[Rspamd-Users] strange behavior symbol BAYES_SPAM random

[Fabrice Grelaud]

Hi list, 

i got a strange behavior on my rspamd server (1.7.3-1~stretch) 

Sometimes i got symbol BAYES_SPAM and sometimes not. 

An exemple with rspamc on mail learned as spam: 

# rspamc spam-easyjet 
Results for file: spam-easyjet (0.075 seconds) 
[Metric: default] 
Action: add header 
Spam: true 
Score: 7.00 / 15.00 
Symbol: ARC_NA (0.00) 
Symbol: BAYES_SPAM (4.00)[100.00%] 
Symbol: DMARC_NA (0.00)[u-bordeaux.fr] 
Symbol: FROM_EQ_ENVFROM (0.00) 
Symbol: FROM_HAS_DN (0.00) 
Symbol: HAS_XOIP (0.00) 
Symbol: MID_RHS_MATCH_FROM (0.00) 
Symbol: MIME_GOOD (-0.10)[multipart/alternative, text/plain] 
Symbol: NEURAL_HAM (-0.00)[-0.166, 0] 
Symbol: PREVIOUSLY_DELIVERED (0.00)[fabrice.grelaud at u-bordeaux.fr] 
Symbol: RCPT_COUNT_ONE (0.00)[1] 
Symbol: RCVD_COUNT_SEVEN (0.00)[9] 
Symbol: RCVD_NO_TLS_LAST (0.00) 
Symbol: R_DKIM_NA (0.00) 
Symbol: TO_DN_ALL (0.00) 
Symbol: TO_DOM_EQ_FROM_DOM (0.00) 
Message-ID: 1721819489.1223194.1557733787464.JavaMail.zimbra at u-bordeaux.fr 
Message - smtp_message: Forced add header due to BAYES_SPAM probability 

I use rspamd.local.lua script to force add_header if spam probability is > 98% 

In log, i got: 
rspamd[121408]: <51025e>; csession; rspamd_task_write_log: id: <1721819489.1223194.1557733787464.JavaMail.zimbra at u-bordeaux.fr>, from: <anne.vialard at u-bordeaux.fr>, (default: F (add header): [7.00/15.00] [BAYES_SPAM(4.00){100.00%;},MIME_GOOD(-0.10){multipart/alternative;text/plain;},ARC_NA(0.00){},DMARC_NA(0.00){u-bordeaux.fr;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},HAS_XOIP(0.00){},MID_RHS_MATCH_FROM(0.00){},NEURAL_HAM(-0.00){-0.166;0;},PREVIOUSLY_DELIVERED(0.00){fabrice.grelaud at u-bordeaux.fr;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_SEVEN(0.00){9;},RCVD_NO_TLS_LAST(0.00){},R_DKIM_NA(0.00){},TO_DN_ALL(0.00){},TO_DOM_EQ_FROM_DOM(0.00){}]), len: 73408, time: 78.194ms real, 8.994ms virtual, dns req: 18, digest: <3dd7cb1a627435d878f08d9396a0e86e>, mime_rcpt: <fabrice.grelaud at u-bordeaux.fr>, file: spam-easyjet 

I reload it: 
# rspamc spam-easyjet 
Results for file: spam-easyjet (0.041 seconds) 
[Metric: default] 
Action: no action 
Spam: false 
Score: -0.10 / 15.00 
Symbol: ARC_NA (0.00) 
Symbol: DMARC_NA (0.00)[u-bordeaux.fr] 
Symbol: FROM_EQ_ENVFROM (0.00) 
Symbol: FROM_HAS_DN (0.00) 
Symbol: HAS_XOIP (0.00) 
Symbol: MID_RHS_MATCH_FROM (0.00) 
Symbol: MIME_GOOD (-0.10)[multipart/alternative, text/plain] 
Symbol: NEURAL_HAM (-0.00)[-0.167, 0] 
Symbol: PREVIOUSLY_DELIVERED (0.00)[fabrice.grelaud at u-bordeaux.fr] 
Symbol: RCPT_COUNT_ONE (0.00)[1] 
Symbol: RCVD_COUNT_SEVEN (0.00)[9] 
Symbol: RCVD_NO_TLS_LAST (0.00) 
Symbol: R_DKIM_NA (0.00) 
Symbol: TO_DN_ALL (0.00) 
Symbol: TO_DOM_EQ_FROM_DOM (0.00) 
Message-ID: [ mailto:1721819489.1223194.1557733787464.JavaMail.zimbra at u-bordeaux.fr | 1721819489.1223194.1557733787464.JavaMail.zimbra at u-bordeaux.fr ] 

rspamd[121408]: <a6f109>; csession; rspamd_task_write_log: id: <1721819489.1223194.1557733787464.JavaMail.zimbra at u-bordeaux.fr>, from: <anne.vialard at u-bordeaux.fr>, (default: F (no action): [-0.10/15.00] [MIME_GOOD(-0.10){multipart/alternative;text/plain;},ARC_NA(0.00){},DMARC_NA(0.00){u-bordeaux.fr;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},HAS_XOIP(0.00){},MID_RHS_MATCH_FROM(0.00){},NEURAL_HAM(-0.00){-0.167;0;},PREVIOUSLY_DELIVERED(0.00){fabrice.grelaud at u-bordeaux.fr;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_SEVEN(0.00){9;},RCVD_NO_TLS_LAST(0.00){},R_DKIM_NA(0.00){},TO_DN_ALL(0.00){},TO_DOM_EQ_FROM_DOM(0.00){}]), len: 73408, time: 43.601ms real, 8.316ms virtual, dns req: 18, digest: <3dd7cb1a627435d878f08d9396a0e86e>, mime_rcpt: <fabrice.grelaud at u-bordeaux.fr>, file: spam-easyjet 

Any idea, why such behavior ? 

Regards, 


[ mailto:fabrice.grelaud at u-bordeaux.fr | Fabrice GRELAUD ] 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2063 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.rspamd.com/pipermail/users/attachments/20190513/f91e066b/attachment.bin>