Practical SA-Learn input methodologies

[Thomas Bianco]

this isn't really a Linux question, but i hope there are enough experts here on Spam Assassin to help me.

recently some of my user community have been complaining about spam, and I'd like to give them an automated method to train the Bayesian filter. Since the Bayesian filter depends on having copious quantities of red and green messages, so I'd like to get as many as possible into the learning process with as little effort to the users as possible.

i have a cron job to learn messages and accounts set up, but I'm running into a bit of an issue with the practical application.

user base is (in descending count order) outlook/pop3, outlook/imap, thunderbird/pop3, thunderbird/imap, and at least one Pegasus/pop3 oddball.

Given this, I've come up with two possible input methodologies.

A) red and green email addresses, the user forwards spam to RedList@domain.com, and good messages to GreenList@domain.com. Problems: misses a lot of green messages that the user doesn't forward to the list, headers all messed up due to the forward process.

B) imap folder for spam, processed nightly. User moves the spam message to the spam folder (preserving the headers) and it's learned and deleted. The rest of the imap store is learned as green. Problems: only available to imap users. Messages may be processed by both red and green if a user doesn't move it in the cron time frame.

Which brings me around to my questions: which of these methods causes less statistical damage to the Bayesian databases? Are there any mitigating steps i can employ to offset these problems? Are there any better methods? Am i missing something major?

[Steven E. Protter]

Shalom Thomas,

Let me suggest a slightly different method.

Don't forward the messages, harming the headers.

Move them to a spam folder, like item b.

You should be able to come up with move methodology that works for popmail as well.

I have in place a methodology that is similar to yours.

I or my users move the message using a web mail reader like squirrelmail(imap i know) to a folder called spam.

That folder is ready periodically by a cron job that can provide clean headers to a spam filer and a custom strip tha can go through the header and make block entries for the /etc/mail/access file.

We may wish to even swap methodology to improve the spam filtering on our respective servers.

SEP

[Thomas Bianco]

thanks SEP, i think i'm going to go with the IMAP folder method, and just have the pop clients forward their spam and notspam by attachment.

will post the cron script once i have it debugged.