On Thursday, July 29, 2004, 10:42:40 AM, Jorge wrote: JA> Has something happened lately (in the last 24-48 hours).
Nothing significant that I can see except for a higher than usual spike in spam through the evening hours last night. JA> Normally, I get small amounts (less than 10 a day) of spam that fail to JA> be detected by my combination of Message Sniffer and Spam Assasin (most JA> of the times Message Sniffer is the one that get all the messages that JA> Spam Assasin fail to detect). JA> Bur since 2 days ago, I've been getting about 60-80 daily, that do not JA> get detected. I've managed to forward them all to [EMAIL PROTECTED], JA> but I still keep getting duplicate of the same spam I reported 12+ hours JA> earlier, even tough my rulebase has updated several times already. JA> What the reason exactly for this suddent jump in non-detection? Have old JA> rules been dropped out of the rulebase to get new ones in place? I've checked your account. It is up to date and it is set to it's maximum sensitivity (0.1). Nothing special happened in the last 2 days except that 3 days ago we had a spam storm and generated 757 rules in one day. The last two days have been 449 and 441. http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp Flow rates look ok too, showing a slight increase in capture rates (not the decrease I would expect if your conditions were systemic). http://www.sortmonster.com/MessageSniffer/Performance/FlowRates.jsp (We're up to 78.3% spam/ham - likely due to the evening hours being heavier than usual. There are usually day/night cycles in flow rates starting almost exactly on 00:00:00 and 12:00:00 hours.) Please check your log files for any errors. Please also zip up a few examples of the spam that are still getting through and send them to me at [EMAIL PROTECTED] I will research them to see if I can find anything special. We had another recent case like this that was apparently solved by a change to the update script(s). You say your rulebase has been updated though - so that's not likely to be the problem. It may be worth a closer look though just to be sure. Our rulebase update coverage is nearly round the clock with only a few hours open - so it would be unusual for a spam to go 12+ hours without a rule unless there was no way to code a rule that was not too risky for some reason. Rules do get dropped periodically - though not for being old. Rules are dropped from active duty when they stop showing activity - which is why it is important to submit logs. It's possible that a rule may have been removed due to a false positive report... though it would be extremely rare for such a removal to cause any significant increase in spam leakage. I will know more when I see your zipped samples. Hope this helps, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
