1. Place negative weight tests first. 2. While testing effectiveness of a single test, place it first or turn off the stop processing flag for a period of time.
Todd Holt Xidix Technologies, Inc Las Vegas, NV USA www.xidix.com 702.319.4349 > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) > Sent: Thursday, January 22, 2004 3:01 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Clarification > > If a filter is skipped by SKIPIFWEIGHT, at that point I am not concerned > about logging that filter, as I do not want it to run. Remember, > SKIPIFWEIGHT is only for filters. > > However, what if a message gets a high weight early, but then would get a > negative weight from a filter? You took action before the message had a > chance to get the negative weight. > > What if you are checking to see the effectiveness of one test compared to > others? If processing is stopped short, that test may not be run on all > messages. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Dave Doherty > > Sent: Thursday, January 22, 2004 1:00 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [Declude.JunkMail] Clarification > > > > John- > > > > Doesn't SKIPIFWEIGHT also defeat the logging of the skipped tests? > > > > -Dave Doherty > > Skywaves, Inc. > > > > ----- Original Message ----- > > From: "John Tolmachoff (Lists)" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Thursday, January 22, 2004 1:04 PM > > Subject: RE: [Declude.JunkMail] Clarification > > > > > > > I would like to see the SKIPIFWEIGHT option removed. If we had a > > > conditional option to stop when a specific weight is reached, then > there > > > would be not need for SKIPIFWEIGHT. In addition, why would anyone use > > > SKIPIFWEIGHT on less than every test...and why would anyone define one > > > test with a different SKIPIFWEIGHT value than another test? This > leads > > > me back to a HOLDIFWEIGHT/DELETEIFWEIGHT logic which optionally stops > > > processing when reached. > > > > Coming in late some my comments may be off. > > > > Scott has stated before that to stop all processing once a certain > weight > > has been reached would be difficult and/or problematic. That is where > > SKIPIFWEIGHT comes in. I use SKIPIFWEIGHT on all body filters, as those > > are > > the most expensive in terms of CPU cost. I then have body filters listed > > in > > order, from most effective to least effective or specific target. > Example, > > I > > have a custom body filter on my server for one client only. That is the > > last > > filter to run. > > > > Also, another reason to not stop processing is if you are doing log > > analysis > > and adjust filters or blocks based on that analysis. If you stop > > processing > > at say 35, but the message would have failed 5 other tests, those tests > > will > > then not show up in log analysis. > > > > John Tolmachoff > > Engineer/Consultant/Owner > > eServices For You > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus > (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
