NiceBayes as non-decisive

Problems/questions regarding the MailCleaner configuration

Moderators: FlorianB, Pascal, bourgeois, mentor

MatthewW
Posts: 31
Joined: Fri Apr 19, 2013 2:24 pm
How did you hear about Mailcleaner: google

NiceBayes as non-decisive

Postby MatthewW » Fri Apr 19, 2013 3:25 pm

I would like to make NiceBayes (Bogofilter) non-decisive but have it feed into Spamc (Spamassassin) with a positive or negative score for the final decision. Is there an option or pre-built rule for that? Or do I have to write my own Spamassassin rule?
Thanks in advance for your help!
Here is the background for my question for those who are interested:
I just switched our domain with 100~ users from Barracuda to mailcleaner this morning and so far I am pleased. I had setup NiceBayes as active but non-decisive. I got a spam message and upon investigating I found that NicyBayes had marked it 100% spam but I couldn't see a Spamc rule using that information:
Apr 19 08:11:57 localhost MailScanner[2496]: NiceBayes result is spam (100%%) for 1UTAAV-0001KL-Ou
Apr 19 08:12:00 localhost MailScanner[2496]: Spamc result is not spam (3.1/5.0) for 1UTAAV-0001KL-Ou
Apr 19 08:12:00 localhost MailScanner[2496]: Message 1UTAAV-0001KL-Ou from 206.214.95.231 (autopricefinderdeals!springblowout@esdibmaredoth.us) to [mydomain].com is not spam, NiceBayes (100%%), Spamc (score=3.1, required=5.0, URIBL_BLACK 1.8, HTML_EXTRA_CLOSE 0.0, RDNS_NONE 1.3, HTML_MESSAGE 0.0, T_FRT_LITTLE 0.0, SPF_HELO_PASS -0.0, HTML_IMAGE_RATIO_08 0.0, TO_NO_BRKTS_NORDNS 0.0, T_REMOTE_IMAGE 0.0)

My temporary solution was to just make NiceBayes decisive. However, I am not sure if I completely trust NiceBayes at this point so I would really like it to just count towards the total score. I am worried about false positives.
If any of the maintainers for MailCleaner are reading, thank you for a great piece of open source software! :D The reason we switched from Barracuda is that our company is not doing well financially and will possibly be sold so we dropped maintenance on the Barracuda and without updates it goes downhill fast. I really think that MailCleaner will be able to do a better job of filtering when I get everything tuned right. A few of our users were still getting 10+ spams per day with the Barracuda.
Thanks again!
Matthew
MatthewW
Posts: 31
Joined: Fri Apr 19, 2013 2:24 pm
How did you hear about Mailcleaner: google

Re: NiceBayes as non-decisive

Postby MatthewW » Tue May 14, 2013 2:49 pm

After spending a month with mailcleaner here is the answer I wish someone had given to me:
To use Bayesian data as part of the total score instead of being decisive you should use the built in Bayesian database in Spamassassin instead of NiceBayes (Bogofilter). In fact, this is automatically turned on in the default configuration and is set to auto-train over time. To train on a single message use:

Code: Select all

sa-learn -C /usr/mailcleaner/etc/mailscanner/spam.assassin.prefs.conf --ham ham.eml
sa-learn -C /usr/mailcleaner/etc/mailscanner/spam.assassin.prefs.conf --spam spam.eml

To train on an mbox file:

Code: Select all

sa-learn -C /usr/mailcleaner/etc/mailscanner/spam.assassin.prefs.conf --ham --mbox ham.mbox
sa-learn -C /usr/mailcleaner/etc/mailscanner/spam.assassin.prefs.conf --spam --mbox spam.mbox
viniciusferrao
Posts: 24
Joined: Tue Jun 24, 2014 6:08 pm
How did you hear about Mailcleaner: Serverfault

Re: NiceBayes as non-decisive

Postby viniciusferrao » Wed Jun 25, 2014 2:44 am

That's really the only way? If yes whats the point of using NiceBayes with non decisive option? It's equivalent to completely disable NiceBayes?

And finally I was thinking that NiceBayes was better than native SpamAssassin sa-learn tool.
PACE
Posts: 3
Joined: Fri Nov 27, 2015 5:01 pm
How did you hear about Mailcleaner: googling, SpiceWorks

Re: NiceBayes as non-decisive

Postby PACE » Sun Nov 29, 2015 6:42 pm

I was searching for this too, because I'd like to make use of the bogofilter in the long run, but as of now the filter is not trained (I have only 30 mailboxes with low traffic on this server so it might take a while). Because of that I'm really uncomfortable to make the filter decisive.
Having it non-decisive doesn't make sense to me, or am I missing somoething?

Anyway, there is an easy way to combine NiceBayes and SpamAssassin with a SA rule!

First, you activate NiceBayes and make it non-decisive. It will be executed and adds a header like "X-NiceBayes: is not spam (52%)" or "X-NiceBayes: is spam (100%)".

Second, create a file /usr/mailcleaner/share/spamassassin/local.cf with the following content:

Code: Select all

# This rule will increase the score based on the earlier assessment of the NiceBayes filter
header     LOCAL_NICEBAYES_SPAM    X-NiceBayes =~ /is spam/
score      LOCAL_NICEBAYES_SPAM    1.0
describe   LOCAL_NICEBAYES_SPAM    Identified as spam by NiceBayes filter

# The following can be used for testing purposes
# If your bogofilter is trained well, you could use a negative score here
header     LOCAL_NICEBAYES_HAM     X-NiceBayes =~ /is not spam/
score      LOCAL_NICEBAYES_HAM     0.0
describe   LOCAL_NICEBAYES_HAM     Identified as not spam by NiceBayes filter

Then restart your server.

You can now see the rule being executed in the admin Message preview like this:
Image
(this spam didn't really need the additional evaluation :wink: )

I wrote the second rule LOCAL_NICEBAYES_HAM mainly for debug puposes, to be able to see if it got executed. You will probably want to disable it in the long run. However you could also use it to lower the score if you like...

One could also fine-tune this to analyze the given percentages also and use different scores. I'll look into that maybe when I have more data.

Regards,
Benjamin

Return to “Configuration”

Who is online

Users browsing this forum: Bing [Bot] and 2 guests