RE: [Declude.JunkMail] Setting MAX Testing Weight
> There is a new "PREWHITELIST ON" option that will run some of the > whitelists before the tests are run. Can you explain the "some" part? It currently just does the WHITELIST FROM and WHITELIST IP whitelist entries before running the spam tests. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Setting MAX Testing Weight
> There is a new "PREWHITELIST ON" option that will run some of the > whitelists before the tests are run. Can you explain the "some" part? John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Setting MAX Testing Weight
Scott, I am not familiar with programming or the methods that Declude uses to run its tests. Is it possilbe to either set a MaxWeight in Declude, or section the tests and check Weight after each section( and would it require a great deal of programming), i.e. BondedSender IPNotinMX WHITELISTSWEIGHT < -20 EndTests Spamcop FiveTen BLACKLISTS WEIGHT > 40 EndTests Thanks, Todd - Original Message - From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, September 03, 2003 9:13 AM Subject: Re: [Declude.JunkMail] Setting MAX Testing Weight > > >Scott, are there any plans to, or can Declude already, run the Whitelist > >tests FIRST, so that if they are whitelisted, forgoes any weight testing > >alltogether? I think that would be beneficial in this case. If we list the > >whitelist tests first, will they be run first? > > There is a new "PREWHITELIST ON" option that will run some of the > whitelists before the tests are run. > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Setting MAX Testing Weight
Scott, are there any plans to, or can Declude already, run the Whitelist tests FIRST, so that if they are whitelisted, forgoes any weight testing alltogether? I think that would be beneficial in this case. If we list the whitelist tests first, will they be run first? There is a new "PREWHITELIST ON" option that will run some of the whitelists before the tests are run. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Setting MAX Testing Weight
As was mentioned here before, it's not a BAD idea to want Declude to stop after X has been reached, but, what if the whitelist came right after that X number? Scott, are there any plans to, or can Declude already, run the Whitelist tests FIRST, so that if they are whitelisted, forgoes any weight testing alltogether? I think that would be beneficial in this case. If we list the whitelist tests first, will they be run first? Paul - Original Message - From: Todd - Smart Mail To: [EMAIL PROTECTED] Sent: Tuesday, September 02, 2003 10:27 PM Subject: Re: [Declude.JunkMail] Setting MAX Testing Weight I brought this up last week. Anyone see the benefit beside me? The idea of being able to stop testing once a given Weight has been reached seems to have multiple benefits to me. My numbers indicate that about 45% of my spam would benefit from stopping testing at 4X my Hold Weight. I know that Declude is not a resource hog but my Declude tests have increased dramatically over the past couple months and I don't see them getting any less in the future. I've Added 2 x Subjectspaces Spamdomains 4 x Comments Spamcheck And a host of DNS tests. That's my CPU, Bandwidth, and other resources. And as more and more people move to spam prevention it seems the DNS Blacklists will get more use. I guess my point is why continue to test and use resources once you reach a certain point where you're 3X, 4X or 5X your hold weight? Any thoughts? Todd Hunter Progressive Systems
Re: [Declude.JunkMail] Setting MAX Testing Weight
I thought the essence of the argument against this is the fact that
such testing doesn't happen one at a time, but instead in unison with
one another. So if 20 queries are sent out and the first 10 that come
back to put the score high enough to fail, there isn't really that much
overhead in waiting for the remaining 10 to come back considering that
they have already been queried.
I'm not sure exactly how the application handles the technical tests,
but it would seem that many of them are done in unison as opposed to
independent of one another just like the DNS-based tests. HELOBOGUS,
SPAMHEADERS and BADHEADERS for instance all look at the same pieces of
information, so it's probably not something that can be separated into
individually triggered tests. I would think that by the time you
caught a high enough score, the majority of the processing would
already be finished and you would only be waiting on the remaining DNS
queries to come back.
Another issue is that score handling is only marked in the
$default$.junkmail files, and you can have different settings for each
domain and user depending on your version, yet there is only one
global.config file that gets used for every user on a system. So
knowing what score to stop on becomes overhead since the system doesn't
need to keep track of handling information during testing as things
stand, and beyond that a logic mess for a programmer.
I guess that while what you suggest would be nice in some
circumstances, it might not be practical programmatically???
I'm also going to guess that some of the newer tests that involve
opening, parsing and execution of files like SPAMDOMAINS and SPAMCHECK
would have a noticeable impact on the processor cycles needed, and that
might be why you are seeing the increase that you are. Some DNS-based
tests might also be slow in responding, and might also rarely return a
match, in which case it would make sense to remove them if you are
worried about processing time.
I'm no expert on the details, but that's what makes sense from what I
think I know :)
Matt
Todd - Smart Mail wrote:
I brought this up last
week. Anyone see the benefit beside me? The idea of being able to stop
testing once a given Weight has been reached seems to have multiple
benefits to me. My numbers indicate that about 45% of my spam would
benefit from stopping testing at 4X my Hold Weight.
I know that Declude is not a resource hog but my
Declude tests have increased dramatically over the past couple months
and I don't see them getting any less in the future.
I've Added
2 x Subjectspaces
Spamdomains
4 x Comments
Spamcheck
And a host of DNS tests.
That's my CPU, Bandwidth, and
other resources. And as more and more people move to spam prevention
it seems the DNS Blacklists will get more use.
I
guess my point is why continue to test and use resources once you reach
a certain point where you're 3X, 4X or 5X your hold weight?
Any thoughts?
Todd Hunter
Progressive Systems
-
Original Message -
From:
Todd
- Smart Mail
To:
[EMAIL PROTECTED]
Sent:
Thursday, August 28, 2003 10:04 AM
Subject:
Re: [Declude.JunkMail] Setting MAX Testing Weight
John,
As I mentioned, the order that
you ran the tests would affect the outcome. Tests that generate a
negative weight would need to be run first, such as IPNOTINMX,
BONDEDSENDER, and other whitelist type of tests. Also the reason I
suggested stopping testing at weigh 3x my HOLD weight. This gives some
margin where test would continue to run.
Todd
- Original Message -
From:
John Tolmachoff (Lists)
To:
[EMAIL PROTECTED]
Sent:
Thursday, August 28, 2003 9:36 AM
Subject:
RE: [Declude.JunkMail] Setting MAX Testing Weight
You do not
want Declude to stop at a certain point. What if it stops, right before
the next test which is a whitefilter type test?
With the
weighting system, it is important to run all tests to get the final
weight.
John Tolmachoff
MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original
Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Todd - Smart Mail
Sent: Thursday, August 28, 2003 12:34 AM
To:
[EMAIL PROTECTED]
Subject:
[Declude.JunkMail] Setting MAX Testing Weight
My Declude config has
grown since install. I am curious if it is possible determine a Weight
at which Declude ceases running tests on an email.
Say I have 40
tests and after Declude runs the first 10 of them it accumulates
a score of 300.
Re: [Declude.JunkMail] Setting MAX Testing Weight
I brought this up last
week. Anyone see the benefit beside me? The idea of being able to
stop testing once a given Weight has been reached seems to have multiple
benefits to me. My numbers indicate that about 45% of my spam would
benefit from stopping testing at 4X my Hold Weight.
I know that Declude is not a resource hog but my Declude tests have
increased dramatically over the past couple months and I don't see them getting
any less in the future.
I've Added
2 x Subjectspaces
Spamdomains
4 x Comments
Spamcheck
And a host of DNS tests.
That's my CPU, Bandwidth, and
other resources. And as more and more people move to
spam prevention it seems the DNS Blacklists will get more
use.
I
guess my point is why continue to test and use resources once you reach a
certain point where you're 3X, 4X or 5X your hold
weight?
Any thoughts?
Todd Hunter
Progressive Systems
- Original Message -
From:
Todd - Smart
Mail
To: [EMAIL PROTECTED]
Sent: Thursday, August 28, 2003 10:04
AM
Subject: Re: [Declude.JunkMail] Setting
MAX Testing Weight
John,
As I mentioned, the order that
you ran the tests would affect the outcome. Tests that generate a
negative weight would need to be run first, such as IPNOTINMX, BONDEDSENDER,
and other whitelist type of tests. Also the reason I suggested stopping
testing at weigh 3x my HOLD weight. This gives some margin where test
would continue to run.
Todd
- Original Message -
From:
John Tolmachoff (Lists)
To: [EMAIL PROTECTED]
Sent: Thursday, August 28, 2003 9:36
AM
Subject: RE: [Declude.JunkMail] Setting
MAX Testing Weight
You do not want
Declude to stop at a certain point. What if it stops, right before the next
test which is a whitefilter type test?
With the
weighting system, it is important to run all tests to get the final
weight.
John Tolmachoff MCSE
CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com
-Original
Message-From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Todd - Smart
MailSent:
Thursday, August 28,
2003 12:34
AMTo:
[EMAIL PROTECTED]Subject: [Declude.JunkMail] Setting MAX
Testing Weight
My Declude
config has grown since install. I am curious if it is possible
determine a Weight at which Declude ceases running tests on an email.
Say I
have 40 tests and after Declude runs the first 10 of
them it accumulates a score of 300. I HOLD at
100. Further testing beyond 300 uses additional resources to
produce the same outcome with no additional benefits. Resources
including processing, bandwidth, and un-needed additional queries to
blacklist servers that are working hard to maintain their
services.
In this
scenario the order that Declude ran your tests would be a factor. You
could place your tests in a specific order in the Declude
config so that primacy tests like Spamcop were first,
and additional tests would only be run if needed. Or you
could run tests like Spamcheck, Badheaders, Helobogus first and be
able to HOLD messages with a minimum or no external DNS queries.
Todd
Hunter
Progressive
Systems
Re: [Declude.JunkMail] Setting MAX Testing Weight
John, As I mentioned, the order that you ran the tests would affect the outcome. Tests that generate a negative weight would need to be run first, such as IPNOTINMX, BONDEDSENDER, and other whitelist type of tests. Also the reason I suggested stopping testing at weigh 3x my HOLD weight. This gives some margin where test would continue to run. Todd - Original Message - From: John Tolmachoff (Lists) To: [EMAIL PROTECTED] Sent: Thursday, August 28, 2003 9:36 AM Subject: RE: [Declude.JunkMail] Setting MAX Testing Weight You do not want Declude to stop at a certain point. What if it stops, right before the next test which is a whitefilter type test? With the weighting system, it is important to run all tests to get the final weight. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd - Smart MailSent: Thursday, August 28, 2003 12:34 AMTo: [EMAIL PROTECTED]Subject: [Declude.JunkMail] Setting MAX Testing Weight My Declude config has grown since install. I am curious if it is possible determine a Weight at which Declude ceases running tests on an email. Say I have 40 tests and after Declude runs the first 10 of them it accumulates a score of 300. I HOLD at 100. Further testing beyond 300 uses additional resources to produce the same outcome with no additional benefits. Resources including processing, bandwidth, and un-needed additional queries to blacklist servers that are working hard to maintain their services. In this scenario the order that Declude ran your tests would be a factor. You could place your tests in a specific order in the Declude config so that primacy tests like Spamcop were first, and additional tests would only be run if needed. Or you could run tests like Spamcheck, Badheaders, Helobogus first and be able to HOLD messages with a minimum or no external DNS queries. Todd Hunter Progressive Systems
RE: [Declude.JunkMail] Setting MAX Testing Weight
You do not want Declude to stop at a certain point. What if it stops, right before the next test which is a whitefilter type test? With the weighting system, it is important to run all tests to get the final weight. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd - Smart Mail Sent: Thursday, August 28, 2003 12:34 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Setting MAX Testing Weight My Declude config has grown since install. I am curious if it is possible determine a Weight at which Declude ceases running tests on an email. Say I have 40 tests and after Declude runs the first 10 of them it accumulates a score of 300. I HOLD at 100. Further testing beyond 300 uses additional resources to produce the same outcome with no additional benefits. Resources including processing, bandwidth, and un-needed additional queries to blacklist servers that are working hard to maintain their services. In this scenario the order that Declude ran your tests would be a factor. You could place your tests in a specific order in the Declude config so that primacy tests like Spamcop were first, and additional tests would only be run if needed. Or you could run tests like Spamcheck, Badheaders, Helobogus first and be able to HOLD messages with a minimum or no external DNS queries. Todd Hunter Progressive Systems
Re: [Declude.JunkMail] Setting MAX Testing Weight
My Declude config has grown since install. I am curious if it is possible determine a Weight at which Declude ceases running tests on an email. No. It is something that we have given thought to, but there are a number of potential problems. As you point out, the order of the tests would now become a factor (which means serious re-working of the code, and slower delivery if DNS lookups are no longer done in parallel). Also, if you are not careful, negative weights could be an issue (for example, if you do not order the tests correctly, you may skip over a test that would reduce the weight to the point where processing should continue). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you have been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Setting MAX Testing Weight
My Declude config has grown since install. I am curious if it is possible determine a Weight at which Declude ceases running tests on an email. Say I have 40 tests and after Declude runs the first 10 of them it accumulates a score of 300. I HOLD at 100. Further testing beyond 300 uses additional resources to produce the same outcome with no additional benefits. Resources including processing, bandwidth, and un-needed additional queries to blacklist servers that are working hard to maintain their services. In this scenario the order that Declude ran your tests would be a factor. You could place your tests in a specific order in the Declude config so that primacy tests like Spamcop were first, and additional tests would only be run if needed. Or you could run tests like Spamcheck, Badheaders, Helobogus first and be able to HOLD messages with a minimum or no external DNS queries. Todd Hunter Progressive Systems
