On 10/21/10 11:57 AM, Lawrence @ Rogers wrote:
Hi,
I recall reading somewhere that there is a way to prevent a rule from
being considered for Bayes auto-learning. I am trying to create a rule
that hits upon some obvious spam that I am seeing, yet I want to make
sure (for now) that any scores it assigns are not used for anything
Bayes-related. I cannot seem to find any documentation on how to do
this (Google doesn't help). I think it is something to do with setting
a tflag, but any guidance would be appreciated.
you can prevent your rule from being considered in the DECISION as to if
it will auto learn the tokens in the email with tflag noautolearn.
I don't know of any flag that would prevent the rule itself, so example:
rule1, hits 15 points
rule2(bayes) hits 4 points. total is 19 points. if rule2 has
noautolearn flag, then the 'do we auto learn this' score is only 15 points.
if your threshold is > 15.1, then the whole email is not considered for
auto learning.
if rule3 hits 2 points, your total score is 21 points, but 'decision'
delta is at 17 points now, and whole email is autolearned as spam.
we decided that we didn't too much care to auto learn as 'not spam',
emails sent from marketing companies, (because the reverse is true for
auto learn ham) thus:
aa_scores.cf:tflags RCVD_IN_DNSWL_HI net nice noautolearn
aa_scores.cf:tflags RCVD_IN_DNSWL_MED net nice noautolearn
aa_scores.cf:tflags RCVD_IN_DNSWL_LOW net nice noautolearn
aa_scores.cf:tflags RCVD_IN_RP_SAFE net nice noautolearn
aa_scores.cf:tflags RCVD_IN_RP_CERTIFIED net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_UT_CPR_MAT net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_UT_CPR_30 net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_UT_CPEAR net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_UNVERIFIED_2 net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_UNVERIFIED_1 net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_SPF net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_SENDERID net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_RDNS net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_OPTIN_LT50 net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_OPTIN_GT50 net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_OPTIN net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_ML_DOPTIN net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_MI_CPR_MAT net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_MI_CPR_30 net nice noautolearn
aa_scores.cf:tflags RCVD_IN_IADB_MI_CPEAR net nice noautolearn
Regards,
Lawrence Williams
LCWSoft
www.lcwsoft.com
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* 2008-9 Hot Company Award Winner, World Executive Alliance
* Five-Star Partner Program 2009, VARBusiness
* Best in Email Security,2010: Network Products Guide
* King of Spam Filters, SC Magazine 2008
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
