bogofilter, procmail, & training bogofilter

[Max Rible]

On Wed, 2003-04-09 at 21:36, Rodney D. Myers wrote:
> How do most people get bogofilter trained? cron? manual?

I use Ximian Evolution.  I've set up three of my labels to be
"Spam", "Not Spam", and "Send to SpamCop", and four filters,
"Send to Spamcop", "False Negative", "False Positive", and
"Spam".  I have a folder, "Spam", with a subfilter
"Bogofilter Training" (which I keep around in case I need
to blow away my bogofilter DB).

The first three filters are at the top of my filter chain,
before all the ones that kick various mailing lists into
various mailboxes.  The final filter is at the end of the
chain, after everything else has been processed.  (I'd set
things up differently if I ever got spam on my mailing lists.)

When spam turns up in my Inbox, I label it as such and hit
"Apply Filters".  This trains SpamCop to recognize that
message as spam and moves it into my Spam folder.  If,
for some odd reason, bogofilter ever got a false positive,
I could label it as "Not Spam" and do the same thing to
send it back to my inbox.  I then label *everything* in my
Spam folder as "Send to SpamCop", run "Apply Filters" on
the works, and they're all automatically sent, headers and
all, to SpamCop for analysis and reporting.

My filters are:

"False Negative":
[If all criteria are met:]
	[Label] [is] [Spam]
	[Pipe Message to Shell Command] [bogofilter -Ns]
		[returns less than [40]]
[Then]
	[Move to Folder] ["Spam" in "Local Folders"]
	[Stop Processing]

"False Positive":
[If all criteria are met:]
	[Label] [is] [Not Spam]
	[Pipe Message to Shell Command] [bogofilter -Ns]
		[returns less than [40]]
[Then]
	[Move to Folder] ["Inbox" in "Local Folders"]
	[Stop Processing]

"Spam":
[If any criteria are met:]
	[Pipe Message to Shell Command] 
	[bogofilter -u -vv >> ~/.spamcop.log] [returns] [0]
[Then]
	[Move to Folder] ["Spam" in "Local Folders"]
	[Stop Processing]

"Send to SpamCop":
[If all criteria are met:]
	[Label] [is] [Send to SpamCop]
	[Pipe Message to Shell Command] [forward.pl]
		[returns less than [40]]
[Then]
	[Move to Folder] ["Bogofilter Training" in "Local Folders"]
	[Stop Processing]

And forward.pl looks like this:
---
#!/usr/bin/perl

open(OUT, "|sendmail -fme\@mydomain submit.xxx\@spam.spamcop.net") ||
die "Couldn't open sendmail.";

print OUT "From: Me <me\@mydomain>\n";
print OUT "Subject: Spam report\n";
print OUT "\n";

while(<STDIN>) {
    print OUT $_;
}

close OUT;
---

By the way:  does anyone know of other spam analysis-and-reporting
services like SpamCop?  I don't use SpamCop's blacklist, since it has
a poor reputation for accuracy, but I like having an E-mail
analysis tool that will automatically warn the operators of
open relays and hosts of spammers.  (I maintained one myself
for a while but keeping track of the vagaries of lots of
different whois servers got tedious after a while, and I
decided it was worthwhile to just pay a few bucks and have
someone else do the scripting.)
-- 
%% Max Rible % slothman at amurgsval.org % www.amurgsval.org/~slothman/ %%
%% "Before enlightenment:  sharpen claws, catch mice.                %%
%%  After enlightenment:  sharpen claws, catch mice."                %%