Rule triggering more than once

[Richard Nairn <ri...@nairnconsulting.ca>]

I am using a rule to detect email with very long links included as I 
have seen that those are mostly spam. Some of the messages will include 
many copies of the link.

Is there a way to write a meta rule that detects multiple instances of 
the same rule?

Re: Rule triggering more than once

[Bill Cole <sa...@billmail.scconsult.com>]

On 5 Oct 2017, at 11:21, Richard Nairn wrote:

> I am using a rule to detect email with very long links included as I 
> have seen that those are mostly spam. Some of the messages will 
> include many copies of the link.
>
> Is there a way to write a meta rule that detects multiple instances of 
> the same rule?

Quoting the documentation for Mail::SpamAssassin::Conf, from the section 
documenting "tflags":

     multiple
         The test will be evaluated multiple times, for use with meta
         rules. Only affects header, body, rawbody, uri, and full tests.

     maxhits=N
         If multiple is specified, limit the number of hits found to N.
         If the rule is used in a meta that counts the hits (e.g.
         __RULENAME > 5), this is a way to avoid wasted extra work (use
         "tflags multiple maxhits=6").

            For example:

               uri      __KAM_COUNT_URIS /^./
               tflags   __KAM_COUNT_URIS multiple maxhits=16
               describe __KAM_COUNT_URIS A multiple match used to count 
URIs in a message

               meta __KAM_HAS_0_URIS (__KAM_COUNT_URIS == 0)
               meta __KAM_HAS_1_URIS (__KAM_COUNT_URIS >= 1)
               meta __KAM_HAS_2_URIS (__KAM_COUNT_URIS >= 2)
               meta __KAM_HAS_3_URIS (__KAM_COUNT_URIS >= 3)
               meta __KAM_HAS_4_URIS (__KAM_COUNT_URIS >= 4)
               meta __KAM_HAS_5_URIS (__KAM_COUNT_URIS >= 5)