Re: rules better than bayes?

[Matt Kettler]

Matthew Yette wrote:
> 
> Do you recommend running airmax as a supplementary ruleset with 3.1.0?

I personally have no recommendations on it.. I've never run it.

I personally like SARE's specific, evilnumbers, random and adult rulesets.


Here's some quick grep's for hit-rates on some SARE rules I use (no declarations
 about FPs vs real spam hits, but none of these sets have caused me any problems
so far)

70_sare_evilnum0.cf & 70_sare_evilnum1.cf:
  grep SARE_EN_ /var/log/maillog |wc -l
    301
70_sare_specific.cf:
  grep SARE_SPEC_ /var/log/maillog |wc -l
     60
70_sare_genlsubj0.cf:
  grep SARE_SUB /var/log/maillog |wc -l
     44
70_sare_adult.cf:
  grep SARE_ADLT /var/log/maillog |wc -l
     31
70_sare_uri0.cf:
  grep SARE_URI_ /var/log/maillog |wc -l
     10
70_sare_random.cf:
  grep SARE_RAND_ /var/log/maillog |wc -l
      1


I also strongly recommend enabling SA's URIBL support, and adding on a .cf file
to get uribl.com's list added in (default SA only uses surbl.org lists)

  grep URIBL_BLACK /var/log/maillog |wc -l
   2214

  grep _SURBL /var/log/maillog |wc -l
   2144

And of course I get great results from bayes:
  grep BAYES_99 /var/log/maillog |wc -l
   2190

Ditto DCC and Razor2:
 grep RAZOR2_CHECK /var/log/maillog |wc -l
   2114
 grep DCC_CHECK /var/log/maillog |wc -l
   1833