Beta 4.50.4 released -- faster than 4.49

[Steve Freegard]

Hi Raymond,

On Wed, 2006-01-04 at 23:40 +0100, Raymond Dijkxhoorn wrote:
> Hi!
> 
> > One thing worth mentioning: if you use rcpt splitting (one message per 
> > recipient) then you should see a massive speed improvement with this version.
> >
> > Raymond --- this may help you!
> 
> Ok. After some thinking :)
> 
> This works, but! :)
> 
> Let me try to explain.
> 
> Spammer sends spam, SA detects, but low spam score. We feed all those to 
> our analyzer box, analyzer box finds URL thats bad, lists in a RBL...
> 
> Normally the next messages will have a higher score, since more URI-BL 
> lists will detect them after a few minutes. Same goes for bayes scores and 
> so on.
> 
> Is it a good idea to make it configurable when to use this feature? Eg, 
> when its high spam? If its high spam i care less about the extra scores, 
> high is high enough. If its low spam i certainly would be interested if 
> its not high spam by then. Makes the difference of delivering or deleting 
> in our case. Some ligic to only cache low spam for lets say 5 mins, and 
> high spam an hour or so would be preferred. Else the detection will go 
> down and thats bad.
> 
> Just some idea's, hopefully it helps. Really cool move i think this. Saves 
> a lot of power, only need to figure out something for the above... to 
> optimize things.

Good idea - treating low/high spam differently in the cache expiry timer
makes sense - this shouldn't be too difficult to do either.  Working out
the best amount to time to cache each will be trickier though as it
really depends on how much mail you get.

The way the expiry works at the moment is to expire:

- non-spam after 30mins from the creation of the cache record (to
account for lag getting onto RBLs/Pyzor/Razor/DCC).

- spam after 6 hours from the initial creation of the cache record.

- virus infected messages after 48 hours from the last cache-hit (to
give the best possible chance of getting a cache-hit).

These values are configurable in SA.pm at the moment as we didn't think
it was likely that they would need to be changed.

Kind regards,
Steve.

--
Steve Freegard
Fort Systems Ltd.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!