>
> Tuc at T-B-O-H.NET wrote:
> >> Tuc at T-B-O-H wrote:
> >>>> That's as much detail as I'm going to go into here. But the result is
> >>>> that I have 720,000 IP addresses of virus infected computers and I'm
> >>>> fiultering about 1600 domains and I'm not getting any more than the
> >>>> normal few false positive complaints. And those are due to other
> >>>> unrelated mistakes that I'm still working on.
> >>>>
> >>>>
> >>> I've had it running for 26 hours so far. Its shown up on 79
> >>> out of 1519 messages processed. Of those, SA decided 482 of them were
> >>> spam. Eight were on the whitelist (Which didn't matter, the scores from
> >>> SA were 0 or negative ANYWAY). 68 were "BL", but the numbers were so
> >>> high from SA anyway, they were well over the limit. The rest were "BR"
> >>> and again the numbers were so high SA caught them on its own.
> >>>
> >>> <SHRUG>
> >>>
> >>> Tuc/TBOH
> >>>
> >>>
> >> So - no false positives?
> >>
> > No false anything really. SA had scored the others so low BEFORE
> > adding in your score that the "WH" didn't mean anything to the score.
> > Likewise, SA scored the "BL"/"BR" ones so high BEFORE adding in your
> > score that your score didn't mean anything.
> >
> > So, to me, its basically just "tagging along" with the big
> > boys and every once and a while giving its .02 where the big boys
> > already came to a decision.
> >
> > What I was hoping it would be was that "extra little bit" ,
> > that "hanging chad" shall we say, that pushed it over the line one
> > way or the other on a much greater percentage of processed messages.
> > This was on my personal mail server ONLY, my "production" one processes
> > around 57250 emails a day, of which 52000 are thrown out before
> > they are even checked (KNOWN spam just by the receiving email address),
> > 3500 are identified by SA as spam (Some false positives), 250 are
> > passed as clean (Of which I'd say 25% are still spam), and the rest
> > aren't even run through SA before reaching the user due to the users
> > not being happy with the results of SA scans.
>
> But, if you were to use the WH and BL/BR lists as pre-filters to reduce
> spam assassin's load, what difference would it make to your mail server
> load?
>
> And, in that cases, how many errors would you get?
>
> I think that might be Marc's actual goal here. Not to "tip the balance
> on questionable email", but to keep you from having to scan stuff that
> is definitely ham and definitely spam.
>
Hi,
Unfortunately, I don't know how to tell this given that Mark
provided SA rules for processing. If this was something I could implement
at the sendmail level, before it got to SA (pre-filter), then it may
make a difference to AT MOST what seems to be about 5% of my email.
But since SA has to run ANYWAY, then if anything it slows
the server down since it needs to make an additional DNS call.
Tuc/TBOH
