Optimizing Content Filters

[ehavemann]

I want to add a new Content Filtering rule that will examine the entire body of the email for certain blocked words. I am not sure of the potential performance hit this may have. I want this rule to be applied as a "last ditch" test to screen out some remaining spams if other rules haven't already flagged the email as such. If I create a rule like NOT SPAM flag set AND (test 1 or test2 or test3....), will the AMS engine still attempt to execute test1, test2 etc. if the SPAM flag has already been set by a prior rule? Or should I insert a rule above this one that says if the SPAM flag is already set then "stop processing"?

[rob]

The best way to avoid the performance hit is indeed to have a condition that checks if the SPAM flag is set, and an action to stop filtering. Basically all the conditions are evulated per rule, and so even though the SPAM flag will ensure the rule's actions cannot occur, it will most likely perform a search of the mail with the other conditions you will created.