[Gross] perpetual match

[Eino Tuominen]

Jesse Thompson wrote:
> 
> Next, I checked the gross logs.  There were 0 Grey entries for these IP 
> addresses going back 30 days.   hmmm

Check that you do have update = grey in config (it's the default).

> But why does it only happen to these few mailers?  Surely this would be 
> more random?

It really is possible to have this kind of deterministic behaviour with 
bloom filters. Suppose you have a client that is constantly on some 
blocklist, and who regurarly sends email to the same recipient in your 
organization. The triplet is always the same and it always is present in 
your bloom filter. Suppose that these other triplets collide with the 
earlier triplet. The result is just what you are seeing.

> Could this be leading to the bloom filter false positives?

I'm afraid so.

> Anyway, this isn't really a big problem, just a minor annoyance since it 
> screws up my stats.

Yup. Spammers tend to be more random than real people, so this really is 
no big deal, I think.

Sorry I didn't have time to answer you sooner, I've been pretty tied up 
elsewhere.

--