Trouble Shooting Spam Score Changes

Revision as of 00:23, 25 September 2010 by Jhurley (talk | contribs) (Created page with 'Within the upgrade process Zimbra will update the spam configuration files with the latest files that have been released by SpamAssassin, because of this your spam scores could c…')

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Within the upgrade process Zimbra will update the spam configuration files with the latest files that have been released by SpamAssassin, because of this your spam scores could change. Also any custom configuration to these files will be removed. We recommend making notes on all custom configuration.

How To Read Your Spam Scores

When the message triggers a policy it will be reported within the header within X-spam-Status:. The following is an example of a message that received a score of 10.535 which exceeded the 6.6 threshold.

X-Spam-Flag: YES 
X-Spam-Score: 10.535 
X-Spam-Level: ********** 
X-Spam-Status: Yes, score=10.535 tagged_above=-10 required=6.6 tests=[BAYES_50=0.8, DOS_OUTLOOK_TO_MX=2.845, HTML_MESSAGE=0.001, 
MSGID_MULTIPLE_AT=0.001, RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_RP_RNBL=1.31,
RCVD_IN_SORBS_DUL=0.001,RDNS_NONE=0.793] autolearn=no


When reading the X-Spam_Status there is a section called test. This section will list each test that was triggered by the message and the score that was applied by the test. Adding all the scores, will give you the total score. If this score exceeds the required score then the message will be marked as spam. In the example above the top four test that were triggered by this message were DOS_OUTLOOK_TO_MX, score of 2.845, RCVD_IN_BRBL_LASTEXT score of 1.449, RCVD_IN_PBL score of 3.335 and RCVD_IN_RP_RNBL score of 1.31 which has a total score of 8.939.

The following is a link of the rules that can be applied by the spam engine and their definitions:

http://wiki.apache.org/spamassassin/Rules 

You will find the configuration files within:

/opt/zimbra/conf/spamassassin 

Most of the scores are stored within 50.score.cf.

Spam Score Changed After Migrating To A New System

When migrating from one server to another the SA files are not migrated.  To restore the old catch rate you can copy the files within the following two directories from the old to the new ZCS system. This step is only valid when the amavis/SA version are the same. We recommend as a precautionary step, backing up the files on the new system just in case  the files from the old system don't work.

/opt/zimbra/amavisd/.spamassassin/init
bayes_seen
bayes_toks
/opt/zimbra/data/amavisd/.spamassassin
auto-whitelist
auto-whitelist.mutex
bayes.mutex
bayes_journal
bayes_seen
bayes_toks 
Jump to: navigation, search