You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by na...@riconcorp.com on 2004/03/02 01:20:30 UTC

I need to write a rule with a 'greater than or equal to' evaluati on.

I've been using Messagewall for a while now, and I decided to throw
SpamAssassin into the mix.  Messagewall is great, but it's not dynamic
enough.

Problem is that I eventually want messagewall to tag messages only, then
pass them on to SA.
Messagewall always adds the header "X-MessageWall-Score: <score>
(<host.domain.tld>)".  I want to write a rule for SpamAssassin that
basically says, "if <score> is greater than or equal to 15, then it's a
match."  Note that <score> can be more than two digits.

This is how far I've gotten in local.cf:

header MW_SPAM X-MessageWall-Score: =~ /^[>=15].*/
score MW_SPAM 1.00

Something's wrong with the expression syntax, and I know nothing of perl so
I haven't been able to figure it out.
Anybody know how to do this sorta thing?

TIA,

Nate

Re: I need to write a rule with a 'greater than or equal to' evaluati on.

Posted by "Adam D. Lopresto" <ad...@pubcrawler.org>.

On Mon, 1 Mar 2004 nate@riconcorp.com wrote:

> I've been using Messagewall for a while now, and I decided to throw
> SpamAssassin into the mix.  Messagewall is great, but it's not dynamic
> enough.
>
> Problem is that I eventually want messagewall to tag messages only, then
> pass them on to SA.
> Messagewall always adds the header "X-MessageWall-Score: <score>
> (<host.domain.tld>)".  I want to write a rule for SpamAssassin that
> basically says, "if <score> is greater than or equal to 15, then it's a
> match."  Note that <score> can be more than two digits.
>
> This is how far I've gotten in local.cf:
>
> header MW_SPAM X-MessageWall-Score: =~ /^[>=15].*/
> score MW_SPAM 1.00

There's no direct way to do that.  The regexp syntax is for text matching, not
numbers.

But you can cheat a little.

header MW_SPAM X-MessageWall-Score: =~ /^(?:1(?:[5-9]|\d\d)|[2-9]\d)/

should do it.  (Untested).

>
> Something's wrong with the expression syntax, and I know nothing of perl so
> I haven't been able to figure it out.
> Anybody know how to do this sorta thing?
>
> TIA,
>
> Nate
>

-- 
Adam Lopresto
http://cec.wustl.edu/~adam/

If you can spend a perfectly useless afternoon in a perfectly useless
manner, you have learned how to live. -Lin Yutang

Re: I need to write a rule with a 'greater than or equal to' evaluati on.

Posted by Bob George <ma...@ttlexceeded.com>.

nate@riconcorp.com wrote:

>I've been using Messagewall for a while now, and I decided to throw
>SpamAssassin into the mix.  Messagewall is great, but it's not dynamic
>enough.
>
>Problem is that I eventually want messagewall to tag messages only, then
>pass them on to SA.
>Messagewall always adds the header "X-MessageWall-Score: <score>
>(<host.domain.tld>)".
>
I'm doing something similar, using bogofilter to cross-check SA scoring. 
Just make sure you add a "bayes_ignore_header X-MessageWall-Score" to 
your SA config if you're using bayes, lest it learn to associate that 
header (regardless of score) with spam.

>I want to write a rule for SpamAssassin that
>basically says, "if <score> is greater than or equal to 15, then it's a
>match."  Note that <score> can be more than two digits.
>
>This is how far I've gotten in local.cf:
>
>header MW_SPAM X-MessageWall-Score: =~ /^[>=15].*/
>score MW_SPAM 1.00
>  
>
Er, hmm. How downright clever of you! I pass incoming messages through 
virus scanning and bayes scripts before spamassassin, but hadn't thought 
about letting good ol' spamassassin do all that hard math stuff for me. 
And it opens up possibilities with metas. Not to mention simplifying 
procmailrc, and scoring recipes.

Good stuff.

- Bob

Re: spamd running but not scanning

Posted by Matthias Fuhrmann <Ma...@stud.uni-hannover.de>.

On Tue, 2 Mar 2004, James Nelson wrote:

> I am having a weird problem where at some point spamd just quits scanning
> email.  There is no particular reason why... any clues?  A restart of the
> daemon gets it back on track.

we have those trouble sometimes if the load of our machine gets way too
high. so its a matter of timeouts. had to set timing higher, so there is
enough time for spamd checking the mail in time.
made due to timing tweaking of the milter app (miltrassassin) within
sendmail.mc

regards,
Matthias

Re: Custom Rule Help

Posted by Matt Kettler <mk...@evi-inc.com>.

At 12:58 PM 3/2/2004, James Nelson wrote:
>Greetings,
>         I am trying to create a custom rule that will take away x pts if an
>email is sent from a particular domain.  Can someone please let me know if
>this is correct syntax?  If not, please correct me.
>
>describe DOMAIN_CHECK   Mail from a particular domain
>header  DOMAIN_CHECK   From =~ /\@domain\.com/i
>score    DOMAIN_CHECK   -2.0

That should work... Of course, there's no forgery protections so any 
spammer knowing you've added that can take advantage of it, but it should work.

Re: Custom Rule Help

Posted by Loren Wilton <lw...@earthlink.net>.

Looks to me like it should work.

Note you could also use whitelist_from, but that subtracts a whole lotta
points.

        Loren

> I am trying to create a custom rule that will take away x pts if an
> email is sent from a particular domain.  Can someone please let me know if
> this is correct syntax?  If not, please correct me.
>
> describe DOMAIN_CHECK   Mail from a particular domain
> header  DOMAIN_CHECK   From =~ /\@domain\.com/i
> score    DOMAIN_CHECK   -2.0

Re: Custom Rule Comparions

Posted by Matt Kettler <mk...@evi-inc.com>.

At 11:09 AM 3/10/2004, James Nelson wrote:
>What comparison operators can be used when making meta rules?  For instance
>the following is using the && operator for testing that both tests are
>passed.  I am assuming then that there is NOTs and ORs, but I can find no
>specific references to the syntax.
>
>
>meta       VALID_PAYPAL_EMAIL          (ONLY_PAYPAL_FROM &&
>MSGID_FROM_MTA_PAYPAL )

See man Mail::SpamAssassin::Conf. It's very well detailed in the section 
describing "meta".

In 2.4x and higher there are 3 operators:
         && - boolean and
         ! - boolean not
         || - boolean or

in 2.5x and higher there are arithmetic operators allowing you to do 
addition, subtraction, multiplication, greater-than, less-than, etc.