I understand what you are asking for. I believe there is currently no simple way of what you want. If a developer is listening, it would be nice to have a switch added that JUST adds the list of rules that hit to the syslog. Debug is too much info, and regular logging just says Yes or No.
However even if you get this feature Rickhardur, it may not do you as much good as you think. So the rules hit 300 times in a day, what would that tell you? Without a copy of the email it hit, the numbers do little for server tweaking. At least that is what we are finding. The SARE Ninjas are actively discussing putting our Micro-GA results into comments for each rule. So far everyone is taking our word that these rules are good. (And you should! The Ninjas are relentles when it comes to testing!) But it would be good if we showed you the data to back up our claims. Some people want rules by type or category. Others only want the best hitting. Other still want only above a certain S/O rating. Only a database for rules can satisfy everyone. That is a loooooong term goal of SARE. --Chris SARE Ninja #1 > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Monday, March 29, 2004 8:40 AM > To: [EMAIL PROTECTED] > Subject: SA logging and big sites ? > > > > After a few months of testing with satisfying results, it > loks like we might > route all our incoming emails through SA. > > What bothers me is that SA provides very little logging > capability and with > over 2000 users and 20000 emails/day, trying to tune the > ruleset is like > controling the Mars rovers without video feedback. > > My problem is that even though SA has, so far, been > remarkably eficcient in > flagging Spam, the subjects we deal with routinely contain > phrases that add > spampoints, such as "Dear <something>" and "millions of dollars". > > Has anyone tried to add more logging to SA ? I.e what I am > looking for is > what rules match for each mail. > > Thanks, > -- > R�khar�ur Egilsson >
