> # grep HTML_IMAGE_ONLY /var/log/maillog | wc -l > 35834 This is wrong. It should have been # grep "HTML_IMAGE_ONLY.*hits=" /var/log/maillog | wc -l 17917 > But almost 45% of all mails match HTML_IMAGE_ONLY, so it's unusable > at all. I even use lower scores for those rules now - which gives > me less FPS: 22% is still a lot ... Martin