>-----Original Message----- >From: Bram Mertens [mailto:[EMAIL PROTECTED] >Sent: Friday, May 14, 2004 4:32 AM >To: spamassassin >Subject: Re: Rule efficiency > > >On Thu, 2004-05-13 at 15:27, [EMAIL PROTECTED] wrote: >> What is more efficient from a processing perspective, having a single >> large rule or multiple smaller rules? What is the ideal size for a >> rule? > >This has nothing to do with efficiency but keep in mind that the two >alternatives will behave differently... > >> Im simplest terms: >> >> /one|t(?:wo|hree)|four/ > >This will trigger is one, two, three or four is encountered, >BUT if they >are all encountered it still only triggers once. > >> Or >> >> /one/ >> >> /t(?:wo|hree)/ >> >> /four/ > >With these three rules the same message containing one, two, three and >four will get hit three times... > >Matt already explained that the first is more efficient "memory-wise" >but if by efficiency you mean scoring spam as high as possible the >second alternative becomes more efficient. > >So it depends on your situation/perspective. > >HTH > >Bram
On a side note, this is precisicely why the SARE body rules haven't been updated and published yet. We want to tweak them to be fast, but get good hit rates. It doesn't help to put all rules regarding subject1 into a single tweaked and fast regex rule. It will only hit once. So we have to go thru all those body rules and split like subjects into different rules, then tweak all of them, So one rule will contain 10 different subjectX's. That and the fact that I said I would do the body rules :) --Chris (I need a clone)
