Razor will by default alert if *any* mime part of the email is in the database, not just the "body". So if a spam message comes by with an embedded background image and is reported by a few people both the message and the background image will be listed as spam. If later a nonspam message uses the same embedded image, it will be reported by razor-check as being spam because of the image.
Now, that sounds pretty bad, but razor does have the concept of "contention" where the same mime part commonly appears in both spam and nonspam and stops considering them spam parts, however this relies on you revoking the messages that are false hits.
You can see which mime part was matched if you look at the output of razor-check -d.
You can also force razor to only match if all non-contention mime parts are spam, instead of any one part. This can cause the false negative rate to go up a lot, but will drive the false positive rate down quite a lot too.
In your razor-agent.conf you can set the logic_method to 5 to change this:
#flag if any non-contention part listed (default setting)
#logic_method = 4
#flag message only if all non-contention parts are listed
logic_method = 5
Personally I run razor with logic_method 5 because I'd much rather have a razor setup that I can have a very strong confidence in it not being false positive than one which catches a lot of spam.
At 09:15 AM 1/22/2003 -0500, Fox wrote:
This morning I have two razor false positives. I have -lm 5 running with 2.20.One is a very confidential message between my company and our law firm about a specific case, which I cannot possibly post to this list or even talk about. Certainly not going to be a duplicate. And then there is the the one below. There _must_ be hash collisions going on. Fox
------------------------------------------------------- This SF.net email is sponsored by: Scholarships for Techies! Can't afford IT training? All 2003 ictp students receive scholarships. Get hands-on training in Microsoft, Cisco, Sun, Linux/UNIX, and more. www.ictp.com/training/sourceforge.asp _______________________________________________ Razor-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/razor-users
