> > Tuc at T-B-O-H.NET wrote: > >> Tuc at T-B-O-H wrote: > >>>> That's as much detail as I'm going to go into here. But the result is > >>>> that I have 720,000 IP addresses of virus infected computers and I'm > >>>> fiultering about 1600 domains and I'm not getting any more than the > >>>> normal few false positive complaints. And those are due to other > >>>> unrelated mistakes that I'm still working on. > >>>> > >>>> > >>> I've had it running for 26 hours so far. Its shown up on 79 > >>> out of 1519 messages processed. Of those, SA decided 482 of them were > >>> spam. Eight were on the whitelist (Which didn't matter, the scores from > >>> SA were 0 or negative ANYWAY). 68 were "BL", but the numbers were so > >>> high from SA anyway, they were well over the limit. The rest were "BR" > >>> and again the numbers were so high SA caught them on its own. > >>> > >>> <SHRUG> > >>> > >>> Tuc/TBOH > >>> > >>> > >> So - no false positives? > >> > > No false anything really. SA had scored the others so low BEFORE > > adding in your score that the "WH" didn't mean anything to the score. > > Likewise, SA scored the "BL"/"BR" ones so high BEFORE adding in your > > score that your score didn't mean anything. > > > > So, to me, its basically just "tagging along" with the big > > boys and every once and a while giving its .02 where the big boys > > already came to a decision. > > > > What I was hoping it would be was that "extra little bit" , > > that "hanging chad" shall we say, that pushed it over the line one > > way or the other on a much greater percentage of processed messages. > > This was on my personal mail server ONLY, my "production" one processes > > around 57250 emails a day, of which 52000 are thrown out before > > they are even checked (KNOWN spam just by the receiving email address), > > 3500 are identified by SA as spam (Some false positives), 250 are > > passed as clean (Of which I'd say 25% are still spam), and the rest > > aren't even run through SA before reaching the user due to the users > > not being happy with the results of SA scans. > > But, if you were to use the WH and BL/BR lists as pre-filters to reduce > spam assassin's load, what difference would it make to your mail server > load? > > And, in that cases, how many errors would you get? > > I think that might be Marc's actual goal here. Not to "tip the balance > on questionable email", but to keep you from having to scan stuff that > is definitely ham and definitely spam. > Hi,
Unfortunately, I don't know how to tell this given that Mark provided SA rules for processing. If this was something I could implement at the sendmail level, before it got to SA (pre-filter), then it may make a difference to AT MOST what seems to be about 5% of my email. But since SA has to run ANYWAY, then if anything it slows the server down since it needs to make an additional DNS call. Tuc/TBOH