Reply to: R. Scott Perry
Re: [Declude.JunkMail] Weight Fix? on Thursday 1:16:53 PM
We have not seen it error here. It adds 'em up and HOLDs all
exceeding the limit just fine. We basically set all switches to
WARN except WEIGHT10 and then we can see just how well each
combination of tests adds up. I'd say about 80-85% of all spam
is caught now with very very few legit mails and the Imail
keyword filters are picking up most of the rest..
This feature adds an 'intelligence' to catching spam..
--
Roger Heath
[EMAIL PROTECTED]
Here's the original how-to from Scott:
The second is a weighting system (that was discussed here recently). With
it, you can assign each test a "weight", and you can have a new test that
will only fail if a total weight value is reached. For example, you could
have ORDB assigned a weight of 5, SPAMCOP a weight of 8, and SPAMHEADERS a
weight of 3, along with a "WEIGHT10" test that would get triggered if a
weight of 10 was reached. If just ORDB and SPAMHEADERS failed (a total of
8), the WEIGHT10 test would not be triggered. If the SPAMCOP test failed,
it would not trigger the WEIGHT10 test. But, if the SPAMCOP test and
either the ORDB or SPAMHEADERS tests failed, the WEIGHT10 test would be
triggered.
Without much experimentation, we were able to set it up so that the
weighting system catches about 95% of the spam at our spamtrap. The only
false positive we are aware of was a canned response that we got from
Network Solutions (to an E-mail that they claimed would receive a
personalized reposonse), because they fail the NOPOSTMASTER test, NOWHOIS
test, and REVDNS tests (which had a total weight of 13 the way we set it
up, and a limit of 10). Given that Network Solutions wants us to pay
$10,000 to let people do Whois lookups on our web site, it didn't really
bother me at all that it was caught.
To use the new weighting system, you should look at the new global.cfg
file, which shows how the entries should look. The definition for each
test now has 2 extra numbers added to the end (tests that did not already
have 4 pieces of information associated with them, such as "REVDNS revdns",
need to have a placeholder, so they will now look like "REVDNS revdns x x
10 0"). The first of the two new numbers indicates the weight if a test
fails, while the other number indicates the weight if a test does not fail
(which is normally 0).
You can then add a test using the type "weight", such as "WEIGHT10 weight x
x 20 0", which would get triggered if the total weight was 20 or higher.
----- Copy of Original Message(s): -----
>>I remember several announcements in the past two weeks (since the official
>>1.30 beta started), that there was going to be a fix in the respective next
>>day or two that would at least re-fix the weight test?
R> It's actually only been about a week -- the holidays seem to make it seem
R> longer. The holidays did delay the new release, which should be out later
R> today or tomorrow.
R> -Scott
R> ---
R> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
R> ---
R> This E-mail came from the Declude.JunkMail mailing list. To
R> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
R> type "unsubscribe Declude.JunkMail". You can E-mail
R> [EMAIL PROTECTED] for assistance. You can visit our web
R> site at http://www.declude.com .
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
