide not really different. Who does not know the "I'm 19 years old russian" Mails, or "I have some money for you" or any other basic Spamshit who send to everyone wordwide.

So in my opinion i can strongly recommend to do this. I have a few Spam Mails which are getting through but many other which directly blocked or send to quarantine. I have no false positive after i pushed in the Signatures. We have no complaints from our Customer. I check the Tracking Center very often and check which mails are blocked and which not. So i can't really see any Problem about this.

At the end everyone must decide it by his own.

Depends. Which country are you from? It may work, if the mails read similar. Once I did and checked the scores lateron, I saw many spam getting low score meanwhile many ham getting high score, so the scores didn’t fit at all. Once I trained myself, I checked again bayes levels and they fit well. Did you check in tracking center the final behavior, maybe other rules and settings will help to wave out wrong scores, or did you really check bayes_00 up to bayes_99?