...
Everyone's spam is different. What rules and plugins plug-ins work for me one installation may not work for you.for yours. There can also be significant performance penalties for using some rules.
One way to more about The best way to know how your installation is working is to check you logs and see what rules are hitting on your spam, and what rules are not. This way you can see which rules are the most productive for your spam. Several good Some scripts to run against your logs are,
- Mike's Stat Script
- This script is quite old, doesn't use strict, and is reported to just plain not work. It is also no longer available from the original source. However, it was rewritten at Perl Monk's rewrite of Mike's
- sa-stats.pl pre SA version 3.1
- sa-stats.pl post SA version 3.1
there is no relevance to the list order above
Using a log analyzer Using scripts such as these to analyze your logs, you can see which rules /plugins and plug-ins are working hardest best for you. On our servers Bayes, DCC, Rayzor are all disabled. We catch all the spam we want with a combination of SURBL tests and a few custom rules both written inhouse your installation. Some installations have chosen to avoid Bayes, DCC, Vipul's Razor and use URI Blacklist tests such as SURBL and URIBL combined with a few custom rules developed in-house and by the SARE Ninjas. to save resources. However, what works for another installation may not work for you!
This does not mean you shouldn't run DCC, Rayzor, or Bayes. Many people have great success with each or all those tools. You may or may not have success with them, Know your spam.
- Setup a honeypot account, and actualy actually read the spam that arrives there.
- Have users send you complete copies, headers included, of missed spam or tagged ham.
- Analyze your logs as often as you can.
- Learn to write custom rules.
Once you begin to know the spam your client base system receives, you can begin making educated decisions to what on rules that will best capture the most spam using the least amount of resources. That equates to faster processing, more messages handled, happier clients (at least in my case).Good luck!and happier users.