You have enabled the Advanced Antispam Filter (BitDefender) with the Filter Contribution to normal (5) and also enabled the Bayesian Filter (Spam Assasin) with every incoming email checked. You want to know if these settings are acceptable and how to decide if the Bayesian filter (Spam Assassin) has learned enough.
The SpamAssassin filter is based on an open-source library provided by Apache. It uses a robust scoring framework and plug-ins to integrate a wide range of advanced heuristic and statistical analysis tests on email headers and body text including text analysis, Bayesian filtering, DNS blocklists, and collaborative filtering databases.
Kerio Connect requires that you have at least one spam filter on at all times. If you do not have the Advanced Antispam filter (Bitdefender) licensed, the SpamAssassin filter is always enabled. If you do have it licensed, you can choose to have only one of the two enabled or both. If you disable the Spam Assassin filter, then you can increase the contribution from the Bitdefender filter.
Most customers usually leave both filters enabled.
The contribution of the Bitdefender filter, it depends on the effectiveness of your Spam Assassin filter. If it has "learned" a lot of messages and you feel that it is generally accurate on adding/removing score (see the Additional Information section below for how to get this data), then you don't need the Bitdefender filter to contribute so much.
On the other hand, if the Bayesian filter has not learned enough or you do not feel it is accurate in adding/removing score, you can increase the contribution of the Bitdefender filter as it uses much more complex calculations.
If this filter is enabled, recipients on your server can train the Bayes database to recognize messages as spam or ham. The filter breaks messages into small pieces called tokens and determines which tokens occur mostly in spam messages, and which tokens occur mostly in ham messages.
The Bayes database must learn a lot of emails before it can function effectively. In general, the Bayes database begins to work after it has learned at least 200 spams and 200 hams. End-users must train the Bayes database enough to effectively fight mutating spam.
Since it usually only adds a few points to the score, together with the Bitdefender filter and Blocklists set to add score rather than block emails, these few points of score can be enough to tag/block emails (depending on your current score settings). Depending on how the filter was 'trained', it might add these points to real spam messages, or it might add them to legitimate/ham messages. Because of this unpredictability, we suggest disabling the Spam Assassin filter if you feel like it adds score to more legitimate/ham messages than spam messages.
You can check how much score it is adding by inspecting the headers of the ham messages you're receiving and the spam messages (requires that you create a quarantine address) and then make a decision.
How to find out if the Bayesian filter (Spam Assassin) has learned enough?
You can check the calculation done by the Bayesian filter (Spam Assassin) by enabling the Debug log with "SpamAssassin Processing". You can also check the score added by it on oncoming emails by checking their headers (everything that shows up on the tests that is not the KERIO_ANTI_SPAM):
The Bayesian filter uses autolearning to figure out what could be spam and ham (not spam). Kerio Connect's implementation of the filter doesn't have any manual controls to finetune its settings. Since the type of messages received by each server can wildly vary, the filter can prove to be more beneficial to some customers than to others. Generally, the filter doesn't add much score by itself. It is best to use it as an extra measure instead of the only measure.
Bayesian self-learning in Kerio Connect