[Rspamd-Users] False positive and learn ham

[Tim Harman]

On 02/12/2018 9:28 pm, Tobias Kirchhofer wrote:

> If we move a false positive from the spam folder to eq. inbox rspamd indicates in the log that it learend the mail as ham:
> 
> ```bash
> 2018-12-02 09:21:46 #743(controller) rspamd_log_reopen_priv: log file reopened
> 2018-12-02 09:21:46 #743(controller) <221190>; csession; bayes_classify: skip classification as spam class has not enough learns: 4, 200 required
> 2018-12-02 09:21:46 #743(controller) <221190>; csession; rspamd_controller_learn_fin_task: <127.0.0.1> learned message as ham: 0000BBE2.5BFBAA15 at 192.168.1.100
> ```

"2018-12-02 09:21:46 #743(controller) <221190>; csession;
bayes_classify: skip 
classification as spam class has not enough learns: 4, 200 required" 

rspamd isn't using bayes yet to do any classification - you haven't
trained it enough.  Once you've trained it fully, 
you will find it gives it a -3 score for full ham message, or a +5.1 for
a full spam message. 
You need to show us what flags are being triggered to consider the
message spam.  Are you using SPF, DKIM, DMARC? 
Have you added your mailserver to the dnswl.org whitelist? 

Anyway, this doesn't sound like a problem with rspamd.  You just haven't
trained it enough yet so it's not making 
bayes decisions and you're doing something else with your newsletter
that's causing it to be flagged up as spam. 
You need to look at what rules are triggering to add up it up over the
spam threshold and see what you can do to do 
reduce those hits. 

Tim