You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by RobertH <ro...@abbacomm.net> on 2009/01/22 23:54:41 UTC
experienced comments on these rules and their effectiveness in large installations please
would those of you in the know please comment based upon your data re: the
below rules and their effectiveness in hitting spam vrs ham and/or false
readings in diverse or fairly diverse large scale isp and/or corporate
installations please
RCVD_IN_BL_SPAMCOP_NET
RCVD_IN_DSBL
RCVD_IN_NJABL_CGI
RCVD_IN_NJABL_MULTI
RCVD_IN_NJABL_PROXY
RCVD_IN_NJABL_RELAY
RCVD_IN_NJABL_SPAM
RCVD_IN_SBL
RCVD_IN_SORBS_BLOCK
RCVD_IN_SORBS_DUL
RCVD_IN_SORBS_HTTP
RCVD_IN_SORBS_MISC
RCVD_IN_SORBS_SMTP
RCVD_IN_SORBS_SOCKS
RCVD_IN_SORBS_WEB
RCVD_IN_SORBS_ZOMBIE
RCVD_IN_XBL
RCVD_IN_PBL
DNS_FROM_AHBL_RHSBL
RCVD_IN_MAPS_RBL
RCVD_IN_MAPS_DUL
RCVD_IN_MAPS_RSS
RCVD_IN_MAPS_NML
we are just wondering if we should use them or not, and specifically which
ones are the best, if any at all.
RE: experienced comments on these rules and their effectiveness in large installations please
Posted by RobertH <ro...@abbacomm.net>.
>
> Sorry, don't understand what you mean.
>
> Kai
>
recently i put a small list of RBL rulenames we have zero'd out on the list
to ask if anyone would share their experience and comments about how
effective they are in stopping spam in their large installations.
we have them zero'd out cause we were not using them
you mentioned to find out how good they are to try the ones that are not
being used by the MTA for awhile and then going to the config at some later
date and setting skip_rbl_checks to 1 and then monitoring more
i asked, doesnt that shut off network tests (in general) that we always want
to have running
if not, how does SA know only to stop using certain rules and are they only
ones with URIBL in them?
a long time ago Ratatouille aka Mouss said do this to get info to zero out
egrep "_(SBL|XBL|PBL|SPAMCOP|DSBL|SORBS|NJABL|AHBL|MAPS)"
/path/to/share/spamassassin/50_scores.cf | grep -v URIBL | awk '{print
"score " $2 " 0"}' > scores.cf
i realize that one or more no longer function as i am just quoting the full
script
thanks
- rh
Re: experienced comments on these rules and their effectiveness in large installations please
Posted by Kai Schaetzl <ma...@conactive.com>.
RobertH wrote on Thu, 29 Jan 2009 14:18:56 -0800:
> we use other network tests so turning off rbl checks wouldnt be a good idea
> right?
Sorry, don't understand what you mean.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
RE: experienced comments on these rules and their effectiveness in large installations please
Posted by RobertH <ro...@abbacomm.net>.
>
> fairly easy. run one week with default settings and one week
> with "skip_rbl_checks 1". Then compare.
> In general, these rules will provide hits if you don't use
> RBLs at MTA level. If you use RBLs to reject at MTA level
> they won't hit much.
>
> Kai
>
> --
> Kai Schätzl, Berlin, Germany
kai
we have them zero'd out for now.
we use other network tests so turning off rbl checks wouldnt be a good idea
right?
:-)
- rh
Re: experienced comments on these rules and their effectiveness in large installations please
Posted by Kai Schaetzl <ma...@conactive.com>.
RobertH wrote on Thu, 22 Jan 2009 14:54:41 -0800:
> would those of you in the know please comment based upon your data re: the
> below rules and their effectiveness in hitting spam vrs ham and/or false
> readings in diverse or fairly diverse large scale isp and/or corporate
> installations please
fairly easy. run one week with default settings and one week with
"skip_rbl_checks 1". Then compare.
In general, these rules will provide hits if you don't use RBLs at MTA
level. If you use RBLs to reject at MTA level they won't hit much.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
Re: experienced comments on these rules and their effectiveness in
large installations please
Posted by Justin Mason <jm...@jmason.org>.
On Thu, Jan 29, 2009 at 22:17, RobertH <ro...@abbacomm.net> wrote:
>
>
>
>> >
>> A general grasp of how it performs across a diverse range of
>> email can be gotten from the STATISTICS-set*.txt files
>> included in the tarball.
>> Look in the rules directory.
>>
>> The file contains the mass-check results that were used in
>> score generation. Generally the best numbers to look at are
>> %spam, mostly to see how often a rule hits, and S/O, to see
>> how accurate it is. S/O is the ratio of spam to overall hits,
>> where a rule with a S/O of 1.0 hits only spam, and never any
>> nonsapm, while a S/O of 0 never hits any spam, only nonspam.
>>
>>
>>
>
> how often is that file on mass-check updated?
>
> daily?
that file is only updated at release time. However you can also see the results
at http://ruleqa.spamassassin.org/ . Note that nightly mass-checks don't
check the network rules; those are checked weekly.
--j.
RE: experienced comments on these rules and their effectiveness in large installations please
Posted by RobertH <ro...@abbacomm.net>.
> >
> A general grasp of how it performs across a diverse range of
> email can be gotten from the STATISTICS-set*.txt files
> included in the tarball.
> Look in the rules directory.
>
> The file contains the mass-check results that were used in
> score generation. Generally the best numbers to look at are
> %spam, mostly to see how often a rule hits, and S/O, to see
> how accurate it is. S/O is the ratio of spam to overall hits,
> where a rule with a S/O of 1.0 hits only spam, and never any
> nonsapm, while a S/O of 0 never hits any spam, only nonspam.
>
>
>
how often is that file on mass-check updated?
daily?
- rh
Re: experienced comments on these rules and their effectiveness in
large installations please
Posted by Matt Kettler <mk...@verizon.net>.
RobertH wrote:
> would those of you in the know please comment based upon your data re: the
> below rules and their effectiveness in hitting spam vrs ham and/or false
> readings in diverse or fairly diverse large scale isp and/or corporate
> installations please
>
A general grasp of how it performs across a diverse range of email can
be gotten from the STATISTICS-set*.txt files included in the tarball.
Look in the rules directory.
The file contains the mass-check results that were used in score
generation. Generally the best numbers to look at are %spam, mostly to
see how often a rule hits, and S/O, to see how accurate it is. S/O is
the ratio of spam to overall hits, where a rule with a S/O of 1.0 hits
only spam, and never any nonsapm, while a S/O of 0 never hits any spam,
only nonspam.
Re: experienced comments on these rules and their effectiveness in large installations please
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 22.01.09 14:54, RobertH wrote:
> would those of you in the know please comment based upon your data re: the
> below rules and their effectiveness in hitting spam vrs ham and/or false
> readings in diverse or fairly diverse large scale isp and/or corporate
> installations please
I think they all have scores set according to thei effectiveness and
FP-rate.
Note that _DUL and _PBL only apply on last external IP, thus it's important
to have trusted_networks and internal_networks set up correctly.
> RCVD_IN_BL_SPAMCOP_NET
> RCVD_IN_DSBL
this one is obsolete (dsbl is dead) . run sa-update to get fresh versions of
all rules.
> RCVD_IN_NJABL_CGI
> RCVD_IN_NJABL_MULTI
> RCVD_IN_NJABL_PROXY
> RCVD_IN_NJABL_RELAY
> RCVD_IN_NJABL_SPAM
> RCVD_IN_SBL
> RCVD_IN_SORBS_BLOCK
> RCVD_IN_SORBS_DUL
> RCVD_IN_SORBS_HTTP
> RCVD_IN_SORBS_MISC
> RCVD_IN_SORBS_SMTP
> RCVD_IN_SORBS_SOCKS
> RCVD_IN_SORBS_WEB
> RCVD_IN_SORBS_ZOMBIE
> RCVD_IN_XBL
> RCVD_IN_PBL
> DNS_FROM_AHBL_RHSBL
> RCVD_IN_MAPS_RBL
> RCVD_IN_MAPS_DUL
> RCVD_IN_MAPS_RSS
> RCVD_IN_MAPS_NML
These are non-standard and I don't know if anyone published some
investigations and measurements here. Try searching...
> we are just wondering if we should use them or not, and specifically which
> ones are the best, if any at all.
I happily use them as they are distributed with SA (and sa-update). I don't
use MAPS*. So does our company (only I'm maintaining SA for last months)
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
If Barbie is so popular, why do you have to buy her friends?