Reviewing the catch takes about 60 minutes on Monday, 15 minutes on other days.
Its a FAST scan of headers only. Only when a header falls outside of normal standards of spam, do we zoom in for a closer look. Or if the spam looks interesting. ;) As we've done it more, we've gotten better at it. I can go through 1500 spams (a typical overnight) in 15 minutes flat, just paging up in Outlook looking at headers. If something is unusual, it now just jumps out of the background at me. Same for my colleagues. If a spam gets through and a user sends it to us as something which made it through our filters, we forward it (with original headers) back in to the filters to train them to recognize similar stuff in the future. In the rare case of a false positive, we do the same thing, but with a different switch. Jesse > -----Original Message----- > From: Roger Seielstad [mailto:[EMAIL PROTECTED] > Sent: Wednesday, March 12, 2003 11:38 AM > To: Exchange Discussions > Subject: RE: SPAM blockin software recommendations..... > > > What level of time is involved from the admin side with that? > 10k messages a > week, say 5 seconds each, that's a hair under 14 hours a week. That's > awefully time intensive. > > -------------------------------------------------------------- > Roger D. Seielstad - MCSE > Sr. Systems Administrator > Inovis Inc. > > > > -----Original Message----- > > From: Wendel, Jesse [mailto:[EMAIL PROTECTED] > > Sent: Wednesday, March 12, 2003 12:47 PM > > To: Exchange Discussions > > Subject: RE: SPAM blockin software recommendations..... > > > > > > Out in the dmz we use qmail with a loop to spamassassin, for > > inbound traffic to our internal Exchange organization. > > > > If the email is ranked as spam, the envelope gets rewritten > > and sent inbound to a quarantine mailbox which gets reviewed > > daily by staff. We're grabbing over 10,000 spams per week, > > with less than one (1) false positive per week (yes, that is > > over 1/10,000 or better than .9999 of reliability!) > > > > And with the Bayesian filters - > > http://www.paulgraham.com/antispam.html - enabled by default, > > spamassassin automatically learns what is spam for our > > enterprise, and what isn't. Not to mention that we can and > > do train the filters specifically for both non-spam (ham) and spam. > > > > Our users love us. And we love both qmail and spamassassin. > > Greatest thing since (insert your own metaphor here.) > > > > Jesse Wendel > > Sr. Technical Systems Analyst > > Primary Messaging/DNS Administrator > > www.pse.com > > > > > > > -----Original Message----- > > > From: Ed Crowley [mailto:[EMAIL PROTECTED] > > > Sent: Tuesday, March 11, 2003 2:21 PM > > > To: Exchange Discussions > > > Subject: RE: SPAM blockin software recommendations..... > > > > > > > > > There are lists of them at http://www.slipstick.com and > > > http://www.mail-resources.com. > > > > > > Ed Crowley MCSE+Internet MVP > > > Freelance E-Mail Philosopher > > > Protecting the world from PSTs and Bricked Backups!T > > > > > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] On Behalf Of > Brian Dugas > > > Sent: Tuesday, March 11, 2003 6:36 AM > > > To: Exchange Discussions > > > Subject: SPAM blockin software recommendations..... > > > > > > > > > Good Morning, > > > > > > I am currently using Trend eManager to block SPAM(in > trial version > > > still), it is not appearing to be very effective. What are > > some other > > > options for blocking SPAM? > > > > > > Thanks in advance. > > > > > > Brian > > > > > > > > > _________________________________________________________________ > > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > > Archives: http://www.swynk.com/sitesearch/search.asp > > > To unsubscribe: mailto:[EMAIL PROTECTED] > > > Exchange List admin: [EMAIL PROTECTED] > > > > > > > > > _________________________________________________________________ > > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > > Archives: http://www.swynk.com/sitesearch/search.asp > > > To unsubscribe: mailto:[EMAIL PROTECTED] > > > Exchange List admin: [EMAIL PROTECTED] > > > > > > > _________________________________________________________________ > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > Archives: http://www.swynk.com/sitesearch/search.asp > > To unsubscribe: mailto:[EMAIL PROTECTED] > > Exchange List admin: [EMAIL PROTECTED] > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
