I've been dutifully training the SA filters by feeding it batches of spam and ham (in mbox format, 200+ at a time), however I don't think it's actually filtering anything.

SA is catching a lot of spam, and the X-Spam-Status header is being added with all the tests that ran. However, none of the 700+ spams I just looked at (caught and uncaught) have BAYES_XX in the X-Spam-Status header.

My /private/etc/mail/spamassassin/local.cf file has auto_learn 1 and use_bayes 1, among other settings.

Shouldn't I be seeing some indication of the bayes filters in the mail headers?

Thanks,
Dave

I still have not figured out why I'm not getting any bayesian filtering. I tried a test run of SA from the command line on a batch of known spam with the -D debug switch on.

su - clamav -c "spamassassin -D --test --local --mbox /Users/dave/spam3.mbox > spam.test"

debug: bayes: 2187 tie-ing to DB file R/O /var/clamav/.spamassassin/bayes_toks
debug: bayes: 2187 tie-ing to DB file R/O /var/clamav/.spamassassin/bayes_seen
debug: bayes corpus size: nspam = 4310, nham = 3017
debug: tests= BAYES_99,FORGED_RCVD_HELO,HTML_80_90,HTML_MESSAGE,, [lots of other stuff]...

So, when run manually, I can see that bayesian filtering works. It just doesn't seem to be engaged when mail is normally received by postfix. I have yet to see a BAYES_XX tag added to any spam processed by postfix/amavis.

Any thoughts? Is there some way I can enable SA debug output when called from amavisd?

Thanks,
Dave

ping ping ping.

bump bump bump.

I just noticed the exact same thing. Why are we supposed to train our anti-spam software when it has no effect?

I've added the "debug" arg to the launchd plist for amavisd, and turned on the sa_debug thing at the bottom of the amavisd.conf file. I now get a lot more logging from amavisd, but I still don't see any debug logging from SA anyplace I've looked.

I'm suspecting there is some sort of problem with SA finding the correct bayes databases. Possibly it's being run as a user other than clamav, or some sort of path or ownership problem. It would probably be obvious if I could figure out how to get SA to output debug logs when called from amavisd.

Dave

/private/var/amavis/.spamassassin/bayes_journal
/private/var/amavis/.spamassassin/bayes_seen
/private/var/amavis/.spamassassin/bayes_toks

Thar she blows, thinbits.

Those are the amavis users' bayes files for SA.

On my system the file permissions look kosher. All owned by clamav:clamav and rw for it.

We've having the same exact problem. No Bayes on 10.4.2 server! Very strange. Has anyone been able to fix this?

That's interesting... I did a locate on bayes_seen and got the following:

/private/var/amavis/.spamassassin/bayes_seen
/private/var/clamav/.spamassassin/bayes_seen

Looking in those directories I see:

dave% sudo ls -l /private/var/amavis/.spamassassin/
-rw------- 1 clamav clamav 671744 Oct 14 08:13 auto-whitelist
-rw------- 1 clamav clamav 172032 Oct 14 08:03 bayes_seen
-rw------- 1 clamav clamav 1318912 Oct 14 08:03 bayes_toks

dave% sudo ls -l /private/var/clamav/.spamassassin/
-rw------- 1 clamav clamav 655360 Oct 14 01:00 bayes_seen
-rw------- 1 clamav clamav 5349376 Oct 14 01:00 bayes_toks
-rw-r--r-- 1 clamav clamav 1175 Oct 9 18:32 user_prefs

From what I can tell, /private/var/clamav is where the results of learn_junk_mail go, (or at least that's what happens on my machine). I'm wondering if it actually pulling from the /private/var/amavis directory when processing real mail. That would explain the lack of filtering...

I'll tinker with this today and report my results. I'm hoping we are on to something...

Dave

I stopped mail, moved /var/amavis/.spamassassin aside and replaced it with a symlink to /var/clamav/.spamassassin.

The next two mails that came in got a BAYES_99 tag. Yay!

So, it appears there is some sort of disconnect between the database path learning takes and what the mail server uses. I'll let this run for the weeked and see how it turns out.

This is a huge bug. One of the features they advertise doesn't even work! Do you think a symlink would work? Let me know how this is working for you.

This is a huge bug.

Way to go, Thinbits. You earned yourself a high-five. Someone want to blog this somewhere? I hope its fixed in 10.4.3

Since placing the symlink, I'm getting almost 100% accuracy with spam filtering. It's quite amazing! I'm not used to my Inbox not being full every morning.

I reported this as bug # 4305231 at bugreport.apple.com

Maybe if enough people report the bug it will get fixed for 10.4.3

Thanks for filing that and then posting the number.

Josh and I have been meaning to do a piece on the importance of filing bugs to Apple on this stuff, but haven't had a chance to do that yet.

The upshot is that for far too long Mac admins have just worked around issues, and never really had an outlet to file bugs. For OS X to get better, especially server, we need to be feeding back to Apple when things don't work.

The best way to do this, is as you've done, find a problem and find a solution for it, or hard evidence that it's really broken, and file that. Also posting the actual radar number is very helpful too. Those among us who can login to Radar can then put extra weight behind the bug.

Hmm. I've "moved /var/amavis/.spamassassin aside and replaced it with a symlink to /var/clamav/.spamassassin" but no effect. In fact, on my 10.4.2 machine, it seems like there is alot more info in amvis than clamav. Any suggestions?

I only have the .spamassassin in /va/amavis when i move it os .spamassassin_old it recreates it but none in /var/clamav

Also I noticed in /etc a /etc/spam with some files like amavisd.conf what is that there for ?

Thaks

P.S. talking about bugs anybody able to filter the logsi in serveradmin mail portion ?

Our system was a clean install of 10.4.2. It looks like the files are being written to /var/root/.spamassassin . I've backed up /var/amavis/.spamassassin symlinked to the one in var root and changed the permissionis on the one in /var/root but I still don't be seeming to get any hot bayesian action.

Kevin

Well I figured out my problem. I was manually calling sa-learn as root as I don't have the auto learn accounts set up (and there's no cron job or launchd plist for it anyway). So I su'ed to clamav and it created the /var/clamav directory. I made a .spamassassin directory and copied the files from /var/root/.spamassassin and changed the owner to clamav. Then I followed your directions and bingo, bayesian goodness.

I suspect the gentleman who was having it still not work may not have taught it the required 200 messages?

Thanks,

Kevin

any word on 10.4.3?

trying to get a handle on this.

I have been teaching ( or so I thought ) spamassassin for about a month yet still getting some spam.
I've been running learn_junk_mail manually from root whenever i get messages that don't get tagged. i have been delivering these messages to the junkmail user.

local.cf has
# Bayesian Auto Learn
auto_learn 1
# Use Bayesian Filtering
use_bayes 1

i do not have a .spamassassin in /var/root

/var/clamav/.spamassassin root# ls
bayes_seen bayes_toks

/var/amavis/.spamassassin root# ls
auto-whitelist bayes_journal
auto-whitelist.lock bayes_seen
auto-whitelist.lock.mail2.beth.k12.pa.us.18894 bayes_toks

both of these locations show todays date. both have user clamav:clamav

which one is the correct one?
Is there one that the system is updating and one that the manual learn is updating?

whcih one should i be replacing with a sym link ? or do i even have to?

okay replying to my own post.

/var/clamav -- is updated by the manual learn_junk_mail
/var/amavis -- is updated by the system constantly. i can see the time changing every time I ls -la.

it appears that there is more information in /var/amavis, how can i get the manual info from /var/clamav into /var/amavis?

I had the same problem. I just deleted the /var/amavis/.spamassassin dir and symlinked it to /var/clamav/.spamassassin and took the loss. I don't seem to have suffered for it.

If you still have all the emails you learned from, I guess you could go the other way with the symlink and learn into the amavid databases.

I don't know if there is a way to dump and load stuff across two databases.

Thinbits (et al.),

First, being totally new to running mail services on OS X Server (and not being very comfortable with UNIX in general) I am a little confused by this thread. Can someone give us newbies a simple step-by-step breakdown of what files are supposed to be where? All of your testing and you patience is greatly appreciated!

Second, does anyone know if the supposed automatic daily sa-learn --spam and --ham actually works? According to the Mail Service manual a cron script runs at 1am and checks junkmail and notjunkmail accounts, but I don't see anything like that listed in /etc/daily. And since I don't know what log file(s) to check to see what SA is doing, I am sort of in the dark.

Any help would be greatly appreciated!!!

-John

1. You need to type the following in the Terminal:
sudo ln -s /var/clamav/.spamassassin /var/amavis/.spamassassin
This will create a link from the folder that SpamAssassin looks to for Bayesian data (amavis) to the folder that has the Bayesian data written to it during the learn_junk_mail process (clamav).

2. Up until 10.4.2 the daily learning jobs did not run. 10.4.3 fixes that; my server has been running the jobs at 1:30 am every day since the update.

Hmmmm, just double-checked and realised that my log entries were from my launchd job to run it.

Let me check on a clean server...

Listing my two 10.4.3 directories I get:


total 1056
-rw------- 1 clamav clamav 168K Dec 29 14:50 auto-whitelist
-rw------- 1 clamav clamav 28K Dec 29 14:34 bayes_seen
-rw------- 1 clamav clamav 332K Dec 29 14:34 bayes_toks
total 1056
-rw------- 1 clamav clamav 168K Dec 29 14:50 auto-whitelist
-rw------- 1 clamav clamav 28K Dec 29 14:34 bayes_seen
-rw------- 1 clamav clamav 332K Dec 29 14:34 bayes_toks

I havn't personally made any tasks to sync these, yet they seem to be the same. 95% of my spam is being filtered properly, but I do seem to get almost identical spams to ones that I have alerted 'junkmail' to.

Here are some relevant headers from a piece of good email:

X-Virus-Scanned: by amavisd-new at jgubby.com
X-Spam-Status: No, hits=0.652 tagged_above=-999 required=3 tests=HTML_40_50,
HTML_MESSAGE, NO_REAL_NAME
X-Spam-Level:


There is nothing about bayes in any of the headers. Also, why must we empty the folders every day? If we dont will it get badly weighted, or does it skip over stuff it has already seen making the clearout a housekeeping task?

James

I finally got around to checking a couple of my servers which have the 10.4.3 standard install with SA/ClamAV enabled.

Both servers had the problem where:
sa_learn uses: /var/clamav/.spamassassin
auto-learning and analysis use: /var/amavis/.spamassassin

I receive no bayes tags in mail headers.

So the fix seemed simple enough, install the symlink in one direction or the other. (with proper owner, permissions, etc)

-- end result --

Still no bayes scoring for my servers.
I tried one with the symlink in /var/amavis and the other I tried the reverse.

local.cf contains
auto_learn 1
use_bayes 1

While moving the .spamassassin folder, creating symlinks, etc the mail server was stopped. I did a "diskutil repairpermissions /" before starting mail service.

Here are my directories:
x:/var/clamav jj$ ls -al
total 5472
drwxr-xr-x 5 clamav clamav 170 Jan 3 21:08 .
drwxr-xr-x 33 root wheel 1122 Jan 3 16:02 ..
drwxr-xr-x 5 clamav clamav 170 Jan 3 21:17 .spamassassin
-rw-r--r-- 1 clamav clamav 237106 Jan 2 14:06 daily.cvd
-rw-r--r-- 1 clamav clamav 2560365 Nov 22 13:27 main.cvd

x:/var/amavis root# ls -l
total 16
drwx------ 5 clamav clamav 170 Jan 3 21:17 .spamassassin
drwxr-xr-x 5 root clamav 170 Jan 3 21:02 .spamassassin.bak
drwxr-x--- 4 clamav clamav 136 Dec 22 23:34 amavis-20051222T233446-17248
drwxr-x--- 4 clamav clamav 136 Dec 23 20:44 amavis-20051223T204439-03812
drwxr-x--- 4 clamav clamav 136 Jan 3 10:14 amavis-20060103T071430-18613
drwxr-x--- 4 clamav clamav 136 Jan 3 21:17 amavis-20060103T211743-08375
-rw-r----- 1 clamav clamav 0 Nov 22 13:29 amavisd.lock
-rw-r----- 1 clamav clamav 5 Jan 3 21:17 amavisd.pid
srwxr-x--- 1 clamav clamav 0 Jan 3 21:17 amavisd.sock
-rw-r--r-- 1 clamav clamav 3 Jun 24 2005 whitelist_sender

And my headers look like:
X-Virus-Scanned: by amavisd-new at mac007.com
X-Spam-Status: No, hits=0 tagged_above=-999 required=2 tests=
X-Spam-Level:


Any suggestions?
This is absolutely ridiculous and now I understand why training hasn't had the effect it should.

Jeff

To all the extremely helpful heavy hitters in this discussion: the following is an example of an 'X-Spam-Status' header that I'm getting in my incoming email:

X-Spam-Status: No, hits=3.92 tagged_above=-999 required=4
tests=DATE_IN_FUTURE_12_24, MIME_BASE64_NO_NAME, MIME_BASE64_TEXT

My spam threshold for appending the subject line is 4, and as you can see in the header, this message was marked as 3.92. So obviously becasue the message was assigned a score, that means SpamAssassin is working, right?

Now there's nothing in my header that says 'BAYES_xx', but the original poster was concerned that he wasn't seeing 'BAYES_xx' in his headers. If SA is working, doesn't that mean bayesian filtering is working? What extra filtering benefits do the 'BAYES_xx' entries indicate?

Thanks to any who can elucidate for me.

This is all very interesting but can some please point me to the documentation that explains how to get this thing to learn in the first place? I see lots of discussion about cron running a job to process junk mail for learning (and this thread about linking the correct directories) but nothing about where and how to put junk mail whereever it is supposed to go so that this learning process has something to process. Thanks.

Has any of you examined if this is working after applying 10.4.5?

I am just about to enable it on my server - but after reading this thread I am not quite sure how to do it…

To automatically train the junk mail filter:

1 Enable junk mail filtering.

2 Create two local accounts: junkmail, and notjunkmail

3 Use Workgroup Manager to enable them to receive mail.

4 Instruct your mail users to “Redirect” junk mail messages which have not previously
been tagged as junk mail to “junkmail@”.

5 Instruct your mail users to “Redirect” real mail messages which were wrongly tagged as
junk mail to “notjunkmail@”.

6 Each day at 1 am, the junk mail filter will learn what is junk and what was mistaken for
junk, but is not.

7 Delete the messages in junkmail and notjunkmail’s accounts daily.

I have it set up as described in the MailAdmin.pdf but not real sure that it is working. I have not done the symlinking, was hoping it was fixed in 10.4.7.

Can anyone confirm or deny that it is still broken in 10.4.7 or .8?

thanks,
Eric H

Right then guys. I have a 10.4.7 server. I've setup the symbolic link as shown in this thread and ran the learn_junk_mail script manually as root. The next day, the Bayes filter is definiteyl working. More mails are being stopped than before doing this, but not enough!!
Now I have been collecting a lot of junk getting through in the junkmail account, and now have over 1000. If I now run teh learn_junk_mail script, it takes an age and just finishes with no report or error. When I check the bayes files in /var/clamav/.spamassassin (which are the same as /var/amavis/.spamassassin) the dates have changed but size has not increased on the files.
If however I run the manual sa learn script as root on the /var/spool/imap/user/junkmail folder, the files in /var/root/.spamassassin increase a hell of a lot. For instace the bayes_tok file is now twice the size of the one in clamav.

How can I find out if the learning is working correctly??

Don't run sa-learn as root, or , as you've seen, it stores the result in /var/root/.spamassassin
which won't be referenced by anything else.

sudo -u clamav sa-learn --showdots --spam --mbox --no-sync /path/to/your/junkmail

Apple's script at /etc/mail/spamassassin/learn_junk_mail
while needing to be invoked as root, does su to clamav:

su - clamav -c "sa-learn --spam --no-sync ## etc.

I cracked the code... !

There is Lots of things broken in Tiger Server. Bayesian Filters will never work !

Go there for fixes:

http://wiki.apache.org/spamassassin/SpamAssassin_on_Mac_OS_X_Server

BTW, the Bayesian filter will not work until you have at least 200 Messages Learned in the DB.

On my machine, the learning script was never triggering !

With the database problem, no wonder the bayesian doesn't work....

OK, some more observations on this most interesting topic:
servu:~ root# system_profiler | grep "System Version"
System Version: Mac OS X Server 10.4.6 (8I127)
The server is definitely learning and /var/clamav/.spamassassin is never used:
servu:~ root# ls -lh /var/clamav/.spamassassin/ /var/amavis/.spamassassin/
/var/amavis/.spamassassin/:
total 31168
-rw------- 1 clamav clamav 9M Nov 18 13:07 auto-whitelist
-rw------- 1 clamav clamav 10K Nov 18 13:07 bayes_journal
-rw------- 1 clamav clamav 2M Nov 18 12:54 bayes_seen
-rw------- 1 clamav clamav 2M Nov 18 12:54 bayes_toks

/var/clamav/.spamassassin/:
total 752
-rw------- 1 clamav clamav 36K Jul 28 01:21 bayes_seen
-rw------- 1 clamav clamav 340K Jul 28 01:21 bayes_toks

However, a good portion of junk is still being caught and tagged:
X-Sieve: CMU Sieve 2.2
X-Virus-Scanned: by amavisd-new at mac.ee
X-Spam-Status: Yes, hits=6.586 tagged_above=-999 required=3 tests=BAYES_50, DRUGS_ERECTILE, HELO_DYNAMIC_IPADDR, HTML_70_80, HTML_MESSAGE, MIME_QP_LONG_LINE
X-Spam-Level: ******
X-Spam-Flag: YES

I'll try the symlink tonight and report back.