Hello
Am 2024-05-11 19:24, schrieb Loren Wilton:
Can I just take the names of the rules?
e.g. at least two checks should fire:
meta MULTIPLE_TESTS (( RAZOR2_CF_RANGE_51_100 + RAZOR2_CHECK +
URIBL_ABUSE_SURBL) > 1)
score MULTIPLE_TESTS 1
found in
X-Spam-Status: No, score=5.908 tagged_above=2 required=6.31
tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, FSL_BULK_SIG=0.001,
HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=2.43,
RAZOR2_CHECK=1.729,
SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_ABUSE_SURBL=1.948]
Why is your score threshold for spam 6.31? By default it is 5, and that
message would have been spam.
6.31 has been the default value on a Debian system for ages and is based
on the experience of the “spam analysts”. That's how I remember it. I
have therefore retained this value. Who introduced the default value of
5? Spamassassin itself, because spam is getting better and better and
fewer rules apply?
The meta you suggest would have fired and added a point, but only
because the combined score for the rules it mentions added up to > 1.0.
Since every single one has a score > 1.0, the rule would have fired if
any single one or any combination of those rules fired. Is that what
you intended? It would not have fired if you had picked SPF_HELO_NONE,
SPF_PASS, and FSL_BULK_SIG, as that only adds up to 0.003.
Most commonly a meta for "multiple rules fired" would have used the &&
operator, for instance:
meta MY_MANY_RULES SPF_HELO_NONE && SPF_PASS && FSL_BULK_SIG
describe MY_MANY_RULES Several random rules hit
score MY_MANY_RULES 1
Your metarule says: all three subrules must match. My rule says, that at
least 2 subrules must match. Here it can be A+B+C, A+B, A+C, B+C. In my
rule the matches (trues) are counted. I have taken this rule from the
wiki. Please look here at meta rules
https://cwiki.apache.org/confluence/display/SPAMASSASSIN/writingrules
