Ah yes, I think you're correct. So then it should be: HABEAS habeas x x -10 0
Bill ----- Original Message ----- From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, January 14, 2004 4:22 PM Subject: RE: [Declude.JunkMail] Habeas log entry > I thought Scott had it configured that if the Habeas headers were found, it > was considered a "fail" and therefore the negative weight should be the > first weight parameter, not the second. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Bill Landry > > Sent: Wednesday, January 14, 2004 4:15 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.JunkMail] Habeus log entry > > > > ----- Original Message ----- > > From: "Tandem Group" <[EMAIL PROTECTED]> > > > > > > > I am not entirely sure what the log entries mean for Habeas. I have > > changed > > > from the whitlisting to a standard test as follows: > > > > > > HABEAS habeas x x 0 10 > > > > > > What I get is a log entry like this: > > > > > > nHABEAS:10 > > > > > > It was intended to reduce the total if a Habeus warrant mark was > > detected, > > > whether a legitimate one or not, but when I add up all scores, like > > this: > > > > > > SNIF-FINANC:16 nHABEAS:10 NOLEGITCONTENT:2 SPAMHEADERS:12 . Total > > weight > > = > > > 40 > > > > > > there has been no reduction, but rather an increase. > > > > > > What gives? > > > > Try: HABEAS habeas x x 0 -10 (add the minus "-" sign) if you want a > > weight > > reduction. > > > > Bill > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > .com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
