On 2/17/2014 3:59 PM, Ian Zimmerman wrote:
Hello. This is the first time SA is giving me enough trouble that I
need to ask for help. I hope I get this right.
I observed a marked increase in false negatives in the last few weeks.
There have definitely been some increases in the past few weeks but as
you'll see below, I think BAYES_99/999 is not the culprit except very
recently.
Only today I had enough sense to look at the detailed scores. And, all
the escaped spams have hit the BAYES_999 rule. I grepped the site
configuration directory:
The BAYES_999 rule changed in the last day or three. I was expecting
the ruleqa engine to score it appropriately and it didn't.
BAYES_999 is just a finer gradient on BAYES_99 allowing for a higher
score on the top .001% of Bayes hits.
It'll be fixed with the next rule update but you might want these
temporarily:
body BAYES_99 eval:check_bayes('0.99', '0.999')
body BAYES_999 eval:check_bayes('0.999', '1.00')
score BAYES_99 0 0 3.8 3.5
score BAYES_999 0 0 4.0 3.7
regards,
KAM
