He could also use
WEIGHT02 weightmatch x x 2 0
Since weightmatch matches exactly that weight. I will recommend using
little bit bigger catch boxes though.
I think you will get a very good picture by having ranges set up along
these lines:
WEIGHT00-04 weightrange x x 0 4
WEIGHT05-09 weightrange x x 5 9
WEIGHT10-14 weightrange x x 10 14
WEIGHT15-19 weightrange x x 15 19
WEIGHT20-24 weightrange x x 20 24
WEIGHT25 weight x x 25 0
As long as you still have a line similar to
XINHEADER X-Spam-Tests-Failed: %TESTSFAILED% [%WEIGHT%]
In your global.cfg file you should still be able to see the true weight.
Then if you see one range with false positives, you can expand it for
more detail. From using the system and reading posts on this list, it
appears most admins adjust the weight of the failed test and leave the
weight based actions constant, the range could just as easily be between
0 and 200 as 0 and 20, it is all in the value of failed tests. I
personally have it between 0 and 30 (some filter test can actually have
values in the hundreds).
Thanks,
Chuck Frolick
ArgoNet, Inc.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Tuesday, February 18, 2003 11:59 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Making My Own Tests
>To that end I have created 25 tests...
>
>WEIGHT01
>WEIGHT02
>...
>WEIGHT24
>WEIGHT25
>
>which are defined just like WEIGHT10 and WEIGHT20.
One catch here is that an E-mail with a total weight of 25 will fail all
25
tests (if they are set up like the WEIGHT10 and WEIGHT20 tests). It
might
be better to define the tests as:
WEIGHT01 weightrange x x 1 1
WEIGHT02 weightrange x x 2 2
This way, an E-mail with a weight of 2 would fail just the WEIGHT02
test,
and would not fail the WEIGHT01 test.
>First of all, will what I outline with my new WEIGHT definitions even
work?
>I've never created my own test before so I don't know if I am doing it
>right.
Yes, it will work the way that you suggest (although depending on your
needs, the "weightrange" way may be better).
>Secondly, will testing for all of these weights but undue overhead on
the
>processing of e-mail?
No. You shouldn't notice the extra load.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
