Don Russell wrote:
I don't really like /dev/null because there's no way to recover (or even
know of) false-positives.
At my office, I've got procmail set up to dev/null anything
that SA set to eight stars or more. Over the last three years,
I've lowered the number to eight from thirteen, because I've
never had a false positive that high.. in fact, I don't think
I've ever had a false positive above four (the virus scanners
actually FP more legit mail that SA).
And, anything with three stars or up (to eight) gets put
into a temp location I check every day. In the last three years,
I think only three or so legit messages have appeared there..
the FP rate has been tremendously low.
Of course, I wouldn't suggest dev/null'ing emails when initially
getting the system rolling.. (= once it gets tweaked and things
are more certain, there should be no chance of FP's getting
trashed.
TLD
____________________________________________________________
procmail mailing list Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail