I know this is a non-answer, but what sort of scores are your false positives getting?
If they're all tending toward 5.1-10, you might be able to raise your threshold rather than messing with the GA scores. I use a threshold of 7.0 and haven't had a false positive in about a month. If they're all coming from a similar source (i.e. a mailing list) you might be better off whitelisting rather than changing scores. If you're getting false positives with really high scores, you might let us know which rules they're hitting, as the rules might need work. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "Research is the process of going up alleys to see if they are blind." -- Marston Bates > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of > Andrew Kohlsmith > Sent: Monday, May 13, 2002 10:10 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] updating GA scores > > > Hello again, > > I upgraded to 2.20 late last week and while the amount of spam > that is getting > through has gone down *dramatically* from SA1.5, the number of false > positives has seen a (slight) increase. Ferinstance: yesterday 2086 spam > messages were received but 8 were false positives, even with my > additional > tests and whitelisted entries. During the week there are only about a > thousand spam messages a day but from Friday to Sunday the volume > seems to > double. <sigh> > > I'm keeping track of the emails which are being misdetected and I > would like > to modify my GA scores based on these false positives. > > When I was subscribed last the idea came about and I was told > that I just grab > a CVS copy and run the messages through the GA, and replace my > scores with > the output. Is this still the right way to go about it? What's > the correct > method for adding some specific tests to be included in the GA? > > I've got a very "typical internet email user" userbase to pull > stats from -- > would running their mail spools through the GA on a regular basis and > contributing the scores back be something you would like to see? > > Regards, > Andrew > > _______________________________________________________________ > > Have big pipes? SourceForge.net is looking for download mirrors. We supply > the hardware. You get the recognition. Email Us: [EMAIL PROTECTED] > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > _______________________________________________________________ Have big pipes? SourceForge.net is looking for download mirrors. We supply the hardware. You get the recognition. Email Us: [EMAIL PROTECTED] _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
