Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a question. Whether the use of sa-learn to teach spamassassin about email spam and ham it matter? How if I do not use it because I do not have a sample of spam or ham in my mail server?

share|improve this question

2 Answers 2

sa-learn is generally used for mail stored on the machine (in mbox or maildir format), and only works when you have filed spam and ham separately. If you are going to use it, it is best used with a decent amount of examples of both to prevent filter bias.

there is a nice doc here which goes through the process and details, but it does require locally stored mail (in either format).

having said this, I use SA on a few boxes and never use sa-learn, and it still does a pretty good job. I do use a number of other anti-spam techniques that aren't SA based, though...

share|improve this answer
    
Would be great if you mention which other technologies you use! –  3molo Apr 27 '11 at 8:27
    
indeed - RBL's, header syntax checks (e.g. invalid or incomplete server name or IP in HELO's) eliminate a large portion of bot generated spam, and the dreaded sender verify (the efficiency of which has come close to generating fist fights at the office) reduces accepted spam hugely. It also can effect valid mail (from badly configured servers), so you need to have some good whitelisting processes available to counter it - but the inconvenience is worth it. At most 4 or 5 addresses a month are whitelisted for close to 1500 users. –  Mark Regensberg Apr 27 '11 at 9:00
    
hmm, I'm understand now. Thanks very much. n_n –  jack Apr 28 '11 at 15:31

I agree with Mark Regensberg's answer, but to be more specific: as I understand it, sa-learn and the other Bayesian elements of SpamAssassin only affect the Bayesian tests (you can see the current complete list of SA tests for clarification).

That is to say, all the rule-based tests function at full effectiveness regardless of whether you use sa-learn or not. Only the matching of the BAYES_nn rules are affected by your personalised training of the Bayesian engine with sa-learn --ham and --spam.

Having said that, some of those tests score quite highly - the rating of a message can be affected by an amount between -1.9 and +3.8, according to how "spammy" the Bayesian engine thinks it is - so I find quite a lot of value in giving my engine some training. As Mark notes, you will need to file your ham and undetected spam separately in order to do this.

In answer to your note to Mark, the "other" technique that has decreased my spam more than any other is greylisting, which by eliminating "fire-and-forget" mail reduced my incoming spam by well over 90%. Introducing SPF filtering on incoming email was the second most effective, cutting out about 5% of it.

share|improve this answer
    
I have had colleagues using greylisting with great success - I guess it's whatever recipe you get used to (and that works) first :) –  Mark Regensberg Apr 27 '11 at 9:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.