[Mimedefang] bayes filtering for a mimedefang implementation

[Nels Lindquist]

On 8 Aug 2003 at 16:13, Matt Cramer wrote:

> On Fri, 8 Aug 2003, Kevin A. McGrail wrote:
> 
> > Bayesian definitely works in a site-wide mode, autolearn process like you
> > are talking about.  However, it won't keep in on the tests until you have
> > like 200 or 300 messages in the learned queue.
> 
> OK.  I understood that it wouldn't start until enough data was collected.
> What concerns me is that I see no indication that it is collecting data
> beyond when I manually ran sa-learn.

Have a look at the directory indicated by bayes_path.  You should see 
a number of files, including bayes_msgcount, bayes_seen, bayes_toks 
and possibly bayes_journal.  If bayes is working, you should see 
changes in file sizes, update times, etc.

Also have a look at the SpamAssassin source tree--there's a /tools 
directory in there with a check_bayes_db utility which can be used to 
provide some detailed statistics on what your bayes system is up to.  
(Note that you'll need to call check_bayes_db with 
"--dbpath=/var/spool/MD-Quarantine/bayes" since that's a non-standard 
location).

> I do run mimedefang and mimedefang-multiplexor as the defang user.
> However there is no /home/defang/.spamassassin directory.  In my
> /etc/mail/spamassassin/local.cf (only file in that directory) I have the
> following lines:
> 
> use_bayes 1
> bayes_auto_learn 1
> bayes_file_mode 0777
> bayes_path /var/spool/MIMEDefang/bayes

This line determines the location for the site-wide bayes files, 
which is /var/spool/MIMEDefang (no .spamassassin).

> bayes_auto_learn_threshold_spam 6.00

I hope you're just using this for testing purposes.  For a production 
system, changing the default autolearn thresholds is usually a really 
bad idea.  The whole point of the bayesian learner is to improve the 
accuracy of SA overall.  Using a learning threshold of 6 will resuilt 
in a *lot* of false positives being incorrectly learned as spam.
 
Nels Lindquist <*>
----
Quidquid latine dictum sit altum viditur.

Whatever is said in Latin, sounds profound.