<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Times New Roman; font-size: 12pt; color: #000000'>Julian I am not looking at what rules are used, I am looking for what rules are triggered. The sa-stats program is found at <span class="Apple-style-span" style="font-family: verdana, geneva, helvetica, arial, sans-serif; font-size: 13px; border-collapse: collapse; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><a href="http://www.rulesemporium.com/programs/sa-stats.txt" target="_top" rel="nofollow" style="font-size: 1em; text-decoration: none; ">http://www.rulesemporium.com/programs/sa-stats.txt</a></span><div><font class="Apple-style-span" face="verdana, geneva, helvetica, arial, sans-serif" size="3"><span class="Apple-style-span" style="border-collapse: collapse; font-size: 13px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px;"></span></font></div><div><span class="Apple-style-span" style="font-family: verdana, geneva, helvetica, arial, sans-serif; font-size: 13px; border-collapse: collapse; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><br><span class="Apple-style-span" style="font-size: medium;"><font class="Apple-style-span" face="'Times New Roman', Times, serif">Here is the a Sample Output with the type of information I am looking to collect.</font></span></span></div><div><span class="Apple-style-span" style="font-family: verdana, geneva, helvetica, arial, sans-serif; font-size: 13px; border-collapse: collapse; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><span class="Apple-style-span" style="font-size: medium;"><font class="Apple-style-span" face="'Times New Roman', Times, serif">---------------------<br></font></span><br>Time Spent Running SA: 1.68 hours <br>Time Spent Processing Spam: 0.29 hours <br>Time Spent Processing Ham: 1.39 hours <br><br>TOP SPAM RULES FIRED <br>---------------------------------------------------------------------- <br>RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM <br>---------------------------------------------------------------------- <br> 1 HTML_MESSAGE 824 77.07 88.13 74.20 <br> 2 RAZOR2_CHECK 772 19.61 82.57 3.32 <br> 3 RAZOR2_CF_RANGE_51_100 753 18.21 80.53 2.08 <br> 4 RAZOR2_CF_RANGE_E8_51_100 713 17.19 76.26 1.91 <br> 5 URIBL_BLACK 652 16.03 69.73 2.13 <br> 6 MIME_HTML_ONLY 609 29.64 65.13 20.45 <br></span></div><div><br></div><div>This type of report is helpful for tuning sa rules.</div><div><br></div><div>Thanks.</div><div><br></div><div>Mike</div><div><br>----- Original Message -----<br>From: "Jules Field" <MailScanner@ecs.soton.ac.uk><br>To: "MailScanner discussion" <mailscanner@lists.mailscanner.info><br>Sent: Monday, August 3, 2009 2:30:36 PM GMT -05:00 US/Canada Eastern<br>Subject: Re: Spamassassin Syslog Functionality<br><br>You can find out what SA rules are being used by doing a "MailScanner <br>--debug --debug-sa".<br>That will print the list of rules files it uses. They are the same for <br>every message.<br><br>On 03/08/2009 19:00, Mike Wallace wrote:<br>> The reason I ask is that I want to run sa-stats to figure out what sa <br>> rules are being used.<br>><br>> I'm not a Perl expert so I would prefer to not have to modify it to <br>> handle MailScanner's "Log Spam = yes" details in maillog.<br>><br>> Or, is there an equivalent tool that will use the existing format?<br>><br>> Thanks.<br>><br>> Mike<br>><br>><br>> On Jul 31, 2009, at 3:54 PM, Mike Wallace wrote:<br>><br>>> Is there anyway to have MailScanner generate Spamassassin syslog output?<br>>><br>>> I tried using the "Log Spam" setting in MailScanner but it logs to <br>>> maillog and not a separate log file that the Spamassassin log tools use.<br>>><br>>> Thanks.<br>>><br>>> -- <br>>> MailScanner mailing list<br>>> mailscanner@lists.mailscanner.info<br>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner<br>>><br>>> Before posting, read http://wiki.mailscanner.info/posting<br>>><br>>> Support MailScanner development - buy the book off the website!<br>>> This message has been scanned for viruses and dangerous content by <br>>> MailScanner, and is believed to be clean.<br>>><br>><br><br>Jules<br><br>-- <br>Julian Field MEng CITP CEng<br>www.MailScanner.info<br>Buy the MailScanner book at www.MailScanner.info/store<br><br>Need help customising MailScanner?<br>Contact me!<br>Need help fixing or optimising your systems?<br>Contact me!<br>Need help getting you started solving new requirements from your boss?<br>Contact me!<br><br>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<br>Follow me at twitter.com/JulesFM and twitter.com/MailScanner<br><br><br>-- <br>This message has been scanned for viruses and<br>dangerous content by MailScanner, and is<br>believed to be clean.<br><br>-- <br>MailScanner mailing list<br>mailscanner@lists.mailscanner.info<br>http://lists.mailscanner.info/mailman/listinfo/mailscanner<br><br>Before posting, read http://wiki.mailscanner.info/posting<br><br>Support MailScanner development - buy the book off the website! <br><br> <br>This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.<br><br></div></div></body></html>