[mmorse]

Originally Posted by dwmtractor

So, Mike, are you saying that brained is right and perusing the list to decide what needs purging is not an option?

If you know you have a lot wrong just dump it.
Or lookup check_whitelist - It's like ./check_whitelist | grep user@domain.com

Originally Posted by dwmtractor

And how much averaging does it take? the message is already getting a maximum Bayes score but is getting about half of that score robbed back by the AWL.

It's the average between the currentMessageScore & the currentHistoryAverage.
(For the stats buffs that's x-bar of the x-bar-bar right? average of a sample of a grand sample? Sometimes it makes me wish I paid more attention back in the day...)

For example: If someone with a currentHistoryAverage of 1 sent me an email that had some bad items in it, and it got a currentMessageScore of 9 before AWL is applied:
The AWL system would get the resulting average as 5 (1+9=10 10/2=5) so the AWL would knock 4 points off the score in this case. And the final score is 5.

(I believe there's also a setting for how much force/weighting to give it, ie: You could choose half of that 4 so it would only bring it down 2 points for a final score of 7.)

A quicker description for what your having happen: Some spam that you got everyday with a past average of 10, and today gets a current score of 20 before AWL is applied, can result in the AWL knocking 5 points off the score, resulting in a final score of 15.

The algorithm works using a database of entries. Each entry has a key formed by the From: address of the mail, and the IP address it originated at, and contains a TOTAL score and a COUNT number. The MEAN score is TOTAL/COUNT.
The current algorithm works as follows:
1. Compute the SCORE of the message without AWL
2. Compute AWL DELTA as (MEAN-SCORE)*auto_whitelist_factor
3. Increment TOTAL by SCORE
4. Increment COUNT by one
5. Set the final score of the message to SCORE+DELTA

That finalScore isn't put back into the database of prior history for SA scores so your not slowly skewing it towards one value and fixing it there!

Originally Posted by dwmtractor

Any clue how many times I have to re-define a message as junk before AWL is neutralized?

Sound's like a fun math problem to me...