[quote user="TheJJ"]

 My Spamhalter.ini:

[SpamHalter]<br><snip>

<br><b>TrainAlways=1</b><br>IgnoreWhite=0<br>ImageParser=1<br><br>[bayDynamic]<br>bayForcedWrites=1<br><b>bayNoSpamBoost=3</b><br>bayClasifyMaxTokens=20<br>bayUnknownProb=40<br>baySpamProb=80<br>bayMaxCorrCnt=10<br>bayOldDays=100<br>bayExpire=365<br>bayWhiteOldDays=100<br>CustomHeaders=<br><br>[bayStatic]<br>bayMaxLength=8192<br>bayMinTokenLength=3<br>bayMaxTokenLength=25<br><br>

Thanks for help,

 JJ

[/quote]

Spammers have got a bit smarter wrt bayseian filters by including more "good" and "random" words.

I recall the docs implying that the "bayNoSpamBoost=3" setting is to err

on the side of caution in a fresh install and should be modified to

suit after a bit of training. 

The 'bayNoSpamBoost=3' setting means that "good" words have 3 x the 'weight' of "bad" words, so spam with sufficient "good" words is passed as 'nospam'.

This, combined with "train always" means that your database is constantly updated with incorrectly classified spam mails, which adds the included "bad" words to it's "good" list and the effect snowballs.

To combat this I have adjusted my settings as below.

Part of my Spamhalter.ini

TrainAlways=1
ImageParser=1
IgnoreWhite=0

[bayDynamic]
bayNoSpamBoost=1
bayClasifyMaxTokens=30
bayUnknownProb=90
baySpamProb=40
bayMaxCorrCnt=50
bayOldDays=30
bayExpire=180
bayWhiteOldDays=365
CustomHeaders=

[bayStatic]
bayMaxLength=8192
bayMinTokenLength=3
bayMaxTokenLength=25

These settings work very well for our mail but may not necessarily work for you, YMMV. :)

Hi all,

I have a problem with my Mercury and Spamhalter mail server:

I dont't know why, but Spamhalter gives up checking for spam after some time (~1 week).

Before that everything worked well and spam probabilities were calculated.

But suddenly, this stops and every mail is classified as noSPAM.

I turned on all debug modes and here's an example, the registration mail at this forum:

First the debug headers:

Received: from spooler by myserver.tld (Mercury/32 v4.72); 12 Aug 2010 11:08:48 +0200
X-Envelope-To: <reciever@myserver.tld>
X-SPAMWALL: Passed through antiSPAM test by Spamhalter 4.5.1.411 on myserver.tld (1854)
X-SPAMWALL: Spam probability 0.0%
X-SPAMWALL: Debug - aspx 0.0011547344111
X-SPAMWALL: Debug - login 0.0135135135135
X-SPAMWALL: Debug - Your 0.0161290322581
X-SPAMWALL: Debug - user 0.0227272727273
X-SPAMWALL: Debug - new 0.0344827586207
X-SPAMWALL: Debug - TheJJ 0.0384615384615
X-SPAMWALL: Debug - Mercury 0.0384615384615
X-SPAMWALL: Debug - Password 0.0500000000000
X-SPAMWALL: Debug - account 0.0512820512821
X-SPAMWALL: Debug - You 0.0524475524476
X-SPAMWALL: Debug - can 0.0563380281690
X-SPAMWALL: Debug - and 0.0722433460076
X-SPAMWALL: Debug - Mail 0.0757575757576
X-SPAMWALL: Debug - please 0.0909090909091
X-SPAMWALL: Debug - have 0.0952380952381
X-SPAMWALL: Debug - com 0.0968652037618
X-SPAMWALL: Debug - href 0.0992187500000
X-SPAMWALL: Debug - http 0.1357475645913
X-SPAMWALL: Debug - su*Account 0.1666666666667
X-SPAMWALL: Debug - body 0.1920289855072
X-SPAMWALL: Debug - ... 0.0000000000000
Return-path: <NoReply@praktit.se> 

Next the internal log of spamhalter: 

D 20100812 110846.760 MG000038 Mercury version >= 4.1<br>D 20100812 110846.761 MG000038 jobfile: D:\JMAIL\QUEUE\MG000038.QDF<br>D 20100812 110846.762 MG000038 spamdir: D:\JMAIL\MAILBOX\spam<br>D 20100812 110846.763 MG000038 nospamdir: D:\JMAIL\MAILBOX\nospam<br>D 20100812 110846.765 MG000038 IP: 62.20.118.73<br>D 20100812 110847.952 MG000038 > Missed ACL<br>&nbsp; 20100812 110847.953 MG000038 from: <NoReply@praktit.se> <br>&nbsp; 20100812 110847.954 MG000038&nbsp; to: rec@mydomain.tld<br>D 20100812 110847.954 MG000038 > Internet sender<br>D 20100812 110847.955 MG000038 > Need to test<br>D 20100812 110848.405 MG000038 before parse<br>D 20100812 110848.407 MG000038 before lookup<br>&nbsp; 20100812 110848.420 MG000038 Tokens: 49<br>N 20100812 110848.433 MG000038 <u>noSPAM 0.0000</u><br>_ 20100812 110848.603 MG000038 Done. (1855)<br>

 As you can see, the mail is always just tagged as noSPAM.

 My Spamhalter.ini:

[SpamHalter]<br>Queue=<br>Debug=1<br>BayDebug=1<br>CleanTime=2<br>StatRate=1<br>SpamAddr=spam@mydomain.tld<br>NoSpamAddr=nospam@

mydomain.tld

HoneyPot=honey@

mydomain.tld

LocalIP=127.0.0.1/8,192.168.0.0/16,10.9.0.0/16<br>DynamicHost=

warrior1.mydomain.tld

Password=mypassword<br>BlockTag=X-Blocked<br>VirusTag=attach removed<br>LogVirWall=1<br>subject=*Spam* <br>tagname=X-SPAMWALL<br>WhitelistText=Whitelisted<br>BlockText=Blocked SPAM!<br>DebugText=Debug -<br>ProbText=Spam probability<br>SpamText=SPAM detected!<br>bayDataDir=D:\jMail\spamhalter\<br>logfile=D:\jMail\Logs\sh~Y~W.LOG<br>Enabled=1<br>SpamTrack=1<br>TrainAlways=1<br>IgnoreWhite=0<br>ImageParser=1<br><br>[bayDynamic]<br>bayForcedWrites=1<br>bayNoSpamBoost=3<br>bayClasifyMaxTokens=20<br>bayUnknownProb=40<br>baySpamProb=80<br>bayMaxCorrCnt=10<br>bayOldDays=100<br>bayExpire=365<br>bayWhiteOldDays=100<br>CustomHeaders=<br><br>[bayStatic]<br>bayMaxLength=8192<br>bayMinTokenLength=3<br>bayMaxTokenLength=25<br><br>

Thanks for help,

 JJ

This was maybe not the best example, it's a message that should be classified as nospam and is classified as nospam. But generally speaking, you may need to train the database with lots of spam messages and good messages before you get reliable results.

/Rolf

Indeed not the best example, but there should still be a minimal spam-probability, i think.

Anyway, it works perfect if you reset the database to 0 and give Spamhalter a few Spam-Mails.