[Mimedefang] sa-learn HowTo ?

[Lucas Albers]

Ole Holm Nielsen said:
> I read the thread "using sa-learn in conjunction with mimedefang"
> with interest, since in the past weeks we've been receiving tons
> of hefty spam that scores below our SA threshold of 5.0.  Does
> everyone else get spam with text such as ?
>     How can it be.. BETTER THEN V_IAGRA! open to see.
>     FULLY DO.CTOR APP.ROVED . L.EARN MOR.E!
>     etc.
>

perhaps you could enable some more network tests?
And grab some more rules from spamassassin rules emporium, that should
up your rule listings.
Their are some rules to get gappy text.
You are running a new version of sa? 2.6.1?
You should not really have to learn with sa, it should be frighteningly
accurate enough.

I see this rule hitting that sort of spam:
 2.7 GAPPY_SUBJECT          Subject: contains G.a.p.p.y-T.e.x.t

Trying to find where I got that rule, not sure. but it's in their working
it's magic for me.


You have enabled rbl checks, and header/forgery checks in mimedefang?
Greylisting?

Their really isn't that much to sa-learn, just learn ham/spam at low and
high thresholds, quality is more important than quantity.
I apologize if I am not giving an answer to your question, but rather my
opinion on your problem.

-- 
Luke Computer Science System Administrator
Security Administrator,College of Engineering
Montana State University-Bozeman,Montana