Thank you Martin, I will give it a try to your pormanteu, appreciated for sharing it.
Regards, Sergio On Fri, Nov 25, 2011 at 12:13 PM, Martin Gregorie <mar...@gregorie.org>wrote: > On Fri, 2011-11-25 at 11:49 -0600, Sergio wrote: > > I have the following rule where I wrote all the HELO spammers that SA > > didn't caught, I insert the new HELO everytime that I found one. My > concern > > is, is too much for just one rule or the rule can grow without limit? > > > When I asked this question a while back I was told that "several MB" > should be OK. Currently my largest rule has 371 alternatives. It and a > few friends are passed to SA as a 24 kb .cf file. > > If you're finding your rule is starting to get difficult to maintain, > take a look at my rule assembly tool, which is designed to allow such > rules to be defined in an easily edited file for each rule that are used > to create a single .cf file. See: > http://www.libelle-systems.com/free/portmanteau/portmanteau.tgz > > I was thinking of using a server plus plugin to do this but was > convinced that this 'portmanteau rule' approach was better: it certainly > works well for me. > > > Martin > > > > > header CHARLY_RULE1 ALL =~ > > > /(actaddonuniverse\.net|albeitnetworks\.com|allotic\.info|andersonbolt\.info|atefchoca\.info|backtobackfunding\.com|baskan\.info|betabel\.info|black-and-whiteticket\.info|bodygid\.info|brevardphysicians\.net|cheetloope\.info|circuitfivenine\.com|claimatic\.info|cmasyria\.com|complementhold\.com|CORE5PUMPER2|dauksstold\.info|dtsetfieri\.info|eshisha\.org|evegashotels\.com|felisranty\.info|finkleandthecleanshorts\.com|fisterfarms\.info|furium\.info|furizer\.info|gardenhowevercity\.net|grownvegetables\.com|hookerdaybyday\.info|hostalmiraflores\.com|hotrodbailbondsks\.com|juddy\.org|laughsidecant\.net|layeredvpnzervices\.com|lyonlandscapema\.com|maritimecranesimulator\.com|miiiley\.com|mixcomstar\.net|monitorstarway\.com|naturopathyport\.info|netcontrolusa\.com|pataboden\.info|peoriachat\.com|powerfulrun\.com|print2floors\.com|relacionesy\.com|slowlybuymorning\.info|stonyroadalbum\.com|straighttin\.info|sumejorweb\.com|surelycomplainsecretary\.info|teuksull\.info|theharborccc\.org|themiamibeachheat\.com|thoroughlydevelopment\.info|tivolicn\.com|whaukferth\.com|barrchickenjoint\.info)/i > > describe CHARLY_RULE1 Charly Spammers > > score CHARLY_RULE1 11 > > > > Regards, > > > > Sergio > > > >
