Topic: spamassassin vs groups

[Jáder]

Yes, I'm aware about junkmail but that's not the case.

This is today statistics (at 7am):
[root@andorinha ~]# if [ -z $DAYS ]; then DAYS=1; fi; echo -n "Days of logfiles to scan [$DAYS]: "; read NEWDAYS; if [ $NEWDAYS ]; then DAYS=$NEWDAYS; fi; awk -F"[\t]" ' /logterse plugin/ { svc=$6; count[svc]++; count["Total"]++; }  END  { for (j in count) print count[j] "\t" j; }' $(find /var/log/qpsmtpd /var/log/sqpsmtpd -ctime -$DAYS -type f) |sort -nr
Days of logfiles to scan [1]:
2654      Total
932       queued
713       rhsbl
566       check_goodrcptto
187       dnsbl
105       tls
101       check_spamhelo
32        spamassassin
18        check_earlytalker

So at monday we got 2654 messages and 932 went queued.

And yesterday:

[root@andorinha ~]# if [ -z $DAYS ]; then DAYS=1; fi; echo -n "Days of logfiles to scan [$DAYS]: "; read NEWDAYS; if [ $NEWDAYS ]; then DAYS=$NEWDAYS; fi; awk -F"[\t]" ' /logterse plugin/ { svc=$6; count[svc]++; count["Total"]++; }  END  { for (j in count) print count[j] "\t" j; }' $(find /var/log/qpsmtpd /var/log/sqpsmtpd -ctime -$DAYS -type f) |sort -nr
Days of logfiles to scan [1]:
2518      Total
911       rhsbl
711       queued
438       check_goodrcptto
262       dnsbl
65        spamassassin
61        tls
44        check_spamhelo
24        check_earlytalker
2         count_unrecognized_commands
[root@andorinha ~]# if [ -z $DAYS ]; then DAYS=1; fi; echo -n "Days of logfiles to scan [$DAYS]: "; read NEWDAYS; if [ $NEWDAYS ]; then DAYS=$NEWDAYS; fi; awk -F"[\t]" ' /logterse plugin/ { svc=$6; count[svc]++; count["Total"]++; }  END  { for (j in count) print count[j] "\t" j; }' $(find /var/log/qpsmtpd /var/log/sqpsmtpd -ctime -$DAYS -type f) |sort -nr
Days of logfiles to scan [1]: 2
4464      Total
1413      rhsbl
1173      queued
1154      check_goodrcptto
416       dnsbl
113       spamassassin
96        check_spamhelo
65        tls
26        check_earlytalker
5         auth::auth_cvm_unix_local
2         count_unrecognized_commands
1         check_badmailfrom

So at whole weekend We got 4464 messages (sat/sun) and 1173 went queued.
At weekend most (if not all) messages are spam.

SOMETHING IS WRONG. There are too many SPAM getting thru... even after several tweaks.
My users are getting as much as 100+ spam each day.

Can someone help me to improve Spamassassin hit count ?
Thanks

Jáder

[Knuddi]

Hi Jader,

If you would want to give it a go, then feel free tro try out ScanMailX filter - I can help you out with a free account if you please. Just to see whether your mail flow is truely unique and hard to filter.