On Sat, 2008-11-01 at 18:20 +0100, Karsten Bräckelmann wrote:

> Also, various URI BLs should include the URIs rather early. Are you
> perhaps missing some of these in your SA setup? Maybe put some examples
> up a pastebin and send the link here.
> 
I'm running the standard SA setup without any additional rulesets apart
from private ones I've written for amusement and self-education. I have
blacklist interrogation enabled.

> If you're feeling confident about the rule, you can open a new bug.
> However, you always can simply post it here for discussion and a broader
> peer-review first in either case.
> 
Here's the rule with spaces removed from the meta-rule to prevent it
line-wrapping. Unfortunately, the 4th sub-rule has wrapped and there's
not a lot I can do about that.

describe MG_CASINO Casino gambling 
body     __MG_CAS1 /(csnaio|casino)/i
header   __MG_CAS2 Subject =~ /casino/i
header   __MG_CAS3 From =~ /casino/i
body     __MG_CAS4 /(\$[0-9]+|[0-9]+ *euro|gold|real deal|
invite.*play)/i
meta     MG_CASINO ((__MG_CAS1||__MG_CAS2||__MG_CAS3)&&__MG_CAS4)
score    MG_CASINO 2.0

and here's one of the messages I mentioned:

http://pastebin.com/m1de987d0


Martin


Reply via email to