A: Because they are not defined. (See second half of this post.)
On Fri, 2009-05-15 at 09:23 +0100, Jeremy Morton wrote: > On Fri, 15 May 2009 02:01:34 +0200, Karsten Bräckelmann wrote: > >> > Hmm, well now it's getting 6.4 from the commandline and seems to be > >> > matching more appropriate rules. Maybe it was because I ran sa-update; > > What do you mean, "more appropriate" rules? Do you, or don't get any > > hits on that rule if it should? (Unanswered question here.) > > Did you --lint check? Did you do a -D debug run, to have a close look? > > lint gives me no output at all. -D gives me some output, but what exactly > am I supposed to be looking for? Errors, warnings, generally weird stuff, confirming SA is picking up the cf files you expect... BTW, since you said -D gives *some* output only, whereas it should flood you with heaps of verbose debugging information -- you are supposed to feed it a mail. It's a plain, scanning 'spamassassin' run with debugging enabled. Alternatively, use -D --lint, which generates an internal message, though disables network test. > What I was getting at with MIME_IMAGE_ONLY is, is this a really > fundamental test that's supposed to be defined in the tests in > /usr/share/spamassassin/ ? No, it is not. That's a *custom* rule that has been posted here very recently, to fight a particular, recent run of image spam. > I grep'd for it, but didn't find it. Did I miss you saying that before? That's the most crucial bit of information you can give! Dude, all our debugging was aimed at finding an issue why a *defined* rule doesn't trigger -- in some cases, as it appeared to me, while it does in other cases. See my previous question above, if you get those hits at all. *sigh* > Or is it a rule that only gets put into the sa-update directory, > wherever that is? What ruleset (eg. 25_antivirus.cf, etc) is it in? It lives here. Put it in your local.cf. http://markmail.org/message/zio642mxs5p42kxa Where did you come across that rule at all? How did you get the impression it should be in your stock install? guenther -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
