Do you have both 5000 good and bad?

Dan S/

Keizersozay,

Did you receive 5,000 spam and 5,000 good emails? The Bayesian filter kicks in after both good and bad count are over 5000. If so, even if your other filters were super-effective, you should see at least a small amonut of emails blocked by the Bayesian filter. Please note that the statistical analysis only occurs after all other filters have failed to catch spam, so the number of emails blocked by the Bayesian filter will be small when compared to others.

Can you try running the following query on the database? It returns a list of howm many emails in the quarantine have been blocked by the various rules, and post the results?

Roberto F.
LogSat Software

SELECT     tblQuarantine.RejectID, tblRejectCodes.RejectDesc, COUNT(tblQuarantine.RejectID) AS Total
FROM         tblQuarantine INNER JOIN
                      tblRejectCodes ON tblQuarantine.RejectID = tblRejectCodes.RejectID
GROUP BY tblQuarantine.RejectID, tblRejectCodes.RejectDesc

After running the query script posted by Roberto further down this thread I got these results showing that it does work when the good/bad  emails go past 5000.

Reverse DNS not found =1466
Empty Mail From =32
Mail From and Mail To are equal =2
Exceeded maximum number of RCPT TO =1950
Keywords found in content =879
Statistical filter match =61

server1 Duel XEON1000/1.5gb mem, 2000adv build 302 via udl to sql (no odbc) mdac 2.8  Mcafee Netshield 4.51
server2 DuelPentiumPro200 256mb mem, 2000adv and MS SQL2000
server3 Duel XEON1000/1.5gb mem, 2000adv, Sendmail 3.05

While this setup is not high end by any means, it handles things pretty good. The cpu load stays down around 50% with some spikes up to 100%. Memory usage by SF is 48,000K to 52,000K

In the last 3 1/2 hours, 64 emails were deleted by the AV for virus's.

Hi Roberto,
Thanks for the response. It has been well over 5000 good and 5000 bad messages. I looked in the corpus.ini to confirm and it is more that double what it should be. When I ran the query I got this info:
+----------+------------------------------------------+-------+
| RejectID | RejectDesc                                            | Total |
+----------+------------------------------------------+-------+
|        2 | EmailFrom is in local blacklist file            |    27 |
|        4 | Empty Mail From                                        |  1287 |
|        8 | IP address is from a blacklisted country |  1721 |
|       12 | IP found in MAPS search                        | 18718 |
|       13 | Keywords found in content                     |  4038 |
+----------+------------------------------------------+-------+
5 rows in set (0.28 sec)

You should also know that I disable the bayes at night and enable it in the morning. I do this in reference to this problem http://www.logsat.com/spamfilter/forums/showmessage.asp?messageID=3261" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.logsat.com/spamfilter/forums/showmessage.asp?messageID=3261" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.logsat.com/spamfilter/forums/showmessage.asp?messageID=3261  that I still have. I can't affort for the sevice to crash at night when I am not around so I just activate the bayes during the day.
Also in reference to the above messageID 3261 I have since moved the spamfilter program to a new "server" that is a 2.6 ghz dell workstation with .5 gig of ram with windows 2003 server. The server has nothing else on it except Trend Server Protect and mysql. The errors are much less frequent but it still happened (once) yesterday. I will try the latest build and see how it goes.
I was reading through the posts and it looked like Dan posted something a while back about not releasing stale connections and the service eventually bombs out..this is what happens to me eventually when I have bayes enabled.

this really isn't an emergency for me, I just wanted to make sure I wasn't doing something wrong with the bayes portion and to further help the development process.  I guess its possible that bayes just hasn't found anything yet....

Thanks again for a fantastic product.

It is very strange that you do not have even a single email caught by the Bayes filter, I'm pretty sure there is something else going on.

If you are running the latest build 312, and if you email us at the support address your SpamFilter logfile for a day or two well try to understand what the problem is.

Roberto F.
LogSat Software

I will download the new build shortly, but it may be until monday before I can set it up. Also, my log files are about 30 mb for each day so I will post it to our ftp site and email you with details.

Thanks again.

John,

What does your corpus.ini file have in it ... it is in the corpus folder.

Dan S.

Hello,

      I seem to have the same problem.  Below is the contents of my copus.ini http://file:" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://file:

[Messages]
Spam=20255
Good=19621

    Below is the output of my query:

Reverse DNS not found 4960
Empty Mail From 294
IP found in MAPS search 18004
Keywords found in content 1433

The Statistical filter does not appear to be catching anything.

Thanks,

Stan

I too have also yet to see the filter kicking in, only 4?

running v2.0.1.302

query

corpu.ini

[Messages]
Spam=13817
Good=49039

Thanks