Hi,
>> rawbody __CCM_UNSUB
>> /"https?:..visitor\.constantcontact.com\/[^<>]{60,200}>SafeUnsubscribe</
>
> Ouch! Rawbody, that hurts.
Do you mean that it's much more resource-intensive than a regular
"body" check? When is it necessary (or possible) to use it over the
URIDetail substitute you mentioned?
For example, I have to use "rawbody" here because I'm searching within
HTML tags:
rawbody DDN_SPAM_3 /\/.{5}\-.{4}\-.{3}\/.{5}\-.{4}\-.{3}\-1\.jpg"
border=0\>\<\/a\>\<br\>/
describe DDN_SPAM_3 New DDN Spam
score DDN_SPAM_3 2.201
However, I suspect it's pretty resource-intensive, and I have several
of them, along with dozens of rules like:
rawbody __SARE_HTML_INV_TAG /\w<\!\w{18,60}>\w/i^M
Is there a way to easily measure the overhead of a particular rule?
I'd love to find out which rules are consuming the most resources.
Certainly as the number of rules have increased, the constant load on
the server has increased. Does everyone systematically run sa-compile
on their rules?
Thanks,
Alex
