We recommend to our sniffer customers that they hold messages so that they can recover any false positives that show up. Rather than looking through the held messages, keep them around for 30 days or so and if a false positive possibility is reported by a user then you can hunt down the message based on text or keywords provided in the complaint. If you find the message, you can report the false positive (or adjust your rules) and put the message(s) back into the queue.
With the volume of spam that we capture it is unreasonable to expect an SA to "view" all of it... but keeping it around with HOLD is a good way to play it safe and improve your filtering - no matter what technologies you are using. The periodic cleanup can be automated as well so that you never have to see any of the held messages unless you are hunting down a false positive possibility. Hope this helps, _M | -----Original Message----- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]]On Behalf Of Timothy C. Bohen | Sent: Wednesday, March 06, 2002 9:50 AM | To: [EMAIL PROTECTED] | Subject: [Declude.JunkMail] What exactly does HOLD do? | | | I am new to Junkmail and still getting it configured the way I want. | | So here is my question: | | Why would I want to HOLD messages? | | I mean the way I understand it is I would have to manually go through and | check them, and I REALLY don't want to mess with that. | | Thanks | | Timothy C. Bohen | CMSInter.Net LLC / Crystal MicroSystems LLC | =========================================== | web : www.cmsinter.net | email : [EMAIL PROTECTED] | phone : 989.235.5100 x222 | fax : 989.235.5151 | | --- | [This E-mail was scanned for viruses by Declude Virus | (http://www.declude.com)] | | --- | | This E-mail came from the Declude.JunkMail mailing list. To | unsubscribe, just send an E-mail to [EMAIL PROTECTED], and | type "unsubscribe Declude.JunkMail". You can E-mail | [EMAIL PROTECTED] for assistance. You can visit our web | site at http://www.declude.com . | | --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
