> -----Original Message----- > From: Larry Gilson [mailto:[EMAIL PROTECTED] > Sent: Tuesday, August 26, 2003 10:08 AM > To: 'Chris Santerre'; 'Matt Kettler'; spamassassin_list > Subject: RE: [SAtalk] Custom Rules - spamd > > > > > > -----Original Message----- > > From: Chris Santerre > > > I'm not sure about performance loss. I have every rule (That isn't a > > duplicate) in the SA rule emporeum running now. Plus all the > > evil domains generated by reg2rule.pl, plus more custom ones I > > haven't put on the Emporeum yet. I say I have to be running 300+, > > closer to 400 rules for the entire company. But we conly get around > > 3500-4500 emails a week. NO network tests, no bayes. > > Why not use network tests or Bayes? By network tests do you > mean SMTP or SA > (blackhole) tests or both? Out of curiousity (if you care to > share this), > what is the average msg count per mailbox and your average > percentage of > spam to total? I am seeing about 200-250 > messages/mailbox/week and around > 35%-40% spam to total. > > > > I'll try to get a rule count and average time to check later today. > > That would be much appreciated! With that many rules I would > love to see > your numbers. > > > > On a side note, I'm still using 2.4x and about 70% of my > > points come from custom rules. Using the rules gathered from the > > emporeum + the ones generated from reg2rule.pl have boosted my > > average spam score from 9 to about 25!!! Custom rules rock! > > That helps me understand better why there has been such a > flurry of messages > about custom rules. Looks like I need to get off my duff in > this area. Why > are you still using 2.4x? > > Thanks, > Larry >
I just checked out my system. WOW! Are you guys sitting down? 702 custom rules!! Yep! I checked it twice!! 702. System is dedicated spam scrubber on a 266 mhz system with 64 megs of ram. Average time to scan: 1 second!!! Yup! Moslty due to recent bogs by SoBig, or it would be less then that!! I get about 33%-45% spam depending on week. Similar to others. Only about 3500-5000 emails a week. See why I don't need bayes or net tests ;) I catch 99% of spam. I've had a breakthru today that should catch the ones that have been sneaking in. (Matt and JMason, the doc I sent you guys has a pattern in the Message-ID header + BASE64_ENC_TEXT + MIME_HTML_NO_CHARSET that I noticed today. I plan to meta that with some RAW rules to catch those sneaky SOBs!) I have to deal with email from china and korea, so net tests aren't that good for me. I also don't like to rely on someone elses system. Bayes is good. But a good rule is better. Plus bayes with my setup to internal exchange server isn't the best. But I've made some steps to at least try this in future. BUt you can't argue with 2.4x(patched) catching 99% with scores averaging 20's. Bayes and net tests would just add to an already caught spam score. The reg2rule.pl can be found at the wiki under spammerhosts at http://www.exit0.us/index.php/SpamHosts 98% of my rules can be found at the emporeum link in my sig. I also posted my evil domain file generated by the reg2rule.pl on my site today. That alone accounts for 274 rules. This way if you don't want to bother, you can get mine. I'll update it once a month. direct link: http://www.merchantsoverseas.com/wwwroot/gorilla/evilrules.cf Whew! Told you guys I needed to get away from these rules for a while :) I just love whooping the spammers. Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
