Re: Number of rules

Quoting Karsten Bräckelmann <guenther@xxxxxxxxxxxxx>:

> On Fri, 2009-07-31 at 06:07 -0700, John Hardin wrote:
> > On Fri, 31 Jul 2009, Dennis B. Hopp wrote:
> >
> > > I cleared my maia statistics a couple of days ago.  Since then    
> > BAYES_00 has
> > > triggered 4510 times, BAYES_99 2366 times and BAYES_50 1568 (all the other
> > > BAYES_XX are less then 1000 times).
> >
> > Do they all add up to about 45,000?
>
> Doh!  Good catch, John.
>
> No, they cannot possibly.  Do the math. These 3 rules are less than 10k,
> remaining 35k. Each less than 1k hits means we need another > 35 rules.
> However, there are merely 6 ones left.
>
>   $ grep -c BAYES_ 50_scores.cf
>   9
>
> The stats are incorrect.  Well, unless the lions share is processed with
> Bayes disabled, or otherwise not processed by SA.

I do have sanesecurity rules in clamav which may be filtering messages
before spamassassin sees them which would account for some of the
difference between the total BAYES triggered and messages received.
We also relay all outbound mail through these same servers but do not
send outbound mail through spamassassin which again would make for  
some difference.  I should have thought to mention that before.

I couldn't get sa-stats to give me any useful information.  I did get
amavis-logwatch and I am not sure if I like what it's showing me.  I ran it
against the last few maillogs I have so it encompasses basically the  
last month.  Here is the relevant parts of the output:

http://pastebin.com/m59ddaf1d

If I'm reading that correctly less then 50% of mail is actually
being filtered (seems like it should be higher then that). Those stats  
don't count the messages we completely reject.  We don't reject solely  
on one RBL but use policy-weightd to reject messages.  I guess I could  
just let all messages through to SA for a few days to see how things  
change, but I don't see the point of wasting CPU/Memory for messages  
that are pretty much guaranteed spam.

Here is the stats on my postfix:

http://pastebin.com/m15d2533e

Maybe I'm worried about nothing but given some of the spam that I get  
forwarded that gets through (some very obvious spam) and then to see  
what rules it hits just makes me think that something isn't quite right.

--Dennis