Re: __FILL_THIS_FORM_SHORT* rule slowness

2012-02-28 Thread John Hardin
On Tue, 28 Feb 2012, Axb wrote: On 02/28/2012 03:27 PM, John Hardin wrote: If there is community consensus that detecting fill-in-the-form spams isn't valuable enough to justify the overhead of running these (admittedly complex) rules, then I can disable them in my sandbox; but I'd like a

Re: __FILL_THIS_FORM_SHORT* rule slowness

2012-02-28 Thread Axb
On 02/28/2012 03:27 PM, John Hardin wrote: On Tue, 28 Feb 2012, Axb wrote: T __FILL_THIS_FORM_SHORT2 5.9169 5.9169 1 T __FILL_THIS_FORM_LONG2 5.9041 5.9041 1 T RAZOR2_CF_RANGE_E8_51_100 5.0010 5.0010 1 T __FILL_THIS_FORM_FRAUD_PHISH1 2.1362 2.1362 1 T __FILL_THIS_FORM_SHORT2 6.9687 6.9687 1 T

Re: __FILL_THIS_FORM_SHORT* rule slowness

2012-02-28 Thread John Hardin
On Tue, 28 Feb 2012, Axb wrote: T__FILL_THIS_FORM_SHORT25.91695.91691 T __FILL_THIS_FORM_LONG25.90415.90411 T RAZOR2_CF_RANGE_E8_51_1005.00105.00101 T __FILL_THIS_FORM_FRAUD_PHISH12.13622.13621 T__FILL_THIS_FORM_

Re: __FILL_THIS_FORM_SHORT* rule slowness

2012-02-28 Thread John Hardin
On Tue, 28 Feb 2012, dar...@chaosreigns.com wrote: Somebody came into IRC a few days ago saying SA was hanging on some emails. It turns out it was just taking "over 2 minutes". Not sure about the hardware. But when I checked the timings on the two samples he provided, I got this: T__F

Re: __FILL_THIS_FORM_SHORT* rule slowness

2012-02-28 Thread Axb
On 02/28/2012 03:03 PM, dar...@chaosreigns.com wrote: On 02/27, John Hardin wrote: These two rules seem to use as lot of processing time: __FILL_THIS_FORM_SHORT20.8015 __FILL_THIS_FORM_LONG20.7652 Is this consistent, or do you have specific messages where it's unusually slow? There a

Re: __FILL_THIS_FORM_SHORT* rule slowness

2012-02-28 Thread darxus
On 02/27, John Hardin wrote: > >These two rules seem to use as lot of processing time: > > > >__FILL_THIS_FORM_SHORT20.8015 > >__FILL_THIS_FORM_LONG20.7652 > Is this consistent, or do you have specific messages where it's > unusually slow? There are some edge cases that have triggered bad

Re: __FILL_THIS_FORM_SHORT* rule slowness

2012-02-27 Thread John Hardin
On Mon, 27 Feb 2012, dar...@chaosreigns.com wrote: On 02/27, Axb wrote: These two rules seem to use as lot of processing time: __FILL_THIS_FORM_SHORT20.8015 __FILL_THIS_FORM_LONG20.7652 Please remind me, how can I check these times? the HitFreqsRuleTiming plugin -- John Hardin KA

Re: __FILL_THIS_FORM_SHORT* rule slowness

2012-02-27 Thread darxus
On 02/27, Axb wrote: > These two rules seem to use as lot of processing time: > > __FILL_THIS_FORM_SHORT20.8015 > __FILL_THIS_FORM_LONG20.7652 Please remind me, how can I check these times? -- "Wash daily from nose-tip to tail-tip; drink deeply, but never too deep; And remember the nigh

Re: __FILL_THIS_FORM_SHORT* rule slowness

2012-02-27 Thread Axb
On 02/27/2012 04:11 PM, John Hardin wrote: On Mon, 27 Feb 2012, Axb wrote: These two rules seem to use as lot of processing time: __FILL_THIS_FORM_SHORT2 0.8015 __FILL_THIS_FORM_LONG2 0.7652 nearly a second/rule which is only used in metas seems a bit heavy. John, could you optimize them som

Re: __FILL_THIS_FORM_SHORT* rule slowness

2012-02-27 Thread John Hardin
On Mon, 27 Feb 2012, Axb wrote: These two rules seem to use as lot of processing time: __FILL_THIS_FORM_SHORT20.8015 __FILL_THIS_FORM_LONG20.7652 nearly a second/rule which is only used in metas seems a bit heavy. John, could you optimize them somewhat? Is this consistent, or do you

__FILL_THIS_FORM_SHORT* rule slowness

2012-02-27 Thread Axb
These two rules seem to use as lot of processing time: __FILL_THIS_FORM_SHORT20.8015 __FILL_THIS_FORM_LONG20.7652 nearly a second/rule which is only used in metas seems a bit heavy. John, could you optimize them somewhat? Thx