Live Data

Message Sniffer log files reported by our customers are used to continuously improve our spam filter rules and provide important performance statistics. You can access some basic performance statistics as they are compiled from incoming logs. All live reports are calculated from live data. New log files are processed automatically on the hour. The current types of reports that you can view are:

Change Rates

The Live Change Rates report shows the number of new rules or rule adjustments each day for the past 30 days. This is a reasonable approximation of the rate at which "new" spam content is reaching the network.

False Positive Rates

The False Reports Rates report shows the number of False Reports received for the past 30 days.

Flow Rates

Live Flow Rates shows the message flow rate through all reporting Message Sniffer systems for the past 28 days by hour. One of the key values that we watch in this report is the average ms which approximates the processing power required for filtering these messages by measuring the time (in milliseconds) required on average. The other key value we watch is the Spam% which is an average indicator of the ratio of message which are tagged against the total number of messages. On average, 77% of all incoming email is rejected as spam! - We also compare the total number of messages with the number of false positive reports we receive (typically very few).

Rule Strengths

Live Rule Strengths shows the relative strength of each active rule in our rulebase. A rule's strength is determined by it's number of "Traps" compared to other rules in the system. A "Trap" occurs only when the rule is the Final determining factor for Message Sniffer's result code. Rules that simply Match do not get counted for this report (they are used as input data for other tuning systems however). Strengths are rated on a logarithmic scale from 5 (strongest) to 0 (weakest). These strengths are calculated using a sliding window so that rules which become unimportant over time will be reduced in strength and ultimately will become inactive. Rules that have a low strength are treated more harshly if false positive reports are presented and rules with a sufficiently low strength may be excluded from the rulebase altogether.