Roberto, I am using Sawmill as an analysis tool for SF.  It seems to work well for some things but not for others.

For instance I was hoping to use it to evaluate the effectiveness of keyword filters, but alas since it only checks against the logs it cannot tell me which items are totally ineffective and worth deleting, only the items that work very well.

Also when checking the Reasons for filtering, it only lists items that match a content filter, reverse DNS and RBL list items.  It does not include any entries for other reasons such as attachments, IP filters, From and To blacklists, etc even though I know there are items being filtered for those reasons.  Is this info not in the logs such that it is not included in the analysis?

I found that Sawmill provided limited information about log files.  The problem is that one connection to your Spamfilter server can create several to dozens of log entries accounting for one to many email messages.  Because email connections are so varied and complicated it's not possible to get accurate information from the type of log processing Sawmill provides.  Sawmill is designed and works best for transactions captured in a single log entry.

I wrote a C++  program to do my own log analysis processing.  My program analyzes log entries and groups all related columns of information together to create a single row in a database for each email message that is processed.  This way I can combine sender, recipient, source IP, source hostname, keyword, relevant message and result all in one row for each email message.   The end result is a database that gives you all email transactions with the information pertaining to each email message processed by Spamfilter.  This makes it real easy to query and report on email processing.

If you are interested in trying out my program, send me an email: http://mailto:pcmatt@idp.net and I'll send you a copy to test on your log files.