> It wasn't clear from the documentation or google searches that I could > do this. It seemed that I could create a header and then give a score > based upon its presence. But it wasn't obvious to me that I could > actually read the headers value and set the initial spam score from the > value. Any hints are graciously accepted and greatly appreciated.
You can't, so far as I know, do exactly what you want. However, you may be
able to come close.
SA uses text pattern matching for rules, rather than any concept of
arithmetic numbers. You can make multiple rules with various scores and use
them to look at the score lines in the header, at least if you are on 3.0 or
later. (In 2.6x these lines will be stripped before you can look at them).
I think you will have to use 'full' rules to look at this data (or write a
plugin, which might be the better idea) since it will probably be removed
from 'header' rule data before you can look at it.
I would suggest a simple collection of rules that look at the number of
stars in the report line, and score each one at 1 point. This will give you
the score rounded to the nearest point, which might be "good enough". You
could actually make a whole series of rules (it would take 40 rules) to look
at the actual score value and provide a decimal result. For instance,
grabbing part of the summary line from your message, I see
X-Spam-Status: No, hits=-94.4
(This is on 2.64, check the format for 3.0 in case it changed.)
Now I could write a bunch of rules like
full SA_SCORE_100 /^X-Spam-Status:.{0,20}hits=1\d\d/s
score SA_SCORE_100 100
full SA_SCORE_10 /^X-Spam-Status:.{0,20}hits=\d*1\d[^\d]/s
score SA_SCORE_10 10
full SA_SCORE_20 /^X-Spam-Status:.{0,20}hits=\d*2\d[^\d]/s
score SA_SCORE_20 20
full SA_SCORE_30 /^X-Spam-Status:.{0,20}hits=\d*3\d[^\d]/s
score SA_SCORE_30 30
full SA_SCORE_40 /^X-Spam-Status:.{0,20}hits=\d*4\d[^\d]/s
score SA_SCORE_40 40
full SA_SCORE_1 /^X-Spam-Status:.{0,20}hits=\d*1[^\d]/s
score SA_SCORE_1 1
full SA_SCORE_2 /^X-Spam-Status:.{0,20}hits=\d*2[^\d]/s
score SA_SCORE_2 2
full SA_SCORE_3 /^X-Spam-Status:.{0,20}hits=\d*3[^\d]/s
score SA_SCORE_3 3
full SA_SCORE_4 /^X-Spam-Status:.{0,20}hits=\d*4[^\d]/s
score SA_SCORE_4 4
full SA_SCORE_point1 /^X-Spam-Status:.{0,20}hits=\d*\.1/s
score SA_SCORE_point1 0.1
full SA_SCORE_point2 /^X-Spam-Status:.{0,20}hits=\d*\.2/s
score SA_SCORE_point2 0.2
full SA_SCORE_point3 /^X-Spam-Status:.{0,20}hits=\d*\.3/s
score SA_SCORE_point3 0.3
full SA_SCORE_point4 /^X-Spam-Status:.{0,20}hits=\d*\.4/s
score SA_SCORE_point4 0.4
Obviously you need 0-9 in each case.
That will handle positive scores and ignore negative scores. (If you can't
have 3 digit scores, you can simplify the regex in the first casea above to
something like "=1\d/s" on the end). If you want to deal with negative
scores also, you will need a bunch more rules to deal with them.
Oh heck. I started the ruleset above, I just finished the thing. File
attached.
Note these rules are UNTESTED, and may not work as expected. They may not
even lint for that matter. But they might be useful if they do work.
Loren
scorerules.cf
Description: Binary data
