SA Tests

["Kevin W. Gagel" <ga...@cnc.bc.ca>]

I've been looking into my installation of SA for ways to improve
performance. Things like using blacklists that SA tests for so I can block
(if appropriate) before SA tests a message only to have it discarded later
because it scored to high. So created a script to parse my logs and
identify each test that a message triggered and to count up all the times
that that test was hit.

The results are pretty enlightening to me but they have also prompted me to
wonder about a couple of things.

First, the Wiki says to disable a test just give it score of 0. Does that
tell SA to not bother testing that test or does it simply discard any
results for a test that scored 0? I ask because if I set a score to 0 to
gain better performance I don't want SA running the test at all then.

Second, the Wiki has 724 tests listed on the page which lists all the
tests. Yet my script shows me that SA tested and found at least 926 tests
that were tripped at least once so far this month. So, how many tests is SA
actually running?

The results are here:
http://mail.cnc.bc.ca/users/gagel@cnc.bc.ca/spamassassin/

The hits file is the gawk script I made to parse my log file for the info,
the other file is the complete results. The bottom of that file shows total
counts.


=================================
Kevin W. Gagel
Network Administrator
Information Technology Services
(250) 562-2131 local 5448
My Blog:
http://mail.cnc.bc.ca/blogs/gagel
My File share:
http://mail.cnc.bc.ca/users/gagel

-------------------------------------------------------------------
The College of New Caledonia, Visit us at http://www.cnc.bc.ca
Virus scanning is done on all incoming and outgoing email.
Anti-spam information for CNC can be found at http://avas.cnc.bc.ca
-------------------------------------------------------------------

Re: SA Tests

[Theo Van Dinter <fe...@apache.org>]

On Wed, Dec 19, 2007 at 02:55:27PM -0800, Kevin W. Gagel wrote:
> First, the Wiki says to disable a test just give it score of 0. Does that
> tell SA to not bother testing that test or does it simply discard any
> results for a test that scored 0?

Setting the score to 0 stops the rule from running.

> Second, the Wiki has 724 tests listed on the page which lists all the
> tests. Yet my script shows me that SA tested and found at least 926 tests
> that were tripped at least once so far this month. So, how many tests is SA
> actually running?

It depends on many factors: what plugins you have enabled, what version you're
running, what update version you have installed if any, what third party rules
you're using if any, what local rules you're using if any, etc, etc.

I don't think there's a really easy way to answer that question.

-- 
Randomly Selected Tagline:
"But you have to allow a little for the desire to evangelize when you
 think you have good news."         - Larry Wall