when i run spamassassin --lint -D, SA get these directorys:
debug: using "/usr/local/share/spamassassin" for default rules dir debug: using "/usr/local/etc/mail/spamassassin" for site rules dir debug: using "/root/.spamassassin" for user state dir debug: using "/root/.spamassassin/user_prefs" for user prefs file
<snip>
is SA read the .cf files in the /usr/local/share/spamassassin first?
Yes, which is definitely what you want it to do.
SA parses and handles duplication in a "last one read wins" process..
Thus /usr/local/etc/mail/spamassassin takes precedence over /usr/local/share/spamassassin, clobbering any duplicate settings.
First SA reads the "default" rules directory. This should contain the original rulefiles shipped with SA, without any modifications or additions.
Next it reads the "site" rules directory. This is where you can over-ride defaults, add your own rulesets, etc. You can re-declare scores, settings, and over-ride more-or-less whatever you want.
Last it reads the user_prefs. Where the user can over-ride a few options.