| From: jm at jmason.org (Justin Mason)
| Date: Tue, 17 Apr 2007 09:45:27 +0100
| Brian Foster writes:
| > I have just revamped my spam-filtering techniques
| > to include the usage of SpamAssassin (v3.1.8).
| > the Bayesian filter was trained with c.40,000 of
| > the spams I've received, and with c.20,000 hams;
| > both the hams and spams cover the last c.5 years.
| > the training was done in `--local' mode (i.e., no
| > internet access).
| Wow, that's quite a lot! I'd suggest that it'd be fine
| (and faster) with just the most recent 1000 or so.
well, the learning is all done now. yer right, the learning
did take a long long time. (so what? seti at home is the only
user overnight: the learning time wasn't an issue.)
the spam/ham-checking of incoming e-mail seems quite fast,
both when `--local' or when not-`--local' with a down net;
I haven't (yet) tried in my nominal net-up situation.
so unless yer telling me the checking will be more accurate
with a smaller Bayesian sample, I'll continue to use what I
| >[ ... ] (possibly relevant here, spamd(1) is
| > currently being run `--local' (this could, perhaps,
| > be changed?).)
| Yep, definitely change this -- unfortunately spam has evolved to really
| require it. Allowing network lookups will have a much greater
| effect on accuracy than training will.
changed (but as of when I write this, not yet tested with
an accessible (up) network). thanks for the hint!
|[ ... ]
| --no-sync will write changes to a journal; you do, then, need
| to run --sync later to synchronise the journal to the DB.
| If you don't run --sync, the changes will not be reflected
| in your scan results.
ah. Ok, now I (mostly) grok. but two follow-ups:
1st, is the journal written to only by `sa-learn',
or does (e.g.) the `spamd' autolearning also
write to the journal?
2nd, is `--sync' the only way of synchronising?
perhaps I can teach my fingers to do an `sa-learn --sync'
after a mail-reading session; or perhaps a daily(?) cron
job in the middle of night or something ...... ?
| > and b.t.w., how safe is it to interrupt (^C) or
| > suspend (^Z) an überlong `sa-learn --spam'?
| Both are safe -- just don't "kill -9" [ ... ]
I *never* `kill -9' except as a next-to-last resort
(the last resort being a reboot). I usually try
`kill -TERM' (`kill -15') first, and if that does
not do it, then try various other things (depending
on circumstances) before those last-resorts.
again, many thanks for the help & advice.
Experienced (>25 yrs) kernel/software Eng: | Brian Foster Montpellier,
• Unix, embedded, &tc; • Linux; • doc; | blf at utvinternet.ie FRANCE
• IDL, automated testing, process, &tc. | Stop E$$o (ExxonMobile)!
Résumé (CV) http://www.blf.utvinternet.ie | http://www.stopesso.com
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!