> Do all these rules have pretty much the same value? > Can they be combined into single rules that match on multiple strings? > Just quadruple your timeouts and see if it can handle all those rules.
Lucas, The script produces descrete rawbody rules for each line of text in the input file. As for point-value, I am originally setting everything to a point value of zero. My intent was to observe the performance impact of such a huge set of rules, without (yet) letting the rules otherwise influence the message in any way. Once we knew how "expensive" the rules were, the intent was to score them high enough to reject the message (since that's what they do on the Exchange boxes internal to my organization). If the input file looks like this: line one line two line three The resulting rules look like this: rawbody LOCAL_EMGR_STRING_1 /line one/i describe LOCAL_EMGR_STRING_1 Unacceptable word or phrase score LOCAL_EMGR_STRING_1 0 rawbody LOCAL_EMGR_STRING_2 /line two/i describe LOCAL_EMGR_STRING_2 Unacceptable word or phrase score LOCAL_EMGR_STRING_2 0 rawbody LOCAL_EMGR_STRING_3 /line 4/i describe LOCAL_EMGR_STRING_3 Unacceptable word or phrase score LOCAL_EMGR_STRING_3 0 Each line of text in the input file represents a string or phrase that on the Exchange servers, is considered evil enough to cause message rejections. There is no pattern or other relationship between the lines of input... they're just a list of dirty words, phrases, and other no-no patterns. KEN CORMACK, RHCE Sr. UNIX Systems Analyst, Open Systems Group Sr. Software Analyst, TSG Midrange Systems Group AFFILIATED COMPUTER SERVICES, INC. _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang