Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Bayesian-Keyword-Attachment Issue
  FAQ FAQ  Forum Search   Register Register  Login Login

Bayesian-Keyword-Attachment Issue

 Post Reply Post Reply
Author
Chuck Bell View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Chuck Bell Quote  Post ReplyReply Direct Link To This Post Topic: Bayesian-Keyword-Attachment Issue
    Posted: 10 March 2004 at 5:44am

I have a few questions/problems regarding the use of the Bayesian filter. I noticed (and it has been mentioned before in another thread somewhere) that in order to use the Bayseian filter, you must NOT be blocking any keywords. Now, when I remove the keyword blocking to activate the bayesian filter, the attachment filtering stops as well....bad...bad news, unless I am missing something here.

To me this is not appropriate at all. Even with the bayesian filter, I still see hundreds of spam messages sneak through the filter, and by keeping the keword filter in place it would help to minimize this, as many a spam are caught this way. The attachment filter should be selectable in it's own right, especially with all the latest worms/viruses that have been leashed upon us, it should not be tied into the keyword filter.

I am running the latest version 2.0.1.302 registered. For the most part, spamfilter does a great job, as we get up to 10,000 emails per day. However, because of this bug/limitation, I am unwilling/unable to use the Bayesian filtering mainly because of the attachment issue.

Is there some way to fix this? or is it coming in another release? I would have hoped when I had to pay for another upgrade, that this would be fixed, but it was not. Any insight into this problem would be appreciated.

Thanks,

 

Chuck

 

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 10 March 2004 at 8:26am

Where did you see that you "Must not" block keywords?  I believe you may have misundersood something there.

Regards,

Dan S.

Back to Top
Andy View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Andy Quote  Post ReplyReply Direct Link To This Post Posted: 10 March 2004 at 9:16am

I was the one that had that problem because I was NOT using any keywords. Gotta have keywords to make the attachments work. This will be fixed in the future according to LogSat.

Regards,
Andy

Back to Top
Chuck Bell View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Chuck Bell Quote  Post ReplyReply Direct Link To This Post Posted: 10 March 2004 at 2:10pm

To Dan,

Yes...that was my my main concern. Having to have keywords in place to use the attachment feature, but to use the Bayesian feature, you have to remove all the keywords for that to work, which breaks the attachment scanning feature. Is that something that will be resolved in the future? or was that by design?

In otherwords, you can't utilize all three methods at once, since the rely upon the different states of the keyword filter either using keywords or not using keywords. I would like to be able to use all three, since that would be the most effective approach in my case.

Chuck

 

 

Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143
Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 10 March 2004 at 4:31pm

Chuck,

 

As Andy stated, you MUST use Keywords.  So I do not  think you have an issue because the attchment blocking will work fine.

 

Dan

 

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 10 March 2004 at 11:06pm

Chuck,

That is actually incorrect. If you can please point to us where you saw that comment we'd like to reply to it with the correction.

You most definetly want to keep your keyword blacklist in place. Any filtering that you have that stops spam should be left as is, this way the Bayesian filter will learn the true picture of your spam.

Roberto F.
LogSat Software

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 10 March 2004 at 11:10pm

Chuck,

As Andy and Dan explained, build 302 has a bug that is opposite the symptom you described. If you do not have at least one keyword in the keyword blacklist, the bayesian filter will not kick in. We have a patched build with the fix ready and are testing it internally to ensure all is well before releasing it. If you wish to test it before we release it officially, please emails us at support@logsat.com and we'll be glad to provide it to you.

Roberto F.
LogSat Software

Back to Top
Chuck View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Chuck Quote  Post ReplyReply Direct Link To This Post Posted: 11 March 2004 at 5:48am

Hi Roberto & Gang,

 

Ok...I understand what has been said about the keyword situation. Now, with keywords is place, all e-mails that pass all other filters are assigned (is that the right word) a value of 0% for spam. If I remove the keywords, then the Bayesian filter kicks in, and begins to report values such as 47% (example) spam etc. It depends on the email.

While I did this, I noticed at the same time, that spamfilter was not blocking anymore attachments...it was forwarding them straight through. The only way I caught this was two fold. One, I normally see up to hundreds of blocked attachments per day. But when I removed the keywords...this went to zero. Then, my anti-virus on my main e-mail server began catching the infected emails that are normally blocked by the attachment filter.

When I re-inserted the keywords back into SpamFilter, the Bayesian Filter then reports 0% spam on e-mails that had cleared all other filters, and the main e-mail server suddenly was virus-free again. On my install, the Bayesian only works if there are no keywords listed in the blacklist.

I am not sure what's going on, but that's what has been happening on my installation. The only other problems I have encountered are occasional CPU hits at 100%....usually when I attempt to force delivery of mail that I know is not spam to my users. And occasionally SpamFilter crashes...just disappears completely. In this case, All I do is restart the service. There again, it's associated with deleting and delivering quarantined e-mails. Also, I noticed that if I don't run SpamFilter as a service the crashing problem is much less servere, as well as the CPU hits are much less likely to occur.

I run the SpamFilter on Windows 2000 Advanced Server, 1GB Ram on a IBM Netfinity 5000 dual PIII. MDAC ver 2.8 using the Microsoft Access driver.

Roberto...I would be interested in testing that for you....maybe it could help in my situation...thanks. You can e-mail the info to me.

I'll try to duplicate the scenario, at least the logs show the bayesian problem, and is easy to re-create if you need them...just let me know if you need them.

Chuck

 

 

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 11 March 2004 at 11:53pm

Chuck,

Thanks for the report. You indeed found a bug that caused the attachment filter not to work unless there were keywords present. This and another couple of issues have been fixed in a pre-release build that we've made available. To download it simply login in your registered user download area.

A release-notes list is at http://logsat.com/sfi-release-notes-and-bug-fixes.asp. Please let us know if there are more issues.

Roberto F.
LogSat Software

Back to Top
Chuck View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Chuck Quote  Post ReplyReply Direct Link To This Post Posted: 12 March 2004 at 2:42am

Roberto,

Just a heads-up,

I downoaded and installed this new patched version. With the limited testing I have down, all indications appear that the Bayesian filter is now not working at all. Before, if I removed all my kewords, the filter kicked in immedialtely. Now, either way, I don't see the Bayesian filter working at all. In both cases the messages that pass all the the other filter rules, are being reproted as 0% spam.

I have not determined with certainty that the attachment blocking is working or not with the keywords removed. This I plan to do in the morning.

For now, I re-inserted my kewords list and will try again tomorrow when the traffic is much higher.

Was there anything special that I needed to do? All I did was copy and replace the executables within the spamfilter directory. I did stop spamfilter first, and then re-started it after replacing the exe's. Is this okay?

 

Chuck

 

Back to Top
Chuck View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Chuck Quote  Post ReplyReply Direct Link To This Post Posted: 13 March 2004 at 10:01pm

Roberto,

We have been running the new patch, and as far as we can tell, it has broken the Bayesian filtering altogether.Either with or without keywords, spamfilter consistantly reports all email that passed through all the other filters as 0% spam. We could not determine for sure if the attachment blocking was affected at all. We are unwilling to let spamfilter run for very long without the attachment filtering in place as we are still receiveing a high number of viruses each day.

We have since re-inserted our keywords and will continue to run in this mode until we hear back from you regarding this patched version. Is there anything specific we were supossed to do to enable this? How is the Bayesian Filter/Attachment Filter/Keyword filter all tied together?

Thanks for all your hard work,

 

Chuck

 

 

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4066
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 14 March 2004 at 11:13am

Chuck,

Please note that the Bayesian filter is used only if all other tests fail to catch spam. If your regular keywords are very effective, the bayesian analysis will only catch the few emails that are missed by the keyword filter. If you remove the keyword filter and others, then yes, the Bayesian filter will be doing a lot of work.

The upgraded procedure is that simple. Stop SpamFilter, replace the exe's, then restart. That's it.

Roberto F.
LogSat Software

Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.094 seconds.