Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (hermes.apache.org: domain of mkettler@evi-inc.com
 designates 208.39.141.86 as permitted sender)
Message-Id: <6.2.1.2.0.20050303140520.03c02820@192.168.50.2>
Date: Thu, 03 Mar 2005 14:09:52 -0500
To: Steve Dimoff <sdimoff@usnetworksinc.com>,
   "Spamassassin-Users (spamassassin-users@incubator.apache.org)"
 <spamassassin-users@incubator.apache.org>
From: Matt Kettler <mkettler@evi-inc.com>
Subject: Re: SA Rule - Matching on "From" AND "Subject"
In-Reply-To: <87FA7D7775F8A84B9FD5EAD78EDE751701D4C5C3@usnet-mail1>
References: <87FA7D7775F8A84B9FD5EAD78EDE751701D4C5C3@usnet-mail1>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed

At 01:52 PM 3/3/2005, Steve Dimoff wrote:
>         I'm running SA 2.63, and I have a rule I would like to create that
>would only be a positive number/match if two checks both were matched.
>
>
>I don't want one rule checking "To" and another checking "Subject", I want
>to combine to the two rules so that if "To" and "Subject" both match
>something then to give it a positive score.

Sounds like you want a meta rule. You'll actually need three rules, a 
header rule, a subject rule and a meta rule that combines them. Of the 
three, only the meta rule should have a strong positive score.

The subject and header rules can also be scored if you want, or name the 
rule starting with a double underscore (__) and omit the score statement 
and that rule will become unscored and not visible in the hits list. (this 
is a common practice, create two unscored rules and a meta rule, and only 
the meta shows in the hits and has a score statement)

Here's a sample meta rule I made that uses body rules, but you can do 
header rules just as easily:

body __PGP_BEGIN_SIG            /-----BEGIN PGP SIGNATURE-----/
body __PGP_END_SIG              /---END PGP SIGNATURE---/

meta    LOCAL_PGP_SIG_ABUSE     (__PGP_BEGIN_SIG && !__PGP_END_SIG)
score LOCAL_PGP_SIG_ABUSE       0.5
describe LOCAL_PGP_SIG_ABUSE    Message has a PGP signature that never ends