----- Original Message ----- From: "Kevin Bilbee" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, July 27, 2003 1:03 AM Subject: [Declude.JunkMail] Filter processing
> When there is a hit in a filter file does declude continue to procees the > filer or stop? I continues through the end of the file, however, Declude will only report the last line that matched out of the file. Some of us have asked if Declude could be made to log all lines that match with a log setting of MID or higher, but I don't think that has happened yet. > If it stops then it would be better to have the lines that hit the most at > the top of the filter text file. It will parse the entire file adding weight for every unique positive match, but will only count a single match once per e-mail. So, for example, if you filter on the word "sex" (5 points), and "sex" is found five times in a single e-mail message, the weight that has been set in your filter file for "sex" will only be applied once, not multiplied by 5 (the reported filter weight would be 5). However, if you filter on "sex" (5 points) and "drugs" (3 points) and "rock & roll" (1 point), and each word or phrase is found one or more times in a single message, the weight of each single matched word or phrase will be added together and that's what will be reported as the filter weight (9 points in this case). > I have already noticed we get the most HELO hits on our own IP addresses. So > with this thinking declude would do less processing if they are at the > beginning of the file. Doesn't matter, Declude will still parse the entire file. The logic behind this is that you would want to add weight for every match that is found in the filter file, not just the first one (this is especially true for the body, subject, and header filter files). Just curious why your own IP addresses or FQHNs would be listed in your HELO filter file? > If this is the case I think I will write a filter optimizer. It would go > through the log files and count the number of hits on particular lines in > the specified filter. Then rewrite the file with the most hit lines at the > top. Sounds like it would be a good optimization technique if the filter files were parsed till they found their first match. But as it works now, all filter files are always parsed to the end of file. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
