fixar det
/Lelle
>>> Kai Schaetzl <mailli...@conactive.com> 14-02-20 12:33 >>>
Kevin A. McGrail wrote on Mon, 17 Feb 2014 13:18:12 -0500:
> body BAYES_99 eval:check_bayes('0.99', '0.999')
> body BAYES_999 eval:check_bayes('0.999', '1.00')
> score BAYES_99 0 0 3.8 3.5
> score BAYES_999 0 0 4.0 3.7
I've also just recognized the presence of BAYES_999 and searched my local
copy of this mailing list for a discussion of it :-)
The problem that I see with this rule is that it seems to *replace* the
BAYES_99 hits *when* it hits and thus downscores the normal hits
*significantly* if you don't take manual action. Many people have scored
high BAYES values up, because there are almost NIL FPs on them. I have set
95 to 4.0 and 99 to 5.0 (on some servers just to 4.0). Suddenly having 999
replace those hits/scores with 1.0 (that is what I get here) makes a lot
of spam go thru. It would rather have been better to add 999 as meta rule,
so that the basic 99 still hits plus any additional scoring from 999. In
that case I would have had 5.0 + 1.0 = just fine.
Anyway, this lapse also made me look at the latest improvements :-)
I have set 999 now to 6.0 and also added the body eval per your advice
above. Generally, 999 is a welcome addition as it might send those spams
over the border that used to get scored under 5.0 because of hits on the
negative values for whitelist, RP_MATCHES_RCVD and other "positive" stuff.
Which SA versions do get this new 999 rule? e.g. I have also older
installations with 3.2.4 and 3.2.5 that would need careful updating. Am I
safe to assume that these won't get this new rule?
Kai
--
Get your web at Conactive Internet Services: http://www.conactive.com
