On 13 Dec 2018, at 16:24, Chris Pollock wrote: > On Thu, 2018-12-13 at 15:14 -0600, Chris Pollock wrote: >> On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: >>> On 11 Dec 2018, at 16:37, Chris Pollock wrote: >>> >>>> On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: >>> >>> [...] >>>>> Anyway, as of today I've capped those 2 subrules at levels >>>>> which >>>>> leave ample space to still match the target spam. Should show >>>>> up >>>>> in >>>>> tomorrow's update. >>> >>> I was wrong. The addition of a 'maxhits' parameter to the two >>> subrules apparently didn't get committed in time for the nightly >>> rule >>> promotion run. It was in r1848602 and the current ruleset is still >>> at >>> r1848555. Assuming all goes well tonight, the change will appear >>> tomorrow. >>> >> >> Shouldn't this have stopped by now - https://pastebin.com/7260daT3 >> Today's update was '1848731'. >> > Hit send too fast. Doing a compare between 72_active.cf dated the 11th > and the one dated today I do see: > > Dated 11 Dec > if can(Mail::SpamAssassin::Conf::feature_bug6558_free) > ifplugin Mail::SpamAssassin::Plugin::ReplaceTags > body __E_LIKE_LETTER /<E>/ > tflags __E_LIKE_LETTER multiple > > if can(Mail::SpamAssassin::Conf::feature_bug6558_free) > ifplugin > Mail::SpamAssassin::Plugin::ReplaceTags > body __LOWER_E > /e/i > tflags __LOWER_E multiple > > Dated today 13 Dec > if can(Mail::SpamAssassin::Conf::feature_bug6558_free) > ifplugin Mail::SpamAssassin::Plugin::ReplaceTags > body __E_LIKE_LETTER /<E>/ > tflags __E_LIKE_LETTER multiple maxhits=400 > > if can(Mail::SpamAssassin::Conf::feature_bug6558_free) > ifplugin > Mail::SpamAssassin::Plugin::ReplaceTags > body __LOWER_E > /e/ > tflags __LOWER_E multiple maxhits=250 > > IIUC then __E_LIKE_LETTER can hit a max of 400 times in one message and > __LOWER_E a max of 250 times in one message.
For now, yes. Those numbers were the result of a mis-think on my part and will be 320 and 230 once the current rev works its way through. > Therefore I may still have > a large listing of subtest ran. Yes. I don't expect that behavior to change. SA has always tallied rules and sub-rules with multiple matches and the 'multiple' tflag this way and I see no compelling reason to change that. It almost certainly will not change for 3.4.3, which should be the last 3.4.x release. If there's a bug opened and someone is willing to work on code for whatever changes need to be made to collapse duplicate hit names in the lists of rule matches into a single citation with a count of hits, I expect that change would be accepted for v4, even though it may impact existing users' tooling. -- Bill Cole b...@scconsult.com or billc...@apache.org (AKA @grumpybozo and many *@billmail.scconsult.com addresses) Available For Hire: https://linkedin.com/in/billcole
signature.asc
Description: OpenPGP digital signature
