I have a question. Whether the use of sa-learn to teach spamassassin about email spam and ham it matter? How if I do not use it because I do not have a sample of spam or ham in my mail server?
sa-learn is generally used for mail stored on the machine (in mbox or maildir format), and only works when you have filed spam and ham separately. If you are going to use it, it is best used with a decent amount of examples of both to prevent filter bias.
there is a nice doc here which goes through the process and details, but it does require locally stored mail (in either format).
having said this, I use SA on a few boxes and never use sa-learn, and it still does a pretty good job. I do use a number of other anti-spam techniques that aren't SA based, though...
I agree with Mark Regensberg's answer, but to be more specific: as I understand it, sa-learn and the other Bayesian elements of SpamAssassin only affect the Bayesian tests (you can see the current complete list of SA tests for clarification).
That is to say, all the rule-based tests function at full effectiveness regardless of whether you use sa-learn or not. Only the matching of the
BAYES_nn rules are affected by your personalised training of the Bayesian engine with
sa-learn --ham and
Having said that, some of those tests score quite highly - the rating of a message can be affected by an amount between -1.9 and +3.8, according to how "spammy" the Bayesian engine thinks it is - so I find quite a lot of value in giving my engine some training. As Mark notes, you will need to file your ham and undetected spam separately in order to do this.
In answer to your note to Mark, the "other" technique that has decreased my spam more than any other is greylisting, which by eliminating "fire-and-forget" mail reduced my incoming spam by well over 90%. Introducing SPF filtering on incoming email was the second most effective, cutting out about 5% of it.
SpamAssassin has quite a few techniques for finding spam. One of them is its regular expressions (as noted by MadHatter's answer), but that isn't terribly potent these days. Another (also noted by MadHatter) is SPF, though I'd call that about negligible in its ability to catch otherwise-uncaught spam.
The most potent techniques in SpamAssassin are Bayesian detection and online lookups (DNSBLs (a.k.a. "RBLs") and URI DNSBLs, as well as hashing systems like Razor and Pyzor, see also the SA wiki pages for installing Razor and installing Pyzor).
Online lookups are by far the simplest; configure them right and you're good to go. They'll keep up to date with spam that hits the various spam trap networks (honeypots) out there, but they won't protect you from snowshoe (which is too fast) or targeted attacks like spearphishing (which is too small).
Bayesian detection requires constant maintenance; it is a machine learning system and therefore must be regularly trained on what it has missed (and on what it inappropriately caught). The more attention it gets, the better it gets.
SpamAssassin has an auto-learning system that will assume all very high scoring spam should be learned as such and all very low scoring ham should similarly be learned as ham. The problem is that it is only learning from what is easy, and (especially for ham) may learn from misclassified mail, which will reinforce SpamAssassin's mistakes.
No SpamAssassin deployment should ever trust auto-learning without additional manual training. It is meant to supplement manual training, not replace it. You must use
spamassassin --report, which also reports to Pyzor, Razor, and the SpamCop DNSBL).
You can learn more about Bayes on the SpamAssassin wiki.