This is a resubmission of a question that I have been trying to sort out
for about a week now. I am trying to tag messages that have more than
10 random words in the message body of an incoming e-mail I am running
the following
Solaris 8
Sendmail 8.12.10 (+libmilter support)
Mimedefang 2.39
Spamassassin 2.60
This is the .cf rule file
rawbody RANDOMWORD_10
/(?:\b(?!(?:from|even|more|were|with)\b)[a-z]{4,12}\s+){10}/
describe RANDOMWORD_10 string of 10+ random words
score RANDOMWORD_10 0.5
rawbody RANDOMWORD_15
/(?:\b(?!(?:from|even|more|were|with)\b)[a-z]{4,12}\s+){15}/
describe RANDOMWORD_15 string of 15+ random words
score RANDOMWORD_15 2.5
Copied from this list last week.
I have verified that the rule is being read via spamassassin -D and that
the config produces no errors.
Below is an exert from my sendmail logs that shows an email that has got
through
09881 >>> 220 smtp.uk.superh.com ESMTP Sendmail 8.12.10/8.12.10; Mon, 12
Jan 200
4 15:41:25 GMT
09881 <<< HELO HQAI7P9NL5OHSSQ
09881 >>> 250 smtp.uk.superh.com Hello [211.168.218.78], pleased to meet
you
09881 <<< MAIL FROM: <[EMAIL PROTECTED]>
09881 >>> 250 2.1.0 <[EMAIL PROTECTED]>... Sender ok
09881 <<< RCPT TO: <[EMAIL PROTECTED]>
09881 >>> 250 2.1.5 <[EMAIL PROTECTED]>... Recipient ok
09881 <<< DATA
09881 >>> 354 Enter mail, end with "." on a line by itself
09881 <<< Received: from [107.176.139.173] by 211.168.218.78 with HTTP;
09881 <<< Tue, 13 Jan 2004 11:38:31 +0600
09881 <<< From: "Patti Pate" <[EMAIL PROTECTED]>
09881 <<< To: [EMAIL PROTECTED]
09881 <<< Subject: ,,You can improve your looks
09881 <<< Mime-Version: 1.0
09881 <<< X-Mailer: intestate
09881 <<< Date: Tue, 13 Jan 2004 09:34:31 +0400
09881 <<< Reply-To: "Patti Pate" <[EMAIL PROTECTED]>
09881 <<< Content-Type: multipart/alternative;
09881 <<< boundary="07622999020661090"
09881 <<< Message-Id: <[EMAIL PROTECTED]>
09881 <<<
09881 <<< --07622999020661090
09881 <<< Content-Type: text/plain; charset=us-ascii
09881 <<< Content-Transfer-Encoding: 8bit
09881 <<<
09881 <<< edging hayes catapult leavenworth font angus pumice
09881 <<< tenable rockford aggressor coffee plaza swarm louise testicle
condemna
te influenza
09881 <<< grebe bluejacket fried retail censure abutting isaacson
09881 <<< gallonage comatose hegelian rudyard credulous cosmopolitan
restoration
09881 <<< spayed vail address brasilia
09881 <<< widow tollgate grandstand cindy precede casey aegis
09881 <<<
09881 <<< --07622999020661090
09883 === CONNECT sh-uk-ex01.uk.w2k.superh.com.
09883 <<< 220 sh-uk-ex01.uk.w2k.superh.com Microsoft ESMTP MAIL Service,
Versio
: 5.0.2195.6713 ready at Mon, 12 Jan 2004 15:43:08 +0000
09883 >>> EHLO smtp.uk.superh.com
09883 <<< 250-sh-uk-ex01.uk.w2k.superh.com Hello [193.128.105.170]
09883 <<< 250-TURN
09883 <<< 250-ATRN
09883 <<< 250-SIZE 15360000
09883 <<< 250-ETRN
09883 <<< 250-PIPELINING
09883 <<< 250-DSN
09883 <<< 250-ENHANCEDSTATUSCODES
09883 <<< 250-8bitmime
09883 <<< 250-BINARYMIME
09883 <<< 250-CHUNKING
09883 <<< 250-VRFY
09883 <<< 250-X-LINK2STATE
09883 <<< 250-XEXCH50
09883 <<< 250 OK
09883 >>> MAIL From:<[EMAIL PROTECTED]> SIZE=1195
09883 <<< 250 2.1.0 [EMAIL PROTECTED] OK
09883 >>> RCPT To:<[EMAIL PROTECTED]>
09883 >>> DATA
09883 <<< 250 2.1.5 [EMAIL PROTECTED]
09883 <<< 354 Start mail input; end with <CRLF>.<CRLF>
09883 >>> Received: from HQAI7P9NL5OHSSQ ([211.168.218.78])
09883 >>> by smtp.uk.superh.com (8.12.10/8.12.10) with SMTP id
i0CFfODC00
881
09883 >>> for <[EMAIL PROTECTED]>; Mon, 12 Jan 2004
15:41:28 GMT
09883 >>> Received: from [107.176.139.173] by 211.168.218.78 with HTTP;
09883 >>> Tue, 13 Jan 2004 11:38:31 +0600
09883 >>> From: "Patti Pate" <[EMAIL PROTECTED]>
09883 >>> To: [EMAIL PROTECTED]
09883 >>> Subject: ,,You can improve your looks
09883 >>> Mime-Version: 1.0
09883 >>> X-Mailer: intestate
09883 >>> Date: Tue, 13 Jan 2004 09:34:31 +0400
09883 >>> Reply-To: "Patti Pate" <[EMAIL PROTECTED]>
09883 >>> Content-Type: multipart/alternative;
boundary="07622999020661090"
09883 >>> Message-Id: <[EMAIL PROTECTED]>
09883 >>> X-Scanned-By: MIMEDefang 2.39
09883 >>>
09883 >>> This is a multi-part message in MIME format...
09883 >>>
09883 >>> --07622999020661090
09883 >>> Content-Type: text/plain; charset=us-ascii
09883 >>> Content-Transfer-Encoding: 8bit
09883 >>> Content-Disposition: inline
09883 >>>
09883 >>> edging hayes catapult leavenworth font angus pumice
09883 >>> tenable rockford aggressor coffee plaza swarm louise testicle
condemn
te influenza
09883 >>> grebe bluejacket fried retail censure abutting isaacson
09883 >>> gallonage comatose hegelian rudyard credulous cosmopolitan
restoratio
09883 >>> spayed vail address brasilia
09883 >>> widow tollgate grandstand cindy precede casey aegis
09883 >>>
09883 >>> --07622999020661090--
09883 >>> .
09883 <<< 250 2.6.0 <[EMAIL PROTECTED]> Queued mail for
delivery
09883 >>> QUIT
09883 <<< 221 2.0.0 sh-uk-ex01.uk.w2k.superh.com Service closing
transmission c
annel
This is the header once it gets to exchange
Microsoft Mail Internet Headers Version 2.0
Received: from smtp.uk.superh.com ([193.128.105.170]) by
sh-uk-ex01.uk.w2k.superh.com with Microsoft SMTPSVC(5.0.2195.6713);
Mon, 12 Jan 2004 15:43:08 +0000
Received: from HQAI7P9NL5OHSSQ ([211.168.218.78])
by smtp.uk.superh.com (8.12.10/8.12.10) with SMTP id
i0CFfODC009881
for <[EMAIL PROTECTED]>; Mon, 12 Jan 2004 15:41:28
GMT
Received: from [107.176.139.173] by 211.168.218.78 with HTTP;
Tue, 13 Jan 2004 11:38:31 +0600
From: "Patti Pate" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: ,,You can improve your looks
Mime-Version: 1.0
X-Mailer: intestate
Date: Tue, 13 Jan 2004 09:34:31 +0400
Reply-To: "Patti Pate" <[EMAIL PROTECTED]>
Content-Type: multipart/alternative; boundary="07622999020661090"
Message-Id: <[EMAIL PROTECTED]>
X-Scanned-By: MIMEDefang 2.39
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 12 Jan 2004 15:43:09.0093 (UTC)
FILETIME=[C7379550:01C3D922]
--07622999020661090
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
--07622999020661090-
Hope someone can help!!
Regards
Julia McWhirter
IT Manager
SuperH (UK) Ltd
Network House
2410 Aztec West
Almondsbury
Bristol
BS32 4QX
Tel : 01454 465661
Fax : 01454 465601
Mobile : 07979 913494
Email : [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>
Web : www.superh.com <http://www.superh.com>
