Re: Number of rules

On Fri, 2009-07-31 at 10:36 -0500, Dennis B. Hopp wrote:
> I couldn't get sa-stats to give me any useful information.

AFAIK it understands spamd logs, not Amavis logs. You would need to
adjust the script for that -- as discussed just a few days ago.


> If I'm reading that correctly less then 50% of mail is actually
> being filtered (seems like it should be higher then that). Those stats  

Actually, the numbers you gave for the "last couple days" are even
lower. About one third, <15k out of 45k do have a BAYES_xx hit and thus
are scanned by SA.

I told you how to train your Bayes, if you're not satisfied with the
result. Whether you like it not, there really isn't an other way. FWIW,
blocking the obvious offenders early seems like a proper explanation for
Bayes not showing a lot of high hitters.

Anyway, considering the back and forth -- IMHO, you *first* should get a
clear picture how exactly your mail is being processed. I don't feel
like stabbing in the dark.


> Maybe I'm worried about nothing but given some of the spam that I get  
> forwarded that gets through (some very obvious spam) and then to see  
> what rules it hits just makes me think that something isn't quite right.

Forwarded -- as in reports by your users, or forwarded from external MXs
to yours? In the latter case, the obvious thing to check is your
internal and trusted network settings.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}