[Rspamd-Users] learn_spam seems not to

[Randy Bush]

i spent some decades in the ietf, so am used to dealing with
pontificators

> Are you using per user bayes/classifier or are you using default
> (global bayes for all users),

default, as the MXen process inbound for O(100) users, none local

> and more importantly, if you simply run `rspamc newspam/99` for
> example, do you see the actual bayes_spam/ham revealed there?

# rspamc newspam/1 
Results for file: newspam/1 (0.592 seconds)
[Metric: default]
Action: no action
Spam: false
Score: -10.10 / 15.00
Symbol: ASN (0.00)[asn:3130, ipnet:147.28.0.0/23, country:EE]
Symbol: DKIM_TRACE (0.00)[pawbiotix.sa.com:-]
Symbol: FROM_HAS_DN (0.00)
Symbol: FROM_NEQ_ENVFROM (0.00)[dinner_change at pawbiotix.sa.com, 2352-5109-12744-406-noc=rg.net at mail.pawbiotix.sa.com]
Symbol: MIME_GOOD (-0.10)[multipart/alternative, text/plain]
Symbol: MIME_TRACE (0.00)[0:+, 1:+, 2:~]
Symbol: R_DKIM_REJECT (1.00)[pawbiotix.sa.com:s=k1]
Symbol: R_SPF_FAIL (1.00)[-all]
Symbol: WHITELIST_IP (-12.00)[147.28.0.30]
Message-ID: l3u6iprwd0tkxu9o-z3pdvwzviy49kl85-31c8 at pawbiotix.sa.com
Urls: ["pawbiotix.sa.com"]
Emails: []
Message - smtp_message: Matched map: WHITELIST_IP

aha!!!  bingo!  thank you!

147.28.0.30 is in the /24 for the LAN on which the rspemd/MX host is
sitting.  and that really has to be white-listed as there are multiple
mail sources on it.

i can not see an rspamc option to ignore multi.  look for options

-p did not help (and --pass was not recognised!)
-i 192.168.0.1 worked!  :)

> And do you have enough learns already (minimum is 200 by default),
> rspamd logs will tell you if you're below, when email comes in.

uh, these systems are not large, but do process a few thousand inbound a
day

> Could you post your statistic.conf, classifier-bayes.conf (if it
> exists) and bayes_expiry.conf configs?

https://archive.psg.com/statistic.conf
https://archive.psg.com/classifier-bayes.conf  (the one in local.d)

# find / -name bayes_expiry.conf
#

thanks for the clue!!!

randy