On Wednesday 30 June 2004 09:59 pm, David B Funk wrote: > On Wed, 30 Jun 2004, Chris wrote: > > Must be because the little message below took 43.6 secs to process, > > while the norm now seems to be between 3.5 and 11 seconds. I stil > > question though why it seems to take so long to process a 'clean' > > message as opposed to a 'spam' message, almost twice as long it seems. > > Ham processing takes longer than spam for the same reason that: > That missing watch/keys/wallet/glasses is always found in the -last- > place that you look. (IE you stop as soon as you find it ;). > > SA in general looks for spam signs in a message. There are very few rules > that look for ham signs. > > When running a particular spam rule, the regex search engine stops as > soon as it has found a hit -or- when it has searched all possible data > in the message. Thus with ham, you have to run all rules to exhaustion, > in spam just until you find the first match for each rule. > > You will particularly notice this with SpamCopURI. It does the > DNS lookups on every URL's host until it finds one that gets a > 'hit'. So if it finds a spam-host in the first URL, it's done. > In ham, it does the DNS checks on all the URLs (with the attending > possible network delays with each DNS operation ;).
Thanks Dave, I understand now -- Chris Registered Linux User 283774 http://counter.li.org 10:12pm up 2 days, 3:30, 2 users, load average: 0.21, 0.37, 0.42 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Men use thought only to justify their wrong doings, and speech only to conceal their thoughts. -- Voltaire ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
