Mike, I suspect you are using the wrong criterion in removing some of the rules. Unfortunately none of the log readers seem to store the most interesting bit of information. How many times did the SARE rules make a critical difference between marking a spam message as spam? I find they are a critical difference worth keeping around here, particularly the stocks rules.
That may be true, but there's a trade-off: how much system resources am I willing to trade for one or two spams that were identified by some of the heavyweight rulesets? I mean, look at those numbers again:
SARE RULESETS: 70_sare_adult.cf: 10 70_sare_bayes_poison_nxm.cf: 0 70_sare_html0.cf: 1 70_sare_obfu0.cf: 1 70_sare_oem.cf: 30 70_sare_specific.cf: 5 70_sare_spoof.cf: 14 70_sare_stocks.cf: 69 70_sc_top200.cf: 1
The stock ruleset I can certain see keeping, but like I said, I already removed the SARE header rulesets because out of 450 messages (and thousands of rule hits), there were only 33 hits on the rules in those very heavy rulesets. Is it worth it? I'm beginning to wonder. Conventional wisdom needs challenging every once in a while.
