[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Email Stats



Hi,

Quoting Wichert Akkerman (wichert@wiggy.net):
> Subject: Network Queuing Environment (NQE) contains vulnerabilities
> Message-Id: <10201071350.ZM28298@einstein.csd.sgi.com>
> X-Spam-Status: Yes, hits=6 required=5 tests=FROM_ENDS_IN_NUMS,RAZOR_CHECK,      
>     FROM_AND_TO_SAME

Razor is useful, but less useful on its own. On small amounts of email, it
will probably work just fine. On big(ger) amounts of email, you will
encounter more problems. The best thing to do (as wichert is doing above),
resulting in 'better' (YMMV) spamcatching, is using it in combination with
other tools, like the razor check that is used in spamassassin.
Spamassassin gives each check that succeeds a score, if the score goes
beyond a configurable threshold, great results are obtainable. (my
spamasassin config currently catches about 30 spam messages a day, misses
about 2 or 3 - again, some days are better than others, and users are
different; my results with razor-only were much better than wichert's
razor-only results, resulting in a 'razor sucks' opinion from wichert, and a
'razor rules' opinion from me :).

Spamasassin does need tweaking though. the default install did pretty well
in my case, but was a bit too trigger-happy on some points. I lowered
razor's scoring with 1 point, and changed some other values, the above
message was not tagged as spam in my case. 

It might be a good idea to give spamasassin the capability (trough an extra
utility) to analyse a couple of mailboxes, and build statistics on message
count and hitcount on the various conditions that score, comparing those to
results on a folder containing a bunch of spam messages (recieved by the 
same user), to get an idea of 'expected results', and hints for tweaking 
the config.
This is assuming the user saves all his/her mail, and saves all spam
seperately (either directly or trough manual 'postprocessing' :) ).

Greets,
	Robert

-- 
			      Linux Generation
   encrypted mail preferred. finger rvdm@debian.org for my GnuPG/PGP key.
  Despite all appearances, your boss is a thinking, feeling, human being.



Reply to: