This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

9.706 - anti-spam engine changed to SASI

One of the changes is that: Email Protection anti-spam engine changed to Sophos Anti-Spam Interface (SASI)

Anybody has experience with that change? Does it effect the rate of recognition? I haven't figured out yet if the Commtouch Advanced Security Daemon (ctasd) is dropped with this or not. And if so aren't the results from cyren no longer used?

Best regards

Alex



This thread was automatically locked due to age.
Parents
  • Hi Alex,

    some observations from our test-installation which holds only "spam-domains":

    • 10 days bevor the update: total 441 mails, from that 419 recognised as spam (111 Quarantine, 195 RBL) ->  old engine recognition rate 95%
    • 10 days after the update: total 326 mails, from that 191 recognised as spam (0 Quarantine, 191 RBL) -> new engine recognition rate 59%

    So from that numbers, the filterrate over all on the new engine is worse. It seems in the new engine only a RBL-filter works, which is not good.

    bye Josef

    BERGMANN engineering & consulting GmbH, Wien/Austria

  • Maybe I'm not that disappointed, because I always used some extra RBLs. These are zen.spamhaus.org, ix.dnsbl.manitu.net, b.barracudacentral.org and bl.spamcop.net.
    Give it a try. Btw. something I learned not log ago, these extra RBLs are always rejecting emails. The settings in the GUI only have an effect of the Sophos own tests.

    Best regards
    Alex

    -

Reply
  • Maybe I'm not that disappointed, because I always used some extra RBLs. These are zen.spamhaus.org, ix.dnsbl.manitu.net, b.barracudacentral.org and bl.spamcop.net.
    Give it a try. Btw. something I learned not log ago, these extra RBLs are always rejecting emails. The settings in the GUI only have an effect of the Sophos own tests.

    Best regards
    Alex

    -

Children
  • RBLs are nice but will generally not help when the spam comes from abused/hacked accounts or from spam gangs which quickly change their infrastructur/IPs (which most of them do). Additionally on most of the RBLs you quickly run in a volume limitation when you use DNS-resolvers form providers (which is mostly the case).

    Dear Sophos you must had content matching (words/sentences, URLs, GIFs...) in your spam engine, why is this obviously not working in the new version?

    bye Josef

    BERGMANN engineering & consulting GmbH, Wien/Austria

  • Well i guess they wont help you:

    here are my RBL lists:

    bl.spamcop.net

    ix.dnsbl.manitu.net
    zen.spamhaus.org

    and i am using my very own dnsbl.

    but nothing helps here with the new update. as u can see, i got the bank phishing anyway.

  • Josef, i know it's only 5 Days, but is there anything you can tell already ? i guess after 5 Days there must at least one or 2 mails in quarantine

  • Hi Wolfgang

    short answer, yes now are many mails in the quarantine and the anti-spam engine seem to work.

    bye Josef

    BERGMANN engineering & consulting GmbH, Wien/Austria

  • hmm, then i ask myself whats wrong with my installation ?

    i made a new install and imported a backup. so where is the issue here ?

    do u use profile mode with the smtpd proxy ?

    also IPS is on 0

    antispyware is 0

    webfilter is 0

    what the heck is going on here ?

    maybe someone from the dev's could look at this, because i have no clue what i can do here and where to look.