On Fri, 2011-11-25 at 11:49 -0600, Sergio wrote: > I have the following rule where I wrote all the HELO spammers that SA > didn't caught, I insert the new HELO everytime that I found one. My concern > is, is too much for just one rule or the rule can grow without limit? > When I asked this question a while back I was told that "several MB" should be OK. Currently my largest rule has 371 alternatives. It and a few friends are passed to SA as a 24 kb .cf file.
If you're finding your rule is starting to get difficult to maintain, take a look at my rule assembly tool, which is designed to allow such rules to be defined in an easily edited file for each rule that are used to create a single .cf file. See: http://www.libelle-systems.com/free/portmanteau/portmanteau.tgz I was thinking of using a server plus plugin to do this but was convinced that this 'portmanteau rule' approach was better: it certainly works well for me. Martin > header CHARLY_RULE1 ALL =~ > /(actaddonuniverse\.net|albeitnetworks\.com|allotic\.info|andersonbolt\.info|atefchoca\.info|backtobackfunding\.com|baskan\.info|betabel\.info|black-and-whiteticket\.info|bodygid\.info|brevardphysicians\.net|cheetloope\.info|circuitfivenine\.com|claimatic\.info|cmasyria\.com|complementhold\.com|CORE5PUMPER2|dauksstold\.info|dtsetfieri\.info|eshisha\.org|evegashotels\.com|felisranty\.info|finkleandthecleanshorts\.com|fisterfarms\.info|furium\.info|furizer\.info|gardenhowevercity\.net|grownvegetables\.com|hookerdaybyday\.info|hostalmiraflores\.com|hotrodbailbondsks\.com|juddy\.org|laughsidecant\.net|layeredvpnzervices\.com|lyonlandscapema\.com|maritimecranesimulator\.com|miiiley\.com|mixcomstar\.net|monitorstarway\.com|naturopathyport\.info|netcontrolusa\.com|pataboden\.info|peoriachat\.com|powerfulrun\.com|print2floors\.com|relacionesy\.com|slowlybuymorning\.info|stonyroadalbum\.com|straighttin\.info|sumejorweb\.com|surelycomplainsecretary\.info|teuksull\.info|theharborccc\.org|themiamibeachheat\.com|thoroughlydevelopment\.info|tivolicn\.com|whaukferth\.com|barrchickenjoint\.info)/i > describe CHARLY_RULE1 Charly Spammers > score CHARLY_RULE1 11 > > Regards, > > Sergio
