RE: stop quarantine after sufficient confidence level

[Kristopher Austin]

Title: stop quarantine after sufficient confidence level

Jared,   This pretty much depend on your MTA.  For example, in Exim you can use a System Filter to read the header after SA is done for the spam score and then do specific actions based on that score.  You could have it delete at one threshold, save a copy at another, and rewrite the subject at yet another.  The possibilities are near endless.  Each MTA has its own filtering abilities.   In our setup, we use sa-exim to do all of this for us at connection time before ever writing it to the hard drive.   I hope this helps.   Kris   From: Jared Priddy [mailto:[EMAIL PROTECTED] Sent: Wednesday, May 26, 2004 1:36 PM To: [EMAIL PROTECTED] Subject: stop quarantine after sufficient confidence level   My company currently receives vast amounts of UCE... SpamAssassin has been doing a pretty decent job of tagging spam and I am currently working on training the Bayes filters to make it even more effective.  I am not currently not blocking any mail - for selected users, I have my production mail server forwarding a duplicate message to my spam filter machine, which in turn runs the tests, redirects spam to a "junk" mailbox and good mail to a "ham" mailbox.  I currently use these mailboxes to train my Bayes filters, moving messages to the appropriate mailbox if necessary. When I begin blocking for real, I will not want keep a duplicate of every mail message we get but a quarantine will be necessary.  I will probably still use a mailbox for quarantine purposes, but I do not want every message that fails the tests to be kept.  Any message that scores above a certain number, say 20.0, I would like to drop without quarantining since I would be pretty certain that it wouldn't be spam.  Then my quarantine would only contain mail items that scored between my kill threshold and 20.0. Is there something built in that enables me to do this, or has anyone monkey'd around with SA and figured this out? Thanks in advance