Mike, Good news. I dug in deeper and found that 56536 of the 88943 were from one server. It's a user that fires off a batch job or something every few minutes. I have made some adjustments and thus this user's email will no longer be part of the stats.
QQQQ ----- Original Message ----- From: "Mike Jackson" <[EMAIL PROTECTED]> To: <users@spamassassin.apache.org> Sent: Monday, May 08, 2006 1:52 PM Subject: Re: Latest sa-stats from last week | > TOP HAM RULES FIRED | > ------------------------------------------------------------ | > RANK RULE NAME COUNT %OFRULES %OFMAIL %OFSPAM | > %OFHAM | > ------------------------------------------------------------ | > 1 DNS_FROM_RFC_ABUSE 88943 13.50 15.85 12.68 | > 25.27 | | That worries me. Granted, at most that will add 0.479 to a message (when | used with the default 3.1.1 scores), but to have your #1 *ham* rule be one | that's supposed to identify *spam* doesn't speak well for the rule. I like | RFCI; I feed it bogusmx or DSN-violating mail whenever I can. But, the abuse | and postmaster lists contain far too many *major* ISPs for them to be | reliable indicators of spam. | |
