| Re: Custom SpamAssassin scores and rules [message #116477 is a reply to message #116466] |
Thu, 02 October 2014 23:59   |
MarkK
Messages: 342
Registered: April 2007
|
|
|
|
Glad to hear it has helped. What few do it through is much easier to manage now.
For me, it was a process. The initial set of custom rules reduced spam probably 80+%, and then it was a matter of fine tuning for what was still making it through. Then there was a couple or so quiet weeks, and then new spams would slip through, followed by some more fine tuning.
At this point, my users get unmarked spam maybe 2 or 3 times a week. MUCH easier to manage. In fact, a couple of them have complained / asked about how come if it knows it is spam, why doesn't it just delete it. My reply: "Really, you are complaining that the spam filter marked spam as spam? Really?"
There will always be some tweaking needed from time to time, but that has gotten to growing further apart now. I'm modifying maybe every other week, and even at that, I don't always restart the server to implement the changes right away. I figure at some point I'll add something that I want to implement right away, and that will catch the other changes made earlier.
|
|
|
|
| Re: Custom SpamAssassin scores and rules [message #117254 is a reply to message #116477] |
Mon, 03 November 2014 18:57 |
Machete
Messages: 187
Registered: February 2012
Location: United States
|
|
|
|
Hi Markk (and others) -
I've implemented your suggestions and had some improved success - as well as created some of my own rules to help weed out those Alzheimers, etc. spam.
The problem I am having is that my BAYES_50 filter is the only rule being triggered on alot of the spam making it through as Likely Spam. I have the BAYES_50 score set pretty high (3.325) and my SPAM score at 3.6.
These are plain text emails making it through from U.S. ip addresses, so scoring netblocks from other parts of the world aren't going to help me.
I've read about that Bayes DB only holds so many 'tokens' - and there's supposedly a place to increase this, but I haven't found it with Kerio's implementation. Does this sound like anything I should pursue? (modifying how many token the db stores)
|
|
|
|
| Re: Custom SpamAssassin scores and rules [message #117257 is a reply to message #117254] |
Mon, 03 November 2014 19:10 |
MarkK
Messages: 342
Registered: April 2007
|
|
|
|
Sounds like you need to reset your Bayes filter database. It can get out of whack from time to time. I end up resetting our probably every 12 t0 18 months because we start to see it not functioning properly.
Stop the server, go to the .\store\spamassassin\bayes\ folder, I create a folder named with the date (Ex: 20141103), and MOVE the files from the \bayes\ folder in to that new folder. This keeps a copy of the files just in case you want to undo the reset. So the \bayes\ folder is empty now. Restart Kerio Connect.
|
|
|
|
|
|
| Re: Custom SpamAssassin scores and rules [message #120428 is a reply to message #117261] |
Wed, 01 April 2015 19:15 |
Lyle M
Messages: 59
Registered: August 2004
Location: Frederick, MD
|
|
|
|
Sorry for bumping an older thread. I wanted to mention that instead of restarting Connect, I stop/start the spamassassin process from the web admin. From the debug log, it does appear to load and use the 99_*.cf file I added to the spamassassin folders. I haven't seen this documented anywhere as yet, so YMMV.
Cheers.
|
|
|
|
|
|
|
|
| Re: Custom SpamAssassin scores and rules [message #120431 is a reply to message #120430] |
Wed, 01 April 2015 21:22 |
MarkK
Messages: 342
Registered: April 2007
|
|
|
|
Interesting. I'm using Windows, and it looks the same. I would have not interpreted that function as something that would stop/start SA and read all of the .cf files again.
If it works, it works. I'll have to try that one when I do another rule update, which hasn't been for a few months. Well, I did have a couple of the builtin "Diet" and "Marketing" rules with .001 scores hit. Increased those scores to something meaningful.
score DIET_1 0.4
score MARKETING_PARTNERS 0.4
|
|
|
|
| Re: Custom SpamAssassin scores and rules [message #120432 is a reply to message #120431] |
Wed, 01 April 2015 22:03 |
Lyle M
Messages: 59
Registered: August 2004
Location: Frederick, MD
|
|
|
|
Hi Mark,
I was just now working with Rob at Invaluement to optimize our setup to use his excellent blacklist service. I loaded up a revised SpamAssassin rule file and toggled that "SpamAssassin tests" checkbox in the admin. Rob almost immediately saw our queries. Beyond just seeing log entries, I'm now confident this works.
For reference:
Server: Connect 8.4.2 on Mac OS X 10.10.2.
Best wishes,
Lyle
|
|
|
|
|
|
| Re: Custom SpamAssassin scores and rules [message #120436 is a reply to message #114168] |
Wed, 01 April 2015 22:46 |
MarkK
Messages: 342
Registered: April 2007
|
|
|
|
Lyle
GREAT discovery! That will be MUCH faster and friendly to restarting Kerio.
Yukiomishima
Attached is the latest custom file I have been using. It is still working very well for us, but it may require some tweaking for your particular industry and the spam that you are receiving.
-
Attachment: zMyRules.cf
(Size: 4.81KB, Downloaded 356 times)
|
|
|
|
| Re: Custom SpamAssassin scores and rules [message #120438 is a reply to message #114168] |
Wed, 01 April 2015 23:20 |
yukiomishima
Messages: 116
Registered: July 2006
|
|
|
|
markK
awesome stuff... HUGE thanks
i will install and see if it helps... seem to be getting a lot more recently (amazon rewards, kohls, ford clearnace sale etc etc)
an issue that we are having.... when we have clients activate OOO... and are out for a few days.... with the OOO auto-replying to all received mail (incl newsletters, spam etc)... their overall spam numbers shoot way up (obviously)... would be nice if the OOO was a little more configurable in that regard
thanks again
yukioMishima
|
|
|
|
 Re: Custom SpamAssassin scores and rules [message #120757 is a reply to message #114168] |
Thu, 16 April 2015 11:11 |
yukiomishima
Messages: 116
Registered: July 2006
|
|
|
|
markk
massive thanks for sharing the file
a little feedback......
i loaded the file... stopped and started the spamAssassin engine as per recent posts... and it has made a HUGE HUGE difference to the amount of spam received
if / when you update your file... if you could re-post.. that would be awesome / greatly appreciated
thanks again 
yukioMishima
|
|
|
|
| Re: Custom SpamAssassin scores and rules [message #122140 is a reply to message #114168] |
Thu, 18 June 2015 18:17 |
MarkK
Messages: 342
Registered: April 2007
|
|
|
|
Attached is the latest copy of the custom SA rule file I am using. this file has a date in the name now; see why below.
Of course, use at your own risk. It will not damage your Kerio or Spam Assassin installation, but it will certainly affect your end user's delivered email, hopefully catching far more spam. You may need to modify the file for your particular industry, it is designed more for mine. Example: LOTS_OF_MONEY has to score low for me, but if your are a Mom & Pop Popcorn Store, then that probably should score much higher for you.
I have added a date to the name of the file so that it won't just overwrite the current zMyRules.cf that you are using in case you have made any changes to it. This would allow you to put it in the folder with the other rules, and make any changes you need to it first before having it go live. Rename your current file from zMyrules.cf to something like zMyRules.cf-old or something, Go in to Kerio Connect to the Spam Filter page - Spam Assassin tab, uncheck the "Check every incoming message..." box, click Apply, Check the "Check every incoming message..." box, and click Apply. Your new SA rules are now being used without having to restart Connect completely.
Changes from the last one:
*Maybe 5 or 6 additional terms added over the previous version
*An error in one of the scoring lines fixed (rule name incorrectly had an : after it)
*Added score MIME_HTML_ONLY_MULTI 0.4
*Added rules for various "offensive" words that score at my Spam threshold (
*Alphabetized (or pretty close to) the trigger words / phrases in the various rules to make it easier to something in the rule
|
|
|
|
|
|
) 1 Vote
Members
Search
Help
Register
Login
Home
