In general the rules for SA are simple perl regexp format. You can also
create functions and make them a rule, but I've not done that myself yet.
You can add your rules to {HOME}/.spamassassin/user_prefs to add rules on
a per-user basis (if your SA gets run as different users) or
/etc/mail/spamassassin/local.cf for a site-wide set.
copy-pasting from a previous post I made about writing rules:
If you have SA installed on your system man Mail::SpamAssassin::Conf.
There's also a copy of this info at
http://spamassassin.taint.org/doc/Mail_SpamAssassin_Conf.html
In general your own rules are of the format
body TEST_NAME <some regexp to match>
describe TEST_NAME <some message to include in report>
score TEST_NAME <some score to apply>
instead of body you can also do header, rawbody and full to check the
message in different places or different stages of decoding.
Here's a simple rule:
body SPAMASSASSIN_MENTIONED /\bSpamAssassin/i
describe SPAMASSASSIN_MENTIONED mentions SpamAssassin in body
score SPAMASSASSIN_MENTIONED -5.0
This will search the decoded message body text and match any word-break (ie
space, tab, newline, etc) followed by "spamassassin" in a case insensitive
manner. Any message matching the rule gets 5 points knocked off it's score.
(I use this rule to help off-list discussions of SA from being tagged as spam)
You can also go to /usr/share/spamassassin and look at the various stock
rules for some ideas on formatting, syntax, etc. The stock ruleset is split
up into body rules, header rules, and scores all in separate files, but
local rules are generally all lumped together like above. I think the only
significant advantage of having the scores in a separate file is if you're
going to run the GA over a corpus on them, but that's a little more
advanced than most mail admins want to get into (myself included).
At 12:58 PM 7/22/2002 -0500, Joel Epstein wrote:
>Hey all...
>
>How exactly do you create rules? I ask because I seem to be getting tons
>of email containing words like incest, etc....
>
>Any thoughts?
>
>Thanks
>--
>=================================
>Joel Epstein
>Manager of Systems Integration
>Integrated Warehousing Solutions
>3075 Highland Parkway Suite 715
>Downers Grove, Illinois 60515
>Phone: 630.932.4300
>Fax: 630.932.7652
>Email: [EMAIL PROTECTED]
>
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>http://thinkgeek.com/sf
>_______________________________________________
>Spamassassin-talk mailing list
>[EMAIL PROTECTED]
>https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
