GFI Software

Welcome to the GFI Software community forum! For support please open a ticket from https://support.gfi.com.

Home » GFI User Forums » Kerio Connect » Custom SpamAssassin scores and rules (Write your own rules and block the crap)  () 1 Vote
Re: Custom SpamAssassin scores and rules [message #116477 is a reply to message #116466] Thu, 02 October 2014 23:59 Go to previous messageGo to next message
MarkK is currently offline  MarkK
Messages: 342
Registered: April 2007
Glad to hear it has helped. What few do it through is much easier to manage now.

For me, it was a process. The initial set of custom rules reduced spam probably 80+%, and then it was a matter of fine tuning for what was still making it through. Then there was a couple or so quiet weeks, and then new spams would slip through, followed by some more fine tuning.

At this point, my users get unmarked spam maybe 2 or 3 times a week. MUCH easier to manage. In fact, a couple of them have complained / asked about how come if it knows it is spam, why doesn't it just delete it. My reply: "Really, you are complaining that the spam filter marked spam as spam? Really?"

There will always be some tweaking needed from time to time, but that has gotten to growing further apart now. I'm modifying maybe every other week, and even at that, I don't always restart the server to implement the changes right away. I figure at some point I'll add something that I want to implement right away, and that will catch the other changes made earlier.
Re: Custom SpamAssassin scores and rules [message #117254 is a reply to message #116477] Mon, 03 November 2014 18:57 Go to previous messageGo to next message
Machete
Messages: 187
Registered: February 2012
Location: United States
Hi Markk (and others) -

I've implemented your suggestions and had some improved success - as well as created some of my own rules to help weed out those Alzheimers, etc. spam.

The problem I am having is that my BAYES_50 filter is the only rule being triggered on alot of the spam making it through as Likely Spam. I have the BAYES_50 score set pretty high (3.325) and my SPAM score at 3.6.

These are plain text emails making it through from U.S. ip addresses, so scoring netblocks from other parts of the world aren't going to help me.

I've read about that Bayes DB only holds so many 'tokens' - and there's supposedly a place to increase this, but I haven't found it with Kerio's implementation. Does this sound like anything I should pursue? (modifying how many token the db stores)
Re: Custom SpamAssassin scores and rules [message #117257 is a reply to message #117254] Mon, 03 November 2014 19:10 Go to previous messageGo to next message
MarkK is currently offline  MarkK
Messages: 342
Registered: April 2007
Sounds like you need to reset your Bayes filter database. It can get out of whack from time to time. I end up resetting our probably every 12 t0 18 months because we start to see it not functioning properly.

Stop the server, go to the .\store\spamassassin\bayes\ folder, I create a folder named with the date (Ex: 20141103), and MOVE the files from the \bayes\ folder in to that new folder. This keeps a copy of the files just in case you want to undo the reset. So the \bayes\ folder is empty now. Restart Kerio Connect.
Re: Custom SpamAssassin scores and rules [message #117261 is a reply to message #117257] Mon, 03 November 2014 20:44 Go to previous messageGo to next message
Machete
Messages: 187
Registered: February 2012
Location: United States
Thanks Markk - I've reset it before and was hoping that it maybe something else. I wonder if what you and I perceive as "whacky" is actually the DB maxing out.

See here: http://spamassassin.apache.org/full/3.1.x/doc/sa-learn.html# expiration
Re: Custom SpamAssassin scores and rules [message #120428 is a reply to message #117261] Wed, 01 April 2015 19:15 Go to previous messageGo to next message
Lyle M is currently offline  Lyle M
Messages: 59
Registered: August 2004
Location: Frederick, MD

Sorry for bumping an older thread. I wanted to mention that instead of restarting Connect, I stop/start the spamassassin process from the web admin. From the debug log, it does appear to load and use the 99_*.cf file I added to the spamassassin folders. I haven't seen this documented anywhere as yet, so YMMV.

Cheers.
Re: Custom SpamAssassin scores and rules [message #120429 is a reply to message #120428] Wed, 01 April 2015 19:39 Go to previous messageGo to next message
MarkK is currently offline  MarkK
Messages: 342
Registered: April 2007
How are you stopping/starting Spam Assassin from the admin panel? I don't see an option that indicates it would stop SA. Are you using Windows, Linux, or Mac version?
Re: Custom SpamAssassin scores and rules [message #120430 is a reply to message #120429] Wed, 01 April 2015 19:45 Go to previous messageGo to next message
Lyle M is currently offline  Lyle M
Messages: 59
Registered: August 2004
Location: Frederick, MD

Hi Mark,

It's all Mac, but I would expect there wouldn't be a difference in this behavior among the versions.
I've attached a screen shot of the location of the checkbox.

The path is: Configuration/Spam Filter/SpamAssassin

I hope this works for you and that I'm not just blowing smoke!

Cheers,
Lyle

[img]http://forums.kerio.com/fa/3790/[/img]

[Updated on: Wed, 01 April 2015 19:47]

Report message to a moderator

Re: Custom SpamAssassin scores and rules [message #120431 is a reply to message #120430] Wed, 01 April 2015 21:22 Go to previous messageGo to next message
MarkK is currently offline  MarkK
Messages: 342
Registered: April 2007
Interesting. I'm using Windows, and it looks the same. I would have not interpreted that function as something that would stop/start SA and read all of the .cf files again.

If it works, it works. I'll have to try that one when I do another rule update, which hasn't been for a few months. Well, I did have a couple of the builtin "Diet" and "Marketing" rules with .001 scores hit. Increased those scores to something meaningful.

score DIET_1 0.4
score MARKETING_PARTNERS 0.4
Re: Custom SpamAssassin scores and rules [message #120432 is a reply to message #120431] Wed, 01 April 2015 22:03 Go to previous messageGo to next message
Lyle M is currently offline  Lyle M
Messages: 59
Registered: August 2004
Location: Frederick, MD

Hi Mark,

I was just now working with Rob at Invaluement to optimize our setup to use his excellent blacklist service. I loaded up a revised SpamAssassin rule file and toggled that "SpamAssassin tests" checkbox in the admin. Rob almost immediately saw our queries. Beyond just seeing log entries, I'm now confident this works.

For reference:

Server: Connect 8.4.2 on Mac OS X 10.10.2.

Best wishes,
Lyle
Re: Custom SpamAssassin scores and rules [message #120434 is a reply to message #114168] Wed, 01 April 2015 22:14 Go to previous messageGo to next message
yukiomishima is currently offline  yukiomishima
Messages: 116
Registered: July 2006
howdy

now that this topic is active again... was wondering if anyone had a customised spam spamAssassin file that they could share

i started one a while ago... but never seem to have time to maintain

huge thanks in advance

yukioMishima
Re: Custom SpamAssassin scores and rules [message #120436 is a reply to message #114168] Wed, 01 April 2015 22:46 Go to previous messageGo to next message
MarkK is currently offline  MarkK
Messages: 342
Registered: April 2007
Lyle
GREAT discovery! That will be MUCH faster and friendly to restarting Kerio.

Yukiomishima
Attached is the latest custom file I have been using. It is still working very well for us, but it may require some tweaking for your particular industry and the spam that you are receiving.
  • Attachment: zMyRules.cf
    (Size: 4.81KB, Downloaded 343 times)
Re: Custom SpamAssassin scores and rules [message #120438 is a reply to message #114168] Wed, 01 April 2015 23:20 Go to previous messageGo to next message
yukiomishima is currently offline  yukiomishima
Messages: 116
Registered: July 2006
markK

awesome stuff... HUGE thanks

i will install and see if it helps... seem to be getting a lot more recently (amazon rewards, kohls, ford clearnace sale etc etc)

an issue that we are having.... when we have clients activate OOO... and are out for a few days.... with the OOO auto-replying to all received mail (incl newsletters, spam etc)... their overall spam numbers shoot way up (obviously)... would be nice if the OOO was a little more configurable in that regard

thanks again

yukioMishima
icon14.gif  Re: Custom SpamAssassin scores and rules [message #120757 is a reply to message #114168] Thu, 16 April 2015 11:11 Go to previous messageGo to next message
yukiomishima is currently offline  yukiomishima
Messages: 116
Registered: July 2006
markk

massive thanks for sharing the file

a little feedback......

i loaded the file... stopped and started the spamAssassin engine as per recent posts... and it has made a HUGE HUGE difference to the amount of spam received

if / when you update your file... if you could re-post.. that would be awesome / greatly appreciated

thanks again Thumbs Up

yukioMishima
Re: Custom SpamAssassin scores and rules [message #122140 is a reply to message #114168] Thu, 18 June 2015 18:17 Go to previous messageGo to next message
MarkK is currently offline  MarkK
Messages: 342
Registered: April 2007
Attached is the latest copy of the custom SA rule file I am using. this file has a date in the name now; see why below.

Of course, use at your own risk. It will not damage your Kerio or Spam Assassin installation, but it will certainly affect your end user's delivered email, hopefully catching far more spam. You may need to modify the file for your particular industry, it is designed more for mine. Example: LOTS_OF_MONEY has to score low for me, but if your are a Mom & Pop Popcorn Store, then that probably should score much higher for you.

I have added a date to the name of the file so that it won't just overwrite the current zMyRules.cf that you are using in case you have made any changes to it. This would allow you to put it in the folder with the other rules, and make any changes you need to it first before having it go live. Rename your current file from zMyrules.cf to something like zMyRules.cf-old or something, Go in to Kerio Connect to the Spam Filter page - Spam Assassin tab, uncheck the "Check every incoming message..." box, click Apply, Check the "Check every incoming message..." box, and click Apply. Your new SA rules are now being used without having to restart Connect completely.

Changes from the last one:
*Maybe 5 or 6 additional terms added over the previous version
*An error in one of the scoring lines fixed (rule name incorrectly had an : after it)
*Added score MIME_HTML_ONLY_MULTI 0.4
*Added rules for various "offensive" words that score at my Spam threshold (Cool
*Alphabetized (or pretty close to) the trigger words / phrases in the various rules to make it easier to something in the rule
Re: Custom SpamAssassin scores and rules [message #122149 is a reply to message #114168] Thu, 18 June 2015 21:46 Go to previous messageGo to previous message
ComputerBudda is currently offline  ComputerBudda
Messages: 112
Registered: January 2013
Location: DFW - USA
When I try to copy your file into the rules directory, it won't save. That's where all the other CF files are. Do Ineed to stop connect before I can copy in?
Previous Topic: Kerio became slow with 10 users
Next Topic: PSA: If you use Internet Explorer don't upgrade to 9.1.1
Goto Forum:
  


Current Time: Wed Mar 22 03:16:01 CET 2023

Total time taken to generate the page: 0.01831 seconds