Hello ddv, Thursday, July 8, 2004, 11:36:25 AM, you wrote:
dhcz> Thanks for the reponse Loren. Glad to know I wasn't just dhcz> missing something obvious :) You weren't, and the quick work-around, until SARE gets our act together, is to rescore those rules in your local.cf -- either set one of the rules to zero, or halve both of them. I'd suggest the former. dhcz> Can I ask what a further 2 things mean: dhcz> - What is a 4-part ruleset? I'm responding, since I'm the one who created the first 4-part rulesets. I assume you're talking about 70_sare_genlsubj0.cf through ...3.cf (also header and html). File 0 (70_sare_genlsubj0.cf, 70_sare_header0.cf, and 70_sare_html0.cf) contains those rules which hit spam and only spam (no ham), and which hit significant spam (well, more than 10 among several corpora). Those are rules which we feel confident every system will benefit from (well, except that you may want to turn off some rules in genlsubj0.cf if your business is specific enough that everyone else's spam might be your ham). File 1 contains rules which either hit fewer than 10 spam, or which also hit ham. Primary qualification is that our S/O (total spam count / total email count) must be 0.900 or higher. Probably also good for most sites, but not as conservative as file 0. File 2 contains rules which should hit spam and only spam, but recent mass-checks had no matches. Many of these are obfuscation rules. Aggressive systems with more than sufficient resources may benefit from these rules eventually (some will hit spam some day), but those systems with tight resources should definitely stay away from these. File 3 contains rules which hit lots of ham. They are scored low, and might help push otherwise questionable spam over the SA threshold. Very conservative systems, and those that are tight on resources, should probably avoid these files. dhcz> - What is the official SARE ruleset (ie. how do I tell if dhcz> something is official or not)? All actively maintained SARE rule set files are named 70_sare_xxxxx.cf or something very similar. Some older files haven't yet been renamed to this convention, but the more active files are. You can also go to http://www.rulesemporium.com/rules.htm -- rules listed on that page are official SARE rules files. They are named in the box that has "redir" on top, and "highrisk" at bottom. Those rules which are on other pages, such as the "incomplete rules", "other rules", and "archived rules" are not official SARE rules. Hope this helps. Bob Menschel
