On Tue, 2 Dec 2003, Robert Menschel wrote:
> header RM_hx_from exists:From
> describe RM_hx_from From header found
> score RM_hx_from 0.001
> meta RM_hn_from !RM_hx_from
> describe RM_hn_from From header not found
> score RM_hn_from 1.00
>
> The first rule tests for the existence of a FROM header. Score minimal
> (could be a non-scoring __RM_hx_from rule for that matter).
>
> The second rule then reverses that test, checking for the lack of a FROM
> header. (There may be a better way to do this -- anyone?) Results:
>
> RM_hx_from -- 45925s/16069h of 63136 corpus
> RM_hn_from -- 1136s / 0h of 63136 corpus
SA has a special 'missing-match' syntax to detect missing headers.
Here's a rule that I wrote to test for missing "Message-Id:" headers:
header L_MESSAGEID_MISSING Message-Id =~ /^UNSET$/ [if-unset: UNSET]
describe L_MESSAGEID_MISSING Missing Message-Id: header
score L_MESSAGEID_MISSING 1.5
So to cretate your rule:
header RM_hn_from From =~ /^UNSET$/ [if-unset: UNSET]
describe RM_hn_from From header not found
score RM_hn_from 1.00
I do not know if it is any more efficient than the way that you
did it, I just copied somthing that I found in one of the distributed
rules.
Dave
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
-------------------------------------------------------
This SF.net email is sponsored by OSDN's Audience Survey.
Help shape OSDN's sites and tell us what you think. Take this
five minute survey and you could win a $250 Gift Certificate.
http://www.wrgsurveys.com/2003/osdntech03.php?site=8
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
