[dspam-users] Re: My consideration to switch to DSPAM (postfix+maildrop)

Hallo Andreas,

Andreas Neuhaus schrieb:
>> Btw: Why do you want to get rid of amavisd? amavisd or amavisd-new?

> Curently we're running amavisd-new, which does a pretty good job on detecting
> spam. Yesterday I disabled amavis processing for my personal account and was
> surprised how fast my mailbox filled up with junk. I'm now trying to use
> dspam (just for my personal account atm) because as far as I heard/read,
> dspam scales better (I never liked how much memory and cpu amavisd is using
> with all that perl stuff).

Regarding the spam detection from amavisd-new: As this is basically
SpamAssassin, you could get probably a better filtering with DSPAM (at
least I could).

I was surprised that you don't want amavisd anymore because it has
more to offer than only spam scanning - detecting viruses for example.

> Unfortunately I probably did something wrong, because I don't get a useful
> accuracy rate with dspam. Current accuracy is at 5.68%, which is not really
> useful. I started with basic settings (TrainingMode teft,
> TestConditionalTraining on, Feature chained,tb=5,whitelist, Algorithm graham
> burton, PValue graham, ProcessorBias on). Starting with empty tables, I
> showed dspam 1250 hams and 1250 spams from my IMAP folders by using
> dspam_corpus (which calls dspam with --class=innocent|spam --source=corpus
> --user andy --mode=teft --feature=chained,noise). The resulting dspam_stats:
> andy TP: 0 TN: 0 FP: 0 FN: 0 SC: 1250 IC: 1250

Although I used ca. 7000 mails in the beginning to get a accuracy
comparable to SpamAssassin, I think 2500 mails should be okay, too.

> Could this be? What did I do wrong?

Did you look into the system.log (on my system in
/usr/local/var/dspam)?
Unfortunately, I can not give any further advice as I used a custom
trainer script which called DSPAM directly without the corpus option
(processing a mail and retraining it if it was misclassified,
alternating spam/ham).

> I'm still confused how groups work. I did read the README about 6 times now,
> and I'm still confused.

I find it confusing, too. The README could be improved explaining the
options better.

> From what I can tell (please correct me, if I'm
> wrong): (...)

I think your description is correct but I configured DSPAM some months
ago so do not rely on my memory :-)

-- 
Felix