Thanks Bob,
SARE_FRAUD was suggested but would this be a duplication when we are running clamd virus scanner on all the mail? Thanks, Ken Rea On Wed, 30 Nov 2005, Robert Menschel wrote: > Wednesday, November 30, 2005, 11:59:23 AM, Matt wrote: > > MK> I'm not well versed in picking the "minimalist" set for a low-resource > site, but > MK> I can at least tell you what I know you should avoid. > > MK> In general, the bigger the .cf file, the more resource intensive it will > likely > MK> be. Admittedly this is a wildly inaccurate measure because of non-rule > content, > MK> but it's better than nothing. I tend to be wary of .cf files over 128k, > and I'd > MK> keep the total under 256k. > > MK> FWIW, I personally like these SARE rulesets: > > MK> 70_sare_adult.cf (SARE_ADULT) > MK> 70_sare_evilnum0.cf (SARE_EVILNUMBERS0) > MK> 70_sare_evilnum1.cf (SARE_EVILNUMBERS1) > MK> 70_sare_genlsubj0.cf (SARE_GENLSUBJ0) > MK> 70_sare_obfu0.cf (SARE_OBFU0) > MK> 70_sare_random.cf (SARE_RANDOM) > MK> 70_sare_specific.cf (SARE_SPECIFIC) > MK> 70_sare_uri0.cf (SARE_URI0) > MK> 99_sare_fraud_post25x.cf (SARE_FRAUD) > > In addition, I suggest 70_sare_html0.cf -- all the 70_sare_*0.cf rules > files that I maintain are the ones which during SARE mass-checks hit > no ham, and hit significant (by our classification) spam. > > Read the documentation in those *0.cf files, and you'll be able to > determine for yourself whether to also use the *1.cf files. If you're > tight on resources, stay away from 70_sare_obfu1.cf, though it is a > very powerful file and useful to many systems. > > Bob Menschel > > >
