John,
I also experienced what you see with the threshold. Out of the box , SA threshold of
5.0 did not cut the spam flow by much at all. I estimated atleast 70% of the spam
still came through. I was using a test group that had there spam marked but passed
through. This way I could tighten the threshold without anyone really losing mail. I
finally got about 80% filtering of the spam at 2.8 threshold !
After this I started adding custom cf's like Bigevil,backhair, etc. I also started
pushing some of the default scores up and down according to what my beta testers were
seeing. I'm now starting to back off on the threshold to eventualy get it back to
5.0. CF's like bigevil are expecting your threshold to be 5.0. I believe even Bayes
assumes your threshold is 5.0.
Scott
-----Original Message-----
From: Robert Menschel [mailto:[EMAIL PROTECTED]
Sent: Wed 1/21/2004 7:51 PM
To: John Fleming
Cc: [EMAIL PROTECTED]
Subject: Re[2]: [SAtalk] Hello, new to list ! :-)
Hello John,
Wednesday, January 21, 2004, 6:42:34 AM, you wrote:
JF> I'm pretty new too, and I'd like some clarification about what is "stock"
in
JF> SA and what's custom. ...
Stock rules are anything installed into the SA rules directory when you
install SA. Custom is anything else.
JF> I see various rules suggested here and names like
JF> BigEvil and MrWiggly etc. I'm not sure what the flow is here - Do some of
JF> these things get incorporated into SA eventually?
Yes. FAQ: http://wiki.spamassassin.org/w/ContributingNewRules
If you check the archives over the past month or so, you'll see that I've
been following that process. I have several dozen rules somewhere in that
process. No guarantees any of them will actually make it into the
distribution (what works wonderfully for me or even several of us may not
be appropriate for the rest of the world).
Perhaps most notable is
> uri AM_BIZ_SITE /S*\.biz/i
> describe AM_BIZ_SITE Body has link to a *.biz site
> score AM_BIZ_SITE 2.00
from http://www.exit0.us/index.php/UriRules -- SA 2.60 includes:
> uri BIZ_TLD /^(?:https?:\/\/|mailto:)[^\/]+\.biz(?:\/|$)/i
> describe BIZ_TLD Contains a URL in the BIZ top-level domain
> score BIZ_TLD 0.747 0.784 0.782 0.100
So anyone who incorporated Abigail's rule under version 2.5x should
consider removing it under 2.6x.
JF> IOW, how do I tell what to incorporate into my local.cf and what to
JF> simply wait for to be included in a regular release. That's probably
JF> not asked quite right, but I think you see the idea?
Don't wait for a release. Per
http://wiki.spamassassin.org/w/VirusScannerTypeUpdates there are
necessarily long delays between stock rules updates. If you like what you
see in custom rules, figure out what score(s) you want to apply, and use
them.
JF> One other question - It seems like most of you get rid of most spam with a
JF> cutoff value of 5? I've got mine down to 2.4 right now. This works pretty
JF> well, with only an occasional ham getting through. I suspect that mine is
JF> this low because I haven't been "SA-learn"ing much...?? If I set it at
5.0,
JF> lots would be getting through. Is this the usual? IOW, as my system
learns
JF> more, I will be able to raise the cutoff? tnx - John
I flag spam at a required hits threshold of 9.0, almost twice the 5.0
default. I consistently flag 99.8% of all spam (it's been stable at that
level now for two months). ALL spam and almost all ham is fed into
sa-learn.
Are you using network tests as well? IMO it's the combination of stock
rules, custom rules, Bayes, and Network tests that make SA such a
powerful tool.
Bob Menschel
--
Best regards,
Robert mailto:[EMAIL PROTECTED]
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
N’×zf¢–+,¦‰ìo! –*lx*'ÛM8>·¦‰êÞ
‰ßz·§qê':—§NŠ%°7¯zZ)™éíjwHž×«b¢tžzØ^n·švØh|G%Š› iËb¾+ræëòߧv¡z)‚m§ÿðÃœ–*lyÊ'¢¸?¢ÇgJ–¦j˲ȵ©d™¨¥Šx%ŠËR¥©š²Æ²)íjY%ŠËl²‹«qç讧zØm¶›?þX¬¶Ë(º· ~ŠàzwþX¬¶ÏåŠËbú?²–¦j˲ȵ©d
