I've got two rules next to each other in the config:
body REPLICA_WATCH /replicas of rolex/i score REPLICA_WATCH 5
body SAVE_UP_TO /save up to/i score SAVE_UP_TO 2
When I have a message that I've been trying to stop with Rolex watches come in, I get the following response from Amavis:
Dec 1 06:37:36 fw amavis[29225]: (29225-10) spam_scan: hits=0.267 tests=SAVE_UP_TO
The text of the message contains the following:
In our online store you can buy replicas of Rolex watches. They look and feel exactly like the real thing.
- Save up to 40% compared to the cost of other replicas
Why is the first rule not getting hit?
1) run spamassassin --lint
Any complaints?2) do you have a copy of the real original message in mbox or 822 format that you can send as an attachment? Sometimes there's subtle things in the actual message encoding that doesn't show up in the visible text that you've copy-pasted to us.
Your rule hit your own message just fine, which is why I suspect either a typo in a config file somewhere that's making SA skip a few lines, or some subtle evil encoding used by the original message to confuse SA (such as an extra letter inserted somewhere but not visible because it's in a font that's 0pt, malformed base64 encoding, malformed mime boundaries, etc)
