Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - SpamFilter Blocking Everything
  FAQ FAQ  Forum Search   Register Register  Login Login

SpamFilter Blocking Everything
 Post Reply Post Reply
Author
  Topic Search Topic Search  Topic Options Topic Options
Matt View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Matt Quote  Post ReplyReply Direct Link To This Post Topic: SpamFilter Blocking Everything
    Posted: 28 July 2005 at 5:06pm

I am running v. 2.5.1.441
Emails Forwarded: 99646
Emails Blocked: 9083
Emails Attempts: 109113

Every email I send is getting returned with the following error:

557 This email is rejected. It contains keywords rejected by the antispam content filter.

The activity log says this:

Bayesian Filter - Rejected - 100% spam

I have sent messages from different email address on different domains and all of them are rejected with 100%. Everything had been working until I added another Local Domain. Any suggestions on things to try? Any help is appreciated.

 

-Matt C.
Back to Top
Marcus View Drop Down
Newbie
Newbie


Joined: 25 July 2005
Location: United States
Status: Offline
Points: 21 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Marcus Quote  Post ReplyReply Direct Link To This Post Posted: 28 July 2005 at 5:11pm

your local domain additions should look similar to:

domain1.com

domain2.com

check and make sure the path to the allowed domains file is valid

check and set your bayesian filter is set to %98.995 (default) or set to 0 to disable temporarily
Back to Top
Matt View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Matt Quote  Post ReplyReply Direct Link To This Post Posted: 28 July 2005 at 5:43pm

I have local domains setup as follows:
domain1.com:mail.domain1.com
domain2.com:mail.domain2.com

I have Excluded FROM Emails:
*@domain1.com
*@domain2.com

Bayesian Filter is set to 98.574%

I copied the following information into the Bayes Probability form:
Received: by 10.54.42.62 with SMTP id p62mr973339wrp;
       Thu, 28 Jul 2005 13:33:19 -0700 (PDT)
Received: by 10.54.124.4 with HTTP; Thu, 28 Jul 2005 13:33:19 -0700 (PDT)
Message-ID: <9c8a8ee8050728133329223671@mail.gmail.com>
Date: Thu, 28 Jul 2005 13:33:19 -0700
From: Fred Meyer <0majestic1@gmail.com>
Reply-To: Fred Meyer <0majestic1@gmail.com>
To: user@domain1.com
Subject: Test
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Just a test to make sure this filter is working. Can't sound like I am
trying to sell you anthing or ask for money. Anything else you can
think of that I should put in this message so it doesn't get trapped.

Results - Passed Bayesian Filter - 0.5594% spam
This is a message that was rejected with 100% when sent.

-Matt C.
Back to Top
Marcus View Drop Down
Newbie
Newbie


Joined: 25 July 2005
Location: United States
Status: Offline
Points: 21 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Marcus Quote  Post ReplyReply Direct Link To This Post Posted: 28 July 2005 at 10:00pm

local domain should be the part after the @ in the email address

emailuser @ domain1.com

local domain entry =  domain1.com

you don't really need the excluded from entrys - use this to exclud external mails from being scanned, ie, user @ externaldomain.com entry would be = externaldomain.com

turn the bayesian filter completly off ( %0 ) for testing
Back to Top
Matt View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Matt Quote  Post ReplyReply Direct Link To This Post Posted: 29 July 2005 at 12:04pm

I have made that changes listed above, but all messages are still getting rejected with 100%. Turning off Bayesian filter will allow messages to pass through. Any more ideas?

-Matt C.
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104 		Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 29 July 2005 at 4:10pm
Matt is emailing us all his relevant files. We'll be looking over them to see if we can find the problem.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
lead View Drop Down
Newbie
Newbie
Avatar

Joined: 08 March 2005
Status: Offline
Points: 18 		Post Options Post Options   Thanks (0) Thanks(0)   Quote lead Quote  Post ReplyReply Direct Link To This Post Posted: 03 November 2005 at 5:55am
Did anything come of this?

I appear to be having the same issue.
The bayes filter has only just kicked in:

[Messages]
Spam=44739
Good=6131

Version: 2.6.3.482

On sending a harmless test email that i would expect to get passed the bayes filter scored it as 100% spam.

Using the Bayesian probability utility I get the probability scores for each word/reference in the email (see below).

Notice how words such as 'you' and 'This' have a high spam score, which have skewed the result.

Is there anyway to adjust these, so they don't have such a dramatic effect on the probability score? (without sending hundreds of emails  with the words in question and letting them through ;-)

I have already deleted the database a number of times becuase of this.

Thanks and many regards,

11/03/05 10:27:17:224 -- ()     Token    Good    Spam    Prob is Spam
11/03/05 10:27:17:224 --      1*0    0    1    0.4
11/03/05 10:27:17:224 --      1*57    0    0    0.2
11/03/05 10:27:17:224 --      10*0    1    0    0.4
11/03/05 10:27:17:224 --      <blanked>    1    0    0.4
11/03/05 10:27:17:234 --      <blanked>    0    0    0.2
11/03/05 10:27:17:234 --      782A4E000376    0    0    0.2
11/03/05 10:27:17:234 --      7bit    0    1    0.4
11/03/05 10:27:17:234 --      Accept    0    0    0.2
11/03/05 10:27:17:234 --      Agent    0    2    0.4
11/03/05 10:27:17:234 --      and    0    80    0.9999
11/03/05 10:27:17:234 --      any    0    33    0.9999
11/03/05 10:27:17:234 --      are    0    42    0.9999
11/03/05 10:27:17:234 --      bayes    0    0    0.2
11/03/05 10:27:17:234 --      blaster    0    0    0.2
11/03/05 10:27:17:234 --      charset    1    0    0.4
11/03/05 10:27:17:234 --      cla    0    2    0.4
11/03/05 10:27:17:234 --      community    1    0    0.4
11/03/05 10:27:17:234 --      considered    1    0    0.4
11/03/05 10:27:17:234 --      contain    1    0    0.4
11/03/05 10:27:17:234 --      Content    1    0    0.4
11/03/05 10:27:17:244 --      could    0    11    0.9999
11/03/05 10:27:17:244 --      Date    0    1    0.4
11/03/05 10:27:17:244 --      day    0    31    0.9999
11/03/05 10:27:17:244 --      Domain    0    0    0.2
11/03/05 10:27:17:244 --      email    0    10    0.9999
11/03/05 10:27:17:244 --      Encoding    1    0    0.4
11/03/05 10:27:17:244 --      ESMTP    1    0    0.4
11/03/05 10:27:17:244 --      filter    1    0    0.4
11/03/05 10:27:17:244 --      flowed    0    0    0.2
11/03/05 10:27:17:244 --      for    0    80    0.9999
11/03/05 10:27:17:244 --      format    2    0    0.4
11/03/05 10:27:17:244 --      from    0    36    0.9999
11/03/05 10:27:17:244 --      From    0    2    0.4
11/03/05 10:27:17:244 --      From*com    0    44    0.9999
11/03/05 10:27:17:244 --      From*<blanked>    4    0    0.4
11/03/05 10:27:17:244 --      From*<blanked>    0    0    0.2
11/03/05 10:27:17:244 --      From*<blanked>    1    0    0.4
11/03/05 10:27:17:244 --      generic    0    2    0.4
11/03/05 10:27:17:244 --      getting    0    34    0.9999
11/03/05 10:27:17:244 --      GMT    1    0    0.4
11/03/05 10:27:17:244 --      had    0    3    0.4
11/03/05 10:27:17:244 --      harmless    0    2    0.4
11/03/05 10:27:17:244 --      having    0    2    0.4
11/03/05 10:27:17:254 --      Hello    0    8    0.4
11/03/05 10:27:17:254 --      HELO    1    0    0.4
11/03/05 10:27:17:254 --      help    0    23    0.9999
11/03/05 10:27:17:254 --      helpful    1    0    0.4
11/03/05 10:27:17:254 --      high    1    1    0.4
11/03/05 10:27:17:254 --      hope    0    1    0.4
11/03/05 10:27:17:254 --      ISO    1    0    0.4
11/03/05 10:27:17:254 --      it's    0    2    0.4
11/03/05 10:27:17:254 --      Language    1    0    0.4
11/03/05 10:27:17:254 --      logsat    0    0    0.2
11/03/05 10:27:17:254 --      LogSat    0    2    0.4
11/03/05 10:27:17:254 --      looks    1    0    0.4
11/03/05 10:27:17:254 --      mailgw    1    0    0.4
11/03/05 10:27:17:254 --      manner    1    0    0.4
11/03/05 10:27:17:254 --      may    1    1    0.4
11/03/05 10:27:17:254 --      Maybe    1    0    0.4
11/03/05 10:27:17:254 --      Message    2    0    0.4
11/03/05 10:27:17:254 --      MIME    1    0    0.4
11/03/05 10:27:17:254 --      Mozilla    0    0    0.2
11/03/05 10:27:17:254 --      net    0    3    0.4
11/03/05 10:27:17:254 --      nice    0    8    0.4
11/03/05 10:27:17:254 --      <blanked>    0    0    0.2
11/03/05 10:27:17:254 --      not    0    20    0.9999
11/03/05 10:27:17:264 --      Nov    1    0    0.4
11/03/05 10:27:17:264 --      off    0    8    0.4
11/03/05 10:27:17:264 --      Path    1    0    0.4
11/03/05 10:27:17:264 --      people    0    8    0.4
11/03/05 10:27:17:264 --      peterb    1    0    0.4
11/03/05 10:27:17:264 --      pipex    0    0    0.2
11/03/05 10:27:17:264 --      plain    1    0    0.4
11/03/05 10:27:17:264 --      Postfix    1    0    0.4
11/03/05 10:27:17:264 --      proability    0    0    0.2
11/03/05 10:27:17:264 --      quite    1    0    0.4
11/03/05 10:27:17:264 --      real    0    27    0.9999
11/03/05 10:27:17:264 --      Received    1    0    0.4
11/03/05 10:27:17:264 --      Received*0000    0    4    0.4
11/03/05 10:27:17:264 --      Received*1*57    4    0    0.4
11/03/05 10:27:17:264 --      Received*10    0    2    0.4
11/03/05 10:27:17:264 --      Received*10*0    1    0    0.4
11/03/05 10:27:17:264 --      Received*17    0    83    0.9999
11/03/05 10:27:17:264 --      Received*<blanked>  &nbs p; 1    0    0.4
11/03/05 10:27:17:264 --      Received*20    0    2    0.4
11/03/05 10:27:17:264 --      Received*2005    0    83    0.9999
11/03/05 10:27:17:264 --      Received*26    0    1    0.4
11/03/05 10:27:17:264 --      Received*27    0    2    0.4
11/03/05 10:27:17:264 --      Received*3    1    1    0.4
11/03/05 10:27:17:274 --      Received*<blanked>  &nbs p; 0    0    0.2
11/03/05 10:27:17:274 --      Received*782A4E000376    0    0    0.2
11/03/05 10:27:17:274 --      Received*blaster    0    0    0.2
11/03/05 10:27:17:274 --      Received*by    0    83    0.9999
11/03/05 10:27:17:274 --      Received*<mydomain>  &nb sp; 0    83    0.9999
11/03/05 10:27:17:274 --      Received*co    0    83    0.9999
11/03/05 10:27:17:274 --      Received*ESMTP    0    1    0.4
11/03/05 10:27:17:274 --      Received*for    0    2    0.4
11/03/05 10:27:17:274 --      Received*from    0    83    0.9999
11/03/05 10:27:17:274 --      Received*GMT    0    4    0.4
11/03/05 10:27:17:274 --      Received*id    0    2    0.4
11/03/05 10:27:17:274 --      Received*LogSat    0    83    0.9999
11/03/05 10:27:17:274 --      Received*mailgw    0    83    0.9999
11/03/05 10:27:17:274 --      Received*net    0    2    0.4
11/03/05 10:27:17:274 --      Received*Nov    0    2    0.4
11/03/05 10:27:17:274 --      Received*<blanked>  &nbs p; 4    0    0.4
11/03/05 10:27:17:274 --      Received*<blanked>  &nbs p; 1    0    0.4
11/03/05 10:27:17:274 --      Received*Postfix    1    0    0.4
11/03/05 10:27:17:274 --      Received*Server    0    83    0.9999
11/03/05 10:27:17:274 --      Received*SMTP    0    83    0.9999
11/03/05 10:27:17:274 --      Received*Software    0    83    0.9999
11/03/05 10:27:17:274 --      Received*systems    1    0    0.4
11/03/05 10:27:17:274 --      Received*Thu    0    2    0.4
11/03/05 10:27:17:284 --      Received*uk    0    83    0.9999
11/03/05 10:27:17:284 --      Received*unknown    1    3    0.4
11/03/05 10:27:17:284 --      Received*with    0    5    0.4
11/03/05 10:27:17:284 --      reliable    0    7    0.4
11/03/05 10:27:17:284 --      Return    3    83    0.6539
11/03/05 10:27:17:284 --      Return-Path*Path*    3    83    0.6539
11/03/05 10:27:17:284 --      Server    1    0    0.4
11/03/05 10:27:17:284 --      shame    1    0    0.4
11/03/05 10:27:17:284 --      should    1    0    0.4
11/03/05 10:27:17:284 --      SMTP    1    0    0.4
11/03/05 10:27:17:284 --      Software    0    2    0.4
11/03/05 10:27:17:284 --      some    2    2    0.4
11/03/05 10:27:17:284 --      Subject    0    4    0.4
11/03/05 10:27:17:284 --      Subject*a    0    2    0.4
11/03/05 10:27:17:284 --      Subject*and    0    3    0.4
11/03/05 10:27:17:284 --      Subject*any    0    3    0.4
11/03/05 10:27:17:284 --      Subject*be    0    2    0.4
11/03/05 10:27:17:284 --      Subject*considered    0    0    0.2
11/03/05 10:27:17:284 --      Subject*contain    0    0    0.2
11/03/05 10:27:17:284 --      Subject*email    1    0    0.4
11/03/05 10:27:17:284 --      Subject*generic    0    0    0.2
11/03/05 10:27:17:284 --      Subject*harmless    0    0    0.2
11/03/05 10:27:17:284 --      Subject*high    0    0    0.2
11/03/05 10:27:17:284 --      Subject*is    0    2    0.4
11/03/05 10:27:17:294 --      Subject*may    1    0    0.4
11/03/05 10:27:17:294 --      Subject*not    0    1    0.4
11/03/05 10:27:17:294 --      Subject*proability    0    0    0.2
11/03/05 10:27:17:294 --      Subject*should    1    0    0.4
11/03/05 10:27:17:294 --      Subject*that    0    2    0.4
11/03/05 10:27:17:294 --      Subject*This    0    4    0.4
11/03/05 10:27:17:294 --      Subject*which    0    0    0.2
11/03/05 10:27:17:294 --      Subject*words    4    0    0.4
11/03/05 10:27:17:294 --      success    1    1    0.4
11/03/05 10:27:17:294 --      systems    1    0    0.4
11/03/05 10:27:17:294 --      text    1    0    0.4
11/03/05 10:27:17:294 --      that    2    2    0.4
11/03/05 10:27:17:294 --      the    3    11    0.2002
11/03/05 10:27:17:294 --      this    2    2    0.4
11/03/05 10:27:17:294 --      This    0    29    0.9999
11/03/05 10:27:17:294 --      Thu    1    0    0.4
11/03/05 10:27:17:294 --      Thunderbird    0    0    0.2
11/03/05 10:27:17:294 --      To*<my domain>    0    82    0.9999
11/03/05 10:27:17:294 --      To*co    0    82    0.9999
11/03/05 10:27:17:294 --      To*<blanked>    1    0    0.4
11/03/05 10:27:17:294 --      To*uk    0    82    0.9999
11/03/05 10:27:17:294 --      Transfer    1    0    0.4
11/03/05 10:27:17:294 --      turn    0    1    0.4
11/03/05 10:27:17:304 --      Type    1    0    0.4
11/03/05 10:27:17:304 --      unknown    1    0    0.4
11/03/05 10:27:17:304 --      useful    1    0    0.4
11/03/05 10:27:17:304 --      User    0    4    0.4
11/03/05 10:27:17:304 --      users    1    0    0.4
11/03/05 10:27:17:304 --      Version    1    0    0.4
11/03/05 10:27:17:304 --      which    1    4    0.4
11/03/05 10:27:17:304 --      Windows    0    2    0.4
11/03/05 10:27:17:304 --      with    0    9    0.4
11/03/05 10:27:17:304 --      words    1    0    0.4
11/03/05 10:27:17:304 --      working    1    0    0.4
11/03/05 10:27:17:304 --      would    0    9    0.4
11/03/05 10:27:17:304 --      you    0    30    0.9999
11/03/05 10:27:17:304 --  ------------------------------------------------------------
11/03/05 10:27:17:304 --      help    0.9999
11/03/05 10:27:17:304 --      not    0.9999
11/03/05 10:27:17:304 --      Received*17    0.9999
11/03/05 10:27:17:304 --      for    0.9999
11/03/05 10:27:17:304 --      any    0.9999
11/03/05 10:27:17:304 --      from    0.9999
11/03/05 10:27:17:314 --      day    0.9999
11/03/05 10:27:17:314 --      Received*by    0.9999
11/03/05 10:27:17:314 --      This    0.9999
11/03/05 10:27:17:314 --      To*co    0.9999
11/03/05 10:27:17:314 --      you    0.9999
11/03/05 10:27:17:314 --      Received*Software    0.9999
11/03/05 10:27:17:314 --      Received*co    0.9999
11/03/05 10:27:17:314 --      Received*LogSat    0.9999
11/03/05 10:27:17:314 --      Received*Server    0.9999
11/03/05 10:27:17:314 --      Received*from    0.9999
11/03/05 10:27:17:314 --      Received*2005    0.9999
11/03/05 10:27:17:314 --      are    0.9999
11/03/05 10:27:17:314 --      getting    0.9999
11/03/05 10:27:17:314 --      and    0.9999
11/03/05 10:27:17:314 --      Received*SMTP    0.9999
11/03/05 10:27:17:314 --      real    0.9999
11/03/05 10:27:17:314 --      email    0.9999
11/03/05 10:27:17:314 --      From*com    0.9999
11/03/05 10:27:17:314 --      could    0.9999
11/03/05 10:27:17:314 --      Received*<mydomain>    0.9999
11/03/05 10:27:17:314 --      Received*mailgw    0.9999
11/03/05 10:27:17:314 --      To*<mydomain>    0.9999
11/03/05 10:27:17:314 --      To*uk    0.9999
11/03/05 10:27:17:314 --      Received*uk    0.9999
11/03/05 10:27:17:314 --      <blanked>    0.2
11/03/05 10:27:17:324 -- **** R E S U L T S *********
11/03/05 10:27:17:324 -- matches Bayesian filter - rejected - 100% spam
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104 		Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 03 November 2005 at 4:40pm
lead,

Matt's issue was solved by emails. The final solution to his problem was as follows:
==========================
Your corpus database, which holds all of the statistical information about incoming emails did appear to have become corrupted. While according to your files it was supposed to hold data for about 100,000 emails received, there were only a few thousand records in it.
 
Our original recommendation, to stop SpamFilter, delete or rename the SpamFilter\corpus directory, and restart SpamFilter will resolve your problem by resetting the statistical information.
===========================

But from your post I see you already cleared the corpus database, so if that is correct, the solution will not apply to you.

Please note that the Corpus database is dependent on the type of emails you receive. From your stats the word "you" has a high spam score, and that is actually correct, since 30 spam email were received containing that word, and not a single clean email arrived with "you" in it. If however false positives have arrived, meaning a "good" email was blocked, if you force the delivery of such emails, they will be reprocessed by SpamFilter, and all the tokens will be re-evaluated, inverting their score, and applying "extra weight" to them to help minimize the problem in the future. For example, if a false positive had the word "you" in it, and you forced its delivery, the spam score assigned to it would be changed by quite a bit, and would not be 0.9999 anymore.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
lead View Drop Down
Newbie
Newbie
Avatar

Joined: 08 March 2005
Status: Offline
Points: 18 		Post Options Post Options   Thanks (0) Thanks(0)   Quote lead Quote  Post ReplyReply Direct Link To This Post Posted: 18 November 2005 at 8:01am
Roberto,

thanks for that.

I am pretty sure that the spam score for words like "you" are not been updated when a false positive has been processed. The good score remains at 0.

Just to be sure I increase the time when the bayes filter kicks in by doubling the required number of emails.

However when the bayes filter kicks in, it still blocks email with 100% stats.

I have sent email with the the simple words in them like "you" which were blocked, I forced the delivery and checked the good token, which remained at 0.

extract from bayes prob util:
11/18/05 12:41:48:160 --      you    0    30    0.9999

by your discription this should not be at 0.9999. Any ideas?

Also does any of the whitelists have any effect on the bayes learning?
I can't be sure, but I feel it does not learn emails which have been forwarded by a whitelist. Therefore their content does not update the good scores.

Regards




Edited by lead
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.209 seconds.

Copyright (c)2002-2021 LogSat Software LLC - Sales: sales@LogSat.com
Contact Us