Robert Fitzpatrick wrote:
Someone just had some ham get hit by KAM.cf. Why would the rule
KAM_HOODIA contain merely the number 920+ found in subject and body be a
hit. According to the rule, one point for header, one for body and if
two or more found, it hits. I had a reservation department not receive a
confirmation notice at a hotel because the confirmation number in both
the header and body started with 920 :\
#HOODIA
header __KAM_HOODIA1 Subject =~ /(hoodia|920+)/i
body __KAM_HOODIA2 /(hoodia|920+)/i
body __KAM_HOODIA3 /fat loss product/is
meta KAM_HOODIA (__KAM_HOODIA1 + __KAM_HOODIA2 + __KAM_HOODIA3
>= 2)
describe KAM_HOODIA Hoodia Product Promotion Spam
score KAM_HOODIA 6.0
How can I write a rule to lower this score if not all 3 hit to cover me
if future KAM.cf updates are not fixed? Never done it before, would it
be something like:
meta KAM_HOODIA_FIX (__KAM_HOODIA1 + __KAM_HOODIA2 + __KAM_HOODIA3 < 3)
describe KAM_HOODIA_FIX Need to hit all three KAM HOODIA rules.
score KAM_HOODIA_FIX -2.0
__KAM_HOODIA2 should always hit if __KAM_HOODIA1 hits since the subject
it prepended to the body text that is checked, so I'd say the meta rule
is a little non-sensical to start with (920 being in the subject is
enough to make the meta hit).
Your meta will knock the score down a bit, but '920' in the subject
alone will still, effectively, score at 4.0.
I'd either ditch the rules altogether (score KAM_HOODIA 0), change your
fix to cancel it completely by scoring it at -6, or rewrite the
KAM_HOODIA meta rule itself in your local.cf as something like:
meta KAM_HOODIA __KAM_HOODIA2 && __KAM_HOODIA3
Daryl
