I have also noticed an increase in the amount of spam that got through, mainly on gatewayed domains. I did forward a bunch in the last 18 hours, hopefully that will help.
John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Pete McNeil > Sent: Thursday, July 29, 2004 8:22 AM > To: Jorge Asch > Subject: Re: [sniffer] Effectiveness (lately) > > On Thursday, July 29, 2004, 10:42:40 AM, Jorge wrote: > > JA> Has something happened lately (in the last 24-48 hours). > > Nothing significant that I can see except for a higher than usual > spike in spam through the evening hours last night. > > JA> Normally, I get small amounts (less than 10 a day) of spam that fail to > JA> be detected by my combination of Message Sniffer and Spam Assasin (most > JA> of the times Message Sniffer is the one that get all the messages that > JA> Spam Assasin fail to detect). > > JA> Bur since 2 days ago, I've been getting about 60-80 daily, that do not > JA> get detected. I've managed to forward them all to [EMAIL PROTECTED], > JA> but I still keep getting duplicate of the same spam I reported 12+ hours > JA> earlier, even tough my rulebase has updated several times already. > > JA> What the reason exactly for this suddent jump in non-detection? Have old > JA> rules been dropped out of the rulebase to get new ones in place? > > I've checked your account. It is up to date and it is set to it's > maximum sensitivity (0.1). Nothing special happened in the last 2 days > except that 3 days ago we had a spam storm and generated 757 rules in > one day. The last two days have been 449 and 441. > > http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp > > Flow rates look ok too, showing a slight increase in capture rates > (not the decrease I would expect if your conditions were systemic). > > http://www.sortmonster.com/MessageSniffer/Performance/FlowRates.jsp > > (We're up to 78.3% spam/ham - likely due to the evening hours being > heavier than usual. There are usually day/night cycles in flow rates > starting almost exactly on 00:00:00 and 12:00:00 hours.) > > Please check your log files for any errors. > > Please also zip up a few examples of the spam that are still getting > through and send them to me at [EMAIL PROTECTED] I will research them to see > if I can find anything special. > > We had another recent case like this that was apparently solved by a > change to the update script(s). You say your rulebase has been updated > though - so that's not likely to be the problem. It may be worth a > closer look though just to be sure. > > Our rulebase update coverage is nearly round the clock with only a few > hours open - so it would be unusual for a spam to go 12+ hours without > a rule unless there was no way to code a rule that was not too risky > for some reason. > > Rules do get dropped periodically - though not for being old. Rules > are dropped from active duty when they stop showing activity - which > is why it is important to submit logs. > > It's possible that a rule may have been removed due to a false > positive report... though it would be extremely rare for such a > removal to cause any significant increase in spam leakage. I will know > more when I see your zipped samples. > > Hope this helps, > _M > > > > > > This E-Mail came from the Message Sniffer mailing list. For information and > (un)subscription instructions go to > http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
