Bayes_99 on All Mail

I have the same problem (everything being tagged as
Bayes_99). I checked my
AWL table and it seems full of spammers addresses & IPs.
So imagine I have
the problem which Robert is describing. I have the following
in my local.cf
file (which I got from the maia website...)

trusted_networks                    127.0.0.1/32        #
Localhost

Any ideas on what could be causing this?

I was also wondering if there is a way to verify that my
Bayes db is ok. I'm
not sure what it's suppose to look like but my tokens are
just crap... 

Thanks in advance

Simon

-----Original Message-----
From: maia-users-bouncesrenaissoft.com
[mailto:maia-users-bouncesrenaissoft.com] On Behalf
Of Robert LeBlanc
Sent: November 13, 2006 9:35 AM
To: maia-usersrenaissoft.com
Subject: Re: [Maia-users] Bayes_99 on All Mail

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

craig carriere wrote:
> I am running MM on a Suse 10 server.  Recently I have
noticed that all
> of our mail was rating as bayes_99; even mail sent
within our network. 
> I have deleted our bayes databases and have just
recently had bayes
> starting again.  It still appears that the majority of
all of our
> incoming and local mail is still rated as bayes_99. 
Only occasionally
> do we see bayes_80 but never anything lower.  I do not
recall this to be
> the case when the server was originally set-up. 
Perhaps spamassassin is
> making a comment on the value of our work ?  If
anyone has any ideas
> on what to look for I would appreciate the information.

Look at the other rules that are triggering on these mail
items.
BAYES_99 doesn't happen all on its own, it gets that way
because a lot
of other positive-scoring rules give the Bayes more
confidence.  Look in
particular for things like AWL and ALL_TRUSTED, which point
to
configuration problems with your trusted_networks and
internal_networks
settings.  If these are misconfigured, the ALL_TRUSTED rule
will fire
when it shouldn't, and all your spam will have its score
reduced to the
point where it's considered ham, confusing your AWL database
and your
Bayes database, which will have a hard time distinguishing
genuine spam
from the misclassified stuff.  If that turns out to be the
case, you
need to fix the trusted_networks and internal_networks
settings in your
local.cf file, and wipe your Bayes and AWL databases.

As Craig points out, another possibility is that if you're
using
encryption, and a version of Crypt::CBC from 2.17 to 2.21
(inclusive),
you may be learning and reporting the encrypted contents
rather than the
decrypted mail.  If so, the only fix is to upgrade to
Crypt::CBC 2.22 or
later (or 2.12 or earlier), and wipe your Bayes and AWL
databases.

Another (less likely) possibility is that some of your users
have a
backwards idea of how to confirm spam and ham, such that
they're
reporting things they shouldn't be, and on a significant
scale.  If
that's the case, a little user education is called for.

- --
Robert LeBlanc <rjlrenaissoft.com>
Renaissoft, Inc.
Maia Mailguard <http://www.maiamail
guard.com/>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFWIKuGmqOER2NHewRAobGAJ9GCOKmmSNU2jeiInDzXqkw+vFt7gCg
hu67
bBq7ikd0Vi/br9MgD9ClPRk=
=EqXu
-----END PGP SIGNATURE-----
_______________________________________________
Maia-users mailing list
Maia-usersrenaissoft.com
http://www.renaissoft.com/mailman/listinfo/maia-users
_______________________________________________
Maia-users mailing list
Maia-usersrenaissoft.com
http://www.renaissoft.com/mailman/listinfo/maia-users

Bayes_99 on All Mail

Thread: Bayes_99 on All Mail