>> From: Jens Strohschnitter [mailto:[EMAIL PROTECTED]
>> Sent: Wednesday, September 10, 2003 7:01 AM
>> To: SpamAssassin
>> Subject: [SAtalk] Logfile of Spam-detected mails
>>
>>
>> Hi there,
>>
>> is it possible to write a logfile that only contains
>> entries that showes spam-detected mails like:
>>
>> FROM foo TO bar -SPAM- -Time-
>>
>> -> for expample.
>>
>> I'm using spamassin 2.55 as spamd working with exim4.20.
>>
>>
> From: "Test, James" <jamestest () ida ! org>
> Date: 2003-09-10 13:15:46
>
>
> Yes. In your exim config, make sure you have a line in your main section:
>
> system_filter = /etc/mail/system-filter (or whatever /path/filename you want to use)
>
> Then in the system_filter file:
>
> logfile /var/log/spamlog (or whatever /path/filename you want to use)
>
> #########################################################################
> # Quarantine SPAM mail #
> #########################################################################
> if
> $h_X-Spam-Level: contains "*****"
> or
> $h_X-Spam-Status: contains "hits=5.0"
> then
> logwrite "\n==========================================================\nFrom: \
> $h_From:\nSubject: $h_Subject:\nReceived: $h_Received: "
> deliver [EMAIL PROTECTED]
> finish
> endif
>
> This will produce logs that look like this:
>
> ==========================================================
> From: The Grant Guys <[EMAIL PROTECTED]>
> Subject: It's MONDAY Sanya!!
> Received: by host.site.org with spam-scanned
> for <[EMAIL PROTECTED]>; Tue, 26 Aug 2003 14:30:27 -0400
> from localhost [127.0.0.1] by exim
> with SpamAssassin (2.60-rc1 1.197-2003-08-21-exp);
> Tue, 26 Aug 2003 14:30:27 -0400
>
> ==========================================================
> From: Sandra Hoffman <[EMAIL PROTECTED]>
> Subject: I can't believe this
> Received: by host.site.org with spam-scanned
> for <[EMAIL PROTECTED]>; Tue, 26 Aug 2003 14:57:48 -0400
> from localhost [127.0.0.1] by exim
> with SpamAssassin (2.60-rc1 1.197-2003-08-21-exp);
> Tue, 26 Aug 2003 14:57:48 -0400
>
> ==========================================================
>
> ** I don't like to use the To: field because it often does not disclose the actual \
> recipient. Showing the received header, the "for <[EMAIL PROTECTED]>" part will
> always \
> show the actual recipient.
>
>
Hi,
sorry for the late reply, but I was on a short vacation.
Your solution is working very fine, thanxx :-)
--
Regards,
Jens Strohschnitter
-------------------------------------
*!!!LINUX LINUX LINUX LINUX LINUX!!!*
* http://www.jens-strohschnitter.de *
-------------------------------------
Set the controls for
the heart of the sun
-------------------------------------
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
