You have used the same name SARE_SUBJ for two different rules. I suspect they are both evaluated before the meta rules and only one result is kept and used for the meta rules. This is why SARE_NO_SUBJ and SARE_BLANK_SUBJ have the exact same statistics. This is probably not what you want.
L > -----Original Message----- > From: Robert Menschel [mailto:[EMAIL PROTECTED] > Posted At: Wednesday, February 02, 2005 9:18 PM > Posted To: sa-users > Conversation: blank subject and contents > Subject: Re: blank subject and contents > > Hello Jeff, > > Tuesday, December 14, 2004, 10:09:29 AM, you wrote: > > JK> We're getting hit with a lot of emails with blank subject lines and blank > JK> contents. Could be some kind of address verification robot. Is SA supposed > JK> to filter these? If not, does anyone have some custom rules that would do > it? > > I finally got around to testing these rules: > > header SARE_SUBJ exists:Subject > meta SARE_NO_SUBJ !SARE_SUBJ > > header SARE_SUBJ Subject =~ m'\S' > meta SARE_BLANK_SUBJ !SARE_SUBJ > > body SARE_BODY m'\S' > meta SARE_BODY_BLANK !SARE_BODY > > meta SARE_EMPTY_SUBJ_BODY ( SARE_NO_SUBJ || SARE_BLANK_SUBJ ) && > SARE_BODY_BLANK > > OVERALL% SPAM% HAM% S/O RANK SCORE NAME > 95115 59678 35437 0.627 0.00 0.00 (all messages) > 100.000 62.7430 37.2570 0.627 0.00 0.00 (all messages as %) > 2.295 3.3094 0.5870 0.849 0.00 1.00 SARE_BLANK_SUBJ > 0.139 0.1843 0.0621 0.748 0.00 1.00 SARE_BODY_BLANK > 2.295 3.3094 0.5870 0.849 0.00 1.00 SARE_NO_SUBJ > 0.130 0.1826 0.0423 0.812 0.00 1.00 SARE_EMPTY_SUBJ_BODY > 99.861 99.8157 99.9379 0.500 0.00 1.00 SARE_BODY > 97.705 96.6906 99.4130 0.493 0.00 1.00 SARE_SUBJ > > An S/O of 0.812 for SARE_EMPTY_SUBJ_BODY is maybe worth a point or so, > but it's not a strong enough indicator of spam to be worth much. > > Bob Menschel > >
