On Thu, 2004-05-13 at 15:27, [EMAIL PROTECTED] wrote: > What is more efficient from a processing perspective, having a single > large rule or multiple smaller rules? What is the ideal size for a > rule?
This has nothing to do with efficiency but keep in mind that the two alternatives will behave differently... > Im simplest terms: > > /one|t(?:wo|hree)|four/ This will trigger is one, two, three or four is encountered, BUT if they are all encountered it still only triggers once. > Or > > /one/ > > /t(?:wo|hree)/ > > /four/ With these three rules the same message containing one, two, three and four will get hit three times... Matt already explained that the first is more efficient "memory-wise" but if by efficiency you mean scoring spam as high as possible the second alternative becomes more efficient. So it depends on your situation/perspective. HTH Bram -- # Mertens Bram "M8ram" <[EMAIL PROTECTED]> Linux User #349737 # # SuSE Linux 8.2 (i586) kernel 2.4.20-4GB i686 256MB RAM # # 10:27am up 53 days 14:05, 5 users, load average: 0.25, 0.09, 0.02 #
