RobertH wrote on Wed, 10 Dec 2008 17:49:28 -0800: > what ones did you keep? if you recall, any particular reason why?
Hm, I checked and it seems I was wrong, partly. I still have them in the channels.txt for my sa-update. I removed them on some other machines partly because of memory constraints and didn't notice ill effects. But I didn't remove on the machine for my own mail. I checked the rule hits on it now and the highest hitting SARE rules (in the last 35.000 messages) for me are: SARE_HEAD_8BIT_SPAM (6% hits on ham!) SARE_GIF_ATTACH (20% hits on ham!) SARE_MSGID_LONG40 (almost 100% of the hits are ham) SARE_ADULT2 (almost no ham) all the other rules are negligable (none hits on more than 0.02 % of spam), so it's probably really time to remove them. This structure might be much different on systems that accept almost every mail for SA processing, though. There the SARE might still be very helpful. I block 80% or more of spam at MTA level with RBL, greylisting, access.db and tight postfix configuration. Interestingly, I find that two of my own and very old rules are among the top 10 scorers for spam and hit almost no ham (< 1%). body SPAM_HEALTH_1 /pharmacy/i score SPAM_HEALTH_1 1.0 body SPAM_BUY_9 /discount/i score SPAM_BUY_9 1.0 Might create more false positives on systems with more legitimate English ham traffic, though ,-) Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com
