Anti-Phishing Update -- New data feed

[Julian Field]

On 18/06/2009 09:48, Steve Freegard wrote:
> Julian Field wrote:
>    
>>> I just got around to trying this - currently this ruleset carries a
>>> heavy penalty:
>>>
>>> Without phishing rules
>>> real    0m1.722s
>>> user    0m1.646s
>>> sys    0m0.065s
>>>
>>> With phishing rules
>>> real    0m4.283s
>>> user    0m1.703s
>>> sys    0m0.080s
>>>
>>> And this is with a very small dummy message.
>>>
>>> In addition to removing the 'full' rules; change (match|match|match) to
>>> (?:match|match|match) which is non-capturing and should save a
>>> considerable amount of memory in SA and should reduce these times.
>>>
>>>        
>> I have made both those changes.
>>      
> Just grabbed the new script and updated; now looks much better:
>
> Without phishing rules:
> real	0m1.734s
> user	0m1.648s
> sys	0m0.086s
>
> With phishing rules:
> real	0m1.822s
> user	0m1.725s
> sys	0m0.075s
>    
That's more like it! Thanks for the tips, Steve.

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.