> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry > Sent: Sunday, July 27, 2003 1:35 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Filter processing > > > ----- Original Message ----- > From: "Kevin Bilbee" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Sunday, July 27, 2003 1:03 AM > Subject: [Declude.JunkMail] Filter processing > > > > When there is a hit in a filter file does declude continue to > procees the > > filer or stop? > > I continues through the end of the file, however, Declude will only report > the last line that matched out of the file. Some of us have asked if > Declude could be made to log all lines that match with a log > setting of MID > or higher, but I don't think that has happened yet. > > > If it stops then it would be better to have the lines that hit > the most at > > the top of the filter text file. > > It will parse the entire file adding weight for every unique > positive match, > but will only count a single match once per e-mail. So, for > example, if you > filter on the word "sex" (5 points), and "sex" is found five times in a > single e-mail message, the weight that has been set in your > filter file for > "sex" will only be applied once, not multiplied by 5 (the reported filter > weight would be 5). > > However, if you filter on "sex" (5 points) and "drugs" (3 points) > and "rock > & roll" (1 point), and each word or phrase is found one or more times in a > single message, the weight of each single matched word or phrase will be > added together and that's what will be reported as the filter weight (9 > points in this case).
This is what I thought but wanted to make shure. I would then ask if there could be a simple filter that would stop on first match it could be called 'simplefilter' or 'firstmatch' that way we could optimize the filter files we expect to have only one match. > > > I have already noticed we get the most HELO hits on our own IP > addresses. > So > > with this thinking declude would do less processing if they are at the > > beginning of the file. > > Doesn't matter, Declude will still parse the entire file. The > logic behind > this is that you would want to add weight for every match that is found in > the filter file, not just the first one (this is especially true for the > body, subject, and header filter files). Just curious why your own IP > addresses or FQHNs would be listed in your HELO filter file? We block on average 10 spams a day by doing this I have seen it catch 50 in a day. > > > If this is the case I think I will write a filter optimizer. It would go > > through the log files and count the number of hits on > particular lines in > > the specified filter. Then rewrite the file with the most hit > lines at the > > top. > > Sounds like it would be a good optimization technique if the filter files > were parsed till they found their first match. But as it works now, all > filter files are always parsed to the end of file. > > Bill > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] ____________________________________ Changing the way industry works. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
