Re: Writing rules to parse Kaspersky-headers

2017-09-27 Thread Matus UHLAR - fantomas
Luca Bertoncello skrev den 2017-09-26 14:20: headerKLMSSPAM_LT10 X-KLMS-AntiSpam-Rate =~ /^([0-9]{1})$/ describe KLMSSPAM_LT10 E-Mail has less than 10% probability to be Spam according to Kaspersky score KLMSSPAM_LT10 0.0 silly score, but rule is correct with pcre h

Re: Writing rules to parse Kaspersky-headers

2017-09-27 Thread Luca Bertoncello
Zitat von Matus UHLAR - fantomas : But if SpamAssassin was called by Exim, it does NOT work. 1. you were asked to provide samples e.g. on pastebin. Therefore my question "when will the header be added"? 2. how do you integrate SA and kaspersky AV? I got it! The problem was that Exim add

Re: Writing rules to parse Kaspersky-headers

2017-09-27 Thread Matus UHLAR - fantomas
Luca Bertoncello skrev den 2017-09-26 15:18: and it will NOT match... I'm really think, that the problem is not by SpamAssassin, but in Exim that does not send the complete message to SpamAssassin... Zitat von Benny Pedersen : why use exim for testing ? spamassassin -t mailmsg | less did it

Re: Writing rules to parse Kaspersky-headers

2017-09-26 Thread Benny Pedersen
Luca Bertoncello skrev den 2017-09-26 15:44: But if SpamAssassin was called by Exim, it does NOT work. Therefore my question "when will the header be added"? this is not a spamassassin problem then

Re: Writing rules to parse Kaspersky-headers

2017-09-26 Thread Luca Bertoncello
Zitat von Benny Pedersen : Luca Bertoncello skrev den 2017-09-26 15:18: and it will NOT match... I'm really think, that the problem is not by SpamAssassin, but in Exim that does not send the complete message to SpamAssassin... why use exim for testing ? spamassassin -t mailmsg | less did i

Re: Writing rules to parse Kaspersky-headers

2017-09-26 Thread Benny Pedersen
Luca Bertoncello skrev den 2017-09-26 15:18: and it will NOT match... I'm really think, that the problem is not by SpamAssassin, but in Exim that does not send the complete message to SpamAssassin... why use exim for testing ? spamassassin -t mailmsg | less did it hit or not ? more debug ?

Re: Writing rules to parse Kaspersky-headers

2017-09-26 Thread Luca Bertoncello
Zitat von Merijn van den Kroonenberg : maybe you can provide a pastebin example of a mail you want to match with the KLMSSPAM_90 rule? I have another idea... I manual add the header "X-AV-scan: yes" in Exim when I receive the E-Mail. This happens just a couple of line before the Spam check. I

Re: Writing rules to parse Kaspersky-headers

2017-09-26 Thread Merijn van den Kroonenberg
>> at third, the last rule should be rewritten, the {2} does not what you >> apparently means it does: >> >> headerKLMSSPAM_90 X-KLMS-AntiSpam-Rate =~ /^(?:9[0-9]|100)$/ >> >> should do what you expect. > > Unfortunately not... > > Same behaviour. Nothing changes... maybe you can prov

Re: Writing rules to parse Kaspersky-headers

2017-09-26 Thread Benny Pedersen
Luca Bertoncello skrev den 2017-09-26 14:20: headerKLMSSPAM_LT10 X-KLMS-AntiSpam-Rate =~ /^([0-9]{1})$/ describe KLMSSPAM_LT10 E-Mail has less than 10% probability to be Spam according to Kaspersky score KLMSSPAM_LT10 0.0 silly score, but rule is correct with pcre h

Re: Writing rules to parse Kaspersky-headers

2017-09-26 Thread Luca Bertoncello
Zitat von Matus UHLAR - fantomas : at first I'd recommend avoid those {1} and skip useless () at second, 1030, 3060, and 6090 should be named 1029, 3059 and 6089 header KLMSSPAM_0X X-KLMS-AntiSpam-Rate =~ /^[0-9]$/ header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~ /^[012][0-9]$/ header KLMS

Re: Writing rules to parse Kaspersky-headers

2017-09-26 Thread Matus UHLAR - fantomas
On 26.09.17 12:20, Luca Bertoncello wrote: I'm trying to write some rules to merge Kaspersky with SpamAssassin... Kaspersky saves the result in the header X-KLMS-AntiSpam-Rate, so I wrote in my local.cf this: headerKLMSSPAM_LT10 X-KLMS-AntiSpam-Rate =~ /^([0-9]{1})$/ describe KLMSSP