Temperamental SpamSieve

Hi folks.

From time to time I get spams in my inbox. Upon right clicking them and applying rules, SS deletes them.

It is obvious that SS didn’t catch them on the way in. All the other spam emails get caught. These are seen as spam by SS, but they get through. How can I fix this? Any advice appreciated.

Cheers

Please check the log and see what, if anything, it says about those messages (before you apply the rules). Also see this page for why SpamSieve might not have seen the messages (and, thus, not generated log entries for them).

Hi there. Thanks for the info. I didn’t know I could look these up individually.

Yeah, probability of spam was 0.499, so it was approved. Then it added both the spoof email address and the real one to my whitelist.

I tried to apply rules to the single spam message I had (the one above), and nothing happened, so this didn’t qualify the tests I asked about before. So upon marking it as spam, it only took the spoof email over to my corpus. It didn’t take out either the spoof or real email address out of my whitelist.

Not really sure what to ask at this point.

Nice to know I can chase these down.

Cheers

It sounds like this is not what happened to the messages you initially mentioned. Those likely would not have gone to the Spam mailbox when you reapplied the rules if SpamSieve had first classified them as good.

This is normal for SpamSieve to do when it thinks a message is good.

The best thing to do if there is spam in your inbox is to train it as spam. If the log shows that there were no predictions for the messages then we could look into what’s causing that. Applying the rules to the same message twice can cause training problems.

SpamSieve doesn’t remove rules from the whitelist; it just disables them.

Hi there. Sorry for the delayed response.

Yes indeed, you are correct on this being considered a legitimate email. I’ve been training SS for many years now. I will go into the log to see what happened the next time this strange occurrence happens.

Cheers

OK, it just happened. Two emails just came in, and stayed “unread”. They are archived in a folder in one of my gmail accounts.

Predicted: Spam (96)
Subject: Upgrade Your PayPal Balance
From: kaun1@ploehj.com
Identifier: XP+/aJEbE2yoj6+0S/uIpg==
Reason: P(spam)=1.000[1.000], bias=0.000, R:^204^194^223(1.000), ^a-class-definitionparent(1.000), ^a-style-width33borderspacing0px(1.000), ^a-style-backgroundcolorffffffimportantcolor00000(1.000), ^a-style-width100maxwidth600pxborderspacing0pxbor(1.000), A:Subscriber(1.000), feedback-id:AWeber(1.000), ^a-class-paragraph(1.000), ^a-style-color00fimportant(1.000), ^a-style-color00fimportant(1.000), R:^204^194(1.000), U:HMycb(1.000), U:HMycb(1.000), x-subscription:66.41.215.245(1.000), U:VEAd(1.000)
Date: 2015-03-01 20:55:01 +0000

Predicted: Spam (96)
Subject: Re: Notification of Payment Received
From: mann3f@jnmehef.com
Identifier: O++zWwyUXVWkFJ2R/lk62g==
Reason: P(spam)=1.000[1.000], bias=0.000, R:^204^194^223(1.000), ^a-class-definitionparent(1.000), ^a-style-width33borderspacing0px(1.000), ^a-style-backgroundcolorffffffimportantcolor00000(1.000), ^a-style-width100maxwidth600pxborderspacing0pxbor(1.000), A:Subscriber(1.000), feedback-id:AWeber(1.000), ^a-class-paragraph(1.000), ^a-style-color00fimportant(1.000), ^a-style-color00fimportant(1.000), R:^204^194(1.000), U:HMycb(1.000), U:HMycb(1.000), x-subscription:66.41.215.245(1.000), x-subscription:25(1.000)
Date: 2015-03-01 20:55:01 +0000

It was marked as spam, but it didn’t follow the rule to be marked as read and put into the Spam folder. Upon applying rules (right click), they disappeared.

I’m not sure what you mean by that. Which folder? How did they get out of the inbox?

OK I thought that might be a little confusing. I have a rule to shove items into an Archive folder in GMail. Still 100% viewable and controllable in my Mail.app client though.

So the rule is in Apple Mail? Is this rule above or below the SpamSieve rule?

If above, I would expect the messages to bypass SpamSieve entirely, so there wouldn’t be any log entries. If below, I would expect the SpamSieve rule to move the messages and stop the rules before it gets to your other rule.

I had a look in my gmail and I couldn’t find it. It’s archived in my gmail folder.

I’ve had another in another gmail account with NO rules, do the same thing. In Mail.app, SS is the first rule.

Are you using any other Mail plug-ins besides SpamSieve?

Nope. Not a thing.

It sounds like Mail is malfunctioning, then. It might help to change your SpamSieve rule to use a server mailbox instead of one On My Mac.

OK, this is unclear.

Open Mail’s preferences and find the SpamSieve rule. Select the server mailbox that you want to use.

Not sure what that means. Here is my SS rule:

If any of the following:

  • Sender is not in my previous recipients

Perform the following:

Move to mailbox Spam
Set Color of background to Gray
Mark as Read
Stop evaluating rules

So there is no server or mailbox to select.

Actually, I think this is the problem. Your SpamSieve rule is not correct. I suggest deleting the “Set Color” and “Stop evaluating rules” actions. The former will cause problems, and the latter is redundant.

OK, will give it a try.

Why would either of those two directives change anything?

Yeah it’s still happening. Took those directives out and it’s still showing emails marked as spam, but not shown as being read.

Because Mail rules that have coloring actions go through a different code path and may not stop the application of subsequent rules. SpamSieve’s plug-in is not designed to work with this type of rule.

How are they shown as being spam? Do you mean with the different background colors?

Are the messages moved to the Spam mailbox?

No they showed up in a Smart folder for unread items. They didn’t have any colouring. When it happens again I will post.

So in what way were they “marked as spam”? Were they marked as junk by a server filter and not processed by SpamSieve at all?