Bayes_99 result different on 2 accounts.

nosajix

• May 10, 2019 14:58

I have a problem with the Bayes_99 rule catching email on one cpanel account but not another. Its an inconspicuous email and I am not sure why it would trigger this rule to begin with. The content is as follows: ___________________start msg Someone left a negative review on Facebook how about you. I'm not sure how you want me to address it. His name is [name omitted], A fireman I think. Jason __________________end of msg I send this to two different cpanel accounts on this server and one triggers the bayes_99 while the other does not. The only real difference between the two accounts is one (the one that throws the flag) is not checked often and is normally just set up to forward to a yahoo account and keep a record of messages. The other is treated normally and doesn't even register a bayes score. Any idea or suggestions what might be happening here?

• 

  cPanelLauren

  • May 10, 2019 20:04

  Hi @nosajix I wonder if there isn't an issue with the bayes db on that account - you might try the troubleshooting steps here: BayesNotWorking - Spamassassin Wiki Their bayes faq is really useful/helpful as well and might get you pointed more in the right direction: BayesFaq - Spamassassin Wiki

  0
• 

  nosajix

  • May 10, 2019 20:06

  Hi @nosajix I wonder if there isn't an issue with the bayes db on that account - you might try the troubleshooting steps here: BayesFaq - Spamassassin Wiki

  
  Would this be different per cpanel account?

  0
• 

  nosajix

  • May 10, 2019 20:09

  Another odd tidbit - it may not be content related as I tested it where the original sender was a gmail account and it did not trigger it. The emails that did trigger it are cpanel emails from another server... I am going to continue to work on this

  0
• 

  cPanelLauren

  • May 10, 2019 20:11

  Interesting, do you happen to also have gmail whitelisted anywhere?

  0
• 

  cPanelLauren

  • May 10, 2019 20:13

  Would this be different per cpanel account?

  
  Yea bayes data is in /home/$user/.spamassassin/

  0
• 

  nosajix

  • May 10, 2019 20:19

  Interesting, do you happen to also have gmail whitelisted anywhere?

  
  No

  0
• 

  cPanelLauren

  • May 10, 2019 20:23

  I can't think of a reason that rule wouldn't get hit if the mail content is the same but just originating from a different provider - spam headers might be helpful in this case as well.

  0
• 

  nosajix

  • May 10, 2019 20:40

  Can you copy the headers and let me delete them? I feel a bit exposed having that data "out there"

  0
• 

  cPanelLauren

  • May 10, 2019 20:52

  So my assumption after seeing these is that because gmail is a more trusted provider it's bayes weight is lighter than the other domain so it's hitting the lower bayesian score

  0
• 

  nosajix

  • May 10, 2019 20:57

  ok - so its not the message content but rather the sender domain? strange. I manage both servers, the sending is not a bad actor. I still havent read up on the bayes documentation. guess I'll look there.

  0
• 

  cPanelLauren

  • May 10, 2019 21:00

  It's not necessarily that it's a bad actor but that the reputation isn't as strong. You can teach bayes not to do this though, the bayes FAQ i sent should explain how to do this properly using sa-learn.

  0
• 

  nosajix

  • May 11, 2019 02:10

  It's not necessarily that it's a bad actor but that the reputation isn't as strong. You can teach bayes not to do this though, the bayes FAQ i sent should explain how to do this properly using sa-learn.

  
  So - interesting development, it seems according to docs here:

  0
• 

  cPanelLauren

  • May 13, 2019 15:51

  That being said, it was removed just yesterday - does cpanel cache dnsbl's? could that be happening here?

  
  I believe this is more related to the bayesian database each account has. Keep in mind bayesian filters are subject to that users email history and what the system shows them routinely marking as spam - the weight of the bayes_99 rule is determined by this.

  It still doesn't explain why two accounts on this server react differently to the same sender and body though.

  
  That's really easily explained, they are weighted differently. From the link you posted: [QUOTE]If the user receives the same message via a new unlisted relay, the Bayesian algorithm will assign a high score to it based on previous experience.
  [QUOTE]Conversely, if a user receives a regular newsletter from a fitness club, and one issue makes reference to diet pills and weight loss (which would normally flag the message as spam), the Bayesian algorithm will assign a lower score to it.
  This rule just marks the spam probability based on key words and the user's history.

  Also it seems as though sa-learn is not installed? Installation notes say its included with Spamassassin?

  
  It should be there but you just may have to call it from the full path like so: /usr/local/cpanel/3rdparty/bin/sa-learn
  

  0
• 

  nosajix

  • September 26, 2019 17:34

  This is an issue still. Bayes_99 is scoring 5 points and I still haven't ben able to fix it. Can you offer any assistance?

  0
• 

  cPanelLauren

  • September 30, 2019 16:17

  If the details discussed in this thread previously are not providing assistance, then I'd suggest opening a support ticket at this juncture.

  0

Please sign in to leave a comment.