Copying mail from multiple servers IMAP Junk E-mail folders

[Grundignz]

I have got a few installs of hmailserver with SpamAssassin in a Box at different locations. These are only very small install with 10 users on each.
I have be getting hit really hard with spam lately i have SpamAssassin multiple RBL blacklists and Greylisting ETC
IE
Server up since 2016-09-12 15:38:35
Processed messages 2409
Spam messages 6071

But i am still having spam get through!!

I am not a programmer i understand code but aren't the best at writing(always learning though)
Almost all my users are using IMAP connections to outlook 2010.
I want to be able to copy the contents of their Junk E-mail folder to a folder on each server.
Then i can sync all the folders together and run sa-learn

Any help will be appreciated

Thanks
David

[jimimaseye]

That's of spam.

Have you tried lowing your thresholds? No genuine email exceeds score 3. Mine is set as such and have RARE emails making it through. My full scoring so is here viewtopic.php?f=21&t=28133

As for your request to copy it's easier to do it external to hms. Simply set a windows ROBOCOPY /MONITOR job on each of the spam folders to copy across to your centralised sa-learn folder. Don't forget you need HAM messages too for bayes to be effective.

[Grundignz]

Have you tried lowing your thresholds? No genuine email exceeds score 3. Mine is set as such and have RARE emails making it through. My full scoring so is here viewtopic.php?f=21&t=28133

I have spent ages changing the settings up and down the problem if i go any higher i start killing valid email

As for your request to copy it's easier to do it external to hms. Simply set a windows ROBOCOPY /MONITOR job on each of the spam folders to copy across to your centralised sa-learn folder. Don't forget you need HAM messages too for bayes to be effective.

I didn't think that was possible when i look in the domain email account i just see folders 00 0A 0B etc

[Grundignz]

Here is an example of email coming in that is spam but being delivered

"SMTPD" 2024 20100 "2016-09-22 04:00:20.389" "31.203.30.240" "SENT: 220 Welcome mail2.******.co.nz"
"SMTPD" 2000 20100 "2016-09-22 04:00:24.577" "31.203.30.240" "RECEIVED: HELO seaircargo.net"
"SMTPD" 2000 20100 "2016-09-22 04:00:24.577" "31.203.30.240" "SENT: 250 Hello."
"SMTPD" 1992 20100 "2016-09-22 04:01:12.473" "31.203.30.240" "RECEIVED: MAIL FROM: <jferrer@seaircargo.net>"
"TCPIP" 1992 "2016-09-22 04:01:13.239" "DNS lookup: 240.30.203.31.zen.spamhaus.org, 0 addresses found: (none), Match: False"
"TCPIP" 1992 "2016-09-22 04:01:13.707" "DNS lookup: 240.30.203.31.bl.spamcop.net, 0 addresses found: (none), Match: False"
"TCPIP" 1992 "2016-09-22 04:01:14.161" "DNS lookup: 240.30.203.31.dnsbl-2.uceprotect.net, 0 addresses found: (none), Match: False"
"TCPIP" 1992 "2016-09-22 04:01:14.473" "DNS lookup: 240.30.203.31.2.0.0.127.b.barracudacentral.org, 0 addresses found: (none), Match: False"
"TCPIP" 1992 "2016-09-22 04:01:18.505" "DNS lookup: 240.30.203.31.spam.dnsbl.sorbs.net, 0 addresses found: (none), Match: False"
"TCPIP" 1992 "2016-09-22 04:01:18.864" "DNS lookup: 240.30.203.31.ix.dnsbl.manitu.net, 0 addresses found: (none), Match: False"
"TCPIP" 1992 "2016-09-22 04:01:28.396" "DNS lookup: 240.30.203.31.combined.njabl.org, 0 addresses found: (none), Match: False"
"TCPIP" 1992 "2016-09-22 04:01:28.740" "DNS lookup: 240.30.203.31.rbl.megarbl.net, 0 addresses found: (none), Match: False"
"DEBUG" 1992 "2016-09-22 04:01:28.740" "Spam test: SpamTestDNSBlackLists, Score: 0"
"DEBUG" 1992 "2016-09-22 04:01:28.772" "Spam test: SpamTestHeloHost, Score: 2"
"DEBUG" 1992 "2016-09-22 04:01:28.803" "Spam test: SpamTestMXRecords, Score: 0"
2024 "2016-09-22 04:03:44.489" "Adding task AsynchronousTask to work queue Asynchronous task queue"
"DEBUG" 1808 "2016-09-22 04:03:44.489" "Executing task AsynchronousTask in work queue Asynchronous task queue"
"DEBUG" 1808 "2016-09-22 04:03:44.489" "SURBL: Execute"
"DEBUG" 1808 "2016-09-22 04:03:44.489" "SURBL: Match not found"
"DEBUG" 1808 "2016-09-22 04:03:44.489" "SURBL: Execute"
"DEBUG" 1808 "2016-09-22 04:03:44.489" "SURBL: Match not found"
"DEBUG" 1808 "2016-09-22 04:03:44.489" "Spam test: SpamTestSURBL, Score: 0"
"DEBUG" 1808 "2016-09-22 04:03:44.489" "Spam test: SpamTestDKIM, Score: 0"
"DEBUG" 2024 "2016-09-22 04:03:44.489" "Sending message to SpamAssassin. Session 20112, File: C:\Program
Files\hMailServer\Data\{17EF07F3-9430-4DC6-8CFB-3FE3AD3AA6C5}.eml"
"DEBUG" 1808 "2016-09-22 04:03:53.662" "Spam test: SpamTestSpamAssassin, Score: 0"
"DEBUG" 1808 "2016-09-22 04:03:53.662" "Total spam score: 0"
"DEBUG" 1808 "2016-09-22 04:03:53.662" "Saving message: {17EF07F3-9430-4DC6-8CFB-3FE3AD3AA6C5}.eml"
"DEBUG" 1808 "2016-09-22 04:03:53.678" "Requesting SMTPDeliveryManager to start message delivery"
"SMTPD" 1808 20100 "2016-09-22 04:03:53.678" "31.203.30.240" "SENT: 250 Queued (81.920 seconds)"
"DEBUG" 1844 "2016-09-22 04:03:53.678" "Adding task DeliveryTask to work queue SMTP delivery queue"
"DEBUG" 1884 "2016-09-22 04:03:53.678" "Executing task DeliveryTask in work queue SMTP delivery queue"
"DEBUG" 1884 "2016-09-22 04:03:53.678" "Delivering message..."
"APPLICATION" 1884 "2016-09-22 04:03:53.678" "SMTPDeliverer - Message 329077: Delivering message from jferrer@seaircargo.net to david@******.co.nz. File: C:\Program
Files\hMailServer\Data\{17EF07F3-9430-4DC6-8CFB-3FE3AD3AA6C5}.eml"

[jimimaseye]

You're right. It was an early Sunday morning when I made my last answer and I simply wasn't thinking. Sorry about that. You are right, you need a script to extract the emails to a specific folder.

Remember that one man's definition of spam is not the definition to another man and often marketing emails will not be detected as spam. Many of these can be removed if you use the unsubscribe link often contained in these emails. I suspect that example you quoted in the log above is one of those emails and that is why it has scored 0.

[SorenR]

I have got a few installs of hmailserver with SpamAssassin in a Box at different locations. These are only very small install with 10 users on each.
I have be getting hit really hard with spam lately i have SpamAssassin multiple RBL blacklists and Greylisting ETC
IE
Server up since 2016-09-12 15:38:35
Processed messages 2409
Spam messages 6071

But i am still having spam get through!!

I am not a programmer i understand code but aren't the best at writing(always learning though)
Almost all my users are using IMAP connections to outlook 2010.
I want to be able to copy the contents of their Junk E-mail folder to a folder on each server.
Then i can sync all the folders together and run sa-learn

Any help will be appreciated

Thanks
David

This should get you started... Remember the key to a welltrained Bayes database is equal amounts of HAM and SPAM. Using SPAM only is very bad.

viewtopic.php?p=164777#p164777

[Grundignz]

I suspect that example you quoted in the log above is one of those emails and that is why it has scored 0.

That message was spam something about IRS owing money.
I'm in NZ we don't even have IRS here it is called IRD

David

[SorenR]

I download a fresh copy of KAM.cf when I update SpamAssassin...

https://www.pccc.com/downloads/SpamAssa ... rib/KAM.cf

sa-update.bat

Code: Select all

net stop spamassassin
sa-update.exe -v --nogpg --channelfile UpdateChannels.txt --refreshmirrors
wget -q http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf -O c:\spamassassin\etc\spamassassin\KAM.cf
net start spamassassin

[Grundignz]

Sorry i have tried to get my head around this(doesn't help its 2am) but i am scripting newbie

If somebody could help me with a script to do the following
copy contents of David@domain1 IMAP\spam folder to c:\sa\spam
copy contents of David@domain1 IMAP\ham folder to c:\sa\ham
copy contents of David@domain2 IMAP\spam folder to c:\sa\spam
copy contents of David@domain2 IMAP\ham folder to c:\sa\ham
copy contents of David@domain3 IMAP\spam folder to c:\sa\spam
copy contents of David@domain3 IMAP\ham folder to c:\sa\ham
copy contents of David@domain4 IMAP\spam folder to c:\sa\spam
copy contents of David@domain4 IMAP\ham folder to c:\sa\ham

I am pretty sure i can work out the rest just can't get my head around this for some reason.

Thanks
David

[jimimaseye]

See this: viewtopic.php?f=20&t=26866

You will find it very useful.