[sniffer] Rash of false positives

2005-11-08 Thread Darin Cox
Hi Pete, What's going on over there? We had somewhere between 5 and 10 times the usual number of Sniffer false positives this morning. They are across the board, so it's not just one rule that's catching them, or a particular set of senders or receivers. Hopefully you can get it under

Re: [sniffer] Rash of false positives

2005-11-08 Thread Computer House Support
Dear Darin, Thanks for the heads up. It's going to take me about 45 minutes to check the 9000 messages that were blocked by Sniffer last night, but I'll let you know if we experienced the same thing. Michael SteinComputer House www.computerhouse.com - Original Message -

Re: [sniffer] Rash of false positives

2005-11-08 Thread Darin Cox
We're seeing a continual stream of false positives. It's taking all of our time just to keep up with it at the moment. If something isn't done soon, we're going to have to disable sniffer. Darin. - Original Message - From: Computer House Support To: sniffer@SortMonster.com

Re: [sniffer] Rash of false positives

2005-11-08 Thread Paul Lushinsky
After reviewing all the blocked messages for the past 2 days on 2 different servers, I found no false positives. Do you happen to have an old rule base from several days again ? If so, try that to see if it temporarily resolves the false positives. -Original Message-From: "Darin Cox"

Re: [sniffer] Rash of false positives

2005-11-08 Thread Darin Cox
No, we automatically update with every notification of a new rulebase. Looking further, they started just before 5pm ET yesterday. So far, it's about 10 times the usual number of Sniffer false positives. We've sent quite a few this morning to false (at) for processing. Darin. -

Re: [sniffer] Rash of false positives

2005-11-08 Thread Scott Fisher
I don't know if I would call it a rash, but over the last week, I've submitted about 30 false positives. That's far more than average. I've developed a feeling that Message Sniffer has become "too tight". - Original Message - From: Darin Cox To: sniffer@SortMonster.com

Re: [sniffer] Rash of false positives

2005-11-08 Thread Darin Cox
I've submitted about 45 so far this morning. I normally submit at most a half dozen each morning. Darin. - Original Message - From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED] To: sniffer@SortMonster.com Sent: Tuesday, November 08, 2005 10:19 AM Subject: Re: [sniffer] Rash of false

Re: [sniffer] Rash of false positives

2005-11-08 Thread Darin Cox
Hi Pete, The rash of false positivesseems to have stopped with the last sniffer rulebase update at 10am ET. It had started with a rulebase update at 4:30pm ET yesterday, and continued through the updates at 8:40pm, 12am, 3am, and 6:20am today. I'd still like to know what happened, and how

Re[2]: [sniffer] Rash of false positives

2005-11-08 Thread Pete McNeil
On Tuesday, November 8, 2005, 11:02:09 AM, Darin wrote: Hi Pete, The rash of false positives seems to have stopped with the last sniffer rulebase update at 10am ET. It had started with a rulebase update at 4:30pm ET yesterday, and continued through the updates at 8:40pm, 12am, 3am, and

Re[4]: [sniffer] Rash of false positives

2005-11-08 Thread Pete McNeil
On Tuesday, November 8, 2005, 3:25:20 PM, Darin wrote: Hi Pete, There was a consistent stream of false positives over the mentioned time period, not just a blast at a particular time. They suddenly started at 5pm (shortly after a 4:30pm rulesbase update), and were fairly evenly spread