Which SARE Rules?

[Peter Russell]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sorry for replying my pown post.

I figured out i need to upgrade my ruledujour it was a little old. I 
hadd the following rulesets and now, immedietly after doing so sa --lint 
test take 40sec+ I am using a dual 3ghz/2GB ram machine.

TRUSTED_RULESETS="TRIPWIRE SARE_EVILNUMBERS0 SARE_EVILNUMBERS1 
SARE_EVILNUMBERS2 BLACKLIST BLACKLIST_URI SARE_BML SARE_OEM SARE_HEADER 
SARE_HTML0 SARE_RANDOM SARE_REDIRECT_POST300 SARE_FRAUD BOGUSVIRUS 
SARE_BAYES_POISON_NXM SARE_ADULT SARE_SPOOF SARE_SPECIFIC SARE_UNSUB 
SARE_URI0 SARE_URI1 SARE_OBFU0 SARE_GENLSUBJ0 SARE_WHITELIST 
SARE_WHITELIST_RCVD SARE_WHITELIST_SPF ZMI_GERMAN"


The worst offenders in the mailwatch lint test results are
[22908] dbg: eval: all '*To' addrs:  5.02445
[22908] dbg: plugin: 
Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x98a1f34) implements 
'finish_parsing_end' 26.05115

Any ideas on getting better performance, or is this part of using all 
these rules? Which woiuld be the best ones to drop to improve perfromance?

Peter Russell wrote:
> I would love to see from ruldujour config examples. I am now using SA 
> 3.1 and unsure which of the SARE rules i should or shouldnt be using, 
> and unsure which ones i can just add a name into TRUSTED_RULESETS or 
> which ones i need to use a munge script for etc.
> 
> WOuld anyone be kind enough to post a current, fully tested and working 
> example of the ruledujour config file?
> 
> Kind regards and many thanks
> Pete
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 
> 
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!