On Wed, 30 Jun 2004, Chris wrote:
> Must be because the little message below took 43.6 secs to process, while
> the norm now seems to be between 3.5 and 11 seconds. I stil question
> though why it seems to take so long to process a 'clean' message as opposed
> to a 'spam' message, almost twice as long it seems.
Ham processing takes longer than spam for the same reason that:
That missing watch/keys/wallet/glasses is always found in the -last-
place that you look. (IE you stop as soon as you find it ;).
SA in general looks for spam signs in a message. There are very few rules
that look for ham signs.
When running a particular spam rule, the regex search engine stops as
soon as it has found a hit -or- when it has searched all possible data
in the message. Thus with ham, you have to run all rules to exhaustion,
in spam just until you find the first match for each rule.
You will particularly notice this with SpamCopURI. It does the
DNS lookups on every URL's host until it finds one that gets a
'hit'. So if it finds a spam-host in the first URL, it's done.
In ham, it does the DNS checks on all the URLs (with the attending
possible network delays with each DNS operation ;).
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
