Kai MacTane wrote:
> In particular, I want to catch use of their "real name" info in the
> Subject:, or capitalized versions in the body. For easy testing, I'm
> supposing just one user, a Mr. Foobar Wombat. My rules to catch
> things are as follows:

[snip extra rule bits]

> header SUBJ_FOOBAR_CAPS Subject =~ /\b(FOOBAR|WOMBAT)\b/
> body FOOBAR_CAPS /\b(FOOBAR|WOMBAT)\b/

> I don't understand why this is happening. Why should the FOOBAR_CAPS
> rule -- a body rule -- be triggering at all?

For whatever reason, the Subject: line is considered part of the message
body in SA's processing.  The only logic I can see in that is in
allowing you to define body rules for various obfuscated words or
letters, without having to define separate rules for both body and
subject- which both often contain similar obfuscation or phrases.  :/

I'd suggest that you drop the score a little for the body rule;  or drop
the subject rule.

-kgd
-- 
<erno> hm. I've lost a machine.. literally _lost_. it responds to
ping, it works completely, I just can't figure out where in my
apartment it is.


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to