Tuc at T-B-O-H.NET wrote:
Tuc at T-B-O-H.NET wrote:
Tuc at T-B-O-H wrote:
That's as much detail as I'm going to go into here. But the result is
that I have 720,000 IP addresses of virus infected computers and I'm
fiultering about 1600 domains and I'm not getting any more than the
normal few false positive complaints. And those are due to other
unrelated mistakes that I'm still working on.
I've had it running for 26 hours so far. Its shown up on 79
out of 1519 messages processed. Of those, SA decided 482 of them were
spam. Eight were on the whitelist (Which didn't matter, the scores from
SA were 0 or negative ANYWAY). 68 were "BL", but the numbers were so
high from SA anyway, they were well over the limit. The rest were "BR"
and again the numbers were so high SA caught them on its own.
<SHRUG>
Tuc/TBOH
So - no false positives?
No false anything really. SA had scored the others so low BEFORE
adding in your score that the "WH" didn't mean anything to the score.
Likewise, SA scored the "BL"/"BR" ones so high BEFORE adding in your
score that your score didn't mean anything.
So, to me, its basically just "tagging along" with the big
boys and every once and a while giving its .02 where the big boys
already came to a decision.
What I was hoping it would be was that "extra little bit" ,
that "hanging chad" shall we say, that pushed it over the line one
way or the other on a much greater percentage of processed messages.
This was on my personal mail server ONLY, my "production" one processes
around 57250 emails a day, of which 52000 are thrown out before
they are even checked (KNOWN spam just by the receiving email address),
3500 are identified by SA as spam (Some false positives), 250 are
passed as clean (Of which I'd say 25% are still spam), and the rest
aren't even run through SA before reaching the user due to the users
not being happy with the results of SA scans.
But, if you were to use the WH and BL/BR lists as pre-filters to reduce
spam assassin's load, what difference would it make to your mail server
load?
And, in that cases, how many errors would you get?
I think that might be Marc's actual goal here. Not to "tip the balance
on questionable email", but to keep you from having to scan stuff that
is definitely ham and definitely spam.
Hi,
Unfortunately, I don't know how to tell this given that Mark
provided SA rules for processing. If this was something I could implement
at the sendmail level, before it got to SA (pre-filter), then it may
make a difference to AT MOST what seems to be about 5% of my email.
But since SA has to run ANYWAY, then if anything it slows
the server down since it needs to make an additional DNS call.
Tuc/TBOH
I gave you rules for SA because this is the SA forum. In the Exim forum
I posted the Exim rules. I manage to route over 99% of the email I
process around SpamAssassin. But I am running off my own data so that
makes a big difference. If the system were scaled up it would catch far
more stuff.
