spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Matt Kettler <mkett...@evi-inc.com>
Subject Re: SA Rule - Matching on "From" AND "Subject"
Date Thu, 03 Mar 2005 19:09:52 GMT
At 01:52 PM 3/3/2005, Steve Dimoff wrote:
>         I'm running SA 2.63, and I have a rule I would like to create that
>would only be a positive number/match if two checks both were matched.
>
>
>I don't want one rule checking "To" and another checking "Subject", I want
>to combine to the two rules so that if "To" and "Subject" both match
>something then to give it a positive score.

Sounds like you want a meta rule. You'll actually need three rules, a 
header rule, a subject rule and a meta rule that combines them. Of the 
three, only the meta rule should have a strong positive score.

The subject and header rules can also be scored if you want, or name the 
rule starting with a double underscore (__) and omit the score statement 
and that rule will become unscored and not visible in the hits list. (this 
is a common practice, create two unscored rules and a meta rule, and only 
the meta shows in the hits and has a score statement)

Here's a sample meta rule I made that uses body rules, but you can do 
header rules just as easily:

body __PGP_BEGIN_SIG            /-----BEGIN PGP SIGNATURE-----/
body __PGP_END_SIG              /---END PGP SIGNATURE---/

meta    LOCAL_PGP_SIG_ABUSE     (__PGP_BEGIN_SIG && !__PGP_END_SIG)
score LOCAL_PGP_SIG_ABUSE       0.5
describe LOCAL_PGP_SIG_ABUSE    Message has a PGP signature that never ends




Mime
View raw message