You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by John Schmerold <sc...@gmail.com> on 2017/08/03 15:12:05 UTC
tflags
I don't understand the purpose of tflags. Where is this parameter explained?
--
John Schmerold
Katy Computer Systems, Inc
https://katy.com
St Louis
Re: tflags
Posted by sh...@shanew.net.
Apologies, I should have used the phrase "score set" rather than
ruleset. The "score" section of Mail::SpamAssassin::Conf talks about
it briefly, as does the this wiki page:
https://wiki.apache.org/spamassassin/WritingRules
On Thu, 3 Aug 2017, Ian Zimmerman wrote:
> On 2017-08-03 10:38, shanew@shanew.net wrote:
>
>> The most common ones that I make use of are "multiple" and "maxhits"
>> in order to allow a rule to be scored for each time it hits, but to
>> stop counting after some threshold. I also use the "net" tflag so
>> that RBL checks only run when a net-based ruleset is loaded.
>
> Where is the concept of "ruleset" in general documented, and in
> particular what makes it "net-based"? Not in Mail::SpamAssassin::Conf.
>
>
--
Public key #7BBC68D9 at | Shane Williams
http://pgp.mit.edu/ | System Admin - UT CompSci
=----------------------------------+-------------------------------
All syllogisms contain three lines | shanew@shanew.net
Therefore this is not a syllogism | www.ischool.utexas.edu/~shanew
Re: tflags
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Thu, 3 Aug 2017, Kris Deugau wrote:
> Ian Zimmerman wrote:
>> On 2017-08-03 10:38, shanew@shanew.net wrote:
>>
>>> The most common ones that I make use of are "multiple" and "maxhits"
>>> in order to allow a rule to be scored for each time it hits, but to
>>> stop counting after some threshold. I also use the "net" tflag so
>>> that RBL checks only run when a net-based ruleset is loaded.
>>
>> Where is the concept of "ruleset" in general documented, and in
>> particular what makes it "net-based"? Not in Mail::SpamAssassin::Conf.
>>
>
> "Ruleset" is a somewhat fuzzy term that depends on context - it could refer
> to a single rule, a cluster of rules in a single file, a group of files, or
> "all active rules files". It's not a formal definition within SpamAssassin.
> In this case it's referring to one rule - tflags are only set on a per-rule
> basis.
>
> Any net-based rule is one that relies on a working Internet connection to do
> a data lookup - most commonly DNS lookups, but rules for eg Vipul's Razor
> (RAZOR_* rules), DCC, or Pyzor are also considered net rules since they do a
> lookup against a network service somewhere.
More to the point, if you look at the "spamd" documentation for the "-L" flag
you'll see:
-L, --local
Perform only local tests on all mail. In other words, skip DNS and
other network tests. Works the same as the
"-L" flag to spamassassin(1).
So all "net-based" rules (as indicated by intrinsic coding or the tflags 'net')
get ignored when running in --local mode.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: tflags
Posted by Kris Deugau <kd...@vianet.ca>.
Ian Zimmerman wrote:
> On 2017-08-03 10:38, shanew@shanew.net wrote:
>
>> The most common ones that I make use of are "multiple" and "maxhits"
>> in order to allow a rule to be scored for each time it hits, but to
>> stop counting after some threshold. I also use the "net" tflag so
>> that RBL checks only run when a net-based ruleset is loaded.
>
> Where is the concept of "ruleset" in general documented, and in
> particular what makes it "net-based"? Not in Mail::SpamAssassin::Conf.
>
"Ruleset" is a somewhat fuzzy term that depends on context - it could
refer to a single rule, a cluster of rules in a single file, a group of
files, or "all active rules files". It's not a formal definition within
SpamAssassin. In this case it's referring to one rule - tflags are only
set on a per-rule basis.
Any net-based rule is one that relies on a working Internet connection
to do a data lookup - most commonly DNS lookups, but rules for eg
Vipul's Razor (RAZOR_* rules), DCC, or Pyzor are also considered net
rules since they do a lookup against a network service somewhere.
-kgd
Re: tflags
Posted by Ian Zimmerman <it...@very.loosely.org>.
On 2017-08-03 10:38, shanew@shanew.net wrote:
> The most common ones that I make use of are "multiple" and "maxhits"
> in order to allow a rule to be scored for each time it hits, but to
> stop counting after some threshold. I also use the "net" tflag so
> that RBL checks only run when a net-based ruleset is loaded.
Where is the concept of "ruleset" in general documented, and in
particular what makes it "net-based"? Not in Mail::SpamAssassin::Conf.
--
Please don't Cc: me privately on mailing lists and Usenet,
if you also post the followup to the list or newsgroup.
Do obvious transformation on domain to reply privately _only_ on Usenet.
Re: tflags
Posted by sh...@shanew.net.
The Mail::SpamAssassin::Conf man page includes a section on tflags and
their various functions, but generally speaking tflags allow you to
alter the way in which a rule is processed.
The most common ones that I make use of are "multiple" and "maxhits"
in order to allow a rule to be scored for each time it hits, but to
stop counting after some threshold. I also use the "net" tflag so
that RBL checks only run when a net-based ruleset is loaded.
As an example, I have various uri rules to detect emails from
questionable journals. Since it's possible that someone might be
having a legitimate mail conversation about that journal and share the
URL to their site, I want to count how many times the URL appears, so
I add a "multiple" tflag for the rule. More appearances means the
mail is more likely to be advertising the journal or soliciting
articles. On the other hand, once it's been seen eight time (or 15 or
whatever), there's a diminishing return on that rule's ability to tell
me anything more about the email, so I use "maxhits=8" to keep it from
continuing to look for the uri (and to stop scoring additional points).
On Thu, 3 Aug 2017, John Schmerold wrote:
> I don't understand the purpose of tflags. Where is this parameter explained?
>
>
--
Public key #7BBC68D9 at | Shane Williams
http://pgp.mit.edu/ | System Admin - UT CompSci
=----------------------------------+-------------------------------
All syllogisms contain three lines | shanew@shanew.net
Therefore this is not a syllogism | www.ischool.utexas.edu/~shanew
Re: tflags
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 3 Aug 2017, at 11:21, John Hardin wrote:
> On Thu, 3 Aug 2017, John Schmerold wrote:
>
>> I don't understand the purpose of tflags. Where is this parameter
>> explained?
>
> man Mail::SpamAssassin::Conf
That will USUALLY work on most Unix-like systems that have SA installed,
but sometimes will not or will bring up a stale document. You can also
use:
perldoc Mail::SpamAssassin::Conf
Which has the advantage of using the version of perl in your $PATH
(hopefully the same one your SA installation is using) and extracting
the documentation directly from the currently installed module instead
of looking for a pre-rendered man page.
Re: tflags
Posted by John Hardin <jh...@impsec.org>.
On Thu, 3 Aug 2017, John Schmerold wrote:
> I don't understand the purpose of tflags. Where is this parameter explained?
man Mail::SpamAssassin::Conf
Basically it allows setting some per-rule metadata that affects how the
rule behaves.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The United States has become a place where entertainers and
professional athletes are mistaken for people of importance.
-- Maureen Johnson Smith Long
-----------------------------------------------------------------------
Tomorrow: the 282nd anniversary of John Peter Zenger's acquittal