You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Christophe Journel <ch...@gmail.com> on 2006/04/12 11:23:37 UTC
Pb with custom rules
Hello !
i use spamassassion v 3.0.3
I added a custom rule, in the local.cf :
body NO_VIOXX /vioxx/i
score NO_VIOXX 999
description NO_VIOXX messages that contain the word Vioxx
then i restart spamassassin
/etc/init.d/spamassassin resart.
But the problem is :
With the spamc -R < test.mail
( of course the test.mail contains vioxx )
the score is not as high as expected.
Did i do something wrong ?
Thx
Re: Pb with custom rules
Posted by Matt Kettler <mk...@evi-inc.com>.
Christophe Journel wrote:
> is /etc/init.d/spamassassin restart enough to update all filters in SA ?
It's enough to update all the filters in spamd, which affects all mail that you
feed to spamc.
If you use the "spamassassin" command-line script for testing, then it parses
the files every time you call it.
Also, you did run spamassassin --lint, right?
(You should run a lint check after EVERY config file edit, before you restart
the spamd deamon. If all is well it should run and exit without print anything.)
>
> coz i tried with a file containing vioxx only... and the score is not 999 :/
Well, you can't do that.. the input MUST be an email message. In particular, a
body rule won't match that file because it looks to SA like a broken header, not
body text.
Re: Pb with custom rules
Posted by Christophe Journel <ch...@gmail.com>.
is /etc/init.d/spamassassin restart enough to update all filters in SA ?
coz i tried with a file containing vioxx only... and the score is not 999 :/
On 4/12/06, Matt Kettler <mk...@comcast.net> wrote:
>
> Christophe Journel wrote:
> > Hello !
> > i use spamassassion v 3.0.3
> >
> > I added a custom rule, in the local.cf <http://local.cf> :
> >
> > body NO_VIOXX /vioxx/i
> > score NO_VIOXX 999
> > description NO_VIOXX messages that contain the word Vioxx
> >
> >
> >
> > then i restart spamassassin
> > /etc/init.d/spamassassin resart.
> >
> >
> > But the problem is :
> >
> > With the spamc -R < test.mail
> >
> > ( of course the test.mail contains vioxx )
> >
> Are you sure the message in question REALLY contains the word vioxx, and
> it's not a table-obfuscated mess? Look at the raw source of the message
> and make sure it's really there. The table obfuscations wind up looking
> like garbage when viewed in source form, because they're written in
> columns, but when viewed in HTML, the letters get re-arranged to fit the
> table and spell the word.
>
> Did DRUGS_PAIN or DRUGS_PAIN_OBFU from the standard rules fire off?
> (these should detect many variants of the word, but also fails to detect
> table-obfuscation)
>
Re: Pb with custom rules
Posted by Matt Kettler <mk...@comcast.net>.
Christophe Journel wrote:
> Hello !
> i use spamassassion v 3.0.3
>
> I added a custom rule, in the local.cf <http://local.cf> :
>
> body NO_VIOXX /vioxx/i
> score NO_VIOXX 999
> description NO_VIOXX messages that contain the word Vioxx
>
>
>
> then i restart spamassassin
> /etc/init.d/spamassassin resart.
>
>
> But the problem is :
>
> With the spamc -R < test.mail
>
> ( of course the test.mail contains vioxx )
>
Are you sure the message in question REALLY contains the word vioxx, and
it's not a table-obfuscated mess? Look at the raw source of the message
and make sure it's really there. The table obfuscations wind up looking
like garbage when viewed in source form, because they're written in
columns, but when viewed in HTML, the letters get re-arranged to fit the
table and spell the word.
Did DRUGS_PAIN or DRUGS_PAIN_OBFU from the standard rules fire off?
(these should detect many variants of the word, but also fails to detect
table-obfuscation)
Re: Pb with custom rules
Posted by Magnus Holmgren <ho...@lysator.liu.se>.
Wednesday 12 April 2006 11:23 skrev Christophe Journel:
> Hello !
> i use spamassassion v 3.0.3
>
> I added a custom rule, in the local.cf :
>
> body NO_VIOXX /vioxx/i
> score NO_VIOXX 999
> description NO_VIOXX messages that contain the word Vioxx
>
>
> then i restart spamassassin
> /etc/init.d/spamassassin resart.
>
>
> But the problem is :
>
> With the spamc -R < test.mail
>
> ( of course the test.mail contains vioxx )
>
> the score is not as high as expected.
>
> Did i do something wrong ?
Do you mean the total score? AWL could bring that down. Either NO_VIOXX is in
the report or it's not. Can you post the output from the above command, and
maybe the input as well?
--
Magnus Holmgren