Rule number 5 million rolled on by this week. We found the highest rule seven times, which was rule 5 million and 429.
C:\MessageSniffer>grep -P "Final\t" munged.2012062?.log | cut -f7 | usort | uniq -c | usort -k2 -n -r 2>nul | head 7 5000429 6 5000190 9 5000187 2 5000186 1 5000170 3 4999799 1 4999618 6 4999419 1 4999415 4 4999088 Andrew 8) -----Original Message----- From: Message Sniffer Community [mailto:sniffer@sortmonster.com] On Behalf Of Colbeck, Andrew Sent: Thursday, June 21, 2012 9:15 AM To: Message Sniffer Community Subject: [sniffer] Creeping higher on those rule numbers Via the GnuWin32 tools on my Windows server: C:\MessageSniffer>grep -P "Match\t" munged.2012062?.log | cut -f7 | usort | uniq -c | usort -k2 -n -r 2>nul | head 2 4991501 8 4991483 8 4991462 8 4991459 8 4991457 8 4991456 8 4991446 6 4991286 3 4991284 11 4991231 >From the top down, this is the top ten highest rule numbers (column 2) that I've seen today and yesterday, and their volume (column 1). So, the highest rule number I've seen in the last two days is 4,991,501 and I've seen it twice. That was the list of rules I've seen. Here's the list of rules that were matched as the "winning" rule for the message scanned: C:\MessageSniffer>grep -P "Final\t" munged.2012062?.log | cut -f7 | usort | uniq -c | usort -k2 -n -r 2>nul | head 2 4991501 8 4991446 6 4991286 3 4991284 3 4991231 6 4991221 1 4991178 1 4991130 1 4991120 5 4991105 (Oh, and I replaced my License ID with the text "munged" before I pasted the command line into this email.) Andrew 8) ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. This list is for discussing Message Sniffer, Anti-spam, Anti-Malware, and related email topics. For More information see http://www.armresearch.com To unsubscribe, E-mail to: <sniffer-...@sortmonster.com> To switch to the DIGEST mode, E-mail to <sniffer-dig...@sortmonster.com> To switch to the INDEX mode, E-mail to <sniffer-in...@sortmonster.com> Send administrative queries to <sniffer-requ...@sortmonster.com> ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. This list is for discussing Message Sniffer, Anti-spam, Anti-Malware, and related email topics. For More information see http://www.armresearch.com To unsubscribe, E-mail to: <sniffer-...@sortmonster.com> To switch to the DIGEST mode, E-mail to <sniffer-dig...@sortmonster.com> To switch to the INDEX mode, E-mail to <sniffer-in...@sortmonster.com> Send administrative queries to <sniffer-requ...@sortmonster.com>