Beta 4.50.4 released -- faster than 4.49

[Ken A]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Just upgraded 3 boxes. Now I only need 2.
Messages with multiple recipients that are split no longer incur a big 
penalty in SA. It's a bad day for spam.

Jan  4 17:02:50 MailScanner[21109]: Cache hit for message k0512HE3026793
Jan  4 17:02:52 MailScanner[21264]: Cache hit for message k0512HE6026793
Jan  4 17:02:52 MailScanner[21264]: Cache hit for message k0512HE7026793
Jan  4 17:02:52 MailScanner[21264]: Cache hit for message k0512HE5026793
Jan  4 17:02:52 MailScanner[21264]: Cache hit for message k0512HE8026793
Jan  4 17:02:52 MailScanner[21264]: Cache hit for message k0512HE4026793

:-)

Ken A
Pacific.Net

Steve Freegard wrote:
> Hi Raymond,
> 
> On Wed, 2006-01-04 at 23:40 +0100, Raymond Dijkxhoorn wrote:
>> Hi!
>>
>>> One thing worth mentioning: if you use rcpt splitting (one message per 
>>> recipient) then you should see a massive speed improvement with this version.
>>>
>>> Raymond --- this may help you!
>> Ok. After some thinking :)
>>
>> This works, but! :)
>>
>> Let me try to explain.
>>
>> Spammer sends spam, SA detects, but low spam score. We feed all those to 
>> our analyzer box, analyzer box finds URL thats bad, lists in a RBL...
>>
>> Normally the next messages will have a higher score, since more URI-BL 
>> lists will detect them after a few minutes. Same goes for bayes scores and 
>> so on.
>>
>> Is it a good idea to make it configurable when to use this feature? Eg, 
>> when its high spam? If its high spam i care less about the extra scores, 
>> high is high enough. If its low spam i certainly would be interested if 
>> its not high spam by then. Makes the difference of delivering or deleting 
>> in our case. Some ligic to only cache low spam for lets say 5 mins, and 
>> high spam an hour or so would be preferred. Else the detection will go 
>> down and thats bad.
>>
>> Just some idea's, hopefully it helps. Really cool move i think this. Saves 
>> a lot of power, only need to figure out something for the above... to 
>> optimize things.
> 
> Good idea - treating low/high spam differently in the cache expiry timer
> makes sense - this shouldn't be too difficult to do either.  Working out
> the best amount to time to cache each will be trickier though as it
> really depends on how much mail you get.
> 
> The way the expiry works at the moment is to expire:
> 
> - non-spam after 30mins from the creation of the cache record (to
> account for lag getting onto RBLs/Pyzor/Razor/DCC).
> 
> - spam after 6 hours from the initial creation of the cache record.
> 
> - virus infected messages after 48 hours from the last cache-hit (to
> give the best possible chance of getting a cache-hit).
> 
> These values are configurable in SA.pm at the moment as we didn't think
> it was likely that they would need to be changed.
> 
> Kind regards,
> Steve.
> 
> --
> Steve Freegard
> Fort Systems Ltd.
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!