You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ronnie Tartar <rt...@symbiostech.com> on 2006/04/20 23:57:58 UTC
Good ruleset
I am struggling with a good set of rules to enable with the rulesdujour.
Some of my spam scores are in the 30's etc... Now, maybe I've enabled too
many rules, I am on v3.1.1 on FC4. Any advice would be helpful. I am
running it with Amavis-new, mysql.
Thanks
RE: Good ruleset
Posted by Ronnie Tartar <rt...@symbiostech.com>.
Nevermind, figured it out, it was already doing it.
Thanks
-----Original Message-----
From: Ronnie Tartar [mailto:rtartar@symbiostech.com]
Sent: Friday, April 21, 2006 5:50 AM
To: users@spamassassin.apache.org
Subject: RE: Good ruleset
Is ther anyway to put the spam score in the header of everymail? Seem to be
getting a lot of spam through the filter, just want to see what kind of
scoring it is getting on everything.
Thanks
-----Original Message-----
From: jdow [mailto:jdow@earthlink.net]
Sent: Friday, April 21, 2006 12:21 AM
To: users@spamassassin.apache.org
Subject: Re: Good ruleset
From: "Matt Kettler" <mk...@comcast.net>
> Ronnie Tartar wrote:
>> I have all the default rules that come with the package, and the
>> following in the rulesdujour config
>>
>> TRIPWIRE SARE_ADULT SARE_OBFU0 SARE_OBFU1 SARE_URI0 SARE_URI1
>> SARE_HTML_ENG SARE_FRAUD SARE_SPOOF SARE_RANDOM SARE_STOCKS"
>>
>> Do you think that is too much?
>>
>
> No.. I use most of those myself.
We use about forty rule sets here. I probably could trim some of them.
However, every time I do that some spammer reads my mind and starts using
formerly neatly filtered tricks.
{O.O}
RE: Good ruleset
Posted by Ronnie Tartar <rt...@symbiostech.com>.
Is ther anyway to put the spam score in the header of everymail? Seem to be
getting a lot of spam through the filter, just want to see what kind of
scoring it is getting on everything.
Thanks
-----Original Message-----
From: jdow [mailto:jdow@earthlink.net]
Sent: Friday, April 21, 2006 12:21 AM
To: users@spamassassin.apache.org
Subject: Re: Good ruleset
From: "Matt Kettler" <mk...@comcast.net>
> Ronnie Tartar wrote:
>> I have all the default rules that come with the package, and the
>> following in the rulesdujour config
>>
>> TRIPWIRE SARE_ADULT SARE_OBFU0 SARE_OBFU1 SARE_URI0 SARE_URI1
>> SARE_HTML_ENG SARE_FRAUD SARE_SPOOF SARE_RANDOM SARE_STOCKS"
>>
>> Do you think that is too much?
>>
>
> No.. I use most of those myself.
We use about forty rule sets here. I probably could trim some of them.
However, every time I do that some spammer reads my mind and starts using
formerly neatly filtered tricks.
{O.O}
Re: Good ruleset
Posted by jdow <jd...@earthlink.net>.
From: "Matt Kettler" <mk...@comcast.net>
> Ronnie Tartar wrote:
>> I have all the default rules that come with the package, and the following
>> in the rulesdujour config
>>
>> TRIPWIRE SARE_ADULT SARE_OBFU0 SARE_OBFU1 SARE_URI0 SARE_URI1 SARE_HTML_ENG
>> SARE_FRAUD SARE_SPOOF SARE_RANDOM SARE_STOCKS"
>>
>> Do you think that is too much?
>>
>
> No.. I use most of those myself.
We use about forty rule sets here. I probably could trim some of them.
However, every time I do that some spammer reads my mind and starts using
formerly neatly filtered tricks.
{O.O}
Re: Good ruleset
Posted by Matt Kettler <mk...@comcast.net>.
Ronnie Tartar wrote:
> I have all the default rules that come with the package, and the following
> in the rulesdujour config
>
> TRIPWIRE SARE_ADULT SARE_OBFU0 SARE_OBFU1 SARE_URI0 SARE_URI1 SARE_HTML_ENG
> SARE_FRAUD SARE_SPOOF SARE_RANDOM SARE_STOCKS"
>
> Do you think that is too much?
>
No.. I use most of those myself.
RE: Good ruleset
Posted by Ronnie Tartar <rt...@symbiostech.com>.
I have all the default rules that come with the package, and the following
in the rulesdujour config
TRIPWIRE SARE_ADULT SARE_OBFU0 SARE_OBFU1 SARE_URI0 SARE_URI1 SARE_HTML_ENG
SARE_FRAUD SARE_SPOOF SARE_RANDOM SARE_STOCKS"
Do you think that is too much?
Thanks
-----Original Message-----
From: Matt Kettler [mailto:mkettler@evi-inc.com]
Sent: Thursday, April 20, 2006 7:30 PM
To: Ronnie Tartar
Cc: spamassassin-users@incubator.apache.org
Subject: Re: Good ruleset
Ronnie Tartar wrote:
> I am struggling with a good set of rules to enable with the rulesdujour.
> Some of my spam scores are in the 30's etc... Now, maybe I've enabled
> too many rules, I am on v3.1.1 on FC4. Any advice would be helpful.
Do not enable antidrug. These rules are included in SA 3.0.0 and higher
anyway, and the separate antidrug.cf file is for users stuck with SA 2.6x or
older.
Check the memory footprint of your spamd instances. If they're really huge,
look at the rulesets you have and consider cutting out some that are large
files.
Generally bigevil, sa-blacklist, and sa-blacklist-uri are big memory hogs
that shouldn't be used by most people unless they've got memory to spare.
Any file that's > 128k or so in size should be questioned.
Re: Good ruleset
Posted by Matt Kettler <mk...@evi-inc.com>.
Ronnie Tartar wrote:
> I am struggling with a good set of rules to enable with the rulesdujour.
> Some of my spam scores are in the 30's etc... Now, maybe I've enabled too
> many rules, I am on v3.1.1 on FC4. Any advice would be helpful.
Do not enable antidrug. These rules are included in SA 3.0.0 and higher anyway,
and the separate antidrug.cf file is for users stuck with SA 2.6x or older.
Check the memory footprint of your spamd instances. If they're really huge, look
at the rulesets you have and consider cutting out some that are large files.
Generally bigevil, sa-blacklist, and sa-blacklist-uri are big memory hogs that
shouldn't be used by most people unless they've got memory to spare. Any file
that's > 128k or so in size should be questioned.