Martin Hepworth said: > Frank > > see more of the rules from www.rulesemporium.com > > I run the following...YMMV > > 99_sare_fraud_pre25x.cf > 70_sare_adult.cf 99_sare_random.cf > 70_sare_bayes_poison_nxm.cf 99_sare_spoof.cf > 70_sare_header.cf RulesDuJour > 70_sare_header0.cf antidrug.cf > 70_sare_html.cf backhair.cf > 70_sare_oem.cf bogus-virus-warnings.cf > 70_sare_random.cf chickenpox.cf > 70_sare_ratware.cf drugads.cf > 70_sare_specific.cf evilnumbers.cf > 70_sare_spoof.cf local.cf > 71_sare_bml_pre25x.cf nazi.cf > 71_sare_redirect_pre3.0.0.cf nov2rules.cf > 72_sare_bml_post25x.cf random.cf > 99_FVGT_Tripwire.cf random.current.cf > 99_sare_adult.cf spamcop_uri.cf > 99_sare_biz_market_learn_post25x.cf ssl_local.cf > 99_sare_biz_market_learn_pre25x.cf tripwire.cf > 99_sare_fraud_post25x.cf > > the nazi.cf > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > >
Hi Martin, You shouldn't need the pre & post versions of fraud or biz_market_learn, also awhile ago the 99_sare_biz_market_learn rules were renamed to 7x_sare_bml, so you should remove the 99_sare_biz_market_learn sets. Then if your are running SA 2.5x or higher remove the 71_X_pre25x sets, if you are running SA 2.4x or lower you should remove the 72_X_post sets. Hmmm, looking at the list of files, you should also remove 99_sare_random, 99_sare_spoof, 99_sare_adult. The are all leftovers from ruleset name changes. Also the nov set can probably go as well. Cheers, matt
